| Message ID | 20220502084614.24123-1-w@1wt.eu (mailing list archive) |
|---|---|
| Headers | show |
| Series | insufficient TCP source port randomness | expand |
Hello: This series was applied to netdev/net.git (master) by Jakub Kicinski <kuba@kernel.org>: On Mon, 2 May 2022 10:46:07 +0200 you wrote: > Hi, > > In a not-yet published paper, Moshe Kol, Amit Klein, and Yossi Gilad > report being able to accurately identify a client by forcing it to emit > only 40 times more connections than the number of entries in the > table_perturb[] table, which is indexed by hashing the connection tuple. > The current 2^8 setting allows them to perform that attack with only 10k > connections, which is not hard to achieve in a few seconds. > > [...] Here is the summary with links: - [v3,net,1/7] secure_seq: use the 64 bits of the siphash for port offset calculation https://git.kernel.org/netdev/net/c/b2d057560b81 - [v3,net,2/7] tcp: use different parts of the port_offset for index and offset https://git.kernel.org/netdev/net/c/9e9b70ae923b - [v3,net,3/7] tcp: resalt the secret every 10 seconds https://git.kernel.org/netdev/net/c/4dfa9b438ee3 - [v3,net,4/7] tcp: add small random increments to the source port https://git.kernel.org/netdev/net/c/ca7af0402550 - [v3,net,5/7] tcp: dynamically allocate the perturb table used by source ports https://git.kernel.org/netdev/net/c/e9261476184b - [v3,net,6/7] tcp: increase source port perturb table to 2^16 https://git.kernel.org/netdev/net/c/4c2c8f03a5ab - [v3,net,7/7] tcp: drop the hash_32() part from the index calculation https://git.kernel.org/netdev/net/c/e8161345ddbb You are awesome, thank you!
Hi, In a not-yet published paper, Moshe Kol, Amit Klein, and Yossi Gilad report being able to accurately identify a client by forcing it to emit only 40 times more connections than the number of entries in the table_perturb[] table, which is indexed by hashing the connection tuple. The current 2^8 setting allows them to perform that attack with only 10k connections, which is not hard to achieve in a few seconds. Eric, Amit and I have been working on this for a few weeks now imagining, testing and eliminating a number of approaches that Amit and his team were still able to break or that were found to be too risky or too expensive, and ended up with the simple improvements in this series that resists to the attack, doesn't degrade the performance, and preserves a reliable port selection algorithm to avoid connection failures, including the odd/even port selection preference that allows bind() to always find a port quickly even under strong connect() stress. The approach relies on several factors: - resalting the hash secret that's used to choose the table_perturb[] entry every 10 seconds to eliminate slow attacks and force the attacker to forget everything that was learned after this delay. This already eliminates most of the problem because if a client stays silent for more than 10 seconds there's no link between the previous and the next patterns, and 10s isn't yet frequent enough to cause too frequent repetition of a same port that may induce a connection failure ; - adding small random increments to the source port. Previously, a random 0 or 1 was added every 16 ports. Now a random 0 to 7 is added after each port. This means that with the default 32768-60999 range, a worst case rollover happens after 1764 connections, and an average of 3137. This doesn't stop statistical attacks but requires significantly more iterations of the same attack to confirm a guess. - increasing the table_perturb[] size from 2^8 to 2^16, which Amit says will require 2.6 million connections to be attacked with the changes above, making it pointless to get a fingerprint that will only last 10 seconds. Due to the size, the table was made dynamic. - a few minor improvements on the bits used from the hash, to eliminate some unfortunate correlations that may possibly have been exploited to design future attack models. These changes were tested under the most extreme conditions, up to 1.1 million connections per second to one and a few targets, showing no performance regression, and only 2 connection failures within 13 billion, which is less than 2^-32 and perfectly within usual values. The series is split into small reviewable changes and was already reviewed by Amit and Eric. Regards, Willy --- v3: - fix field ordering in secure_ipv6_port_ephemeral() so that the timeseed is really part of the hashed array. Spotted by Jason. v2: - fixed build issue reported by lkp@intel.com on 32-bit archs due to the 64-by-32 divide; it's now correctly 32-by-32 as suggested by Eric - addressed the IPv6 hash size as well that was overlooked, as reported by Jason --- Eric Dumazet (1): tcp: resalt the secret every 10 seconds Willy Tarreau (6): secure_seq: use the 64 bits of the siphash for port offset calculation tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: increase source port perturb table to 2^16 tcp: drop the hash_32() part from the index calculation include/net/inet_hashtables.h | 2 +- include/net/secure_seq.h | 4 ++-- net/core/secure_seq.c | 16 ++++++++----- net/ipv4/inet_hashtables.c | 42 ++++++++++++++++++++++------------- net/ipv6/inet6_hashtables.c | 4 ++-- 5 files changed, 43 insertions(+), 25 deletions(-)