Re: SYN cookies security bugfix?

[Gianni Tedesco <gianni@ecsc.co.uk>]

[-- Attachment #1: Type: text/plain, Size: 604 bytes --]

On Thu, 2001-11-08 at 05:20, B. James Phillippe wrote:
> Hello,
> 
> I received a forwarded message from SuSE regarding a security vulnerability
> with respect to randomization of the ISN for SYN cookies - or something to
> that effect.  I have not been able to find the patch which addresses this
> problem; if anyone can point me towards it, I would be appreciative.

Hi,

Think this is the patch you want - (backported it from 2.4.14 to 2.4.9).

-- 
// Gianni Tedesco <gianni@ecsc.co.uk>
"Every great advance in natural knowledge has involved
the absolute rejection of authority." -- Thomas H. Huxley

[-- Attachment #2: syncookie-fix.diff --]
[-- Type: text/x-patch, Size: 2571 bytes --]

diff -urN linux.orig/include/net/sock.h linux/include/net/sock.h
--- linux.orig/include/net/sock.h	Wed Aug 15 22:21:32 2001
+++ linux/include/net/sock.h	Wed Nov  7 14:24:36 2001
@@ -416,6 +416,8 @@
 	unsigned int		keepalive_time;	  /* time before keep alive takes place */
 	unsigned int		keepalive_intvl;  /* time interval between keep alive probes */
 	int			linger2;
+
+	unsigned long		last_synq_overflow;
 };
 
  	
diff -urN linux.orig/net/ipv4/syncookies.c linux/net/ipv4/syncookies.c
--- linux.orig/net/ipv4/syncookies.c	Wed May 16 18:31:27 2001
+++ linux/net/ipv4/syncookies.c	Wed Nov  7 14:23:54 2001
@@ -9,7 +9,7 @@
  *      as published by the Free Software Foundation; either version
  *      2 of the License, or (at your option) any later version.
  * 
- *  $Id: syncookies.c,v 1.14 2001/05/05 01:01:55 davem Exp $
+ *  $Id: syncookies.c,v 1.17 2001/10/26 14:55:41 davem Exp $
  *
  *  Missing: IPv6 support. 
  */
@@ -23,8 +23,6 @@
 
 extern int sysctl_tcp_syncookies;
 
-static unsigned long tcp_lastsynq_overflow;
-
 /* 
  * This table has to be sorted and terminated with (__u16)-1.
  * XXX generate a better table.
@@ -53,7 +51,9 @@
 	int mssind;
 	const __u16 mss = *mssp;
 
-	tcp_lastsynq_overflow = jiffies;
+	
+	sk->tp_pinfo.af_tcp.last_synq_overflow = jiffies;
+
 	/* XXX sort msstab[] by probability?  Binary search? */
 	for (mssind = 0; mss > msstab[mssind + 1]; mssind++)
 		;
@@ -78,14 +78,11 @@
  * Check if a ack sequence number is a valid syncookie. 
  * Return the decoded mss if it is, or 0 if not.
  */
-static inline int cookie_check(struct sk_buff *skb, __u32 cookie) 
+static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
 {
 	__u32 seq; 
 	__u32 mssind;
 
-  	if ((jiffies - tcp_lastsynq_overflow) > TCP_TIMEOUT_INIT)
-		return 0; 
-
 	seq = ntohl(skb->h.th->seq)-1; 
 	mssind = check_tcp_syn_cookie(cookie,
 				      skb->nh.iph->saddr, skb->nh.iph->daddr,
@@ -126,8 +123,8 @@
 	if (!sysctl_tcp_syncookies || !skb->h.th->ack)
 		goto out;
 
-	mss = cookie_check(skb, cookie);
-	if (!mss) {
+  	if (time_after(jiffies, sk->tp_pinfo.af_tcp.last_synq_overflow + TCP_TIMEOUT_INIT) ||
+	    (mss = cookie_check(skb, cookie)) == 0) {
 	 	NET_INC_STATS_BH(SyncookiesFailed);
 		goto out;
 	}
@@ -178,7 +175,7 @@
 			    opt && 
 			    opt->srr ? opt->faddr : req->af.v4_req.rmt_addr,
 			    req->af.v4_req.loc_addr,
-			    sk->protinfo.af_inet.tos | RTO_CONN,
+			    RT_CONN_FLAGS(sk),
 			    0)) { 
 		tcp_openreq_free(req);
 		goto out;