Subject: Re: updates to syncookies - timestamps not needed any more (freebsd)

From: Florian Westphal <[email-masked]>
Date: Fri, 12 Jul 2013 10:41:45 +0200

David Miller <[email-masked]> wrote:
> From: Hannes Frederic Sowa <[email-masked]>
> Date: Mon, 8 Jul 2013 18:04:21 +0200
> 
> > Interesting patch by Andre Opperann of FreeBSD:
> > <http://lists.freebsd.org/pipermail/freebsd-net/2013-July/035999.html>
> 
> Interesting work, but outside of the change of hash function I'm not so
> sure.  The whole reason we went to the timestamp field was to eliminate
> the coarse tables.
> 
> I understand that he claims that %99.99 of connections are handled by
> the values he has chosen, but this is still a step backwards in my
> opinion.

The main difference to what linux does is to avoid encoding the 'count'
value (Linux doesn't reseed secret[], and relies on count to detect old
cookies).

Not having the counter frees up space to encode tcp options in the cookie
instead of the timestamp.