1 files changed, 18 insertions, 0 deletions

diff --git a/include/net/tcp.h b/include/net/tcp.h
index 0e47551e9bdb..de870ee5582d 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -481,6 +481,24 @@ int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th,
 struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                              struct ip_options *opt);
 #ifdef CONFIG_SYN_COOKIES
+#include <linux/ktime.h>
+
+/* Syncookies use a monotonic timer which increments every 64 seconds.
+ * This counter is used both as a hash input and partially encoded into
+ * the cookie value.  A cookie is only validated further if the delta
+ * between the current counter value and the encoded one is less than this,
+ * i.e. a sent cookie is valid only at most for 128 seconds (or less if
+ * the counter advances immediately after a cookie is generated).
+ */
+#define MAX_SYNCOOKIE_AGE 2
+
+static inline u32 tcp_cookie_time(void)
+{
+        struct timespec now;
+        getnstimeofday(&now);
+        return now.tv_sec >> 6; /* 64 seconds granularity */
+}
+
 u32 __cookie_v4_init_sequence(const struct iphdr *iph, const struct tcphdr *th,
                               u16 *mssp);
 __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mss);