This series introduces a new tcp_timestamps=2 mode. When enabled, out-of-order packets that carry data are also subject to a range check of TSecr (timestamp echo).
Current kernels use a global timestamp echo, i.e. the timestamp values are known. Therefore first patch adds per connection randomzation of timestamp. The ISN generator is re-used for this purpose to get same offset for all connections with identical connection quadruple. Second patch adds the new timestamp mode, default is not changed. Third patch adds a MIB counter to track when we drop skb because of the new facility. Syncookies are not yet converted to use tsoff. Depending on how discussion about this set will turn out I will add this for the v1 submit. Documentation/networking/ip-sysctl.txt | 8 ++++-- include/linux/tcp.h | 1 include/net/secure_seq.h | 13 ++++++--- include/net/tcp.h | 2 - include/uapi/linux/snmp.h | 1 net/core/secure_seq.c | 19 +++++++++----- net/ipv4/proc.c | 1 net/ipv4/syncookies.c | 1 net/ipv4/tcp_input.c | 43 ++++++++++++++++++++++++++++++++- net/ipv4/tcp_ipv4.c | 30 +++++++++++++++-------- net/ipv4/tcp_minisocks.c | 4 ++- net/ipv4/tcp_output.c | 2 - net/ipv6/syncookies.c | 1 net/ipv6/tcp_ipv6.c | 28 +++++++++++++-------- 14 files changed, 118 insertions(+), 36 deletions(-)
