No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Eric Dumazet 80cca53a48 tcp: change source port randomizarion at connect() time
commit 190cc82489f46f9d88e73c81a47e14f80a791e1a upstream.

RFC 6056 (Recommendations for Transport-Protocol Port Randomization)
provides good summary of why source selection needs extra care.

David Dworken reminded us that linux implements Algorithm 3
as described in RFC 6056 3.3.3

Quoting David :
   In the context of the web, this creates an interesting info leak where
   websites can count how many TCP connections a user's computer is
   establishing over time. For example, this allows a website to count
   exactly how many subresources a third party website loaded.
   This also allows:
   - Distinguishing between different users behind a VPN based on
       distinct source port ranges.
   - Tracking users over time across multiple networks.
   - Covert communication channels between different browsers/browser
       profiles running on the same computer
   - Tracking what applications are running on a computer based on
       the pattern of how fast source ports are getting incremented.

Section 3.3.4 describes an enhancement, that reduces
attackers ability to use the basic information currently
stored into the shared 'u32 hint'.

This change also decreases collision rate when
multiple applications need to connect() to
different destinations.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: David Dworken <ddworken@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-06 08:33:49 +02:00
arch x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests 2022-06-06 08:33:48 +02:00
block block: return ELEVATOR_DISCARD_MERGE if possible 2022-05-25 09:14:38 +02:00
certs certs: Trigger creation of RSA module signing key if it's not an RSA key 2021-09-15 09:47:29 +02:00
crypto crypto: authenc - Fix sleep in atomic context in decrypt_tail 2022-04-15 14:18:04 +02:00
Documentation Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE"" 2022-05-25 09:14:38 +02:00
drivers Input: goodix - fix spurious key release events 2022-06-06 08:33:48 +02:00
fs afs: Fix afs_getattr() to refetch file status if callback break occurred 2022-05-25 09:14:39 +02:00
include lockdown: also lock down previous kgdb use 2022-06-06 08:33:48 +02:00
init init/main.c: return 1 from handled __setup() functions 2022-04-15 14:18:35 +02:00
ipc shm: extend forced shm destroy to support objects from several IPC nses 2021-12-01 09:23:35 +01:00
kernel lockdown: also lock down previous kgdb use 2022-06-06 08:33:48 +02:00
lib dim: initialize all struct fields 2022-05-18 09:47:25 +02:00
LICENSES
mm mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic() 2022-05-15 19:54:47 +02:00
net tcp: change source port randomizarion at connect() time 2022-06-06 08:33:49 +02:00
samples samples/kretprobes: Fix return value if register_kretprobe() failed 2021-11-17 09:48:39 +01:00
scripts gcc-plugins: latent_entropy: use /dev/urandom 2022-04-20 09:19:38 +02:00
security lockdown: also lock down previous kgdb use 2022-06-06 08:33:48 +02:00
sound ALSA: wavefront: Proper check of get_user() error 2022-05-25 09:14:34 +02:00
tools x86/xen: Mark cpu_bringup_and_idle() as dead_end_function 2022-05-25 09:14:38 +02:00
usr
virt KVM: Prevent module exit until all VMs are freed 2022-04-15 14:18:27 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.196 2022-05-25 09:14:39 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.