OpenE2K/linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
b9bb53f383
linux/net/ipv4
History
Eric Dumazet 4ce7e93cb3 tcp: rate limit ACK sent by SYN_RECV request sockets 
Attackers like to use SYNFLOOD targeting one 5-tuple, as they
hit a single RX queue (and cpu) on the victim.

If they use random sequence numbers in their SYN, we detect
they do not match the expected window and send back an ACK.

This patch adds a rate limitation, so that the effect of such
attacks is limited to ingress only.

We roughly double our ability to absorb such attacks.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Maciej Żenczykowski <maze@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-04-04 22:11:20 -04:00
..
netfilter netfilter: ipv4: fix NULL dereference 2016-03-28 17:59:29 +02:00
af_inet.c net: ipv4: Fix truncated timestamp returned by inet_current_timestamp() 2016-03-21 22:56:38 -04:00
ah4.c
arp.c arp: correct return value of arp_rcv 2016-03-07 14:55:04 -05:00
cipso_ipv4.c
datagram.c
devinet.c ipv4: Don't do expensive useless work during inetdev destroy. 2016-03-13 23:28:35 -04:00
esp4.c
fib_frontend.c ipv4: initialize flowi4_flags before calling fib_lookup() 2016-03-22 15:59:23 -04:00
fib_lookup.h
fib_rules.c
fib_semantics.c
fib_trie.c
fou.c gro: Allow tunnel stacking in the case of FOU/GUE 2016-03-30 16:02:33 -04:00
gre_demux.c
gre_offload.c net: Reset encap_level to avoid resetting features on inner IP headers 2016-03-23 14:19:08 -04:00
icmp.c net: ipv4: Convert IP network timestamps to be y2038 safe 2016-03-01 17:18:44 -05:00
igmp.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-03-08 12:34:12 -05:00
inet_connection_sock.c soreuseport: fix merge conflict in tcp bind 2016-02-24 13:38:18 -05:00
inet_diag.c tcp/dccp: do not touch listener sk_refcnt under synflood 2016-04-04 22:11:20 -04:00
inet_fragment.c
inet_hashtables.c tcp/dccp: do not touch listener sk_refcnt under synflood 2016-04-04 22:11:20 -04:00
inet_timewait_sock.c
inetpeer.c
ip_forward.c net: remove skb_sender_cpu_clear() 2016-03-01 17:36:47 -05:00
ip_fragment.c net: Export ip fragment sysctl to unprivileged users 2016-02-16 20:42:54 -05:00
ip_gre.c bpf, vxlan, geneve, gre: fix usage of dst_cache on xmit 2016-03-08 13:58:47 -05:00
ip_input.c ipv4: namespacify ip_early_demux sysctl knob 2016-02-16 20:42:54 -05:00
ip_options.c net: ipv4: Convert IP network timestamps to be y2038 safe 2016-03-01 17:18:44 -05:00
ip_output.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-03-08 12:34:12 -05:00
ip_sockglue.c ipv4: process socket-level control messages in IPv4 2016-04-04 15:50:30 -04:00
ip_tunnel_core.c netlink: use nla_get_in_addr and nla_put_in_addr for ipv4 address 2016-04-02 20:15:58 -04:00
ip_tunnel.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-03-08 12:34:12 -05:00
ip_vti.c
ipcomp.c
ipconfig.c
ipip.c iptunnel: scrub packet in iptunnel_pull_header 2016-02-18 14:34:54 -05:00
ipmr.c
Kconfig ipv4: Remove inet_lro library 2016-02-17 16:15:46 -05:00
Makefile ipv4: Remove inet_lro library 2016-02-17 16:15:46 -05:00
netfilter.c
ping.c sock: enable timestamping using control messages 2016-04-04 15:50:30 -04:00
proc.c ipv4: Namespaceify ip_default_ttl sysctl knob 2016-02-16 20:42:54 -05:00
protocol.c
raw.c sock: enable timestamping using control messages 2016-04-04 15:50:30 -04:00
route.c route: check and remove route cache when we get route 2016-02-18 11:31:36 -05:00
syncookies.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2016-03-19 10:05:34 -07:00
sysctl_net_ipv4.c ipv4: namespacify ip_early_demux sysctl knob 2016-02-16 20:42:54 -05:00
tcp_bic.c
tcp_cdg.c
tcp_cong.c
tcp_cubic.c
tcp_dctcp.c
tcp_diag.c
tcp_fastopen.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2016-03-19 10:05:34 -07:00
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c
tcp_illinois.c
tcp_input.c tcp: increment sk_drops for listeners 2016-04-04 22:11:20 -04:00
tcp_ipv4.c ipv4: tcp: set SOCK_USE_WRITE_QUEUE for ip_send_unicast_reply() 2016-04-04 22:11:20 -04:00
tcp_lp.c
tcp_metrics.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-03-08 12:34:12 -05:00
tcp_minisocks.c tcp: rate limit ACK sent by SYN_RECV request sockets 2016-04-04 22:11:20 -04:00
tcp_offload.c
tcp_output.c tcp: Add RFC4898 tcpEStatsPerfDataSegsOut/In 2016-03-14 14:55:26 -04:00
tcp_probe.c net: ipv4: tcp_probe: Replace timespec with timespec64 2016-03-01 17:18:44 -05:00
tcp_recovery.c
tcp_scalable.c
tcp_timer.c
tcp_vegas.c
tcp_vegas.h
tcp_veno.c
tcp_westwood.c
tcp_yeah.c
tcp.c sock: enable timestamping using control messages 2016-04-04 15:50:30 -04:00
tunnel4.c
udp_diag.c udp: no longer use SLAB_DESTROY_BY_RCU 2016-04-04 22:11:19 -04:00
udp_impl.h
udp_offload.c net: Reset encap_level to avoid resetting features on inner IP headers 2016-03-23 14:19:08 -04:00
udp_tunnel.c tunnel: Clear IPCB(skb)->opt before dst_link_failure called 2016-02-23 19:11:56 -05:00
udp.c udp: no longer use SLAB_DESTROY_BY_RCU 2016-04-04 22:11:19 -04:00
udplite.c
xfrm4_input.c
xfrm4_mode_beet.c
xfrm4_mode_transport.c
xfrm4_mode_tunnel.c
xfrm4_output.c
xfrm4_policy.c
xfrm4_protocol.c
xfrm4_state.c
xfrm4_tunnel.c