diff options
| author |   bluhm <bluhm@openbsd.org> | 2019-07-10 18:45:31 +0000 |
|---|---|---|
| committer | bluhm <bluhm@openbsd.org> | 2019-07-10 18:45:31 +0000 |
| commit | ed8fdce754a5d8d14c09e989d8877707bd43906f (patch) | |
| tree | 6bb6e44679fa049006e3344a12898e6ba7578beb /sys/netinet/tcp_input.c | |
| parent | Make read/write of the f_offset field belonging to struct file MP-safe; (diff) | |
| download | wireguard-openbsd-ed8fdce754a5d8d14c09e989d8877707bd43906f.tar.xz wireguard-openbsd-ed8fdce754a5d8d14c09e989d8877707bd43906f.zip | |
Received SACK options are managed by a linked list at the TCP socket.
There is a global tunable limit net.inet.tcp.sackholelimit, default
is 32768. If an attacker manages to attach all these sack holes
to a few TCP connections, the lists may grow long. Traversing them
might cause higher CPU consumption on the victim machine. In
practice such a situation is hard to create as the TCP retransmit
and 2*msl timer flush the list periodically. For additional
protection, enforce a per connection limit of 128 SACK holes in the
list.
reported by Reuven Plevinsky and Tal Vainshtein
discussed with claudio@ and procter@; OK deraadt@
Diffstat (limited to 'sys/netinet/tcp_input.c')
| -rw-r--r-- | sys/netinet/tcp_input.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c index 0244e2907ab..1726d653da0 100644 --- a/sys/netinet/tcp_input.c +++ b/sys/netinet/tcp_input.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tcp_input.c,v 1.359 2018/09/17 14:07:48 friehm Exp $ */ +/* $OpenBSD: tcp_input.c,v 1.360 2019/07/10 18:45:31 bluhm Exp $ */ /* $NetBSD: tcp_input.c,v 1.23 1996/02/13 23:43:44 christos Exp $ */ /* @@ -2492,6 +2492,8 @@ tcp_sack_option(struct tcpcb *tp, struct tcphdr *th, u_char *cp, int optlen) * ACKs some data in middle of a hole; need to * split current hole */ + if (tp->snd_numholes >= TCP_SACKHOLE_LIMIT) + goto done; temp = (struct sackhole *) pool_get(&sackhl_pool, PR_NOWAIT); if (temp == NULL) @@ -2519,6 +2521,8 @@ tcp_sack_option(struct tcpcb *tp, struct tcphdr *th, u_char *cp, int optlen) * Need to append new hole at end. * Last hole is p (and it's not NULL). */ + if (tp->snd_numholes >= TCP_SACKHOLE_LIMIT) + goto done; temp = (struct sackhole *) pool_get(&sackhl_pool, PR_NOWAIT); if (temp == NULL) |