* [PATCH net 0/2] inet: make exception handling less predictible
@ 2021-08-29 22:16 Eric Dumazet
2021-08-29 22:16 ` [PATCH net 1/2] ipv6: make exception cache " Eric Dumazet
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: Eric Dumazet @ 2021-08-29 22:16 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski
Cc: netdev, Eric Dumazet, Eric Dumazet, Willy Tarreau, Keyu Man,
David Ahern
From: Eric Dumazet <edumazet@google•com>
This second round of patches is addressing Keyu Man recommendations
to make linux hosts more robust against a class of brute force attacks.
Eric Dumazet (2):
ipv6: make exception cache less predictible
ipv4: make exception cache less predictible
net/ipv4/route.c | 44 +++++++++++++++++++++++++++++---------------
net/ipv6/route.c | 5 ++++-
2 files changed, 33 insertions(+), 16 deletions(-)
--
2.33.0.259.gc128427fd7-goog
^ permalink raw reply [flat|nested] 7+ messages in thread* [PATCH net 1/2] ipv6: make exception cache less predictible 2021-08-29 22:16 [PATCH net 0/2] inet: make exception handling less predictible Eric Dumazet @ 2021-08-29 22:16 ` Eric Dumazet 2021-08-30 0:39 ` David Ahern 2021-08-29 22:16 ` [PATCH net 2/2] ipv4: " Eric Dumazet 2021-08-30 18:04 ` [PATCH net 0/2] inet: make exception handling " Keyu Man 2 siblings, 1 reply; 7+ messages in thread From: Eric Dumazet @ 2021-08-29 22:16 UTC (permalink / raw) To: David S . Miller, Jakub Kicinski Cc: netdev, Eric Dumazet, Eric Dumazet, Willy Tarreau, Keyu Man, David Ahern, Wei Wang, Martin KaFai Lau From: Eric Dumazet <edumazet@google•com> Even after commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()"), an attacker can still use brute force to learn some secrets from a victim linux host. One way to defeat these attacks is to make the max depth of the hash table bucket a random value. Before this patch, each bucket of the hash table used to store exceptions could contain 6 items under attack. After the patch, each bucket would contains a random number of items, between 6 and 10. The attacker can no longer infer secrets. This is slightly increasing memory size used by the hash table, we do not expect this to be a problem. Following patch is dealing with the same issue in IPv4. Fixes: 35732d01fe31 ("ipv6: introduce a hash table to store dst cache") Signed-off-by: Eric Dumazet <edumazet@google•com> Reported-by: Keyu Man <kman001@ucr•edu> Cc: Wei Wang <weiwan@google•com> Cc: Martin KaFai Lau <kafai@fb•com> --- net/ipv6/route.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index c5e8ecb96426bda619fe242351e40dcf6ff68bcf..60334030210192660a7fa141163f36af7489d0ae 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -1657,6 +1657,7 @@ static int rt6_insert_exception(struct rt6_info *nrt, struct in6_addr *src_key = NULL; struct rt6_exception *rt6_ex; struct fib6_nh *nh = res->nh; + int max_depth; int err = 0; spin_lock_bh(&rt6_exception_lock); @@ -1711,7 +1712,9 @@ static int rt6_insert_exception(struct rt6_info *nrt, bucket->depth++; net->ipv6.rt6_stats->fib_rt_cache++; - if (bucket->depth > FIB6_MAX_DEPTH) + /* Randomize max depth to avoid some side channels attacks. */ + max_depth = FIB6_MAX_DEPTH + prandom_u32_max(FIB6_MAX_DEPTH); + while (bucket->depth > max_depth) rt6_exception_remove_oldest(bucket); out: -- 2.33.0.259.gc128427fd7-goog ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH net 1/2] ipv6: make exception cache less predictible 2021-08-29 22:16 ` [PATCH net 1/2] ipv6: make exception cache " Eric Dumazet @ 2021-08-30 0:39 ` David Ahern 2021-08-30 15:54 ` Wei Wang 0 siblings, 1 reply; 7+ messages in thread From: David Ahern @ 2021-08-30 0:39 UTC (permalink / raw) To: Eric Dumazet, David S . Miller, Jakub Kicinski Cc: netdev, Eric Dumazet, Willy Tarreau, Keyu Man, David Ahern, Wei Wang, Martin KaFai Lau On 8/29/21 3:16 PM, Eric Dumazet wrote: > From: Eric Dumazet <edumazet@google•com> > > Even after commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()"), > an attacker can still use brute force to learn some secrets from a victim > linux host. > > One way to defeat these attacks is to make the max depth of the hash > table bucket a random value. > > Before this patch, each bucket of the hash table used to store exceptions > could contain 6 items under attack. > > After the patch, each bucket would contains a random number of items, > between 6 and 10. The attacker can no longer infer secrets. > > This is slightly increasing memory size used by the hash table, > we do not expect this to be a problem. > > Following patch is dealing with the same issue in IPv4. > > Fixes: 35732d01fe31 ("ipv6: introduce a hash table to store dst cache") > Signed-off-by: Eric Dumazet <edumazet@google•com> > Reported-by: Keyu Man <kman001@ucr•edu> > Cc: Wei Wang <weiwan@google•com> > Cc: Martin KaFai Lau <kafai@fb•com> > --- > net/ipv6/route.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > Reviewed-by: David Ahern <dsahern@kernel•org> ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net 1/2] ipv6: make exception cache less predictible 2021-08-30 0:39 ` David Ahern @ 2021-08-30 15:54 ` Wei Wang 0 siblings, 0 replies; 7+ messages in thread From: Wei Wang @ 2021-08-30 15:54 UTC (permalink / raw) To: David Ahern Cc: Eric Dumazet, David S . Miller, Jakub Kicinski, netdev, Eric Dumazet, Willy Tarreau, Keyu Man, David Ahern, Martin KaFai Lau On Sun, Aug 29, 2021 at 5:39 PM David Ahern <dsahern@gmail•com> wrote: > > On 8/29/21 3:16 PM, Eric Dumazet wrote: > > From: Eric Dumazet <edumazet@google•com> > > > > Even after commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()"), > > an attacker can still use brute force to learn some secrets from a victim > > linux host. > > > > One way to defeat these attacks is to make the max depth of the hash > > table bucket a random value. > > > > Before this patch, each bucket of the hash table used to store exceptions > > could contain 6 items under attack. > > > > After the patch, each bucket would contains a random number of items, > > between 6 and 10. The attacker can no longer infer secrets. > > > > This is slightly increasing memory size used by the hash table, > > we do not expect this to be a problem. > > > > Following patch is dealing with the same issue in IPv4. > > > > Fixes: 35732d01fe31 ("ipv6: introduce a hash table to store dst cache") > > Signed-off-by: Eric Dumazet <edumazet@google•com> > > Reported-by: Keyu Man <kman001@ucr•edu> > > Cc: Wei Wang <weiwan@google•com> > > Cc: Martin KaFai Lau <kafai@fb•com> > > --- > > net/ipv6/route.c | 5 ++++- > > 1 file changed, 4 insertions(+), 1 deletion(-) > > > > Reviewed-by: David Ahern <dsahern@kernel•org> > Reviewed-by: Wei Wang <weiwan@google•com> Thanks Eric! ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH net 2/2] ipv4: make exception cache less predictible 2021-08-29 22:16 [PATCH net 0/2] inet: make exception handling less predictible Eric Dumazet 2021-08-29 22:16 ` [PATCH net 1/2] ipv6: make exception cache " Eric Dumazet @ 2021-08-29 22:16 ` Eric Dumazet 2021-08-30 0:40 ` David Ahern 2021-08-30 18:04 ` [PATCH net 0/2] inet: make exception handling " Keyu Man 2 siblings, 1 reply; 7+ messages in thread From: Eric Dumazet @ 2021-08-29 22:16 UTC (permalink / raw) To: David S . Miller, Jakub Kicinski Cc: netdev, Eric Dumazet, Eric Dumazet, Willy Tarreau, Keyu Man, David Ahern From: Eric Dumazet <edumazet@google•com> Even after commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in fnhe_hashfun()"), an attacker can still use brute force to learn some secrets from a victim linux host. One way to defeat these attacks is to make the max depth of the hash table bucket a random value. Before this patch, each bucket of the hash table used to store exceptions could contain 6 items under attack. After the patch, each bucket would contains a random number of items, between 6 and 10. The attacker can no longer infer secrets. This is slightly increasing memory size used by the hash table, by 50% in average, we do not expect this to be a problem. This patch is more complex than the prior one (IPv6 equivalent), because IPv4 was reusing the oldest entry. Since we need to be able to evict more than one entry per update_or_create_fnhe() call, I had to replace fnhe_oldest() with fnhe_remove_oldest(). Also note that we will queue extra kfree_rcu() calls under stress, which hopefully wont be a too big issue. Fixes: 4895c771c7f0 ("ipv4: Add FIB nexthop exceptions.") Signed-off-by: Eric Dumazet <edumazet@google•com> Reported-by: Keyu Man <kman001@ucr•edu> Cc: Willy Tarreau <w@1wt•eu> Signed-off-by: David S. Miller <davem@davemloft•net> --- net/ipv4/route.c | 44 +++++++++++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 15 deletions(-) diff --git a/net/ipv4/route.c b/net/ipv4/route.c index a6f20ee3533554b210d27c4ab6637ca7a05b148b..225714b5efc0b9c6bcd2d58a62d4656cdc5a1cde 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -586,18 +586,25 @@ static void fnhe_flush_routes(struct fib_nh_exception *fnhe) } } -static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash) +static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash) { - struct fib_nh_exception *fnhe, *oldest; + struct fib_nh_exception __rcu **fnhe_p, **oldest_p; + struct fib_nh_exception *fnhe, *oldest = NULL; - oldest = rcu_dereference(hash->chain); - for (fnhe = rcu_dereference(oldest->fnhe_next); fnhe; - fnhe = rcu_dereference(fnhe->fnhe_next)) { - if (time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp)) + for (fnhe_p = &hash->chain; ; fnhe_p = &fnhe->fnhe_next) { + fnhe = rcu_dereference_protected(*fnhe_p, + lockdep_is_held(&fnhe_lock)); + if (!fnhe) + break; + if (!oldest || + time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp)) { oldest = fnhe; + oldest_p = fnhe_p; + } } fnhe_flush_routes(oldest); - return oldest; + *oldest_p = oldest->fnhe_next; + kfree_rcu(oldest, rcu); } static u32 fnhe_hashfun(__be32 daddr) @@ -676,16 +683,21 @@ static void update_or_create_fnhe(struct fib_nh_common *nhc, __be32 daddr, if (rt) fill_route_from_fnhe(rt, fnhe); } else { - if (depth > FNHE_RECLAIM_DEPTH) - fnhe = fnhe_oldest(hash); - else { - fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC); - if (!fnhe) - goto out_unlock; + /* Randomize max depth to avoid some side channels attacks. */ + int max_depth = FNHE_RECLAIM_DEPTH + + prandom_u32_max(FNHE_RECLAIM_DEPTH); - fnhe->fnhe_next = hash->chain; - rcu_assign_pointer(hash->chain, fnhe); + while (depth > max_depth) { + fnhe_remove_oldest(hash); + depth--; } + + fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC); + if (!fnhe) + goto out_unlock; + + fnhe->fnhe_next = hash->chain; + fnhe->fnhe_genid = genid; fnhe->fnhe_daddr = daddr; fnhe->fnhe_gw = gw; @@ -693,6 +705,8 @@ static void update_or_create_fnhe(struct fib_nh_common *nhc, __be32 daddr, fnhe->fnhe_mtu_locked = lock; fnhe->fnhe_expires = max(1UL, expires); + rcu_assign_pointer(hash->chain, fnhe); + /* Exception created; mark the cached routes for the nexthop * stale, so anyone caching it rechecks if this exception * applies to them. -- 2.33.0.259.gc128427fd7-goog ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH net 2/2] ipv4: make exception cache less predictible 2021-08-29 22:16 ` [PATCH net 2/2] ipv4: " Eric Dumazet @ 2021-08-30 0:40 ` David Ahern 0 siblings, 0 replies; 7+ messages in thread From: David Ahern @ 2021-08-30 0:40 UTC (permalink / raw) To: Eric Dumazet, David S . Miller, Jakub Kicinski Cc: netdev, Eric Dumazet, Willy Tarreau, Keyu Man, David Ahern On 8/29/21 3:16 PM, Eric Dumazet wrote: > From: Eric Dumazet <edumazet@google•com> > > Even after commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in > fnhe_hashfun()"), an attacker can still use brute force to learn > some secrets from a victim linux host. > > One way to defeat these attacks is to make the max depth of the hash > table bucket a random value. > > Before this patch, each bucket of the hash table used to store exceptions > could contain 6 items under attack. > > After the patch, each bucket would contains a random number of items, > between 6 and 10. The attacker can no longer infer secrets. > > This is slightly increasing memory size used by the hash table, > by 50% in average, we do not expect this to be a problem. > > This patch is more complex than the prior one (IPv6 equivalent), > because IPv4 was reusing the oldest entry. > Since we need to be able to evict more than one entry per > update_or_create_fnhe() call, I had to replace > fnhe_oldest() with fnhe_remove_oldest(). > > Also note that we will queue extra kfree_rcu() calls under stress, > which hopefully wont be a too big issue. > > Fixes: 4895c771c7f0 ("ipv4: Add FIB nexthop exceptions.") > Signed-off-by: Eric Dumazet <edumazet@google•com> > Reported-by: Keyu Man <kman001@ucr•edu> > Cc: Willy Tarreau <w@1wt•eu> > Signed-off-by: David S. Miller <davem@davemloft•net> > --- > net/ipv4/route.c | 44 +++++++++++++++++++++++++++++--------------- > 1 file changed, 29 insertions(+), 15 deletions(-) > Reviewed-by: David Ahern <dsahern@kernel•org> Tested-by: David Ahern <dsahern@kernel•org> ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net 0/2] inet: make exception handling less predictible 2021-08-29 22:16 [PATCH net 0/2] inet: make exception handling less predictible Eric Dumazet 2021-08-29 22:16 ` [PATCH net 1/2] ipv6: make exception cache " Eric Dumazet 2021-08-29 22:16 ` [PATCH net 2/2] ipv4: " Eric Dumazet @ 2021-08-30 18:04 ` Keyu Man 2 siblings, 0 replies; 7+ messages in thread From: Keyu Man @ 2021-08-30 18:04 UTC (permalink / raw) To: Eric Dumazet, David S . Miller, Jakub Kicinski Cc: netdev, Eric Dumazet, Willy Tarreau, David Ahern Thanks Eric and others for fixing the bug! Keyu Man On 8/29/2021 3:16 PM, Eric Dumazet wrote: > From: Eric Dumazet <edumazet@google•com> > > This second round of patches is addressing Keyu Man recommendations > to make linux hosts more robust against a class of brute force attacks. > > Eric Dumazet (2): > ipv6: make exception cache less predictible > ipv4: make exception cache less predictible > > net/ipv4/route.c | 44 +++++++++++++++++++++++++++++--------------- > net/ipv6/route.c | 5 ++++- > 2 files changed, 33 insertions(+), 16 deletions(-) > ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2021-08-30 18:04 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2021-08-29 22:16 [PATCH net 0/2] inet: make exception handling less predictible Eric Dumazet 2021-08-29 22:16 ` [PATCH net 1/2] ipv6: make exception cache " Eric Dumazet 2021-08-30 0:39 ` David Ahern 2021-08-30 15:54 ` Wei Wang 2021-08-29 22:16 ` [PATCH net 2/2] ipv4: " Eric Dumazet 2021-08-30 0:40 ` David Ahern 2021-08-30 18:04 ` [PATCH net 0/2] inet: make exception handling " Keyu Man
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox