lkml.org 
[lkml]   [2001]   [Nov]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: SYN cookies security bugfix?
From
Date
On Thu, 2001-11-08 at 05:20, B. James Phillippe wrote:
> Hello,
>
> I received a forwarded message from SuSE regarding a security vulnerability
> with respect to randomization of the ISN for SYN cookies - or something to
> that effect. I have not been able to find the patch which addresses this
> problem; if anyone can point me towards it, I would be appreciative.

Hi,

Think this is the patch you want - (backported it from 2.4.14 to 2.4.9).

--
// Gianni Tedesco <gianni@ecsc.co.uk>
"Every great advance in natural knowledge has involved
the absolute rejection of authority." -- Thomas H. Huxley
diff -urN linux.orig/include/net/sock.h linux/include/net/sock.h
--- linux.orig/include/net/sock.h Wed Aug 15 22:21:32 2001
+++ linux/include/net/sock.h Wed Nov 7 14:24:36 2001
@@ -416,6 +416,8 @@
unsigned int keepalive_time; /* time before keep alive takes place */
unsigned int keepalive_intvl; /* time interval between keep alive probes */
int linger2;
+
+ unsigned long last_synq_overflow;
};


diff -urN linux.orig/net/ipv4/syncookies.c linux/net/ipv4/syncookies.c
--- linux.orig/net/ipv4/syncookies.c Wed May 16 18:31:27 2001
+++ linux/net/ipv4/syncookies.c Wed Nov 7 14:23:54 2001
@@ -9,7 +9,7 @@
* as published by the Free Software Foundation; either version
* 2 of the License, or (at your option) any later version.
*
- * $Id: syncookies.c,v 1.14 2001/05/05 01:01:55 davem Exp $
+ * $Id: syncookies.c,v 1.17 2001/10/26 14:55:41 davem Exp $
*
* Missing: IPv6 support.
*/
@@ -23,8 +23,6 @@

extern int sysctl_tcp_syncookies;

-static unsigned long tcp_lastsynq_overflow;
-
/*
* This table has to be sorted and terminated with (__u16)-1.
* XXX generate a better table.
@@ -53,7 +51,9 @@
int mssind;
const __u16 mss = *mssp;

- tcp_lastsynq_overflow = jiffies;
+
+ sk->tp_pinfo.af_tcp.last_synq_overflow = jiffies;
+
/* XXX sort msstab[] by probability? Binary search? */
for (mssind = 0; mss > msstab[mssind + 1]; mssind++)
;
@@ -78,14 +78,11 @@
* Check if a ack sequence number is a valid syncookie.
* Return the decoded mss if it is, or 0 if not.
*/
-static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
+static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
{
__u32 seq;
__u32 mssind;

- if ((jiffies - tcp_lastsynq_overflow) > TCP_TIMEOUT_INIT)
- return 0;
-
seq = ntohl(skb->h.th->seq)-1;
mssind = check_tcp_syn_cookie(cookie,
skb->nh.iph->saddr, skb->nh.iph->daddr,
@@ -126,8 +123,8 @@
if (!sysctl_tcp_syncookies || !skb->h.th->ack)
goto out;

- mss = cookie_check(skb, cookie);
- if (!mss) {
+ if (time_after(jiffies, sk->tp_pinfo.af_tcp.last_synq_overflow + TCP_TIMEOUT_INIT) ||
+ (mss = cookie_check(skb, cookie)) == 0) {
NET_INC_STATS_BH(SyncookiesFailed);
goto out;
}
@@ -178,7 +175,7 @@
opt &&
opt->srr ? opt->faddr : req->af.v4_req.rmt_addr,
req->af.v4_req.loc_addr,
- sk->protinfo.af_inet.tos | RTO_CONN,
+ RT_CONN_FLAGS(sk),
0)) {
tcp_openreq_free(req);
goto out;
\
 
 \ /
  Last update: 2005-03-22 13:18    [W:0.057 / U:10.100 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site