netdev - Re: [PATCH] tcp: verify the checksum of the first data segment in a new connection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <9E6DAC0F-F5A8-4C82-8AC1-5B5766A8AAA5@amazon.com>
Date:   Tue, 12 Jun 2018 21:44:11 +0000
From:   "van der Linden, Frank" <fllinden@...zon.com>
To:     Eric Dumazet <eric.dumazet@...il.com>,
        "edumazet@...gle.com" <edumazet@...gle.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [PATCH] tcp: verify the checksum of the first data segment in a
 new connection

Resubmitted. The various release/deref requirements in that path make a straight "goto csum_error" impossible without duplicating some lines, but this is 2nd best.

Frank

On 6/11/18, 4:43 PM, "van der Linden, Frank" <fllinden@...zon.com> wrote:

    Yeah, true, it's missing INERRS in this case. I'll fix it up a bit.
    
    Frank
    
    On 6/11/18, 4:38 PM, "Eric Dumazet" <eric.dumazet@...il.com> wrote:
    
        
        
        On 06/11/2018 04:25 PM, van der Linden, Frank wrote:
        > A few comments on this one:
        > 
        > - obviously this is fairly serious, as it can let corrupted data all the way up to the application
        
        Sure, although anyone relying on CRC checksum for ensuring TCP data integrity
        has big troubles ;)
        
        I would rather have a refined version of this patch doing a "goto csum_error" 
        so that we properly increment TCP_MIB_CSUMERRORS and TCP_MIB_INERRS 
        
        Thanks !