[PATCH net 0/4] Mitigate a side channel in routing exception caches

[Ido Schimmel <idosch@nvidia.com>]

When an ICMP error that quotes a UDP packet is locally delivered, the
kernel only creates a routing exception if the quoted packet matches a
socket. This allows an off-path attacker to conduct a side-channel
attack on the routing exception caches in order to discover the
ephemeral ports used by connected UDP sockets.

Previous mitigations tried to make it harder for attackers to find hash
collisions in these caches and make the eviction of exceptions less
predictable. Amit Klein and Noam Caspi demonstrated that both of these
mitigations can be bypassed.

This patchset tries to mitigate such attacks by always creating an
exception, even if UDP socket matching failed. The exception is created
by the same helpers that are used when the quoted packet did not
originate from a socket, so that neither the occupancy of the cache nor
the contents of the exception are indicative of the success or failure
of UDP socket matching.

Note that this mitigation does not make it easier for attackers to fill
these caches, since they can already create exceptions with little to no
validation. For example, by sending an ICMP error that quotes an ICMP
Echo Reply or one that quotes a UDP source port that matches a wildcard
socket.

Patch #1 fixes a pre-existing bug in the handling of ICMPv6 Redirect
Message packets. Discovered while writing the selftest.

Patch #2 creates an exception from the IPv4 UDP code when socket
matching failed. Other socket types do not need this: raw sockets have
no ports, and for TCP the ICMP error is discarded unless the quoted
sequence number is in window.

Patch #3 does the same for IPv6.

Patch #4 adds a selftest.

Ido Schimmel (4):
  ipv6: Fix redirect exception creation for UDP/RAW sockets
  ipv4: udp: Create exceptions when socket matching failed
  ipv6: udp: Create exceptions when socket matching failed
  selftests: net: Add exception cache tests

 net/ipv4/route.c                              |   8 +-
 net/ipv4/udp.c                                |  10 +
 net/ipv6/route.c                              |   2 +-
 net/ipv6/udp.c                                |  17 +-
 tools/testing/selftests/net/Makefile          |   1 +
 .../testing/selftests/net/exception_cache.sh  | 501 ++++++++++++++++++
 6 files changed, 534 insertions(+), 5 deletions(-)
 create mode 100755 tools/testing/selftests/net/exception_cache.sh

-- 
2.55.0