linux-stable/net/ipv4
Eric Dumazet e1b8b57623 icmp: randomize the global rate limiter
[ Upstream commit b38e7819ca ]

Keyu Man reported that the ICMP rate limiter could be used
by attackers to get useful signal. Details will be provided
in an upcoming academic publication.

Our solution is to add some noise, so that the attackers
no longer can get help from the predictable token bucket limiter.

Fixes: 4cdf507d54 ("icmp: add a global rate limitation")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Keyu Man <kman001@ucr.edu>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-29 09:06:59 +01:00
..
netfilter netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code 2020-06-03 08:18:09 +02:00
af_inet.c gso_segment: Reset skb->mac_len after modifying network header 2018-09-29 03:06:00 -07:00
ah4.c
arp.c arp: fix arp_filter on l3slave devices 2018-04-12 12:32:22 +02:00
cipso_ipv4.c netlabel: cope with NULL catmap 2020-05-20 08:17:12 +02:00
datagram.c inet: stop leaking jiffies on the wire 2019-11-10 11:25:37 +01:00
devinet.c devinet: fix memleak in inetdev_init() 2020-06-11 09:22:58 +02:00
esp4.c esp4: add length check for UDP encapsulation 2019-05-25 18:25:34 +02:00
esp4_offload.c esp: Fix GRO when the headers not fully in the linear part of the skb. 2018-02-25 11:07:46 +01:00
fib_frontend.c ipv4: Return error for RTA_VIA attribute 2019-03-13 14:03:09 -07:00
fib_lookup.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fib_notifier.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fib_rules.c
fib_semantics.c net: Fix the arp error in some cases 2020-06-30 15:38:00 -04:00
fib_trie.c ipv4: Silence suspicious RCU usage warning 2020-08-21 09:48:00 +02:00
fou.c net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv 2019-04-27 09:35:34 +02:00
gre_demux.c gre: fix uninit-value in __iptunnel_pull_header 2020-03-20 10:54:07 +01:00
gre_offload.c net: gre: recompute gre csum for sctp over gre tunnels 2020-08-21 09:48:01 +02:00
icmp.c icmp: randomize the global rate limiter 2020-10-29 09:06:59 +01:00
igmp.c igmp: fix memory leak in igmpv3_del_delrec() 2019-07-31 07:28:44 +02:00
inet_connection_sock.c net: refactor bind_bucket fastreuse into helper 2020-08-21 09:48:14 +02:00
inet_diag.c inet_diag: return classid for all socket types 2020-03-20 10:54:13 +01:00
inet_fragment.c net: IP defrag: encapsulate rbtree defrag code into callable functions 2019-04-27 09:35:40 +02:00
inet_hashtables.c net: initialize fastreuse on inet_inherit_port 2020-08-21 09:48:16 +02:00
inet_timewait_sock.c soreuseport: initialise timewait reuseport field 2018-05-16 10:10:24 +02:00
inetpeer.c inetpeer: fix data-race in inet_putpeer / inet_putpeer 2020-01-04 14:00:07 +01:00
ip_forward.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ip_fragment.c net: IP defrag: encapsulate rbtree defrag code into callable functions 2019-04-27 09:35:40 +02:00
ip_gre.c ip_gre: fix parsing gre header in ipgre_err 2019-11-20 18:00:02 +01:00
ip_input.c vrf: check accept_source_route on the original netdevice 2019-04-17 08:37:48 +02:00
ip_options.c vrf: check accept_source_route on the original netdevice 2019-04-17 08:37:48 +02:00
ip_output.c ip: fix tos reflection in ack and reset packets 2020-10-01 13:12:24 +02:00
ip_sockglue.c ip: on queued skb use skb_header_pointer instead of pskb_may_pull 2019-01-23 08:09:47 +01:00
ip_tunnel.c ip_tunnel: fix use-after-free in ip_tunnel_lookup() 2020-06-30 15:37:59 -04:00
ip_tunnel_core.c ip_tunnel: allow not to count pkts on tstats by setting skb's dev to NULL 2019-08-04 09:32:03 +02:00
ip_vti.c ip_vti: receive ipip packet by calling ip_tunnel_rcv 2020-06-03 08:18:08 +02:00
ipcomp.c
ipconfig.c ipconfig: Correctly initialise ic_nameservers 2018-08-03 07:50:39 +02:00
ipip.c net: ipip: fix wrong address family in init error path 2020-06-03 08:17:31 +02:00
ipmr.c ipv4: Fix potential Spectre v1 vulnerability 2019-01-09 17:14:42 +01:00
Kconfig vti[6]: fix packet tx through bpf_redirect() in XinY cases 2020-04-02 16:34:32 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
netfilter.c
ping.c ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg 2020-07-22 09:22:19 +02:00
proc.c tcp: tcp_fragment() should apply sane memory limits 2019-06-17 19:52:44 +02:00
protocol.c
raw.c net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg() 2020-05-02 17:24:11 +02:00
raw_diag.c inet_diag: return classid for all socket types 2020-03-20 10:54:13 +01:00
route.c ipv4: Restore flowi4_oif update before call to xfrm_lookup_route 2020-10-29 09:06:58 +01:00
syncookies.c tcp: handle inet_csk_reqsk_queue_add() failures 2019-03-19 13:13:23 +01:00
sysctl_net_ipv4.c tcp: add tcp_min_snd_mss sysctl 2019-06-17 19:52:44 +02:00
tcp.c tcp: make sure listeners don't initialize congestion-control state 2020-07-22 09:22:20 +02:00
tcp_bbr.c tcp_bbr: improve arithmetic division in bbr_update_bw() 2020-01-29 15:02:36 +01:00
tcp_bic.c
tcp_cdg.c
tcp_cong.c tcp: make sure listeners don't initialize congestion-control state 2020-07-22 09:22:20 +02:00
tcp_cubic.c tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT 2020-06-30 15:37:59 -04:00
tcp_dctcp.c tcp: Ensure DCTCP reacts to losses 2019-04-17 08:37:47 +02:00
tcp_diag.c
tcp_fastopen.c net: add rb_to_skb() and other rb tree helpers 2018-09-19 22:43:47 +02:00
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c
tcp_illinois.c net/tcp/illinois: replace broken algorithm reference link 2018-05-30 07:52:06 +02:00
tcp_input.c tcp: fix to update snd_wl1 in bulk receiver fast path 2020-10-29 09:06:59 +01:00
tcp_ipv4.c tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers 2020-07-22 09:22:20 +02:00
tcp_lp.c
tcp_metrics.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tcp_minisocks.c tcp: do not restart timewait timer on rst reception 2018-09-15 09:45:25 +02:00
tcp_nv.c tcp_nv: fix potential integer overflow in tcpnv_acked 2018-04-26 11:02:13 +02:00
tcp_offload.c gso: validate gso_type in GSO handlers 2018-01-31 14:03:47 +01:00
tcp_output.c tcp: allow at most one TLP probe per flight 2020-07-31 16:44:45 +02:00
tcp_probe.c
tcp_rate.c tcp: invalidate rate samples during SACK reneging 2018-01-02 20:31:09 +01:00
tcp_recovery.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tcp_scalable.c
tcp_timer.c tcp: exit if nothing to retransmit on RTO timeout 2019-12-17 20:38:43 +01:00
tcp_ulp.c tcp, ulp: add alias for all ulp modules 2018-09-15 09:45:29 +02:00
tcp_vegas.c tcp: fix under-evaluated ssthresh in TCP Vegas 2017-12-25 14:26:30 +01:00
tcp_vegas.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tcp_veno.c
tcp_westwood.c
tcp_yeah.c
tunnel4.c
udp.c net: udp: Fix wrong clean up for IS_UDPLITE macro 2020-07-31 16:44:44 +02:00
udp_diag.c inet_diag: return classid for all socket types 2020-03-20 10:54:13 +01:00
udp_impl.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
udp_offload.c net: fix use-after-free in GRO with ESP 2018-07-22 14:28:44 +02:00
udp_tunnel.c
udplite.c
xfrm4_input.c xfrm: reset transport header back to network header after all input transforms ahave been applied 2018-11-04 14:52:37 +01:00
xfrm4_mode_beet.c
xfrm4_mode_transport.c xfrm: reset transport header back to network header after all input transforms ahave been applied 2018-11-04 14:52:37 +01:00
xfrm4_mode_tunnel.c
xfrm4_output.c xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish 2020-05-02 17:24:18 +02:00
xfrm4_policy.c net: add bool confirm_neigh parameter for dst_ops.update_pmtu 2020-01-04 14:00:14 +01:00
xfrm4_protocol.c
xfrm4_state.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
xfrm4_tunnel.c