diff options
| author | Florian Westphal <fw@strlen.de> | 2013-09-20 22:32:56 +0200 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2014-03-14 23:01:53 +0100 |
| commit | c880551355b056f9d23d522fe3f8b4da975d950b (patch) | |
| tree | 2d5fa8029b54956f6f17b10c88970593e945000b /net/ipv6 | |
| parent | 6c17205526423c520d8a708d4dbcecbdfe7e9f72 (diff) | |
tcp: syncookies: reduce mss table to four values
commit 086293542b991fb88a2e41ae7b4f82ac65a20e1a upstream.
Halve mss table size to make blind cookie guessing more difficult.
This is sad since the tables were already small, but there
is little alternative except perhaps adding more precise mss information
in the tcp timestamp. Timestamps are unfortunately not ubiquitous.
Guessing all possible cookie values still has 8-in 2**32 chance.
Reported-by: Jakob Lell <jakob@jakoblell.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/syncookies.c | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c index 13ca0a0ea680..d703218a653b 100644 --- a/net/ipv6/syncookies.c +++ b/net/ipv6/syncookies.c @@ -24,15 +24,18 @@ #define COOKIEBITS 24 /* Upper bits store count */ #define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1) -/* Table must be sorted. */ +/* RFC 2460, Section 8.3: + * [ipv6 tcp] MSS must be computed as the maximum packet size minus 60 [..] + * + * Due to IPV6_MIN_MTU=1280 the lowest possible MSS is 1220, which allows + * using higher values than ipv4 tcp syncookies. + * The other values are chosen based on ethernet (1500 and 9k MTU), plus + * one that accounts for common encap (PPPoe) overhead. Table must be sorted. + */ static __u16 const msstab[] = { - 64, - 512, - 536, - 1280 - 60, + 1280 - 60, /* IPV6_MIN_MTU - 60 */ 1480 - 60, 1500 - 60, - 4460 - 60, 9000 - 60, }; |