github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
2ee66e9487
linux/net/ipv4
History
Eric Dumazet 2ee66e9487 inetpeer: randomize RB-tree node comparison using SipHash 
The inetpeer rate limiting system stores peer entries in a Red-Black tree
keyed deterministically on the remote IP address. Because tree lookups walk
the RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp),
an off-path adversary can predict the exact topology of the tree and the
sequence of nodes traversed during lookups (the gc_stack candidate list).

By combining deterministic tree traversal with aggressive garbage collection
(triggered when tree size exceeds inet_peer_threshold), an attacker can
selectively force the eviction of targeted inet_peer nodes. When an evicted
node is subsequently re-created upon receiving a new packet, its rate-limiting
token bucket (rate_tokens, rate_last) is reset to full capacity. This creates
a side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP
rate limits and infer open UDP ports (similar to SAD DNS style attacks).

Mitigate this by randomizing the RB-tree node comparison logic using SipHash
with a secret key (inetpeer_hash_key) initialized via net_get_random_once().
Nodes are ordered in the tree by SipHash(addr, key) rather than raw IP
addresses. Because the secret key is unknown to external entities, the tree
layout and lookup traversal paths are unpredictable to off-path adversaries,
breaking the deterministic eviction gadget.

Cache the computed 64-bit SipHash (hash) in struct inet_peer and compute the
target hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing
SipHash at every step of the RB-tree walk.

Fixes: b145425f26 ("inetpeer: remove AVL implementation in favor of RB tree")
Reported-by: Michael Blunt <michaelbblunt@gmail.com>
Suggested-by: Michael Blunt <michaelbblunt@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260818151213.3953963-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-20 12:55:31 -07:00
..
netfilter netfilter: nf_tables: call skb_valid_dst() before skb_dst() 2026-07-31 14:47:03 +02:00
af_inet.c ipv4: remove obsolete EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL() 2026-06-05 17:47:07 -07:00
ah4.c xfrm: ah: use skb_to_full_sk in async output callbacks 2026-05-16 10:56:14 +02:00
arp.c net: remove ax25 and amateur radio (hamradio) subsystem 2026-04-23 10:24:02 -07:00
bpf_tcp_ca.c bpf: Reject TCP_NODELAY in bpf-tcp-cc 2026-04-22 12:58:57 -07:00
cipso_ipv4.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
datagram.c raw: annotate lockless match fields in raw_v4_match() 2026-07-23 07:46:12 -07:00
devinet.c net: Const qualify ctl_tables that kmemdup unconditionally 2026-08-13 13:12:24 +02:00
esp4_offload.c xfrm: Fix inner mode lookup in tunnel mode GSO segmentation 2025-12-04 09:54:53 +01:00
esp4.c net: Use helpers to get/set UDP len tree-wide 2026-07-22 13:47:02 +02:00
fib_frontend.c ipv4: fib: Define fib_table_hash_lock under CONFIG_IP_MULTIPLE_TABLES. 2026-07-07 10:51:06 +02:00
fib_lookup.h ipv4: fib: Annotate access to struct fib_alias.fa_state. 2026-01-28 19:33:07 -08:00
fib_notifier.c
fib_rules.c net: fib_rules: Only hold RTNL for the first IPv4 RTM_NEWRULE. 2026-07-01 18:42:34 +02:00
fib_semantics.c ipv4: fix use-after-free in fib_nhc_update_mtu() 2026-08-11 11:25:10 +02:00
fib_trie.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-20 09:18:11 +02:00
fou_bpf.c
fou_core.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-30 12:53:19 -07:00
fou_nl.c fou: Don't allow 0 for FOU_ATTR_IPPROTO. 2026-01-17 16:00:24 -08:00
fou_nl.h tools: ynl-gen: add regeneration comment 2025-11-25 19:20:42 -08:00
gre_demux.c gre: Count GRE packet drops 2026-04-12 12:33:33 -07:00
gre_offload.c
icmp.c ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup 2026-07-23 07:01:24 -07:00
igmp_internal.h netlink: support dumping IPv4 multicast addresses 2025-02-11 11:26:53 +01:00
igmp.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-10 10:20:05 +02:00
inet_connection_sock.c tcp: fix TFO max_qlen accounting across reuseport migration 2026-08-05 17:10:28 -07:00
inet_diag.c inet_diag: report delayed ack timer information 2026-03-06 16:32:26 -08:00
inet_fragment.c inet: frags: publish queues before arming timer 2026-07-31 17:05:07 -07:00
inet_hashtables.c net: remove some unused EXPORT_SYMBOL()s 2026-06-12 16:43:11 -07:00
inet_timewait_sock.c inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() 2025-10-17 16:08:43 -07:00
inetpeer.c inetpeer: randomize RB-tree node comparison using SipHash 2026-08-20 12:55:31 -07:00
ip_forward.c
ip_fragment.c inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush 2026-06-04 18:05:23 -07:00
ip_gre.c gre: fix ERSPAN o_flags race/corruption in xmit and fill_info 2026-08-14 12:57:44 -07:00
ip_input.c tcp: move tcp_v4_early_demux() to net/ipv4/ip_input.c 2026-03-09 18:50:24 -07:00
ip_options.c ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options 2026-06-03 18:53:14 -07:00
ip_output.c ipv4: reject undersized MTUs in ip_do_fragment() 2026-08-18 09:12:56 -07:00
ip_sockglue.c net: remove addr_len argument of recvmsg() handlers 2026-03-02 18:17:17 -08:00
ip_tunnel_core.c tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() 2026-05-26 18:11:47 -07:00
ip_tunnel.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-18 10:42:41 -07:00
ip_vti.c net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink 2026-06-17 16:01:52 -07:00
ipcomp.c xfrm: add extack to xfrm_init_state 2026-06-04 12:22:35 +02:00
ipconfig.c net: Use helpers to get/set UDP len tree-wide 2026-07-22 13:47:02 +02:00
ipip.c netfilter: flowtable: rename tun.l3_proto to tun.inner_proto 2026-08-10 13:02:37 +02:00
ipmr_base.c ipmr: Replace use of system_unbound_wq with system_dfl_wq 2026-05-19 18:21:39 -07:00
ipmr.c ip: orphan prefetched skbs before multicast forwarding 2026-08-18 13:05:14 +02:00
Kconfig net/tcp: Remove tcp_sigpool 2026-04-30 09:38:56 +02:00
Makefile netfilter: add option for GCOV profiling 2026-05-24 22:55:47 +02:00
metrics.c net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros 2026-03-29 11:21:22 -07:00
netfilter.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
netlink.c
nexthop.c ipv4: nexthop: handle errors in nexthop_init() 2026-08-04 18:33:17 -07:00
ping.c Networking changes for 7.1. 2026-04-14 18:36:10 -07:00
proc.c udp: Remove UDP-Lite SNMP stats. 2026-03-13 18:57:44 -07:00
protocol.c
raw_diag.c inet_diag: change inet_diag_bc_sk() first argument 2025-08-29 19:29:24 -07:00
raw.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-07-23 14:07:40 -07:00
route.c net: advertise TCP MSS from the configured MTU, not the learned PMTU 2026-08-20 12:14:23 -07:00
syncookies.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
sysctl_net_ipv4.c net: Const qualify network templated ctl_tables Arrays 2026-08-13 13:12:24 +02:00
tcp_ao.c net/tcp-ao: fix use-after-free of current_key on reconnect to another peer 2026-08-20 12:18:12 -07:00
tcp_bbr.c tcp_bbr: fix SPDX-License-Identifier to be GPL-2.0 OR BSD-3-Clause 2026-06-01 16:51:08 -07:00
tcp_bic.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_bpf.c bpf, sockmap: Fix sk_redir use-after-free in send verdict 2026-08-01 18:24:58 +02:00
tcp_cdg.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_cong.c tcp: ECT_1_NEGOTIATION and NEEDS_ACCECN identifiers 2026-02-03 15:13:24 +01:00
tcp_cubic.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_dctcp.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_dctcp.h net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
tcp_diag.c inet_diag: report delayed ack timer information 2026-03-06 16:32:26 -08:00
tcp_fastopen.c net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros 2026-03-29 11:21:22 -07:00
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c
tcp_illinois.c
tcp_input.c tcp: fix icsk_ack.ato bitfield overflow 2026-08-10 16:02:30 -07:00
tcp_ipv4.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc7 2026-08-07 23:04:17 +02:00
tcp_lp.c net: tcp_lp: fix kernel-doc warnings and update outdated reference links 2025-10-28 17:52:44 -07:00
tcp_metrics.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_minisocks.c tcp: honor BPF_SOCK_OPS_RWND_INIT on the active connect path 2026-08-06 11:32:46 -07:00
tcp_nv.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_offload.c gro: flushing when CWR is set negatively affects AccECN 2026-02-03 15:13:24 +01:00
tcp_output.c tcp: honor BPF_SOCK_OPS_RWND_INIT on the active connect path 2026-08-06 11:32:46 -07:00
tcp_plb.c tcp: rehash onto different local ECMP path on retransmit timeout 2026-06-15 15:57:31 -07:00
tcp_recovery.c tcp: move tcp_rack_advance() to tcp_input.c 2026-01-28 19:31:51 -08:00
tcp_scalable.c
tcp_timer.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-13 11:00:14 -07:00
tcp_ulp.c
tcp_vegas.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_vegas.h tcp: add cwnd_event_tx_start to tcp_congestion_ops 2026-03-24 21:00:38 -07:00
tcp_veno.c tcp: add cwnd_event_tx_start to tcp_congestion_ops 2026-03-24 21:00:38 -07:00
tcp_westwood.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp_yeah.c tcp: annotate data-races around tp->snd_ssthresh 2026-04-18 11:10:12 -07:00
tcp.c net: remove some unused EXPORT_SYMBOL()s 2026-06-12 16:43:11 -07:00
tunnel4.c
udp_bpf.c sockmap: Fix use-after-free in udp_bpf_recvmsg() 2026-06-14 21:30:20 -07:00
udp_diag.c udp: Don't pass udptable to IPv4 socket lookup functions. 2026-03-13 18:57:46 -07:00
udp_offload.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-06 11:53:47 -07:00
udp_tunnel_core.c udp: Set length in UDP header to 0 for big GSO packets 2026-07-22 13:47:02 +02:00
udp_tunnel_nic.c net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() 2026-07-28 13:32:34 +02:00
udp_tunnel_stub.c
udp.c Merge branch 'big-tcp-for-udp-tunnels' 2026-07-22 13:49:03 +02:00
xfrm4_input.c xfrm: Fix dev use-after-free in xfrm async resumption 2026-06-12 08:39:59 +02:00
xfrm4_output.c ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] 2025-07-02 14:32:30 -07:00
xfrm4_policy.c net: Const qualify network templated ctl_tables Arrays 2026-08-13 13:12:24 +02:00
xfrm4_protocol.c
xfrm4_state.c
xfrm4_tunnel.c