davidlt/kernel-ark
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
29cee56c0b
kernel-ark/net/ipv6
History
Eric Dumazet 84b114b984 tcp: randomize timestamps on syncookies 
Whole point of randomization was to hide server uptime, but an attacker
can simply start a syn flood and TCP generates 'old style' timestamps,
directly revealing server jiffies value.

Also, TSval sent by the server to a particular remote address vary
depending on syncookies being sent or not, potentially triggering PAWS
drops for innocent clients.

Lets implement proper randomization, including for SYNcookies.

Also we do not need to export sysctl_tcp_timestamps, since it is not
used from a module.

In v2, I added Florian feedback and contribution, adding tsoff to
tcp_get_cookie_sock().

v3 removed one unused variable in tcp_v4_connect() as Florian spotted.

Fixes: 95a22caee3 ("tcp: randomize tcp timestamp offsets for each connection")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Tested-by: Florian Westphal <fw@strlen.de>
Cc: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-05-05 12:00:11 -04:00
..
ila netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
netfilter Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 2017-05-03 10:11:26 -04:00
addrconf_core.c
addrconf.c ipv6: initialize route null entry in addrconf_init() 2017-05-04 12:51:24 -04:00
addrlabel.c net: rtnetlink: plumb extended ack to doit function 2017-04-17 15:35:38 -04:00
af_inet6.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-04-26 22:39:08 -04:00
ah6.c IPsec: do not ignore crypto err in ah6 input 2017-01-16 12:57:48 +01:00
anycast.c
calipso.c
datagram.c net-timestamp: avoid use-after-free in ip_recv_error 2017-04-17 12:59:22 -04:00
esp6_offload.c esp4/6: Fix GSO path for non-GSO SW-crypto packets 2017-04-19 07:48:57 +02:00
esp6.c esp: Fix misplaced spin_unlock_bh. 2017-04-24 07:56:31 +02:00
exthdrs_core.c
exthdrs_offload.c
exthdrs.c ipv6: Need to export ipv6_push_frag_opts for tunneling now. 2017-05-01 15:10:20 -04:00
fib6_rules.c
fou6.c
icmp.c net: for rate-limited ICMP replies save one atomic operation 2017-01-09 15:49:12 -05:00
inet6_connection_sock.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-01-28 10:33:06 -05:00
inet6_hashtables.c inet: collapse ipv4/v6 rcv_saddr_equal functions into one 2017-01-18 13:04:28 -05:00
ip6_checksum.c
ip6_fib.c ipv6: make ECMP route replacement less greedy 2017-03-13 12:16:17 -07:00
ip6_flowlabel.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
ip6_gre.c ip6_tunnel: Allow policy-based routing through tunnels 2017-04-21 13:21:30 -04:00
ip6_icmp.c
ip6_input.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-04-20 10:35:33 -04:00
ip6_offload.c net/tunnel: set inner protocol in network gro hooks 2017-03-09 13:19:52 -08:00
ip6_offload.h
ip6_output.c ipv6: avoid write to a possibly cloned skb 2017-03-13 12:53:35 -07:00
ip6_tunnel.c ip6_tunnel: Fix missing tunnel encapsulation limit option 2017-05-01 14:52:45 -04:00
ip6_udp_tunnel.c
ip6_vti.c ip6_tunnel: Allow policy-based routing through tunnels 2017-04-21 13:21:30 -04:00
ip6mr.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-04-21 20:23:53 -07:00
ipcomp6.c
ipv6_sockglue.c net: Allow IP_MULTICAST_IF to set index to L3 slave 2016-12-30 15:24:47 -05:00
Kconfig ipv6: sr: select DST_CACHE by default 2017-03-27 16:05:06 -07:00
Makefile esp: Add a software GRO codepath 2017-02-15 11:04:11 +01:00
mcast_snoop.c
mcast.c ipv6: add support for NETDEV_RESEND_IGMP event 2017-03-28 22:02:21 -07:00
mip6.c ktime: Get rid of ktime_equal() 2016-12-25 17:21:23 +01:00
ndisc.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-04-26 22:39:08 -04:00
netfilter.c
output_core.c
ping.c ipv6: remove unnecessary inet6_sk check 2016-12-29 12:05:49 -05:00
proc.c
protocol.c net: Add sysctl to toggle early demux for tcp and udp 2017-03-24 13:17:07 -07:00
raw.c ipv4, ipv6: ensure raw socket message is big enough to hold an IP header 2017-05-04 11:02:46 -04:00
reassembly.c
route.c ipv6: initialize route null entry in addrconf_init() 2017-05-04 12:51:24 -04:00
seg6_hmac.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-02-07 16:29:30 -05:00
seg6_iptunnel.c ipv6: sr: fix BUG due to headroom too small after SRH push 2017-04-17 15:33:53 -04:00
seg6.c ipv6: sr: fix out-of-bounds access in SRH validation 2017-04-20 15:40:33 -04:00
sit.c ip_tunnel: Allow policy-based routing through tunnels 2017-04-21 13:21:31 -04:00
syncookies.c tcp: randomize timestamps on syncookies 2017-05-05 12:00:11 -04:00
sysctl_net_ipv6.c
tcp_ipv6.c tcp: randomize timestamps on syncookies 2017-05-05 12:00:11 -04:00
tcpv6_offload.c
tunnel6.c
udp_impl.h
udp_offload.c
udp.c net: ipv6: Fix UDP early demux lookup with udp_l3mdev_accept=0 2017-04-20 15:50:27 -04:00
udplite.c
xfrm6_input.c esp: Add a software GRO codepath 2017-02-15 11:04:11 +01:00
xfrm6_mode_beet.c
xfrm6_mode_ro.c
xfrm6_mode_transport.c xfrm: Add encapsulation header offsets while SKB is not encrypted 2017-04-14 10:07:39 +02:00
xfrm6_mode_tunnel.c xfrm: Add encapsulation header offsets while SKB is not encrypted 2017-04-14 10:07:39 +02:00
xfrm6_output.c xfrm: Add an IPsec hardware offloading API 2017-04-14 10:06:10 +02:00
xfrm6_policy.c xfrm: policy: make policy backend const 2017-02-09 10:22:19 +01:00
xfrm6_protocol.c xfrm: input: constify xfrm_input_afinfo 2017-02-09 10:22:17 +01:00
xfrm6_state.c
xfrm6_tunnel.c