tcp: implement RFC 5961 3.2

Browse source

Implement the RFC 5691 mitigation against Blind
Reset attack using RST bit.

Idea is to validate incoming RST sequence,
to match RCV.NXT value, instead of previouly accepted
window : (RCV.NXT <= SEG.SEQ < RCV.NXT+RCV.WND)

If sequence is in window but not an exact match, send
a "challenge ACK", so that the other part can resend an
RST with the appropriate sequence.

Add a new sysctl, tcp_challenge_ack_limit, to limit
number of challenge ACK sent per second.

Add a new SNMP counter to count number of challenge acks sent.
(netstat -s | grep TCPChallengeACK)

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Kiran Kumar Kella <kkiran@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

...

This commit is contained in:

Eric Dumazet 2012-07-17 10:13:05 +02:00 • committed by David S. Miller

parent a858d64b77

commit 282f23c6ee

6 changed files with 45 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

Documentation/networking/ip-sysctl.txt

View file

1

include/linux/snmp.h

View file

1

include/net/tcp.h

View file

1

net/ipv4/proc.c

View file

7

net/ipv4/sysctl_net_ipv4.c

View file

31

net/ipv4/tcp_input.c

View file