tcp: implement RFC 5961 4.2

Implement the RFC 5691 mitigation against Blind
Reset attack using SYN bit.

Section 4.2 of RFC 5961 advises to send a Challenge ACK and drop
incoming packet, instead of resetting the session.

Add a new SNMP counter to count number of challenge acks sent
in response to SYN packets.
(netstat -s | grep TCPSYNChallenge)

Remove obsolete TCPAbortOnSyn, since we no longer abort a TCP session
because of a SYN flag.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Kiran Kumar Kella <kkiran@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 1 insertions, 1 deletions

diff --git a/include/linux/snmp.h b/include/linux/snmp.h
index 673e0e928b2b..e5fcbd079e4a 100644
--- a/include/linux/snmp.h
+++ b/include/linux/snmp.h
@@ -208,7 +208,6 @@ enum
         LINUX_MIB_TCPDSACKOFOSENT,              /* TCPDSACKOfoSent */
         LINUX_MIB_TCPDSACKRECV,                 /* TCPDSACKRecv */
         LINUX_MIB_TCPDSACKOFORECV,              /* TCPDSACKOfoRecv */
-        LINUX_MIB_TCPABORTONSYN,                /* TCPAbortOnSyn */
         LINUX_MIB_TCPABORTONDATA,               /* TCPAbortOnData */
         LINUX_MIB_TCPABORTONCLOSE,              /* TCPAbortOnClose */
         LINUX_MIB_TCPABORTONMEMORY,             /* TCPAbortOnMemory */
@@ -238,6 +237,7 @@ enum
         LINUX_MIB_TCPOFODROP,                   /* TCPOFODrop */
         LINUX_MIB_TCPOFOMERGE,                  /* TCPOFOMerge */
         LINUX_MIB_TCPCHALLENGEACK,              /* TCPChallengeACK */
+        LINUX_MIB_TCPSYNCHALLENGE,              /* TCPSYNChallenge */
         __LINUX_MIB_MAX
 };