From patchwork Fri Aug 12 13:30:54 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tim Gardner X-Patchwork-Id: 658642 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 3s9m4g2LSyz9sCY; Fri, 12 Aug 2016 23:31:31 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical-com.20150623.gappssmtp.com header.i=@canonical-com.20150623.gappssmtp.com header.b=LrpZuWbc; dkim-atps=neutral Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1bYCYb-0003hU-CT; Fri, 12 Aug 2016 13:31:29 +0000 Received: from mail-pf0-f178.google.com ([209.85.192.178]) by huckleberry.canonical.com with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1bYCYG-0003Vz-Ed for kernel-team@lists.ubuntu.com; Fri, 12 Aug 2016 13:31:08 +0000 Received: by mail-pf0-f178.google.com with SMTP id y134so9320294pfg.0 for ; Fri, 12 Aug 2016 06:31:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical-com.20150623.gappssmtp.com; s=20150623; h=from:to:subject:date:message-id:in-reply-to:references; bh=eJw8zhdfaBoTZajtrXkSSV+21okyGdxM4xnSDpl7ti4=; b=LrpZuWbcl978hCiLvqf29kUkXy2kCpasFFhjJ5S3BHtLqVxAfiiUlk8VXLWPEL1z8J 2UeufJ64QpgYZTGVSvUuwHhaN34f+9C61Hjf3ggKc6W6CrCdteqT0WGIsZGcxlJ98OUG qkiv9/zPO1h+jaRipqQT6xGECEXrltj+DmQNU8yx/ugLnvLAJhxNvUCOPqcTilXPyPol B9RSYDn8jrSkL1V+SDg4JUhTW/LnF86FAEJ96J1pnlWrsfiHpY6FY5I0XIJmnztXTwlY xhWWQZ3Y/bvqCpJ2Y0XM1PeyQ3TonOa+LoqFipi+ojpGlWwXZw8oMpXyQBN8B/GmzBuN pJig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=eJw8zhdfaBoTZajtrXkSSV+21okyGdxM4xnSDpl7ti4=; b=iwa+I9UmCuW/lzUO0Lz6L+6yXCYfehfLE3DOeAtAC3O0r1jxnRP5QZIgKes94QK2Dl DWLbge625w3/0FjPer1Phf9OEpMwnMy9jLWg5t3Ti0gT6NLKHrssEBnthyl+keQUhGOo Ee6wRtRebwBVjlqIqP5Wf6/2QP2DRv4K5b5pNf8q3iHB4bYw3QxPfMXuZhVxPlHz9f8x DV+l8j9JSNS/qiu/2v6kXNX9MtyQjKe/noiMH4l4DP8dkDejY6ymzOb+r2wo+g3sPMZQ 0Bdi0Z+KnmjSmzL/cr5LbPqSSXxtqZopJ2HH3oic1nD3EixtsXC8ZETNCKqy07OokSP2 VBJw== X-Gm-Message-State: AEkoousmFK383vGh6OJ/2UWP1/YFq5E64fGQtR7nTebL2gRpwXolftX150oIUZZ5cjf2yVWG X-Received: by 10.98.20.201 with SMTP id 192mr27757301pfu.144.1471008666846; Fri, 12 Aug 2016 06:31:06 -0700 (PDT) Received: from localhost.localdomain (host-174-45-44-32.hln-mt.client.bresnan.net. [174.45.44.32]) by smtp.gmail.com with ESMTPSA id q26sm13270847pfj.53.2016.08.12.06.31.06 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 12 Aug 2016 06:31:06 -0700 (PDT) From: Tim Gardner To: kernel-team@lists.ubuntu.com Subject: [PATCH 4/4] tcp: make challenge acks less predictable Date: Fri, 12 Aug 2016 07:30:54 -0600 Message-Id: <1471008654-28755-5-git-send-email-tim.gardner@canonical.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1471008654-28755-1-git-send-email-tim.gardner@canonical.com> References: <56dc5289-a906-8574-8401-60291e63d2cc@canonical.com> <1471008654-28755-1-git-send-email-tim.gardner@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com From: Eric Dumazet Yue Cao claims that current host rate limiting of challenge ACKS (RFC 5961) could leak enough information to allow a patient attacker to hijack TCP sessions. He will soon provide details in an academic paper. This patch increases the default limit from 100 to 1000, and adds some randomization so that the attacker can no longer hijack sessions without spending a considerable amount of probes. Based on initial analysis and patch from Linus. Note that we also have per socket rate limiting, so it is tempting to remove the host limit in the future. v2: randomize the count of challenge acks per second, not the period. Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2") Reported-by: Yue Cao Signed-off-by: Eric Dumazet Suggested-by: Linus Torvalds Cc: Yuchung Cheng Cc: Neal Cardwell Acked-by: Neal Cardwell Acked-by: Yuchung Cheng Signed-off-by: David S. Miller CVE-2016-5696 (backported from commit 75ff39ccc1bd5d3c455b6822ab09e533c551f758 upstream) Signed-off-by: Stefan Bader Signed-off-by: Tim Gardner --- net/ipv4/tcp_input.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 2cc1313..1bf94fa 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -86,7 +86,7 @@ int sysctl_tcp_adv_win_scale __read_mostly = 1; EXPORT_SYMBOL(sysctl_tcp_adv_win_scale); /* rfc5961 challenge ack rate limiting */ -int sysctl_tcp_challenge_ack_limit = 100; +int sysctl_tcp_challenge_ack_limit = 1000; int sysctl_tcp_stdurg __read_mostly; int sysctl_tcp_rfc1337 __read_mostly; @@ -3288,17 +3288,25 @@ static void tcp_send_challenge_ack(struct sock *sk) /* unprotected vars, we dont care of overwrites */ static u32 challenge_timestamp; static unsigned int challenge_count; - u32 now = jiffies / HZ; + u32 count, now = jiffies / HZ; + /* Check host-wide RFC 5961 rate limit. */ if (now != challenge_timestamp) { + u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1; + challenge_timestamp = now; - challenge_count = 0; + *((volatile unsigned int *) &challenge_count) = + WRITE_ONCE(challenge_count, half + + prandom_u32_max(sysctl_tcp_challenge_ack_limit)); } - if (++challenge_count <= sysctl_tcp_challenge_ack_limit) { + count = ACCESS_ONCE(challenge_count); + if (count > 0) { + WRITE_ONCE(challenge_count, count - 1); NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK); tcp_send_ack(sk); } } +#undef WRITE_ONCE static void tcp_store_ts_recent(struct tcp_sock *tp) {