diff options
| author | Eric Dumazet <edumazet@google.com> | 2012-07-17 10:13:05 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-07-17 01:36:20 -0700 |
| commit | 282f23c6ee343126156dd41218b22ece96d747e3 (patch) | |
| tree | 9a306d99ed77d760078d29699edd3007507d709b /net/ipv4/sysctl_net_ipv4.c | |
| parent | a858d64b7709ca7bd2ee71d66ef3b7190cdcbb7d (diff) | |
| download | linux-282f23c6ee343126156dd41218b22ece96d747e3.tar.gz linux-282f23c6ee343126156dd41218b22ece96d747e3.tar.bz2 linux-282f23c6ee343126156dd41218b22ece96d747e3.zip | |
tcp: implement RFC 5961 3.2
Implement the RFC 5691 mitigation against Blind
Reset attack using RST bit.
Idea is to validate incoming RST sequence,
to match RCV.NXT value, instead of previouly accepted
window : (RCV.NXT <= SEG.SEQ < RCV.NXT+RCV.WND)
If sequence is in window but not an exact match, send
a "challenge ACK", so that the other part can resend an
RST with the appropriate sequence.
Add a new sysctl, tcp_challenge_ack_limit, to limit
number of challenge ACK sent per second.
Add a new SNMP counter to count number of challenge acks sent.
(netstat -s | grep TCPChallengeACK)
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Kiran Kumar Kella <kkiran@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/sysctl_net_ipv4.c')
| -rw-r--r-- | net/ipv4/sysctl_net_ipv4.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c index 70730f7aeafe..3f6a1e762e9c 100644 --- a/net/ipv4/sysctl_net_ipv4.c +++ b/net/ipv4/sysctl_net_ipv4.c @@ -605,6 +605,13 @@ static struct ctl_table ipv4_table[] = { .mode = 0644, .proc_handler = proc_dointvec }, + { + .procname = "tcp_challenge_ack_limit", + .data = &sysctl_tcp_challenge_ack_limit, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec + }, #ifdef CONFIG_NET_DMA { .procname = "tcp_dma_copybreak", |