Messages in this thread Patch in this message | | | Subject | Re: SYN cookies security bugfix? | From | Gianni Tedesco <> | Date | 08 Nov 2001 08:32:46 +0000 |
| |
On Thu, 2001-11-08 at 05:20, B. James Phillippe wrote: > Hello, > > I received a forwarded message from SuSE regarding a security vulnerability > with respect to randomization of the ISN for SYN cookies - or something to > that effect. I have not been able to find the patch which addresses this > problem; if anyone can point me towards it, I would be appreciative.
Hi,
Think this is the patch you want - (backported it from 2.4.14 to 2.4.9).
-- // Gianni Tedesco <gianni@ecsc.co.uk> "Every great advance in natural knowledge has involved the absolute rejection of authority." -- Thomas H. Huxley diff -urN linux.orig/include/net/sock.h linux/include/net/sock.h --- linux.orig/include/net/sock.h Wed Aug 15 22:21:32 2001 +++ linux/include/net/sock.h Wed Nov 7 14:24:36 2001 @@ -416,6 +416,8 @@ unsigned int keepalive_time; /* time before keep alive takes place */ unsigned int keepalive_intvl; /* time interval between keep alive probes */ int linger2; + + unsigned long last_synq_overflow; }; diff -urN linux.orig/net/ipv4/syncookies.c linux/net/ipv4/syncookies.c --- linux.orig/net/ipv4/syncookies.c Wed May 16 18:31:27 2001 +++ linux/net/ipv4/syncookies.c Wed Nov 7 14:23:54 2001 @@ -9,7 +9,7 @@ * as published by the Free Software Foundation; either version * 2 of the License, or (at your option) any later version. * - * $Id: syncookies.c,v 1.14 2001/05/05 01:01:55 davem Exp $ + * $Id: syncookies.c,v 1.17 2001/10/26 14:55:41 davem Exp $ * * Missing: IPv6 support. */ @@ -23,8 +23,6 @@ extern int sysctl_tcp_syncookies; -static unsigned long tcp_lastsynq_overflow; - /* * This table has to be sorted and terminated with (__u16)-1. * XXX generate a better table. @@ -53,7 +51,9 @@ int mssind; const __u16 mss = *mssp; - tcp_lastsynq_overflow = jiffies; + + sk->tp_pinfo.af_tcp.last_synq_overflow = jiffies; + /* XXX sort msstab[] by probability? Binary search? */ for (mssind = 0; mss > msstab[mssind + 1]; mssind++) ; @@ -78,14 +78,11 @@ * Check if a ack sequence number is a valid syncookie. * Return the decoded mss if it is, or 0 if not. */ -static inline int cookie_check(struct sk_buff *skb, __u32 cookie) +static inline int cookie_check(struct sk_buff *skb, __u32 cookie) { __u32 seq; __u32 mssind; - if ((jiffies - tcp_lastsynq_overflow) > TCP_TIMEOUT_INIT) - return 0; - seq = ntohl(skb->h.th->seq)-1; mssind = check_tcp_syn_cookie(cookie, skb->nh.iph->saddr, skb->nh.iph->daddr, @@ -126,8 +123,8 @@ if (!sysctl_tcp_syncookies || !skb->h.th->ack) goto out; - mss = cookie_check(skb, cookie); - if (!mss) { + if (time_after(jiffies, sk->tp_pinfo.af_tcp.last_synq_overflow + TCP_TIMEOUT_INIT) || + (mss = cookie_check(skb, cookie)) == 0) { NET_INC_STATS_BH(SyncookiesFailed); goto out; } @@ -178,7 +175,7 @@ opt && opt->srr ? opt->faddr : req->af.v4_req.rmt_addr, req->af.v4_req.loc_addr, - sk->protinfo.af_inet.tos | RTO_CONN, + RT_CONN_FLAGS(sk), 0)) { tcp_openreq_free(req); goto out; | |