Commit 12ed8244 authored by Nikolay Borisov's avatar Nikolay Borisov Committed by David S. Miller

ipv4: Namespaceify tcp syncookies sysctl knob

Signed-off-by: default avatarNikolay Borisov <kernel@kyup.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7c083ecb
...@@ -101,6 +101,8 @@ struct netns_ipv4 { ...@@ -101,6 +101,8 @@ struct netns_ipv4 {
int sysctl_tcp_syn_retries; int sysctl_tcp_syn_retries;
int sysctl_tcp_synack_retries; int sysctl_tcp_synack_retries;
int sysctl_tcp_syncookies;
struct ping_group_range ping_group_range; struct ping_group_range ping_group_range;
atomic_t dev_addr_genid; atomic_t dev_addr_genid;
......
...@@ -243,7 +243,6 @@ extern int sysctl_tcp_fin_timeout; ...@@ -243,7 +243,6 @@ extern int sysctl_tcp_fin_timeout;
extern int sysctl_tcp_retries1; extern int sysctl_tcp_retries1;
extern int sysctl_tcp_retries2; extern int sysctl_tcp_retries2;
extern int sysctl_tcp_orphan_retries; extern int sysctl_tcp_orphan_retries;
extern int sysctl_tcp_syncookies;
extern int sysctl_tcp_fastopen; extern int sysctl_tcp_fastopen;
extern int sysctl_tcp_retrans_collapse; extern int sysctl_tcp_retrans_collapse;
extern int sysctl_tcp_stdurg; extern int sysctl_tcp_stdurg;
......
...@@ -19,8 +19,6 @@ ...@@ -19,8 +19,6 @@
#include <net/tcp.h> #include <net/tcp.h>
#include <net/route.h> #include <net/route.h>
extern int sysctl_tcp_syncookies;
static u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS] __read_mostly; static u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS] __read_mostly;
#define COOKIEBITS 24 /* Upper bits store count */ #define COOKIEBITS 24 /* Upper bits store count */
...@@ -307,7 +305,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb) ...@@ -307,7 +305,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
__u8 rcv_wscale; __u8 rcv_wscale;
struct flowi4 fl4; struct flowi4 fl4;
if (!sysctl_tcp_syncookies || !th->ack || th->rst) if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies || !th->ack || th->rst)
goto out; goto out;
if (tcp_synq_no_recent_overflow(sk)) if (tcp_synq_no_recent_overflow(sk))
......
...@@ -341,15 +341,6 @@ static struct ctl_table ipv4_table[] = { ...@@ -341,15 +341,6 @@ static struct ctl_table ipv4_table[] = {
.mode = 0644, .mode = 0644,
.proc_handler = proc_dointvec_jiffies, .proc_handler = proc_dointvec_jiffies,
}, },
#ifdef CONFIG_SYN_COOKIES
{
.procname = "tcp_syncookies",
.data = &sysctl_tcp_syncookies,
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = proc_dointvec
},
#endif
{ {
.procname = "tcp_fastopen", .procname = "tcp_fastopen",
.data = &sysctl_tcp_fastopen, .data = &sysctl_tcp_fastopen,
...@@ -960,6 +951,15 @@ static struct ctl_table ipv4_net_table[] = { ...@@ -960,6 +951,15 @@ static struct ctl_table ipv4_net_table[] = {
.mode = 0644, .mode = 0644,
.proc_handler = proc_dointvec .proc_handler = proc_dointvec
}, },
#ifdef CONFIG_SYN_COOKIES
{
.procname = "tcp_syncookies",
.data = &init_net.ipv4.sysctl_tcp_syncookies,
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = proc_dointvec
},
#endif
{ } { }
}; };
......
...@@ -6163,9 +6163,10 @@ static bool tcp_syn_flood_action(const struct sock *sk, ...@@ -6163,9 +6163,10 @@ static bool tcp_syn_flood_action(const struct sock *sk,
struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue; struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
const char *msg = "Dropping request"; const char *msg = "Dropping request";
bool want_cookie = false; bool want_cookie = false;
struct net *net = sock_net(sk);
#ifdef CONFIG_SYN_COOKIES #ifdef CONFIG_SYN_COOKIES
if (sysctl_tcp_syncookies) { if (net->ipv4.sysctl_tcp_syncookies) {
msg = "Sending cookies"; msg = "Sending cookies";
want_cookie = true; want_cookie = true;
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDOCOOKIES); NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDOCOOKIES);
...@@ -6174,7 +6175,7 @@ static bool tcp_syn_flood_action(const struct sock *sk, ...@@ -6174,7 +6175,7 @@ static bool tcp_syn_flood_action(const struct sock *sk,
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP); NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP);
if (!queue->synflood_warned && if (!queue->synflood_warned &&
sysctl_tcp_syncookies != 2 && net->ipv4.sysctl_tcp_syncookies != 2 &&
xchg(&queue->synflood_warned, 1) == 0) xchg(&queue->synflood_warned, 1) == 0)
pr_info("%s: Possible SYN flooding on port %d. %s. Check SNMP counters.\n", pr_info("%s: Possible SYN flooding on port %d. %s. Check SNMP counters.\n",
proto, ntohs(tcp_hdr(skb)->dest), msg); proto, ntohs(tcp_hdr(skb)->dest), msg);
...@@ -6207,6 +6208,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, ...@@ -6207,6 +6208,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
__u32 isn = TCP_SKB_CB(skb)->tcp_tw_isn; __u32 isn = TCP_SKB_CB(skb)->tcp_tw_isn;
struct tcp_options_received tmp_opt; struct tcp_options_received tmp_opt;
struct tcp_sock *tp = tcp_sk(sk); struct tcp_sock *tp = tcp_sk(sk);
struct net *net = sock_net(sk);
struct sock *fastopen_sk = NULL; struct sock *fastopen_sk = NULL;
struct dst_entry *dst = NULL; struct dst_entry *dst = NULL;
struct request_sock *req; struct request_sock *req;
...@@ -6217,7 +6219,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, ...@@ -6217,7 +6219,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
* limitations, they conserve resources and peer is * limitations, they conserve resources and peer is
* evidently real one. * evidently real one.
*/ */
if ((sysctl_tcp_syncookies == 2 || if ((net->ipv4.sysctl_tcp_syncookies == 2 ||
inet_csk_reqsk_queue_is_full(sk)) && !isn) { inet_csk_reqsk_queue_is_full(sk)) && !isn) {
want_cookie = tcp_syn_flood_action(sk, skb, rsk_ops->slab_name); want_cookie = tcp_syn_flood_action(sk, skb, rsk_ops->slab_name);
if (!want_cookie) if (!want_cookie)
...@@ -6283,7 +6285,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, ...@@ -6283,7 +6285,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
} }
} }
/* Kill the following clause, if you dislike this way. */ /* Kill the following clause, if you dislike this way. */
else if (!sysctl_tcp_syncookies && else if (!net->ipv4.sysctl_tcp_syncookies &&
(sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) < (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
(sysctl_max_syn_backlog >> 2)) && (sysctl_max_syn_backlog >> 2)) &&
!tcp_peer_is_proven(req, dst, false, !tcp_peer_is_proven(req, dst, false,
......
...@@ -860,7 +860,6 @@ static void tcp_v4_reqsk_destructor(struct request_sock *req) ...@@ -860,7 +860,6 @@ static void tcp_v4_reqsk_destructor(struct request_sock *req)
kfree(inet_rsk(req)->opt); kfree(inet_rsk(req)->opt);
} }
#ifdef CONFIG_TCP_MD5SIG #ifdef CONFIG_TCP_MD5SIG
/* /*
* RFC2385 MD5 checksumming requires a mapping of * RFC2385 MD5 checksumming requires a mapping of
...@@ -2391,6 +2390,8 @@ static int __net_init tcp_sk_init(struct net *net) ...@@ -2391,6 +2390,8 @@ static int __net_init tcp_sk_init(struct net *net)
net->ipv4.sysctl_tcp_syn_retries = TCP_SYN_RETRIES; net->ipv4.sysctl_tcp_syn_retries = TCP_SYN_RETRIES;
net->ipv4.sysctl_tcp_synack_retries = TCP_SYNACK_RETRIES; net->ipv4.sysctl_tcp_synack_retries = TCP_SYNACK_RETRIES;
net->ipv4.sysctl_tcp_syncookies = 0;
return 0; return 0;
fail: fail:
tcp_sk_exit(net); tcp_sk_exit(net);
......
...@@ -27,9 +27,6 @@ ...@@ -27,9 +27,6 @@
#include <net/inet_common.h> #include <net/inet_common.h>
#include <net/xfrm.h> #include <net/xfrm.h>
int sysctl_tcp_syncookies __read_mostly = 1;
EXPORT_SYMBOL(sysctl_tcp_syncookies);
int sysctl_tcp_abort_on_overflow __read_mostly; int sysctl_tcp_abort_on_overflow __read_mostly;
struct inet_timewait_death_row tcp_death_row = { struct inet_timewait_death_row tcp_death_row = {
......
...@@ -148,7 +148,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) ...@@ -148,7 +148,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
struct dst_entry *dst; struct dst_entry *dst;
__u8 rcv_wscale; __u8 rcv_wscale;
if (!sysctl_tcp_syncookies || !th->ack || th->rst) if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies || !th->ack || th->rst)
goto out; goto out;
if (tcp_synq_no_recent_overflow(sk)) if (tcp_synq_no_recent_overflow(sk))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment