tcp: implement RFC 5961 4.2

Browse source

Implement the RFC 5691 mitigation against Blind
Reset attack using SYN bit.

Section 4.2 of RFC 5961 advises to send a Challenge ACK and drop
incoming packet, instead of resetting the session.

Add a new SNMP counter to count number of challenge acks sent
in response to SYN packets.
(netstat -s | grep TCPSYNChallenge)

Remove obsolete TCPAbortOnSyn, since we no longer abort a TCP session
because of a SYN flag.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Kiran Kumar Kella <kkiran@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

...

This commit is contained in:

Eric Dumazet 2012-07-17 01:41:30 +00:00 • committed by David S. Miller

parent 5f3600ebe2

commit 0c24604b68

3 changed files with 17 additions and 19 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

include/linux/snmp.h

View file

2

net/ipv4/proc.c

View file

32

net/ipv4/tcp_input.c

View file