summaryrefslogtreecommitdiffstats
path: root/net/ipv6/syncookies.c
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2014-10-30 02:55:38 +0100
committerDavid S. Miller <davem@davemloft.net>2014-10-30 16:53:39 -0400
commit646697b9e3fef913bb6393ebfb6115c442a96be7 (patch)
treebaa2ad2fb7b968b1fec4f11d59949160f93938de /net/ipv6/syncookies.c
parentf5fbf115691c350f88bae103f629503e201a7bff (diff)
downloadlinux-646697b9e3fef913bb6393ebfb6115c442a96be7.tar.bz2
syncookies: only increment SYNCOOKIESFAILED on validation error
Only count packets that failed cookie-authentication. We can get SYNCOOKIESFAILED > 0 while we never even sent a single cookie. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/syncookies.c')
-rw-r--r--net/ipv6/syncookies.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 0e26e795b703..be291baa2ec2 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -171,8 +171,11 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
if (!sysctl_tcp_syncookies || !th->ack || th->rst)
goto out;
- if (tcp_synq_no_recent_overflow(sk) ||
- (mss = __cookie_v6_check(ipv6_hdr(skb), th, cookie)) == 0) {
+ if (tcp_synq_no_recent_overflow(sk))
+ goto out;
+
+ mss = __cookie_v6_check(ipv6_hdr(skb), th, cookie);
+ if (mss == 0) {
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
goto out;
}