netdev - Re: [RFC net 1/2] net: set skb hash for IP6 TCP reset packet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 17 Jul 2017 22:06:37 +0200
From:   Florent Fourcot <flo@...rcot.fr>
To:     Eric Dumazet <eric.dumazet@...il.com>, Shaohua Li <shli@...nel.org>
Cc:     netdev@...r.kernel.org, davem@...emloft.net, Kernel-team@...com,
        Shaohua Li <shli@...com>
Subject: Re: [RFC net 1/2] net: set skb hash for IP6 TCP reset packet

Eric Dumazet wrote:
> I am a bit unsure why we need to add yet another field in TCP timewait
> structure, since :
>
> 1) flowlabel can vary during a TCP flow lifetime.
> 2) flowlabel is different unde synflood (each syncookie gets a random
> flowlabel), and if 3rd packet comes back from the client to finish 3WHS,
> the flowlabel will again be different from the one that SYNACK used.

Actually, there is already a field for flowlabel in TCP timewait 
structure (see commit 1d13a96c74). At least for "stateful" flow labels 
(set with setsockopt(), and not randomly generated by kernel), it should 
work (if not, this is a regression).

The solution is perhaps to store the random generated value in the same 
place than standard flowlabels, instead to store the hash.