netdev - Re: [PATCH net v2] tcp: avoid creating multiple req socks with the same tuples

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 14 Jun 2019 07:34:37 -0700
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Eric Dumazet <edumazet@...gle.com>, maowenan <maowenan@...wei.com>
Cc:     David Miller <davem@...emloft.net>,
        netdev <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH net v2] tcp: avoid creating multiple req socks with the
 same tuples



On 6/14/19 7:25 AM, Eric Dumazet wrote:
> On Fri, Jun 14, 2019 at 7:04 AM maowenan <maowenan@...wei.com> wrote:
>> I agree that this is a special case.
>> I propose one point about the sequence of synack, if two synack with two different
>> sequence since the time elapse 64ns, this issue disappear.
>>
>> tcp_conn_request->tcp_v4_init_seq->secure_tcp_seq->seq_scale
>> static u32 seq_scale(u32 seq)
>> {
>>         /*
>>          *      As close as possible to RFC 793, which
>>          *      suggests using a 250 kHz clock.
>>          *      Further reading shows this assumes 2 Mb/s networks.
>>          *      For 10 Mb/s Ethernet, a 1 MHz clock is appropriate.
>>          *      For 10 Gb/s Ethernet, a 1 GHz clock should be ok, but
>>          *      we also need to limit the resolution so that the u32 seq
>>          *      overlaps less than one time per MSL (2 minutes).
>>          *      Choosing a clock of 64 ns period is OK. (period of 274 s)
>>          */
>>         return seq + (ktime_get_real_ns() >> 6);
>> }
>>
>> So if the long delay larger than 64ns, the seq is difference.
> 
> The core issue has nothing to do with syncookies.
> 
> Are you sure you really understand this stack ?
> 

Oh well, maybe I should not have answered before my breakfast/coffee.

What I meant to say is that we do not want to fix this problem by working around
the issue you noticed (which leads to RST packets)