summaryrefslogtreecommitdiff
path: root/net/ipv4/inet_hashtables.c
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2021-02-09 22:20:28 +0300
committerDavid S. Miller <davem@davemloft.net>2021-02-12 00:13:05 +0300
commitc579bd1b4021c42ae247108f1e6f73dd3f08600c (patch)
tree49afd2838fa108b9b4b796e004da9741430d4c51 /net/ipv4/inet_hashtables.c
parent190cc82489f46f9d88e73c81a47e14f80a791e1a (diff)
downloadlinux-c579bd1b4021c42ae247108f1e6f73dd3f08600c.tar.xz
tcp: add some entropy in __inet_hash_connect()
Even when implementing RFC 6056 3.3.4 (Algorithm 4: Double-Hash Port Selection Algorithm), a patient attacker could still be able to collect enough state from an otherwise idle host. Idea of this patch is to inject some noise, in the cases __inet_hash_connect() found a candidate in the first attempt. This noise should not significantly reduce the collision avoidance, and should be zero if connection table is already well used. Note that this is not implementing RFC 6056 3.3.5 because we think Algorithm 5 could hurt typical workloads. Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: David Dworken <ddworken@google.com> Cc: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/inet_hashtables.c')
-rw-r--r--net/ipv4/inet_hashtables.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 12808dac923a..c96866a53a66 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -818,6 +818,11 @@ next_port:
return -EADDRNOTAVAIL;
ok:
+ /* If our first attempt found a candidate, skip next candidate
+ * in 1/16 of cases to add some noise.
+ */
+ if (!i && !(prandom_u32() % 16))
+ i = 2;
WRITE_ONCE(table_perturb[index], READ_ONCE(table_perturb[index]) + i + 2);
/* Head lock still held and bh's disabled */