Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1462337

[PATCH 3.14 28/29] [PATCH 1/8] tcp: make challenge acks less predictable

Show all headers | View raw

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 75ff39ccc1bd5d3c455b6822ab09e533c551f758 ]

Yue Cao claims that current host rate limiting of challenge ACKS
(RFC 5961) could leak enough information to allow a patient attacker
to hijack TCP sessions. He will soon provide details in an academic
paper.

This patch increases the default limit from 100 to 1000, and adds
some randomization so that the attacker can no longer hijack
sessions without spending a considerable amount of probes.

Based on initial analysis and patch from Linus.

Note that we also have per socket rate limiting, so it is tempting
to remove the host limit in the future.

v2: randomize the count of challenge acks per second, not the period.

Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2")
Reported-by: Yue Cao <ycao009@ucr.edu>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
 net/ipv4/tcp_input.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -87,7 +87,7 @@ int sysctl_tcp_adv_win_scale __read_most
 EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
 
 /* rfc5961 challenge ack rate limiting */
-int sysctl_tcp_challenge_ack_limit = 100;
+int sysctl_tcp_challenge_ack_limit = 1000;
 
 int sysctl_tcp_stdurg __read_mostly;
 int sysctl_tcp_rfc1337 __read_mostly;
@@ -3293,12 +3293,18 @@ static void tcp_send_challenge_ack(struc
 	static u32 challenge_timestamp;
 	static unsigned int challenge_count;
 	u32 now = jiffies / HZ;
+	u32 count;
 
 	if (now != challenge_timestamp) {
+		u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1;
+
 		challenge_timestamp = now;
-		challenge_count = 0;
+		challenge_count = half +
+				  prandom_u32_max(sysctl_tcp_challenge_ack_limit);
 	}
-	if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
+	count = challenge_count;
+	if (count > 0) {
+		challenge_count = count - 1;
 		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
 		tcp_send_ack(sk);
 	}

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.14 00/29] 3.14.76-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:10 +0200
  [PATCH 3.14 16/29] block: fix use-after-free in seq file Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:10 +0200
  [PATCH 3.14 02/29] mm: migrate dirty page without clear_page_dirty_for_io etc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:10 +0200
  [PATCH 3.14 10/29] KEYS: 64-bit MIPS needs to use compat_sys_keyctl for 32-bit userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:10 +0200
  [PATCH 3.14 09/29] arm: oabi compat: add missing access checks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:10 +0200
  [PATCH 3.14 12/29] random: strengthen input validation for RNDADDTOENTCNT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:10 +0200
  [PATCH 3.14 05/29] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:20 +0200
  [PATCH 3.14 25/29] bonding: set carrier off for devices created through netlink Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:20 +0200
  [PATCH 3.14 01/29] USB: fix invalid memory access in hub_activate() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:20 +0200
  [PATCH 3.14 22/29] ext4: fix deadlock during page writeback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:20 +0200
  [PATCH 3.14 24/29] ext4: short-cut orphan cleanup on error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:20 +0200
  [PATCH 3.14 28/29] [PATCH 1/8] tcp: make challenge acks less predictable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:20 +0200
  [PATCH 3.14 11/29] apparmor: fix ref count leak when profile sha1 hash is read Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:20 +0200
  [PATCH 3.14 19/29] crypto: gcm - Filter out async ghash if necessary Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:20 +0200
  Re: [PATCH 3.14 00/29] 3.14.76-stable review Guenter Roeck <linux@roeck-us.net> - 2016-08-15 16:50 +0200
  Re: [PATCH 3.14 00/29] 3.14.76-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-08-16 06:10 +0200

csiph-web