From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:39884 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1166305AbdD2GZG (ORCPT ); Sat, 29 Apr 2017 02:25:06 -0400 Subject: Patch "secure_seq: downgrade to per-host timestamp offsets" has been added to the 4.10-stable tree To: fw@strlen.de, davem@davemloft.net, edumazet@google.com, gregkh@linuxfoundation.org, ncardwell@google.com, soheil@google.com, ycheng@google.com, yvan@vanrossomme.net Cc: , From: Date: Sat, 29 Apr 2017 08:23:29 +0200 Message-ID: <1493447009113147@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled secure_seq: downgrade to per-host timestamp offsets to the 4.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: secure_seq-downgrade-to-per-host-timestamp-offsets.patch and it can be found in the queue-4.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Sat Apr 29 08:22:40 CEST 2017 From: Florian Westphal Date: Sat, 25 Mar 2017 10:58:24 +0100 Subject: secure_seq: downgrade to per-host timestamp offsets From: Florian Westphal [ Upstream commit 28ee1b746f493b7c62347d714f58fbf4f70df4f0 ] Unfortunately too many devices (not under our control) use tcp_tw_recycle=1, which depends on timestamps being identical of the same saddr. Although tcp_tw_recycle got removed in net-next we can't make such end hosts disappear so downgrade to per-host timestamp offsets. 4.10 note: original patch uses siphash (added in 4.11), since ts_off is only used to obscure uptime (and doesn't use same secret as isn generator) this uses jhash instead. Cc: Soheil Hassas Yeganeh Cc: Eric Dumazet Cc: Neal Cardwell Cc: Yuchung Cheng Reported-by: Yvan Vanrossomme Fixes: 95a22caee396c ("tcp: randomize tcp timestamp offsets for each connection") Signed-off-by: Florian Westphal Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/core/secure_seq.c | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) --- a/net/core/secure_seq.c +++ b/net/core/secure_seq.c @@ -16,9 +16,11 @@ #define NET_SECRET_SIZE (MD5_MESSAGE_BYTES / 4) static u32 net_secret[NET_SECRET_SIZE] ____cacheline_aligned; +static u32 ts_secret[2]; static __always_inline void net_secret_init(void) { + net_get_random_once(ts_secret, sizeof(ts_secret)); net_get_random_once(net_secret, sizeof(net_secret)); } #endif @@ -41,6 +43,21 @@ static u32 seq_scale(u32 seq) #endif #if IS_ENABLED(CONFIG_IPV6) +static u32 secure_tcpv6_ts_off(const __be32 *saddr, const __be32 *daddr) +{ + u32 hash[4 + 4 + 1]; + + if (sysctl_tcp_timestamps != 1) + return 0; + + memcpy(hash, saddr, 16); + memcpy(hash + 4, daddr, 16); + + hash[8] = ts_secret[0]; + + return jhash2(hash, ARRAY_SIZE(hash), ts_secret[1]); +} + u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr, __be16 sport, __be16 dport, u32 *tsoff) { @@ -59,7 +76,7 @@ u32 secure_tcpv6_sequence_number(const _ md5_transform(hash, secret); - *tsoff = sysctl_tcp_timestamps == 1 ? hash[1] : 0; + *tsoff = secure_tcpv6_ts_off(saddr, daddr); return seq_scale(hash[0]); } EXPORT_SYMBOL(secure_tcpv6_sequence_number); @@ -87,6 +104,14 @@ EXPORT_SYMBOL(secure_ipv6_port_ephemeral #endif #ifdef CONFIG_INET +static u32 secure_tcp_ts_off(__be32 saddr, __be32 daddr) +{ + if (sysctl_tcp_timestamps != 1) + return 0; + + return jhash_3words((__force u32)saddr, (__force u32)daddr, + ts_secret[0], ts_secret[1]); +} u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport, u32 *tsoff) @@ -101,7 +126,7 @@ u32 secure_tcp_sequence_number(__be32 sa md5_transform(hash, net_secret); - *tsoff = sysctl_tcp_timestamps == 1 ? hash[1] : 0; + *tsoff = secure_tcp_ts_off(saddr, daddr); return seq_scale(hash[0]); } Patches currently in stable-queue which might be from fw@strlen.de are queue-4.10/secure_seq-downgrade-to-per-host-timestamp-offsets.patch