netdev - Re: [PATCH net-next] tcp: be less liberal in tsecr received while in SYN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADVnQykD8i4ArpSZaPKaoNxLJ2if2ts9m4As+=Jvdkrgx1qMHw@mail.gmail.com>
Date: Mon, 24 Feb 2025 10:00:28 -0500
From: Neal Cardwell <ncardwell@...gle.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, 
	Paolo Abeni <pabeni@...hat.com>, Kuniyuki Iwashima <kuniyu@...zon.com>, Simon Horman <horms@...nel.org>, 
	Florian Westphal <fw@...len.de>, netdev@...r.kernel.org, eric.dumazet@...il.com, 
	Yong-Hao Zou <yonghaoz1994@...il.com>
Subject: Re: [PATCH net-next] tcp: be less liberal in tsecr received while in
 SYN_RECV state

On Mon, Feb 24, 2025 at 6:06 AM Eric Dumazet <edumazet@...gle.com> wrote:
>
> Yong-Hao Zou mentioned that linux was not strict as other OS in 3WHS,
> for flows using TCP TS option (RFC 7323)
>
> As hinted by an old comment in tcp_check_req(),
> we can check the TSecr value in the incoming packet corresponds
> to one of the SYNACK TSval values we have sent.
>
> In this patch, I record the oldest and most recent values
> that SYNACK packets have used.
>
> Send a challenge ACK if we receive a TSecr outside
> of this range, and increase a new SNMP counter.
>
> nstat -az | grep TcpExtTSECR_Rejected
> TcpExtTSECR_Rejected            0                  0.0
>
> Reported-by: Yong-Hao Zou <yonghaoz1994@...il.com>
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> ---

Very nice. Thanks, Eric!

Reviewed-by: Neal Cardwell <ncardwell@...gle.com>

neal