Commit 646697b9 authored by Florian Westphal's avatar Florian Westphal Committed by David S. Miller
Browse files

syncookies: only increment SYNCOOKIESFAILED on validation error 



Only count packets that failed cookie-authentication.
We can get SYNCOOKIESFAILED > 0 while we never even sent a single cookie.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f5fbf115

net/ipv4/syncookies.c

+5 −2
Original line number Diff line number Diff line
@@ -275,8 +275,11 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb) 
	if (!sysctl_tcp_syncookies || !th->ack || th->rst)

		goto out;



	if (tcp_synq_no_recent_overflow(sk) ||

	    (mss = __cookie_v4_check(ip_hdr(skb), th, cookie)) == 0) {

	if (tcp_synq_no_recent_overflow(sk))

		goto out;



	mss = __cookie_v4_check(ip_hdr(skb), th, cookie);

	if (mss == 0) {

		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);

		goto out;

	}

net/ipv6/syncookies.c

+5 −2
Original line number Diff line number Diff line
@@ -171,8 +171,11 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) 
	if (!sysctl_tcp_syncookies || !th->ack || th->rst)

		goto out;



	if (tcp_synq_no_recent_overflow(sk) ||

		(mss = __cookie_v6_check(ipv6_hdr(skb), th, cookie)) == 0) {

	if (tcp_synq_no_recent_overflow(sk))

		goto out;



	mss = __cookie_v6_check(ipv6_hdr(skb), th, cookie);

	if (mss == 0) {

		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);

		goto out;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE