From: Eric Dumazet <[email protected]> Date: Sun, 10 Jul 2016 10:04:02 +0200
> From: Eric Dumazet <[email protected]> > > Yue Cao claims that current host rate limiting of challenge ACKS > (RFC 5961) could leak enough information to allow a patient attacker > to hijack TCP sessions. He will soon provide details in an academic > paper. > > This patch increases the default limit from 100 to 1000, and adds > some randomization so that the attacker can no longer hijack > sessions without spending a considerable amount of probes. > > Based on initial analysis and patch from Linus. > > Note that we also have per socket rate limiting, so it is tempting > to remove the host limit in the future. > > v2: randomize the count of challenge acks per second, not the period. > > Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2") > Reported-by: Yue Cao <[email protected]> > Signed-off-by: Eric Dumazet <[email protected]> > Suggested-by: Linus Torvalds <[email protected]> Applied and queued up for -stable, thanks Eric.
