lkml.org 
[lkml]   [2013]   [Jan]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 189/222] tcp: tcp_replace_ts_recent() should not be called from tcp_validate_incoming()
    Date
    3.5.7.3 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Dumazet <edumazet@google.com>

    commit bd090dfc634ddd711a5fbd0cadc6e0ab4977bcaf upstream.

    We added support for RFC 5961 in latest kernels but TCP fails
    to perform exhaustive check of ACK sequence.

    We can update our view of peer tsval from a frame that is
    later discarded by tcp_ack()

    This makes timestamps enabled sessions vulnerable to injection of
    a high tsval : peers start an ACK storm, since the victim
    sends a dupack each time it receives an ACK from the other peer.

    As tcp_validate_incoming() is called before tcp_ack(), we should
    not peform tcp_replace_ts_recent() from it, and let callers do it
    at the right time.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Neal Cardwell <ncardwell@google.com>
    Cc: Yuchung Cheng <ycheng@google.com>
    Cc: Nandita Dukkipati <nanditad@google.com>
    Cc: H.K. Jerry Chu <hkchu@google.com>
    Cc: Romain Francoise <romain@orebokech.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
    ---
    net/ipv4/tcp_input.c | 15 ++++++++++-----
    1 file changed, 10 insertions(+), 5 deletions(-)

    diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
    index afb436d..0b6e6cd 100644
    --- a/net/ipv4/tcp_input.c
    +++ b/net/ipv4/tcp_input.c
    @@ -5500,11 +5500,6 @@ static bool tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
    goto discard;
    }

    - /* ts_recent update must be made after we are sure that the packet
    - * is in window.
    - */
    - tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
    -
    /* step 3: check security and precedence [ignored] */

    /* step 4: Check for a SYN
    @@ -5737,6 +5732,11 @@ step5:
    if (th->ack && tcp_ack(sk, skb, FLAG_SLOWPATH) < 0)
    goto discard;

    + /* ts_recent update must be made after we are sure that the packet
    + * is in window.
    + */
    + tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
    +
    tcp_rcv_rtt_measure_ts(sk, skb);

    /* Process urgent data. */
    @@ -6215,6 +6215,11 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
    } else
    goto discard;

    + /* ts_recent update must be made after we are sure that the packet
    + * is in window.
    + */
    + tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
    +
    /* step 6: check the URG bit */
    tcp_urg(sk, skb, th);

    --
    1.7.9.5


    \
     
     \ /
      Last update: 2013-01-16 18:43    [W:3.082 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site