Commit 213ad73d authored by Wei Wang's avatar Wei Wang Committed by David S. Miller
Browse files

tcp: disable TFO blackhole logic by default 

Multiple complaints have been raised from the TFO users on the internet
stating that the TFO blackhole logic is too aggressive and gets falsely
triggered too often.
(e.g. https://blog.apnic.net/2021/07/05/tcp-fast-open-not-so-fast/

)
Considering that most middleboxes no longer drop TFO packets, we decide
to disable the blackhole logic by setting
/proc/sys/net/ipv4/tcp_fastopen_blackhole_timeout_set to 0 by default.

Fixes: cf1ef3f0 ("net/tcp_fastopen: Disable active side TFO in certain scenarios")
Signed-off-by: default avatarWei Wang <weiwan@google.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Acked-by: default avatarNeal Cardwell <ncardwell@google.com>
Acked-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
Acked-by: default avatarYuchung Cheng <ycheng@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 02dc2ee7

Documentation/networking/ip-sysctl.rst

+1 −1
Original line number Diff line number Diff line
@@ -826,7 +826,7 @@ tcp_fastopen_blackhole_timeout_sec - INTEGER 
	initial value when the blackhole issue goes away.

	0 to disable the blackhole detection.



	By default, it is set to 1hr.

	By default, it is set to 0 (feature is disabled).



tcp_fastopen_key - list of comma separated 32-digit hexadecimal INTEGERs

	The list consists of a primary key and an optional backup key. The

net/ipv4/tcp_fastopen.c

+8 −1
Original line number Diff line number Diff line
@@ -507,6 +507,9 @@ void tcp_fastopen_active_disable(struct sock *sk) 
{

	struct net *net = sock_net(sk);



	if (!sock_net(sk)->ipv4.sysctl_tcp_fastopen_blackhole_timeout)

		return;



	/* Paired with READ_ONCE() in tcp_fastopen_active_should_disable() */

	WRITE_ONCE(net->ipv4.tfo_active_disable_stamp, jiffies);
@@ -526,10 +529,14 @@ void tcp_fastopen_active_disable(struct sock *sk) 
bool tcp_fastopen_active_should_disable(struct sock *sk)

{

	unsigned int tfo_bh_timeout = sock_net(sk)->ipv4.sysctl_tcp_fastopen_blackhole_timeout;

	int tfo_da_times = atomic_read(&sock_net(sk)->ipv4.tfo_active_disable_times);

	unsigned long timeout;

	int tfo_da_times;

	int multiplier;



	if (!tfo_bh_timeout)

		return false;



	tfo_da_times = atomic_read(&sock_net(sk)->ipv4.tfo_active_disable_times);

	if (!tfo_da_times)

		return false;

net/ipv4/tcp_ipv4.c

+1 −1
Original line number Diff line number Diff line
@@ -2965,7 +2965,7 @@ static int __net_init tcp_sk_init(struct net *net) 
	net->ipv4.sysctl_tcp_comp_sack_nr = 44;

	net->ipv4.sysctl_tcp_fastopen = TFO_CLIENT_ENABLE;

	spin_lock_init(&net->ipv4.tcp_fastopen_ctx_lock);

	net->ipv4.sysctl_tcp_fastopen_blackhole_timeout = 60 * 60;

	net->ipv4.sysctl_tcp_fastopen_blackhole_timeout = 0;

	atomic_set(&net->ipv4.tfo_active_disable_times, 0);



	/* Reno is always built in */