1 files changed, 45 insertions, 29 deletions

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 708dc203b03..6cdf6a28f6b 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -72,6 +72,7 @@
 #include <net/timewait_sock.h>
 #include <net/xfrm.h>
 #include <net/netdma.h>
+#include <net/secure_seq.h>
 
 #include <linux/inet.h>
 #include <linux/ipv6.h>
@@ -429,8 +430,8 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                         break;
 
                 icsk->icsk_backoff--;
-                inet_csk(sk)->icsk_rto = __tcp_set_rto(tp) <<
-                                         icsk->icsk_backoff;
+                inet_csk(sk)->icsk_rto = (tp->srtt ? __tcp_set_rto(tp) :
+                        TCP_TIMEOUT_INIT) << icsk->icsk_backoff;
                 tcp_bound_rto(sk);
 
                 skb = tcp_write_queue_head(sk);
@@ -629,7 +630,7 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
         arg.iov[0].iov_len  = sizeof(rep.th);
 
 #ifdef CONFIG_TCP_MD5SIG
-        key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->daddr) : NULL;
+        key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->saddr) : NULL;
         if (key) {
                 rep.opt[0] = htonl((TCPOPT_NOP << 24) |
                                    (TCPOPT_NOP << 16) |
@@ -807,20 +808,38 @@ static void tcp_v4_reqsk_destructor(struct request_sock *req)
         kfree(inet_rsk(req)->opt);
 }
 
-static void syn_flood_warning(const struct sk_buff *skb)
+/*
+ * Return 1 if a syncookie should be sent
+ */
+int tcp_syn_flood_action(struct sock *sk,
+                         const struct sk_buff *skb,
+                         const char *proto)
 {
-        const char *msg;
+        const char *msg = "Dropping request";
+        int want_cookie = 0;
+        struct listen_sock *lopt;
+
+
 
 #ifdef CONFIG_SYN_COOKIES
-        if (sysctl_tcp_syncookies)
+        if (sysctl_tcp_syncookies) {
                 msg = "Sending cookies";
-        else
+                want_cookie = 1;
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDOCOOKIES);
+        } else
 #endif
-                msg = "Dropping request";
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP);
 
-        pr_info("TCP: Possible SYN flooding on port %d. %s.\n",
-                                ntohs(tcp_hdr(skb)->dest), msg);
+        lopt = inet_csk(sk)->icsk_accept_queue.listen_opt;
+        if (!lopt->synflood_warned) {
+                lopt->synflood_warned = 1;
+                pr_info("%s: Possible SYN flooding on port %d. %s. "
+                        " Check SNMP counters.\n",
+                        proto, ntohs(tcp_hdr(skb)->dest), msg);
+        }
+        return want_cookie;
 }
+EXPORT_SYMBOL(tcp_syn_flood_action);
 
 /*
  * Save and compile IPv4 options into the request_sock if needed.
@@ -908,18 +927,21 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
                         }
                         sk_nocaps_add(sk, NETIF_F_GSO_MASK);
                 }
-                if (tcp_alloc_md5sig_pool(sk) == NULL) {
+
+                md5sig = tp->md5sig_info;
+                if (md5sig->entries4 == 0 &&
+                    tcp_alloc_md5sig_pool(sk) == NULL) {
                         kfree(newkey);
                         return -ENOMEM;
                 }
-                md5sig = tp->md5sig_info;
 
                 if (md5sig->alloced4 == md5sig->entries4) {
                         keys = kmalloc((sizeof(*keys) *
                                         (md5sig->entries4 + 1)), GFP_ATOMIC);
                         if (!keys) {
                                 kfree(newkey);
-                                tcp_free_md5sig_pool();
+                                if (md5sig->entries4 == 0)
+                                        tcp_free_md5sig_pool();
                                 return -ENOMEM;
                         }
 
@@ -963,6 +985,7 @@ int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
                                 kfree(tp->md5sig_info->keys4);
                                 tp->md5sig_info->keys4 = NULL;
                                 tp->md5sig_info->alloced4 = 0;
+                                tcp_free_md5sig_pool();
                         } else if (tp->md5sig_info->entries4 != i) {
                                 /* Need to do some manipulation */
                                 memmove(&tp->md5sig_info->keys4[i],
@@ -970,7 +993,6 @@ int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
                                         (tp->md5sig_info->entries4 - i) *
                                          sizeof(struct tcp4_md5sig_key));
                         }
-                        tcp_free_md5sig_pool();
                         return 0;
                 }
         }
@@ -1234,11 +1256,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         __be32 saddr = ip_hdr(skb)->saddr;
         __be32 daddr = ip_hdr(skb)->daddr;
         __u32 isn = TCP_SKB_CB(skb)->when;
-#ifdef CONFIG_SYN_COOKIES
         int want_cookie = 0;
-#else
-#define want_cookie 0 /* Argh, why doesn't gcc optimize this :( */
-#endif
 
         /* Never answer to SYNs send to broadcast or multicast */
         if (skb_rtable(skb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
@@ -1249,14 +1267,9 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
          * evidently real one.
          */
         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
-                if (net_ratelimit())
-                        syn_flood_warning(skb);
-#ifdef CONFIG_SYN_COOKIES
-                if (sysctl_tcp_syncookies) {
-                        want_cookie = 1;
-                } else
-#endif
-                goto drop;
+                want_cookie = tcp_syn_flood_action(sk, skb, "TCP");
+                if (!want_cookie)
+                        goto drop;
         }
 
         /* Accept backlog is full. If we have already queued enough
@@ -1302,9 +1315,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                 while (l-- > 0)
                         *c++ ^= *hash_location++;
 
-#ifdef CONFIG_SYN_COOKIES
                 want_cookie = 0;        /* not our kind of cookie */
-#endif
                 tmp_ext.cookie_out_never = 0; /* false */
                 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
         } else if (!tp->rx_opt.cookie_in_always) {
@@ -1384,6 +1395,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                 isn = tcp_v4_init_sequence(skb);
         }
         tcp_rsk(req)->snt_isn = isn;
+        tcp_rsk(req)->snt_synack = tcp_time_stamp;
 
         if (tcp_v4_send_synack(sk, dst, req,
                                (struct request_values *)&tmp_ext) ||
@@ -1458,6 +1470,10 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
 
         tcp_initialize_rcv_mss(newsk);
+        if (tcp_rsk(req)->snt_synack)
+                tcp_valid_rtt_meas(newsk,
+                    tcp_time_stamp - tcp_rsk(req)->snt_synack);
+        newtp->total_retrans = req->retrans;
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Copy over the MD5 key from the original socket */
@@ -1855,7 +1871,7 @@ static int tcp_v4_init_sock(struct sock *sk)
          * algorithms that we must have the following bandaid to talk
          * efficiently to them.  -DaveM
          */
-        tp->snd_cwnd = 2;
+        tp->snd_cwnd = TCP_INIT_CWND;
 
         /* See draft-stevens-tcpca-spec-01 for discussion of the
          * initialization of these values.