Commit 25429d7b authored by Florian Westphal's avatar Florian Westphal Committed by David S. Miller

tcp: allow to turn tcp timestamp randomization off

Eric says: "By looking at tcpdump, and TS val of xmit packets of multiple
flows, we can deduct the relative qdisc delays (think of fq pacing).
This should work even if we have one flow per remote peer."

Having random per flow (or host) offsets doesn't allow that anymore so add
a way to turn this off.
Suggested-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Acked-by: default avatarYuchung Cheng <ycheng@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 95a22cae
...@@ -610,8 +610,13 @@ tcp_syn_retries - INTEGER ...@@ -610,8 +610,13 @@ tcp_syn_retries - INTEGER
with the current initial RTO of 1second. With this the final timeout with the current initial RTO of 1second. With this the final timeout
for an active TCP connection attempt will happen after 127seconds. for an active TCP connection attempt will happen after 127seconds.
tcp_timestamps - BOOLEAN tcp_timestamps - INTEGER
Enable timestamps as defined in RFC1323. Enable timestamps as defined in RFC1323.
0: Disabled.
1: Enable timestamps as defined in RFC1323 and use random offset for
each connection rather than only using the current time.
2: Like 1, but without random offsets.
Default: 1
tcp_min_tso_segs - INTEGER tcp_min_tso_segs - INTEGER
Minimal number of segments per TSO frame. Minimal number of segments per TSO frame.
......
...@@ -12,6 +12,7 @@ ...@@ -12,6 +12,7 @@
#include <net/secure_seq.h> #include <net/secure_seq.h>
#if IS_ENABLED(CONFIG_IPV6) || IS_ENABLED(CONFIG_INET) #if IS_ENABLED(CONFIG_IPV6) || IS_ENABLED(CONFIG_INET)
#include <net/tcp.h>
#define NET_SECRET_SIZE (MD5_MESSAGE_BYTES / 4) #define NET_SECRET_SIZE (MD5_MESSAGE_BYTES / 4)
static u32 net_secret[NET_SECRET_SIZE] ____cacheline_aligned; static u32 net_secret[NET_SECRET_SIZE] ____cacheline_aligned;
...@@ -58,7 +59,7 @@ u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr, ...@@ -58,7 +59,7 @@ u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
md5_transform(hash, secret); md5_transform(hash, secret);
*tsoff = hash[1]; *tsoff = sysctl_tcp_timestamps == 1 ? hash[1] : 0;
return seq_scale(hash[0]); return seq_scale(hash[0]);
} }
EXPORT_SYMBOL(secure_tcpv6_sequence_number); EXPORT_SYMBOL(secure_tcpv6_sequence_number);
...@@ -100,7 +101,7 @@ u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr, ...@@ -100,7 +101,7 @@ u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
md5_transform(hash, net_secret); md5_transform(hash, net_secret);
*tsoff = hash[1]; *tsoff = sysctl_tcp_timestamps == 1 ? hash[1] : 0;
return seq_scale(hash[0]); return seq_scale(hash[0]);
} }
......
...@@ -85,6 +85,7 @@ int sysctl_tcp_dsack __read_mostly = 1; ...@@ -85,6 +85,7 @@ int sysctl_tcp_dsack __read_mostly = 1;
int sysctl_tcp_app_win __read_mostly = 31; int sysctl_tcp_app_win __read_mostly = 31;
int sysctl_tcp_adv_win_scale __read_mostly = 1; int sysctl_tcp_adv_win_scale __read_mostly = 1;
EXPORT_SYMBOL(sysctl_tcp_adv_win_scale); EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
EXPORT_SYMBOL(sysctl_tcp_timestamps);
/* rfc5961 challenge ack rate limiting */ /* rfc5961 challenge ack rate limiting */
int sysctl_tcp_challenge_ack_limit = 1000; int sysctl_tcp_challenge_ack_limit = 1000;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment