mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git
synced 2026-10-28 21:02:43 +01:00
Eric Dumazet
165573e41f
This reverts28ee1b746f("secure_seq: downgrade to per-host timestamp offsets") tcp_tw_recycle went away in 2017. Zhouyan Deng reported off-path TCP source port leakage via SYN cookie side-channel that can be fixed in multiple ways. One of them is to bring back TCP ports in TS offset randomization. As a bonus, we perform a single siphash() computation to provide both an ISN and a TS offset. Fixes:28ee1b746f("secure_seq: downgrade to per-host timestamp offsets") Reported-by: Zhouyan Deng <[email protected]> Signed-off-by: Eric Dumazet <[email protected]> Reviewed-by: Kuniyuki Iwashima <[email protected]> Acked-by: Florian Westphal <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
52 lines
1.2 KiB
C
52 lines
1.2 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _NET_SECURE_SEQ
|
|
#define _NET_SECURE_SEQ
|
|
|
|
#include <linux/types.h>
|
|
|
|
struct net;
|
|
extern struct net init_net;
|
|
|
|
union tcp_seq_and_ts_off {
|
|
struct {
|
|
u32 seq;
|
|
u32 ts_off;
|
|
};
|
|
u64 hash64;
|
|
};
|
|
|
|
u64 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
|
|
u64 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
|
|
__be16 dport);
|
|
union tcp_seq_and_ts_off
|
|
secure_tcp_seq_and_ts_off(const struct net *net, __be32 saddr, __be32 daddr,
|
|
__be16 sport, __be16 dport);
|
|
|
|
static inline u32 secure_tcp_seq(__be32 saddr, __be32 daddr,
|
|
__be16 sport, __be16 dport)
|
|
{
|
|
union tcp_seq_and_ts_off ts;
|
|
|
|
ts = secure_tcp_seq_and_ts_off(&init_net, saddr, daddr,
|
|
sport, dport);
|
|
|
|
return ts.seq;
|
|
}
|
|
|
|
union tcp_seq_and_ts_off
|
|
secure_tcpv6_seq_and_ts_off(const struct net *net, const __be32 *saddr,
|
|
const __be32 *daddr,
|
|
__be16 sport, __be16 dport);
|
|
|
|
static inline u32 secure_tcpv6_seq(const __be32 *saddr, const __be32 *daddr,
|
|
__be16 sport, __be16 dport)
|
|
{
|
|
union tcp_seq_and_ts_off ts;
|
|
|
|
ts = secure_tcpv6_seq_and_ts_off(&init_net, saddr, daddr,
|
|
sport, dport);
|
|
|
|
return ts.seq;
|
|
}
|
|
#endif /* _NET_SECURE_SEQ */
|