From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <stable-owner@vger.kernel.org>
Received: from wtarreau.pck.nerim.net ([62.212.114.60]:44393 "EHLO 1wt.eu"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1752329AbcHPVny (ORCPT <rfc822;stable@vger.kernel.org>);
	Tue, 16 Aug 2016 17:43:54 -0400
Date: Tue, 16 Aug 2016 23:43:45 +0200
From: Willy Tarreau <w@1wt.eu>
To: "Charles (Chas) Williams" <ciwillia@brocade.com>
Cc: stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
	Yuchung Cheng <ycheng@google.com>,
	Neal Cardwell <ncardwell@google.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: Re: [PATCH v3 3.10.y] tcp: make challenge acks less predictable
Message-ID: <20160816214345.GA16017@1wt.eu>
References: <1471380611-22214-1-git-send-email-ciwillia@brocade.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1471380611-22214-1-git-send-email-ciwillia@brocade.com>
Sender: stable-owner@vger.kernel.org
List-ID: <stable.vger.kernel.org>

On Tue, Aug 16, 2016 at 04:50:11PM -0400, Charles (Chas) Williams wrote:
> From: Eric Dumazet <edumazet@google.com>
> 
> [ Upstream commit 75ff39ccc1bd5d3c455b6822ab09e533c551f758 ]
> 
> Yue Cao claims that current host rate limiting of challenge ACKS
> (RFC 5961) could leak enough information to allow a patient attacker
> to hijack TCP sessions. He will soon provide details in an academic
> paper.
> 
> This patch increases the default limit from 100 to 1000, and adds
> some randomization so that the attacker can no longer hijack
> sessions without spending a considerable amount of probes.
> 
> Based on initial analysis and patch from Linus.
> 
> Note that we also have per socket rate limiting, so it is tempting
> to remove the host limit in the future.
> 
> v2: randomize the count of challenge acks per second, not the period.
> 
> Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2")
> Reported-by: Yue Cao <ycao009@ucr.edu>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
> Cc: Yuchung Cheng <ycheng@google.com>
> Cc: Neal Cardwell <ncardwell@google.com>
> Acked-by: Neal Cardwell <ncardwell@google.com>
> Acked-by: Yuchung Cheng <ycheng@google.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> [ ciwillia: backport to 3.10-stable ]
> Signed-off-by: Chas Williams <ciwillia@brocade.com>
(...)

Thank you guys, I'm queuing this v3 then.

Willy