CVE-XXXX-XXX DoS due to routing packets to too many different dsts/too fast (rhbz 1183744 1188347)
This commit is contained in:
Josh Boyer
parent
fcfe0d2e1f
commit
586c0b53da
|
|
@ -0,0 +1,99 @@
|
|||
From: Hannes Frederic Sowa <hannes@stressinduktion.org>
|
||||
Date: Fri, 23 Jan 2015 12:01:26 +0100
|
||||
Subject: [PATCH] ipv4: try to cache dst_entries which would cause a redirect
|
||||
|
||||
Not caching dst_entries which cause redirects could be exploited by hosts
|
||||
on the same subnet, causing a severe DoS attack. This effect aggravated
|
||||
since commit f88649721268999 ("ipv4: fix dst race in sk_dst_get()").
|
||||
|
||||
Lookups causing redirects will be allocated with DST_NOCACHE set which
|
||||
will force dst_release to free them via RCU. Unfortunately waiting for
|
||||
RCU grace period just takes too long, we can end up with >1M dst_entries
|
||||
waiting to be released and the system will run OOM. rcuos threads cannot
|
||||
catch up under high softirq load.
|
||||
|
||||
Attaching the flag to emit a redirect later on to the specific skb allows
|
||||
us to cache those dst_entries thus reducing the pressure on allocation
|
||||
and deallocation.
|
||||
|
||||
This issue was discovered by Marcelo Leitner.
|
||||
|
||||
Cc: Julian Anastasov <ja@ssi.bg>
|
||||
Signed-off-by: Marcelo Leitner <mleitner@redhat.com>
|
||||
Signed-off-by: Florian Westphal <fw@strlen.de>
|
||||
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
|
||||
Signed-off-by: Julian Anastasov <ja@ssi.bg>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
include/net/ip.h | 11 ++++++-----
|
||||
net/ipv4/ip_forward.c | 3 ++-
|
||||
net/ipv4/route.c | 9 +++++----
|
||||
3 files changed, 13 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/include/net/ip.h b/include/net/ip.h
|
||||
index 0bb620702929..f7cbd703d15d 100644
|
||||
--- a/include/net/ip.h
|
||||
+++ b/include/net/ip.h
|
||||
@@ -39,11 +39,12 @@ struct inet_skb_parm {
|
||||
struct ip_options opt; /* Compiled IP options */
|
||||
unsigned char flags;
|
||||
|
||||
-#define IPSKB_FORWARDED 1
|
||||
-#define IPSKB_XFRM_TUNNEL_SIZE 2
|
||||
-#define IPSKB_XFRM_TRANSFORMED 4
|
||||
-#define IPSKB_FRAG_COMPLETE 8
|
||||
-#define IPSKB_REROUTED 16
|
||||
+#define IPSKB_FORWARDED BIT(0)
|
||||
+#define IPSKB_XFRM_TUNNEL_SIZE BIT(1)
|
||||
+#define IPSKB_XFRM_TRANSFORMED BIT(2)
|
||||
+#define IPSKB_FRAG_COMPLETE BIT(3)
|
||||
+#define IPSKB_REROUTED BIT(4)
|
||||
+#define IPSKB_DOREDIRECT BIT(5)
|
||||
|
||||
u16 frag_max_size;
|
||||
};
|
||||
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
|
||||
index 3a83ce5efa80..787b3c294ce6 100644
|
||||
--- a/net/ipv4/ip_forward.c
|
||||
+++ b/net/ipv4/ip_forward.c
|
||||
@@ -129,7 +129,8 @@ int ip_forward(struct sk_buff *skb)
|
||||
* We now generate an ICMP HOST REDIRECT giving the route
|
||||
* we calculated.
|
||||
*/
|
||||
- if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb_sec_path(skb))
|
||||
+ if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr &&
|
||||
+ !skb_sec_path(skb))
|
||||
ip_rt_send_redirect(skb);
|
||||
|
||||
skb->priority = rt_tos2priority(iph->tos);
|
||||
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
|
||||
index 6a2155b02602..d58dd0ec3e53 100644
|
||||
--- a/net/ipv4/route.c
|
||||
+++ b/net/ipv4/route.c
|
||||
@@ -1554,11 +1554,10 @@ static int __mkroute_input(struct sk_buff *skb,
|
||||
|
||||
do_cache = res->fi && !itag;
|
||||
if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
|
||||
+ skb->protocol == htons(ETH_P_IP) &&
|
||||
(IN_DEV_SHARED_MEDIA(out_dev) ||
|
||||
- inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) {
|
||||
- flags |= RTCF_DOREDIRECT;
|
||||
- do_cache = false;
|
||||
- }
|
||||
+ inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
|
||||
+ IPCB(skb)->flags |= IPSKB_DOREDIRECT;
|
||||
|
||||
if (skb->protocol != htons(ETH_P_IP)) {
|
||||
/* Not IP (i.e. ARP). Do not create route, if it is
|
||||
@@ -2303,6 +2302,8 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
|
||||
r->rtm_flags = (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
|
||||
if (rt->rt_flags & RTCF_NOTIFY)
|
||||
r->rtm_flags |= RTM_F_NOTIFY;
|
||||
+ if (IPCB(skb)->flags & IPSKB_DOREDIRECT)
|
||||
+ r->rtm_flags |= RTCF_DOREDIRECT;
|
||||
|
||||
if (nla_put_be32(skb, RTA_DST, dst))
|
||||
goto nla_put_failure;
|
||||
--
|
||||
2.1.0
|
||||
|
||||
|
|
@ -750,6 +750,9 @@ Patch30000: kernel-arm64.patch
|
|||
# Fix for big-endian arches, already upstream
|
||||
Patch30001: mpssd-x86-only.patch
|
||||
|
||||
# rhbz 1183744 1188347
|
||||
Patch30002: ipv4-try-to-cache-dst_entries-which-would-cause-a-re.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%endif
|
||||
|
|
@ -1463,6 +1466,9 @@ ApplyPatch acpi-video-Add-disable_native_backlight-quirk-for-Sa.patch
|
|||
# Fix for big-endian arches, already upstream
|
||||
ApplyPatch mpssd-x86-only.patch
|
||||
|
||||
# rhbz 1183744 1188347
|
||||
ApplyPatch ipv4-try-to-cache-dst_entries-which-would-cause-a-re.patch
|
||||
|
||||
%if 0%{?aarch64patches}
|
||||
ApplyPatch kernel-arm64.patch
|
||||
%ifnarch aarch64 # this is stupid, but i want to notice before secondary koji does.
|
||||
|
|
@ -2281,6 +2287,9 @@ fi
|
|||
# ||----w |
|
||||
# || ||
|
||||
%changelog
|
||||
* Mon Feb 02 2015 Josh Boyer <jwboyer@fedoraproject.org>
|
||||
- CVE-XXXX-XXX DoS due to routing packets to too many different dsts/too fast (rhbz 1183744 1188347)
|
||||
|
||||
* Fri Jan 30 2015 Justin M. Forbes <jforbes@fedoraproject.org> - 3.18.5-100
|
||||
- Linux v3.18.5
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue