On Tue, Aug 16, 2016 at 04:50:11PM -0400, Charles (Chas) Williams wrote: > From: Eric Dumazet <edumazet@xxxxxxxxxx> > > [ Upstream commit 75ff39ccc1bd5d3c455b6822ab09e533c551f758 ] > > Yue Cao claims that current host rate limiting of challenge ACKS > (RFC 5961) could leak enough information to allow a patient attacker > to hijack TCP sessions. He will soon provide details in an academic > paper. > > This patch increases the default limit from 100 to 1000, and adds > some randomization so that the attacker can no longer hijack > sessions without spending a considerable amount of probes. > > Based on initial analysis and patch from Linus. > > Note that we also have per socket rate limiting, so it is tempting > to remove the host limit in the future. > > v2: randomize the count of challenge acks per second, not the period. > > Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2") > Reported-by: Yue Cao <ycao009@xxxxxxx> > Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx> > Suggested-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> > Cc: Yuchung Cheng <ycheng@xxxxxxxxxx> > Cc: Neal Cardwell <ncardwell@xxxxxxxxxx> > Acked-by: Neal Cardwell <ncardwell@xxxxxxxxxx> > Acked-by: Yuchung Cheng <ycheng@xxxxxxxxxx> > Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> > [ ciwillia: backport to 3.10-stable ] > Signed-off-by: Chas Williams <ciwillia@xxxxxxxxxxx> (...) Thank you guys, I'm queuing this v3 then. Willy -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html