Re: [PATCH net] tcp: reject TIME_WAIT reopens when SYN queue is full

[Eric Dumazet]

On Sun, Jul 12, 2026 at 3:26 PM Yizhou Zhao
<zhaoyz24@xxxxxxxxxxxxxxxxxxxxx> wrote:
>
> A valid SYN that matches a TIME_WAIT socket is redirected to the
> listener with a non-zero tcp_tw_isn.  tcp_conn_request() deliberately
> exempts those requests from normal SYN queue throttling.  A peer can
> therefore create victim-side TIME_WAIT entries with short connections,
> replay valid reopen SYNs, and withhold the final ACK to allocate
> request_sock objects outside the listener's normal SYN-flood controls.
>
> Do not send syncookies for this path: tcp_timewait_state_process()
> derives tcp_tw_isn from tw_snd_nxt so that a direct reopen uses an ISN
> after the prior connection's sequence space.  A syncookie ISN is a
> hash-derived value and has no such ordering guarantee.
>
> Check the selected listener's SYN queue before descheduling the
> TIME_WAIT socket.  If it is full, account a request-queue drop, retain
> the TIME_WAIT socket, and discard the SYN.  Once the queue has room,
> the existing direct-reopen path and its TIME_WAIT ISN are unchanged.
> Normal SYNs continue to use syncookies when the listener is full.

I do not see it as a threat, sorry.

Say no to AI hallucinations.