5 files changed, 31 insertions, 17 deletions

diff --git a/include/net/tcp.h b/include/net/tcp.h
index 36c5084964cd..f50f29faf76f 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -493,7 +493,7 @@ __u32 cookie_v4_init_sequence(struct sock *sk, const struct sk_buff *skb,
 __u32 cookie_init_timestamp(struct request_sock *req);
 bool cookie_timestamp_decode(struct tcp_options_received *opt);
 bool cookie_ecn_ok(const struct tcp_options_received *opt,
-                   const struct net *net);
+                   const struct net *net, const struct dst_entry *dst);
 
 /* From net/ipv6/syncookies.c */
 int __cookie_v6_check(const struct ipv6hdr *iph, const struct tcphdr *th,
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 6de772500ee9..45fe60c5238e 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -273,7 +273,7 @@ bool cookie_timestamp_decode(struct tcp_options_received *tcp_opt)
 EXPORT_SYMBOL(cookie_timestamp_decode);
 
 bool cookie_ecn_ok(const struct tcp_options_received *tcp_opt,
-                   const struct net *net)
+                   const struct net *net, const struct dst_entry *dst)
 {
         bool ecn_ok = tcp_opt->rcv_tsecr & TS_OPT_ECN;
 
@@ -283,7 +283,7 @@ bool cookie_ecn_ok(const struct tcp_options_received *tcp_opt,
         if (net->ipv4.sysctl_tcp_ecn)
                 return true;
 
-        return false;
+        return dst_feature(dst, RTAX_FEATURE_ECN);
 }
 EXPORT_SYMBOL(cookie_ecn_ok);
 
@@ -387,7 +387,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
                                   dst_metric(&rt->dst, RTAX_INITRWND));
 
         ireq->rcv_wscale  = rcv_wscale;
-        ireq->ecn_ok = cookie_ecn_ok(&tcp_opt, sock_net(sk));
+        ireq->ecn_ok = cookie_ecn_ok(&tcp_opt, sock_net(sk), &rt->dst);
 
         ret = get_cookie_sock(sk, skb, req, &rt->dst);
         /* ip_queue_xmit() depends on our flow being setup
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 4e4617e90417..196b4388116c 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5876,20 +5876,22 @@ static inline void pr_drop_req(struct request_sock *req, __u16 port, int family)
  */
 static void tcp_ecn_create_request(struct request_sock *req,
                                    const struct sk_buff *skb,
-                                   const struct sock *listen_sk)
+                                   const struct sock *listen_sk,
+                                   const struct dst_entry *dst)
 {
         const struct tcphdr *th = tcp_hdr(skb);
         const struct net *net = sock_net(listen_sk);
         bool th_ecn = th->ece && th->cwr;
-        bool ect, need_ecn;
+        bool ect, need_ecn, ecn_ok;
 
         if (!th_ecn)
                 return;
 
         ect = !INET_ECN_is_not_ect(TCP_SKB_CB(skb)->ip_dsfield);
         need_ecn = tcp_ca_needs_ecn(listen_sk);
+        ecn_ok = net->ipv4.sysctl_tcp_ecn || dst_feature(dst, RTAX_FEATURE_ECN);
 
-        if (!ect && !need_ecn && net->ipv4.sysctl_tcp_ecn)
+        if (!ect && !need_ecn && ecn_ok)
                 inet_rsk(req)->ecn_ok = 1;
         else if (ect && need_ecn)
                 inet_rsk(req)->ecn_ok = 1;
@@ -5954,13 +5956,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
         if (security_inet_conn_request(sk, skb, req))
                 goto drop_and_free;
 
-        if (!want_cookie || tmp_opt.tstamp_ok)
-                tcp_ecn_create_request(req, skb, sk);
-
-        if (want_cookie) {
-                isn = cookie_init_sequence(af_ops, sk, skb, &req->mss);
-                req->cookie_ts = tmp_opt.tstamp_ok;
-        } else if (!isn) {
+        if (!want_cookie && !isn) {
                 /* VJ's idea. We save last timestamp seen
                  * from the destination in peer table, when entering
                  * state TIME-WAIT, and check against it before
@@ -6008,6 +6004,15 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
                         goto drop_and_free;
         }
 
+        tcp_ecn_create_request(req, skb, sk, dst);
+
+        if (want_cookie) {
+                isn = cookie_init_sequence(af_ops, sk, skb, &req->mss);
+                req->cookie_ts = tmp_opt.tstamp_ok;
+                if (!tmp_opt.tstamp_ok)
+                        inet_rsk(req)->ecn_ok = 0;
+        }
+
         tcp_rsk(req)->snt_isn = isn;
         tcp_openreq_init_rwin(req, sk, dst);
         fastopen = !want_cookie &&
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a3d453b94747..0b88158dd4a7 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -333,10 +333,19 @@ static void tcp_ecn_send_synack(struct sock *sk, struct sk_buff *skb)
 static void tcp_ecn_send_syn(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        bool use_ecn = sock_net(sk)->ipv4.sysctl_tcp_ecn == 1 ||
+                       tcp_ca_needs_ecn(sk);
+
+        if (!use_ecn) {
+                const struct dst_entry *dst = __sk_dst_get(sk);
+
+                if (dst && dst_feature(dst, RTAX_FEATURE_ECN))
+                        use_ecn = true;
+        }
 
         tp->ecn_flags = 0;
-        if (sock_net(sk)->ipv4.sysctl_tcp_ecn == 1 ||
-            tcp_ca_needs_ecn(sk)) {
+
+        if (use_ecn) {
                 TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_ECE | TCPHDR_CWR;
                 tp->ecn_flags = TCP_ECN_OK;
                 if (tcp_ca_needs_ecn(sk))
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 52cc8cb02c0c..7337fc7947e2 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -262,7 +262,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                                   dst_metric(dst, RTAX_INITRWND));
 
         ireq->rcv_wscale = rcv_wscale;
-        ireq->ecn_ok = cookie_ecn_ok(&tcp_opt, sock_net(sk));
+        ireq->ecn_ok = cookie_ecn_ok(&tcp_opt, sock_net(sk), dst);
 
         ret = get_cookie_sock(sk, skb, req, dst);
 out: