Patch "secure_seq: downgrade to per-host timestamp offsets" has been added to the 4.10-stable tree

PATCH [email protected] 1 participant 1 message Apr 29, 2017

Subsystems (2)

Networking Stable branch

lore

Share & tools

lore

[email protected]

author maintainer Applied

2017-04-29 06:25 UTC #0 lore raw

This is a note to let you know that I've just added the patch titled

secure_seq: downgrade to per-host timestamp offsets

to the 4.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
secure_seq-downgrade-to-per-host-timestamp-offsets.patch
and it can be found in the queue-4.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From foo@baz Sat Apr 29 08:22:40 CEST 2017

From: Florian Westphal <[email protected]>
Date: Sat, 25 Mar 2017 10:58:24 +0100
Subject: secure_seq: downgrade to per-host timestamp offsets

From: Florian Westphal <[email protected]>

[ Upstream commit 28ee1b746f493b7c62347d714f58fbf4f70df4f0 ]

Unfortunately too many devices (not under our control) use tcp_tw_recycle=1, which depends on timestamps being identical of the same saddr.

Although tcp_tw_recycle got removed in net-next we can't make such end hosts disappear so downgrade to per-host timestamp offsets.

4.10 note: original patch uses siphash (added in 4.11), since ts_off is only used to obscure uptime (and doesn't use same secret as isn generator) this uses jhash instead.

Cc Soheil Hassas Yeganeh <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Neal Cardwell <[email protected]>

Cc Yuchung Cheng <[email protected]>

Reported-by Yvan Vanrossomme <[email protected]>

Fixes 95a22caee396c ("tcp: randomize tcp timestamp offsets for each connection")

Signed-off-by Florian Westphal <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 net/core/secure_seq.c |   29 +++++++++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

net/core/secure_seq.c +27 -2

@@ -16,9 +16,11 @@
 #define NET_SECRET_SIZE (MD5_MESSAGE_BYTES / 4)
 
 static u32 net_secret[NET_SECRET_SIZE] ____cacheline_aligned;
+static u32 ts_secret[2];
 
 static __always_inline void net_secret_init(void)
 {
+	net_get_random_once(ts_secret, sizeof(ts_secret));
 	net_get_random_once(net_secret, sizeof(net_secret));
 }
 #endif

@@ -41,6 +43,21 @@ static u32 seq_scale(u32 seq)
 #endif
 
 #if IS_ENABLED(CONFIG_IPV6)
+static u32 secure_tcpv6_ts_off(const __be32 *saddr, const __be32 *daddr)
+{
+	u32 hash[4 + 4 + 1];
+
+	if (sysctl_tcp_timestamps != 1)
+		return 0;
+
+	memcpy(hash, saddr, 16);
+	memcpy(hash + 4, daddr, 16);
+
+	hash[8] = ts_secret[0];
+
+	return jhash2(hash, ARRAY_SIZE(hash), ts_secret[1]);
+}
+
 u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
 				 __be16 sport, __be16 dport, u32 *tsoff)
 {

@@ -59,7 +76,7 @@ u32 secure_tcpv6_sequence_number(const _
 
 	md5_transform(hash, secret);
 
-	*tsoff = sysctl_tcp_timestamps == 1 ? hash[1] : 0;
+	*tsoff = secure_tcpv6_ts_off(saddr, daddr);
 	return seq_scale(hash[0]);
 }
 EXPORT_SYMBOL(secure_tcpv6_sequence_number);

@@ -87,6 +104,14 @@ EXPORT_SYMBOL(secure_ipv6_port_ephemeral
 #endif
 
 #ifdef CONFIG_INET
+static u32 secure_tcp_ts_off(__be32 saddr, __be32 daddr)
+{
+	if (sysctl_tcp_timestamps != 1)
+		return 0;
+
+	return jhash_3words((__force u32)saddr, (__force u32)daddr,
+			    ts_secret[0], ts_secret[1]);
+}
 
 u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
 			       __be16 sport, __be16 dport, u32 *tsoff)

@@ -101,7 +126,7 @@ u32 secure_tcp_sequence_number(__be32 sa
 
 	md5_transform(hash, net_secret);
 
-	*tsoff = sysctl_tcp_timestamps == 1 ? hash[1] : 0;
+	*tsoff = secure_tcp_ts_off(saddr, daddr);
 	return seq_scale(hash[0]);
 }

Patches currently in stable-queue which might be from [email protected] are

queue-4.10/secure_seq-downgrade-to-per-host-timestamp-offsets.patch