| rev |
line source |
|
pascal@19377
|
1 based on http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758
|
|
pascal@19376
|
2 --- linux-3.2.71/net/ipv4/tcp_input.c
|
|
pascal@19376
|
3 +++ linux-3.2.71/net/ipv4/tcp_input.c
|
|
pascal@19376
|
4 @@ -87,7 +87,7 @@
|
|
pascal@19376
|
5 EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
|
|
pascal@19376
|
6
|
|
pascal@19376
|
7 /* rfc5961 challenge ack rate limiting */
|
|
pascal@19376
|
8 -int sysctl_tcp_challenge_ack_limit = 100;
|
|
pascal@19376
|
9 +int sysctl_tcp_challenge_ack_limit = 1000;
|
|
pascal@19376
|
10
|
|
pascal@19376
|
11 int sysctl_tcp_stdurg __read_mostly;
|
|
pascal@19376
|
12 int sysctl_tcp_rfc1337 __read_mostly;
|
|
pascal@19377
|
13 @@ -3715,13 +3715,20 @@
|
|
pascal@19376
|
14 /* unprotected vars, we dont care of overwrites */
|
|
pascal@19376
|
15 static u32 challenge_timestamp;
|
|
pascal@19376
|
16 static unsigned int challenge_count;
|
|
pascal@19376
|
17 - u32 now = jiffies / HZ;
|
|
pascal@19376
|
18 + u32 count, now = jiffies / HZ;
|
|
pascal@19377
|
19 +#define READ_ONCE(a) a
|
|
pascal@19377
|
20 +#define WRITE_ONCE(a,b) (a = b)
|
|
pascal@19377
|
21 +#define prandom_u32_max(a) (net_random() % (a))
|
|
pascal@19376
|
22
|
|
pascal@19376
|
23 if (now != challenge_timestamp) {
|
|
pascal@19376
|
24 + u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1;
|
|
pascal@19376
|
25 challenge_timestamp = now;
|
|
pascal@19376
|
26 - challenge_count = 0;
|
|
pascal@19376
|
27 + WRITE_ONCE(challenge_count, half +
|
|
pascal@19376
|
28 + prandom_u32_max(sysctl_tcp_challenge_ack_limit));
|
|
pascal@19376
|
29 }
|
|
pascal@19376
|
30 - if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
|
|
pascal@19376
|
31 + count = READ_ONCE(challenge_count);
|
|
pascal@19376
|
32 + if (count > 0) {
|
|
pascal@19376
|
33 + WRITE_ONCE(challenge_count, count - 1);
|
|
pascal@19376
|
34 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
|
|
pascal@19376
|
35 tcp_send_ack(sk);
|
|
pascal@19376
|
36 }
|