mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 19:29:37 +00:00
ipv4: tcp: send zero IPID in SYNACK messages
[ Upstream commit970a5a3ea8
] In commit431280eebe
("ipv4: tcp: send zero IPID for RST and ACK sent in SYN-RECV and TIME-WAIT state") we took care of some ctl packets sent by TCP. It turns out we need to use a similar strategy for SYNACK packets. By default, they carry IP_DF and IPID==0, but there are ways to ask them to use the hashed IP ident generator and thus be used to build off-path attacks. (Ref: Off-Path TCP Exploits of the Mixed IPID Assignment) One of this way is to force (before listener is started) echo 1 >/proc/sys/net/ipv4/ip_no_pmtu_disc Another way is using forged ICMP ICMP_FRAG_NEEDED with a very small MTU (like 68) to force a false return from ip_dont_fragment() In this patch, ip_build_and_send_pkt() uses the following heuristics. 1) Most SYNACK packets are smaller than IPV4_MIN_MTU and therefore can use IP_DF regardless of the listener or route pmtu setting. 2) In case the SYNACK packet is bigger than IPV4_MIN_MTU, we use prandom_u32() generator instead of the IPv4 hashed ident one. Fixes:1da177e4c3
("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Ray Che <xijiache@gmail.com> Reviewed-by: David Ahern <dsahern@kernel.org> Cc: Geoff Alexander <alexandg@cs.unm.edu> Cc: Willy Tarreau <w@1wt.eu> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
51dde4ae5a
commit
c30ecdba9e
1 changed files with 9 additions and 2 deletions
|
@ -161,11 +161,18 @@ int ip_build_and_send_pkt(struct sk_buff *skb, const struct sock *sk,
|
|||
iph->daddr = (opt && opt->opt.srr ? opt->opt.faddr : daddr);
|
||||
iph->saddr = saddr;
|
||||
iph->protocol = sk->sk_protocol;
|
||||
if (ip_dont_fragment(sk, &rt->dst)) {
|
||||
/* Do not bother generating IPID for small packets (eg SYNACK) */
|
||||
if (skb->len <= IPV4_MIN_MTU || ip_dont_fragment(sk, &rt->dst)) {
|
||||
iph->frag_off = htons(IP_DF);
|
||||
iph->id = 0;
|
||||
} else {
|
||||
iph->frag_off = 0;
|
||||
/* TCP packets here are SYNACK with fat IPv4/TCP options.
|
||||
* Avoid using the hashed IP ident generator.
|
||||
*/
|
||||
if (sk->sk_protocol == IPPROTO_TCP)
|
||||
iph->id = (__force __be16)prandom_u32();
|
||||
else
|
||||
__ip_select_ident(net, iph, 1);
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue