Invalid SYN cookies received，but no syncookie sent?

Question

cat /proc/net/netstat shows that：

SyncookiesSent:0
SyncookiesRecv:0
SyncookiesFailed:34954

Num of bad syncookies is received, but system don't send any syncookie。 What i expect is that bad received sysncookies is less than sent syncookies. Who knows the reason?

2.6.32：

static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
{
    struct tcphdr *th = tcp_hdr(skb);
    const struct iphdr *iph = ip_hdr(skb);
    struct sock *nsk;
    struct request_sock **prev;
    /* Find possible connection requests. */
    struct request_sock *req = inet_csk_search_req(sk, &prev, th->source,
                               iph->saddr, iph->daddr);
    if (req)
        return tcp_check_req(sk, skb, req, prev);

    nsk = inet_lookup_established(sock_net(sk), &tcp_hashinfo, iph->saddr,
            th->source, iph->daddr, th->dest, inet_iif(skb));

    if (nsk) {
        if (nsk->sk_state != TCP_TIME_WAIT) {
            bh_lock_sock(nsk);
            return nsk;
        }
        inet_twsk_put(inet_twsk(nsk));
        return NULL;
    }

#ifdef CONFIG_SYN_COOKIES
    if (!th->rst && !th->syn && th->ack)
        sk = cookie_v4_check(sk, skb, &(IPCB(skb)->opt)); <== check received ack.
#endif
    return sk;
}

Answer 1

Here's the relevant section from cookie_v4_check in net/ipv4/syncookies.c:

    if (tcp_synq_no_recent_overflow(sk) ||
    (mss = cookie_check(skb, cookie)) == 0) {
    NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
    goto out;
}

NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);

So, if:

1. There has been a recent overflow requiring SYN cookies, and
2. The cookie fails to checks out as a valid regular SYN packet or SYN cookie,

then SyncookiesFailed gets incremented. Otherwise, SyncookiesRecv gets incremented. So, if CONFIG_SYN_COOKIES is enabled in the kernel, and you've been under a new connection load that requires it, you'd expect SyncookiesSent to be positive, and SyncookiesRecv to be positive (but less). As it is, it looks like the only ones you've gotten are invalid.

We're seeing similar numbers, and we think it is because UFW's default rules include dropping packets with an invalid state, which may include outgoing and incoming SYN cookies. You might want to check your firewall config and logs to see if unexpected dropped packets are occurring.

Or, you may just be getting invalid SYN cookies, due to some random attacker. In that case, though, I'd expect some SYN cookies sent.