Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b530b681 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

tcp: Namespace-ify sysctl_tcp_challenge_ack_limit 



Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9184d8bb

include/net/netns/ipv4.h

+1 −0
Original line number Diff line number Diff line
@@ -147,6 +147,7 @@ struct netns_ipv4 { 
	int sysctl_tcp_tso_win_divisor;

	int sysctl_tcp_workaround_signed_windows;

	int sysctl_tcp_limit_output_bytes;

	int sysctl_tcp_challenge_ack_limit;

	struct inet_timewait_death_row tcp_death_row;

	int sysctl_max_syn_backlog;

	int sysctl_tcp_fastopen;

include/net/tcp.h

+0 −1
Original line number Diff line number Diff line
@@ -250,7 +250,6 @@ extern int sysctl_tcp_rmem[3]; 


#define TCP_RACK_LOSS_DETECTION  0x1 /* Use RACK to detect losses */



extern int sysctl_tcp_challenge_ack_limit;

extern int sysctl_tcp_min_tso_segs;

extern int sysctl_tcp_min_rtt_wlen;

extern int sysctl_tcp_autocorking;

net/ipv4/sysctl_net_ipv4.c

+7 −7
Original line number Diff line number Diff line
@@ -457,13 +457,6 @@ static struct ctl_table ipv4_table[] = { 
		.maxlen		= TCP_CA_NAME_MAX,

		.proc_handler	= proc_tcp_congestion_control,

	},

	{

		.procname	= "tcp_challenge_ack_limit",

		.data		= &sysctl_tcp_challenge_ack_limit,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec

	},

#ifdef CONFIG_NETLABEL

	{

		.procname	= "cipso_cache_enable",
@@ -1145,6 +1138,13 @@ static struct ctl_table ipv4_net_table[] = { 
		.mode		= 0644,

		.proc_handler	= proc_dointvec

	},

	{

		.procname	= "tcp_challenge_ack_limit",

		.data		= &init_net.ipv4.sysctl_tcp_challenge_ack_limit,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec

	},

	{ }

};

net/ipv4/tcp_input.c

+6 −8
Original line number Diff line number Diff line
@@ -79,9 +79,6 @@ 
#include <linux/unaligned/access_ok.h>

#include <linux/static_key.h>



/* rfc5961 challenge ack rate limiting */

int sysctl_tcp_challenge_ack_limit = 1000;



int sysctl_tcp_max_orphans __read_mostly = NR_FILE;

int sysctl_tcp_min_rtt_wlen __read_mostly = 300;

int sysctl_tcp_invalid_ratelimit __read_mostly = HZ/2;
@@ -3443,10 +3440,11 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb) 
	static u32 challenge_timestamp;

	static unsigned int challenge_count;

	struct tcp_sock *tp = tcp_sk(sk);

	struct net *net = sock_net(sk);

	u32 count, now;



	/* First check our per-socket dupack rate limit. */

	if (__tcp_oow_rate_limited(sock_net(sk),

	if (__tcp_oow_rate_limited(net,

				   LINUX_MIB_TCPACKSKIPPEDCHALLENGE,

				   &tp->last_oow_ack_time))

		return;
@@ -3454,16 +3452,16 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb) 
	/* Then check host-wide RFC 5961 rate limit. */

	now = jiffies / HZ;

	if (now != challenge_timestamp) {

		u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1;

		u32 ack_limit = net->ipv4.sysctl_tcp_challenge_ack_limit;

		u32 half = (ack_limit + 1) >> 1;



		challenge_timestamp = now;

		WRITE_ONCE(challenge_count, half +

			   prandom_u32_max(sysctl_tcp_challenge_ack_limit));

		WRITE_ONCE(challenge_count, half + prandom_u32_max(ack_limit));

	}

	count = READ_ONCE(challenge_count);

	if (count > 0) {

		WRITE_ONCE(challenge_count, count - 1);

		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);

		NET_INC_STATS(net, LINUX_MIB_TCPCHALLENGEACK);

		tcp_send_ack(sk);

	}

}

net/ipv4/tcp_ipv4.c

+2 −0
Original line number Diff line number Diff line
@@ -2501,6 +2501,8 @@ static int __net_init tcp_sk_init(struct net *net) 
	net->ipv4.sysctl_tcp_tso_win_divisor = 3;

	/* Default TSQ limit of four TSO segments */

	net->ipv4.sysctl_tcp_limit_output_bytes = 262144;

	/* rfc5961 challenge ack rate limiting */

	net->ipv4.sysctl_tcp_challenge_ack_limit = 1000;



	net->ipv4.sysctl_tcp_fastopen = TFO_CLIENT_ENABLE;

	spin_lock_init(&net->ipv4.tcp_fastopen_ctx_lock);