Eric Dumazet 4ce7e93cb3 tcp: rate limit ACK sent by SYN_RECV request sockets ... Attackers like to use SYNFLOOD targeting one 5-tuple, as they hit a single RX queue (and cpu) on the victim. If they use random sequence numbers in their SYN, we detect they do not match the expected window and send back an ACK. This patch adds a rate limitation, so that the effect of such attacks is limited to ingress only. We roughly double our ability to absorb such attacks. Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Willem de Bruijn <willemb@google.com> Cc: Neal Cardwell <ncardwell@google.com> Cc: Maciej Żenczykowski <maze@google.com> Acked-by: Neal Cardwell <ncardwell@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-04-04 22:11:20 -04:00
..
6lowpan	6lowpan: iphc: fix SAM/DAM bit comment	2016-03-10 19:51:29 +01:00
9p	net/9p: convert to new CQ API	2016-03-10 20:54:09 -05:00
802
8021q	vlan: propagate gso_max_segs	2016-03-17 21:05:01 -04:00
appletalk
atm
ax25	ax25: add link layer header validation function	2016-03-09 22:13:01 -05:00
batman-adv	batman-adv: clarify CFG80211 dependency	2016-03-02 13:45:47 -05:00
bluetooth	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2016-03-19 10:05:34 -07:00
bridge	bridge: Allow set bridge ageing time when switchdev disabled	2016-03-30 15:38:13 -04:00
caif	net: caif: fix misleading indentation	2016-03-14 13:09:50 -04:00
can	sock: enable timestamping using control messages	2016-04-04 15:50:30 -04:00
ceph	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client	2016-03-26 15:53:16 -07:00
core	tcp: increment sk_drops for listeners	2016-04-04 22:11:20 -04:00
dcb
dccp	tcp/dccp: do not touch listener sk_refcnt under synflood	2016-04-04 22:11:20 -04:00
decnet
dns_resolver
dsa	net: dsa: refine netdev event notifier	2016-03-14 16:05:32 -04:00
ethernet	eth: Pull header from first fragment via eth_get_headlen	2016-02-24 13:58:05 -05:00
hsr
ieee802154	ieee802154: 6lowpan: fix return of netdev notifier	2016-02-23 20:29:40 +01:00
ipv4	tcp: rate limit ACK sent by SYN_RECV request sockets	2016-04-04 22:11:20 -04:00
ipv6	tcp: increment sk_drops for listeners	2016-04-04 22:11:20 -04:00
ipx
irda
iucv
kcm	kcm: Add receive message timeout	2016-03-09 16:36:15 -05:00
key
l2tp	sock: enable timestamping using control messages	2016-04-04 15:50:30 -04:00
l3mdev	net: l3mdev: address selection should only consider devices in L3 domain	2016-02-26 14:22:26 -05:00
lapb
llc
mac80211	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-03-08 12:34:12 -05:00
mac802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2016-03-19 10:05:34 -07:00
mpls
netfilter	tcp/dccp: do not touch listener sk_refcnt under synflood	2016-04-04 22:11:20 -04:00
netlabel	netlabel: do not initialise statics to NULL	2016-03-07 11:08:26 -05:00
netlink	netlink: add support for NIC driver ioctls	2016-03-22 15:45:44 -04:00
netrom
nfc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2016-03-19 10:05:34 -07:00
openvswitch	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2016-03-28 15:38:59 -04:00
packet	sock: enable timestamping using control messages	2016-04-04 15:50:30 -04:00
phonet
rds	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2016-03-19 10:05:34 -07:00
rfkill	Here's another round of updates for -next:	2016-03-01 17:03:27 -05:00
rose
rxrpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2016-03-19 10:05:34 -07:00
sched	cls_bpf: reset class and reuse major in da	2016-03-18 19:35:21 -04:00
sctp	sctp: really allow using GFP_KERNEL on sctp_packet_transmit	2016-03-30 15:41:22 -04:00
sunrpc	Various bugfixes, a RDMA update from Chuck Lever, and support for a new	2016-03-24 10:41:00 -07:00
switchdev	switchdev: fix typo in comments/doc	2016-03-24 14:51:24 -04:00
tipc	tipc: make sure IPv6 header fits in skb headroom	2016-03-14 12:23:12 -04:00
unix	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-02-23 00:09:14 -05:00
vmw_vsock	AF_VSOCK: Shrink the area influenced by prepare_to_wait	2016-03-22 16:18:41 -04:00
wimax
wireless	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2016-03-19 10:05:34 -07:00
x25
xfrm	xfrm: Fix crash observed during device unregistration and decryption	2016-03-24 14:29:36 -04:00
compat.c
Kconfig	Make DST_CACHE a silent config option	2016-03-21 22:56:38 -04:00
Makefile	kcm: Kernel Connection Multiplexor module	2016-03-09 16:36:14 -05:00
socket.c	sock: enable timestamping using control messages	2016-04-04 15:50:30 -04:00
sysctl_net.c