summaryrefslogtreecommitdiffstats
path: root/include/linux/snmp.h
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2012-07-17 10:13:05 +0200
committerDavid S. Miller <davem@davemloft.net>2012-07-17 01:36:20 -0700
commit282f23c6ee343126156dd41218b22ece96d747e3 (patch)
tree9a306d99ed77d760078d29699edd3007507d709b /include/linux/snmp.h
parenta858d64b7709ca7bd2ee71d66ef3b7190cdcbb7d (diff)
downloadop-kernel-dev-282f23c6ee343126156dd41218b22ece96d747e3.zip
op-kernel-dev-282f23c6ee343126156dd41218b22ece96d747e3.tar.gz
tcp: implement RFC 5961 3.2
Implement the RFC 5691 mitigation against Blind Reset attack using RST bit. Idea is to validate incoming RST sequence, to match RCV.NXT value, instead of previouly accepted window : (RCV.NXT <= SEG.SEQ < RCV.NXT+RCV.WND) If sequence is in window but not an exact match, send a "challenge ACK", so that the other part can resend an RST with the appropriate sequence. Add a new sysctl, tcp_challenge_ack_limit, to limit number of challenge ACK sent per second. Add a new SNMP counter to count number of challenge acks sent. (netstat -s | grep TCPChallengeACK) Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Kiran Kumar Kella <kkiran@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/linux/snmp.h')
-rw-r--r--include/linux/snmp.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/snmp.h b/include/linux/snmp.h
index 6e4c511..673e0e9 100644
--- a/include/linux/snmp.h
+++ b/include/linux/snmp.h
@@ -237,6 +237,7 @@ enum
LINUX_MIB_TCPOFOQUEUE, /* TCPOFOQueue */
LINUX_MIB_TCPOFODROP, /* TCPOFODrop */
LINUX_MIB_TCPOFOMERGE, /* TCPOFOMerge */
+ LINUX_MIB_TCPCHALLENGEACK, /* TCPChallengeACK */
__LINUX_MIB_MAX
};
OpenPOWER on IntegriCloud