1 files changed, 49 insertions, 6 deletions

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 2c970626b398..fed3f1c66167 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -110,8 +110,38 @@ static u32 tcp_v4_init_ts_off(const struct net *net, const struct sk_buff *skb)
 
 int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
 {
+        const struct inet_timewait_sock *tw = inet_twsk(sktw);
         const struct tcp_timewait_sock *tcptw = tcp_twsk(sktw);
         struct tcp_sock *tp = tcp_sk(sk);
+        int reuse = sock_net(sk)->ipv4.sysctl_tcp_tw_reuse;
+
+        if (reuse == 2) {
+                /* Still does not detect *everything* that goes through
+                 * lo, since we require a loopback src or dst address
+                 * or direct binding to 'lo' interface.
+                 */
+                bool loopback = false;
+                if (tw->tw_bound_dev_if == LOOPBACK_IFINDEX)
+                        loopback = true;
+#if IS_ENABLED(CONFIG_IPV6)
+                if (tw->tw_family == AF_INET6) {
+                        if (ipv6_addr_loopback(&tw->tw_v6_daddr) ||
+                            (ipv6_addr_v4mapped(&tw->tw_v6_daddr) &&
+                             (tw->tw_v6_daddr.s6_addr[12] == 127)) ||
+                            ipv6_addr_loopback(&tw->tw_v6_rcv_saddr) ||
+                            (ipv6_addr_v4mapped(&tw->tw_v6_rcv_saddr) &&
+                             (tw->tw_v6_rcv_saddr.s6_addr[12] == 127)))
+                                loopback = true;
+                } else
+#endif
+                {
+                        if (ipv4_is_loopback(tw->tw_daddr) ||
+                            ipv4_is_loopback(tw->tw_rcv_saddr))
+                                loopback = true;
+                }
+                if (!loopback)
+                        reuse = 0;
+        }
 
         /* With PAWS, it is safe from the viewpoint
            of data integrity. Even without PAWS it is safe provided sequence
@@ -125,8 +155,7 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
            and use initial timestamp retrieved from peer table.
          */
         if (tcptw->tw_ts_recent_stamp &&
-            (!twp || (sock_net(sk)->ipv4.sysctl_tcp_tw_reuse &&
-                             get_seconds() - tcptw->tw_ts_recent_stamp > 1))) {
+            (!twp || (reuse && get_seconds() - tcptw->tw_ts_recent_stamp > 1))) {
                 tp->write_seq = tcptw->tw_snd_nxt + 65535 + 2;
                 if (tp->write_seq == 0)
                         tp->write_seq = 1;
@@ -621,6 +650,7 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb)
         struct sock *sk1 = NULL;
 #endif
         struct net *net;
+        struct sock *ctl_sk;
 
         /* Never send a reset in response to a reset. */
         if (th->rst)
@@ -723,11 +753,16 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb)
         arg.tos = ip_hdr(skb)->tos;
         arg.uid = sock_net_uid(net, sk && sk_fullsock(sk) ? sk : NULL);
         local_bh_disable();
-        ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk),
+        ctl_sk = *this_cpu_ptr(net->ipv4.tcp_sk);
+        if (sk)
+                ctl_sk->sk_mark = (sk->sk_state == TCP_TIME_WAIT) ?
+                                   inet_twsk(sk)->tw_mark : sk->sk_mark;
+        ip_send_unicast_reply(ctl_sk,
                               skb, &TCP_SKB_CB(skb)->header.h4.opt,
                               ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
                               &arg, arg.iov[0].iov_len);
 
+        ctl_sk->sk_mark = 0;
         __TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
         __TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
         local_bh_enable();
@@ -759,6 +794,7 @@ static void tcp_v4_send_ack(const struct sock *sk,
         } rep;
         struct net *net = sock_net(sk);
         struct ip_reply_arg arg;
+        struct sock *ctl_sk;
 
         memset(&rep.th, 0, sizeof(struct tcphdr));
         memset(&arg, 0, sizeof(arg));
@@ -809,11 +845,16 @@ static void tcp_v4_send_ack(const struct sock *sk,
         arg.tos = tos;
         arg.uid = sock_net_uid(net, sk_fullsock(sk) ? sk : NULL);
         local_bh_disable();
-        ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk),
+        ctl_sk = *this_cpu_ptr(net->ipv4.tcp_sk);
+        if (sk)
+                ctl_sk->sk_mark = (sk->sk_state == TCP_TIME_WAIT) ?
+                                   inet_twsk(sk)->tw_mark : sk->sk_mark;
+        ip_send_unicast_reply(ctl_sk,
                               skb, &TCP_SKB_CB(skb)->header.h4.opt,
                               ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
                               &arg, arg.iov[0].iov_len);
 
+        ctl_sk->sk_mark = 0;
         __TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
         local_bh_enable();
 }
@@ -1474,7 +1515,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
                                 sk->sk_rx_dst = NULL;
                         }
                 }
-                tcp_rcv_established(sk, skb, tcp_hdr(skb));
+                tcp_rcv_established(sk, skb);
                 return 0;
         }
 
@@ -2481,7 +2522,7 @@ static int __net_init tcp_sk_init(struct net *net)
         net->ipv4.sysctl_tcp_orphan_retries = 0;
         net->ipv4.sysctl_tcp_fin_timeout = TCP_FIN_TIMEOUT;
         net->ipv4.sysctl_tcp_notsent_lowat = UINT_MAX;
-        net->ipv4.sysctl_tcp_tw_reuse = 0;
+        net->ipv4.sysctl_tcp_tw_reuse = 2;
 
         cnt = tcp_hashinfo.ehash_mask + 1;
         net->ipv4.tcp_death_row.sysctl_max_tw_buckets = (cnt + 1) / 2;
@@ -2524,6 +2565,8 @@ static int __net_init tcp_sk_init(struct net *net)
                        init_net.ipv4.sysctl_tcp_wmem,
                        sizeof(init_net.ipv4.sysctl_tcp_wmem));
         }
+        net->ipv4.sysctl_tcp_comp_sack_delay_ns = NSEC_PER_MSEC;
+        net->ipv4.sysctl_tcp_comp_sack_nr = 44;
         net->ipv4.sysctl_tcp_fastopen = TFO_CLIENT_ENABLE;
         spin_lock_init(&net->ipv4.tcp_fastopen_ctx_lock);
         net->ipv4.sysctl_tcp_fastopen_blackhole_timeout = 60 * 60;