Merge branch 'for-3.20' of git://linux-nfs.org/~bfields/linux

[karo-tx-linux.git] / Documentation / networking / ip-sysctl.txt

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 85b0221791048aabb65bcee8090562384ab1c628..1b8c964b0d175c7d86d86896469650e5c59fa689 100644 (file)
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -290,6 +290,28 @@ tcp_frto - INTEGER
 
        By default it's enabled with a non-zero value. 0 disables F-RTO.
 
+tcp_invalid_ratelimit - INTEGER
+       Limit the maximal rate for sending duplicate acknowledgments
+       in response to incoming TCP packets that are for an existing
+       connection but that are invalid due to any of these reasons:
+
+         (a) out-of-window sequence number,
+         (b) out-of-window acknowledgment number, or
+         (c) PAWS (Protection Against Wrapped Sequence numbers) check failure
+
+       This can help mitigate simple "ack loop" DoS attacks, wherein
+       a buggy or malicious middlebox or man-in-the-middle can
+       rewrite TCP header fields in manner that causes each endpoint
+       to think that the other is sending invalid TCP segments, thus
+       causing each side to send an unterminating stream of duplicate
+       acknowledgments for invalid segments.
+
+       Using 0 disables rate-limiting of dupacks in response to
+       invalid segments; otherwise this value specifies the minimal
+       space between sending such dupacks, in milliseconds.
+
+       Default: 500 (milliseconds).
+
 tcp_keepalive_time - INTEGER
        How often TCP sends out keepalive messages when keepalive is enabled.
        Default: 2hours.
@@ -1287,6 +1309,13 @@ accept_ra_rtr_pref - BOOLEAN
        Functional default: enabled if accept_ra is enabled.
                            disabled if accept_ra is disabled.
 
+accept_ra_mtu - BOOLEAN
+       Apply the MTU value specified in RA option 5 (RFC4861). If
+       disabled, the MTU specified in the RA will be ignored.
+
+       Functional default: enabled if accept_ra is enabled.
+                           disabled if accept_ra is disabled.
+
 accept_redirects - BOOLEAN
        Accept Redirects.