lkml.org 
[lkml]   [2013]   [Jan]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[ 64/80] tcp: tcp_replace_ts_recent() should not be called from tcp_validate_incoming()
    Date
    3.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------


    From: Eric Dumazet <edumazet@google.com>

    [ Upstream commit bd090dfc634ddd711a5fbd0cadc6e0ab4977bcaf ]

    We added support for RFC 5961 in latest kernels but TCP fails
    to perform exhaustive check of ACK sequence.

    We can update our view of peer tsval from a frame that is
    later discarded by tcp_ack()

    This makes timestamps enabled sessions vulnerable to injection of
    a high tsval : peers start an ACK storm, since the victim
    sends a dupack each time it receives an ACK from the other peer.

    As tcp_validate_incoming() is called before tcp_ack(), we should
    not peform tcp_replace_ts_recent() from it, and let callers do it
    at the right time.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Neal Cardwell <ncardwell@google.com>
    Cc: Yuchung Cheng <ycheng@google.com>
    Cc: Nandita Dukkipati <nanditad@google.com>
    Cc: H.K. Jerry Chu <hkchu@google.com>
    Cc: Romain Francoise <romain@orebokech.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv4/tcp_input.c | 15 ++++++++++-----
    1 file changed, 10 insertions(+), 5 deletions(-)

    --- a/net/ipv4/tcp_input.c
    +++ b/net/ipv4/tcp_input.c
    @@ -5337,11 +5337,6 @@ static bool tcp_validate_incoming(struct
    goto discard;
    }

    - /* ts_recent update must be made after we are sure that the packet
    - * is in window.
    - */
    - tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
    -
    /* step 3: check security and precedence [ignored] */

    /* step 4: Check for a SYN
    @@ -5576,6 +5571,11 @@ step5:
    if (th->ack && tcp_ack(sk, skb, FLAG_SLOWPATH) < 0)
    goto discard;

    + /* ts_recent update must be made after we are sure that the packet
    + * is in window.
    + */
    + tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
    +
    tcp_rcv_rtt_measure_ts(sk, skb);

    /* Process urgent data. */
    @@ -6046,6 +6046,11 @@ int tcp_rcv_state_process(struct sock *s
    } else
    goto discard;

    + /* ts_recent update must be made after we are sure that the packet
    + * is in window.
    + */
    + tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
    +
    /* step 6: check the URG bit */
    tcp_urg(sk, skb, th);




    \
     
     \ /
      Last update: 2013-01-09 23:01    [W:4.045 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site