mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-24 17:59:32 +00:00
tcp: drop SYN+FIN messages
Denys Fedoryshchenko reported that SYN+FIN attacks were bringing his linux machines to their limits. Dont call conn_request() if the TCP flags includes SYN flag Reported-by: Denys Fedoryshchenko <denys@visp.net.lb> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
78a8a36fe0
commit
fdf5af0daf
1 changed files with 2 additions and 0 deletions
|
@ -5811,6 +5811,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
|
||||||
goto discard;
|
goto discard;
|
||||||
|
|
||||||
if (th->syn) {
|
if (th->syn) {
|
||||||
|
if (th->fin)
|
||||||
|
goto discard;
|
||||||
if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
|
if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
|
||||||
return 1;
|
return 1;
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue