lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 31 Jul 2020 15:39:13 -0700 (PDT) From: Mat Martineau <mathew.j.martineau@...ux.intel.com> To: Florian Westphal <fw@...len.de> cc: netdev@...r.kernel.org, edumazet@...gle.com, matthieu.baerts@...sares.net, pabeni@...hat.com Subject: Re: [PATCH v2 net-next 7/9] mptcp: enable JOIN requests even if cookies are in use On Thu, 30 Jul 2020, Florian Westphal wrote: > JOIN requests do not work in syncookie mode -- for HMAC validation, the > peers nonce and the mptcp token (to obtain the desired connection socket > the join is for) are required, but this information is only present in the > initial syn. > > So either we need to drop all JOIN requests once a listening socket enters > syncookie mode, or we need to store enough state to reconstruct the request > socket later. > > This adds a state table (1024 entries) to store the data present in the > MP_JOIN syn request and the random nonce used for the cookie syn/ack. > > When a MP_JOIN ACK passed cookie validation, the table is consulted > to rebuild the request socket from it. > > An alternate approach would be to "cancel" syn-cookie mode and force > MP_JOIN to always use a syn queue entry. > > However, doing so brings the backlog over the configured queue limit. > > v2: use req->syncookie, not (removed) want_cookie arg > > Suggested-by: Paolo Abeni <pabeni@...hat.com> > Signed-off-by: Florian Westphal <fw@...len.de> > --- > net/ipv4/syncookies.c | 6 ++ > net/mptcp/Makefile | 1 + > net/mptcp/ctrl.c | 1 + > net/mptcp/protocol.h | 20 +++++++ > net/mptcp/subflow.c | 14 +++++ > net/mptcp/syncookies.c | 132 +++++++++++++++++++++++++++++++++++++++++ > 6 files changed, 174 insertions(+) > create mode 100644 net/mptcp/syncookies.c Reviewed-by: Mat Martineau <mathew.j.martineau@...ux.intel.com> -- Mat Martineau Intel
Powered by blists - more mailing lists