3 files changed, 18 insertions, 9 deletions

diff --git a/include/net/tcp.h b/include/net/tcp.h
index c826ed7b007b..92faa6a7ea97 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -367,13 +367,6 @@ static inline void tcp_dec_quickack_mode(struct sock *sk,
 #define TCP_ECN_DEMAND_CWR      4
 #define TCP_ECN_SEEN            8
 
-static __inline__ void
-TCP_ECN_create_request(struct request_sock *req, struct tcphdr *th)
-{
-        if (sysctl_tcp_ecn && th->ece && th->cwr)
-                inet_rsk(req)->ecn_ok = 1;
-}
-
 enum tcp_tw_status {
         TCP_TW_SUCCESS = 0,
         TCP_TW_RST = 1,
@@ -671,6 +664,22 @@ struct tcp_skb_cb {
 
 #define TCP_SKB_CB(__skb)       ((struct tcp_skb_cb *)&((__skb)->cb[0]))
 
+/* RFC3168 : 6.1.1 SYN packets must not have ECT/ECN bits set
+ *
+ * If we receive a SYN packet with these bits set, it means a network is
+ * playing bad games with TOS bits. In order to avoid possible false congestion
+ * notifications, we disable TCP ECN negociation.
+ */
+static inline void
+TCP_ECN_create_request(struct request_sock *req, const struct sk_buff *skb)
+{
+        const struct tcphdr *th = tcp_hdr(skb);
+
+        if (sysctl_tcp_ecn && th->ece && th->cwr &&
+            INET_ECN_is_not_ect(TCP_SKB_CB(skb)->ip_dsfield))
+                inet_rsk(req)->ecn_ok = 1;
+}
+
 /* Due to TSO, an SKB can be composed of multiple actual
  * packets.  To keep these tracked properly, we use this.
  */
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index cf97e9821d76..4ff5e1f70d16 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1368,7 +1368,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                 goto drop_and_free;
 
         if (!want_cookie || tmp_opt.tstamp_ok)
-                TCP_ECN_create_request(req, tcp_hdr(skb));
+                TCP_ECN_create_request(req, skb);
 
         if (want_cookie) {
                 isn = cookie_v4_init_sequence(sk, skb, &req->mss);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 57b210969834..078d039e8fd2 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1140,7 +1140,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         treq->rmt_addr = ipv6_hdr(skb)->saddr;
         treq->loc_addr = ipv6_hdr(skb)->daddr;
         if (!want_cookie || tmp_opt.tstamp_ok)
-                TCP_ECN_create_request(req, tcp_hdr(skb));
+                TCP_ECN_create_request(req, skb);
 
         treq->iif = sk->sk_bound_dev_if;