lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 31 Dec 2013 05:28:40 +0100 From: Hannes Frederic Sowa <hannes@...essinduktion.org> To: steffen.klassert@...unet.com Cc: netdev@...r.kernel.org, eric.dumazet@...il.com, davem@...emloft.net Subject: Re: [PATCH net-next 1/2] ipv4: add forwarding_uses_pmtu knob to protect forward path to use pmtu info Hi Steffen! On Fri, Dec 20, 2013 at 02:08:22PM +0100, Hannes Frederic Sowa wrote: > Provide a mode where the forwarding path does not use the protocol path > MTU to calculate the maximum size for a forwarded packet but instead > uses the interface or the per-route locked MTU. > > It is easy to inject bogus or malicious path mtu information which > will cause either unneeded fragmentation-needed icmp errors (in case > of DF-bit set) or unnecessary fragmentation of packets (by default down > to min_pmtu). This could be used to either create blackholes on routers > (if the generated DF-bit gets dropped later on) or to leverage attacks > on fragmentation. > > Forwarded skbs are marked with IPSKB_FORWARDED in ip_forward. This flag > was introduced for multicast forwarding, but as it does not conflict with > our usage in the unicast code path it is perfect for reuse. > > I moved the functions ip_sk_accept_pmtu, ip_sk_use_pmtu and ip_skb_dst_mtu > along with the new ip_dst_mtu_secure to net/ip.h to fix circular > dependencies because of IPSKB_FORWARDED. IIRC you have a (semi-)automatic test suite to test for (p)mtu problems? Would these checks cover such a change? Maybe your test suite is publicly available so I could test these changes myself or otherwise could you give them a testdrive? That would be very helpful. Thank you, Hannes -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists