diff options
| author | Eric Dumazet <edumazet@google.com> | 2021-02-09 11:20:28 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-06-25 11:45:19 +0200 |
| commit | 05a12e5c40635bb8b56fbb344f8fd6cbf97e748a (patch) | |
| tree | 99863b401138e58546712de49d0ea450ae2d5330 | |
| parent | 136b4799419a275155c74e8a637cefd8a0538321 (diff) | |
| download | linux-stable-05a12e5c40635bb8b56fbb344f8fd6cbf97e748a.tar.gz linux-stable-05a12e5c40635bb8b56fbb344f8fd6cbf97e748a.tar.bz2 linux-stable-05a12e5c40635bb8b56fbb344f8fd6cbf97e748a.zip | |
tcp: add some entropy in __inet_hash_connect()
commit c579bd1b4021c42ae247108f1e6f73dd3f08600c upstream.
Even when implementing RFC 6056 3.3.4 (Algorithm 4: Double-Hash
Port Selection Algorithm), a patient attacker could still be able
to collect enough state from an otherwise idle host.
Idea of this patch is to inject some noise, in the
cases __inet_hash_connect() found a candidate in the first
attempt.
This noise should not significantly reduce the collision
avoidance, and should be zero if connection table
is already well used.
Note that this is not implementing RFC 6056 3.3.5
because we think Algorithm 5 could hurt typical
workloads.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: David Dworken <ddworken@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/ipv4/inet_hashtables.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c index c3b5b579c704..6dc2afaa330f 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -642,6 +642,11 @@ next_port: return -EADDRNOTAVAIL; ok: + /* If our first attempt found a candidate, skip next candidate + * in 1/16 of cases to add some noise. + */ + if (!i && !(prandom_u32() % 16)) + i = 2; WRITE_ONCE(table_perturb[index], READ_ONCE(table_perturb[index]) + i + 2); /* Head lock still held and bh's disabled */ |