netdev - [PATCH net-next 0/3] net/tcp_fastopen: Fix for various TFO firewall issues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 20 Apr 2017 14:45:45 -0700
From:   Wei Wang <weiwan@...gle.com>
To:     netdev@...r.kernel.org, David Miller <davem@...emloft.net>
Cc:     Yuchung Cheng <ycheng@...gle.com>,
        Eric Dumazet <edumazet@...gle.com>,
        Wei Wang <weiwan@...gle.com>
Subject: [PATCH net-next 0/3] net/tcp_fastopen: Fix for various TFO firewall issues

From: Wei Wang <weiwan@...gle.com>

Currently there are still some firewall issues in the middlebox
which make the middlebox drop packets silently for TFO sockets.
This kind of issue is hard to be detected by the end client.

This patch series tries to detect such issues in the kernel and disable
TFO temporarily.
More details about the issues and the fixes are included in the following
patches.

Wei Wang (3):
  net-tcp_fastopen: Disable active side TFO in certain scenarios
  net-tcp_fastopen: Add snmp counter for blackhole detection
  net-tcp_fastopen: Remove mss check in tcp_write_timeout()

 Documentation/networking/ip-sysctl.txt |   8 +++
 include/linux/tcp.h                    |   1 +
 include/net/tcp.h                      |   6 ++
 include/uapi/linux/snmp.h              |   1 +
 net/ipv4/proc.c                        |   1 +
 net/ipv4/sysctl_net_ipv4.c             |  21 +++++++
 net/ipv4/tcp.c                         |   1 +
 net/ipv4/tcp_fastopen.c                | 102 +++++++++++++++++++++++++++++++++
 net/ipv4/tcp_input.c                   |  23 ++++++--
 net/ipv4/tcp_ipv4.c                    |   3 +
 net/ipv4/tcp_timer.c                   |   7 +--
 11 files changed, 166 insertions(+), 8 deletions(-)

-- 
2.12.2.816.g2cccc81164-goog