Sophie

Sophie

distrib > Scientific%20Linux > 5x > x86_64 > by-pkgid > 27922b4260f65d317aabda37e42bbbff > files > 3047

kernel-2.6.18-238.el5.src.rpm

From: Eugene Teo <eteo@redhat.com>
Date: Wed, 9 Jul 2008 16:32:01 +0800
Subject: [net] randomize udp port allocation
Message-id: 20080709083201.GC11111@kernel.sg
O-Subject: [RHEL5.3 PATCH] BZ#454572 kernel: randomize udp port allocation
Bugzilla: 454572
RH-Acked-by: David S. Miller <davem@redhat.com>
RH-Acked-by: Neil Horman <nhorman@redhat.com>
RH-Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com>

Backport of upstream commit 32c1da70810017a98aa6c431a5494a302b6b9a30

This patch causes UDP port allocation to be randomized like TCP. The
earlier code would always choose same port (ie first empty list).

Implementing this would mitigate CVE-2008-1447 as applied to the glibc
stub resolver.

Signed-off-by: Eugene Teo <eteo@redhat.com>

 include/net/udp.h |    2 -
 net/ipv4/udp.c    |   64 ++++++++++++++++++++++++++--------------------------
 net/ipv6/udp.c    |   60 +++++++++++++++++++++++++++----------------------
 3 files changed, 65 insertions(+), 61 deletions(-)

 include/net/udp.h |    2 -
 net/ipv4/udp.c    |   64 ++++++++++++++++++++++++++--------------------------
 net/ipv6/udp.c    |   60 +++++++++++++++++++++++++++----------------------
 3 files changed, 65 insertions(+), 61 deletions(-)

 include/net/udp.h |    2 -
 net/ipv4/udp.c    |   64 ++++++++++++++++++++++++++--------------------------
 net/ipv6/udp.c    |   60 +++++++++++++++++++++++++++----------------------
 3 files changed, 65 insertions(+), 61 deletions(-)

diff --git a/include/net/udp.h b/include/net/udp.h
index dd5e3b6..97fe4b5 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -37,8 +37,6 @@
 extern struct hlist_head udp_hash[UDP_HTABLE_SIZE];
 extern rwlock_t udp_hash_lock;
 
-extern int udp_port_rover;
-
 static inline int udp_lport_inuse(u16 num)
 {
 	struct sock *sk;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 8223397..483b625 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -130,9 +130,6 @@ EXPORT_SYMBOL(sysctl_udp_wmem_min);
 atomic_t udp_memory_allocated;
 EXPORT_SYMBOL(udp_memory_allocated);
 
-/* Shared by v4/v6 udp. */
-int udp_port_rover;
-
 static int udp_v4_get_port(struct sock *sk, unsigned short snum)
 {
 	struct hlist_node *node;
@@ -140,47 +137,51 @@ static int udp_v4_get_port(struct sock *sk, unsigned short snum)
 	struct inet_sock *inet = inet_sk(sk);
 
 	write_lock_bh(&udp_hash_lock);
-	if (snum == 0) {
-		int best_size_so_far, best, result, i, low, high;
+	if (!snum) {
+		int i, low, high, remaining;
+		unsigned rover, best, best_size_so_far;
 
 		inet_get_local_port_range(&low, &high);
+		remaining = (high - low) + 1;
+
+		best_size_so_far = UINT_MAX;
+		best = rover = net_random() % remaining + low;
 
-		if (udp_port_rover > high ||
-		    udp_port_rover < low)
-			udp_port_rover = low;
-		best_size_so_far = 32767;
-		best = result = udp_port_rover;
-		for (i = 0; i < UDP_HTABLE_SIZE; i++, result++) {
+		/* 1st pass: look for empty (or shortest) hash chain */
+		for (i = 0; i < UDP_HTABLE_SIZE; i++) {
 			struct hlist_head *list;
-			int size;
+			int size = 0;
 
-			list = &udp_hash[result & (UDP_HTABLE_SIZE - 1)];
-			if (hlist_empty(list)) {
-				if (result > high)
-					result = low + ((result - low) &
-						 (UDP_HTABLE_SIZE - 1));
+			list = &udp_hash[rover & (UDP_HTABLE_SIZE - 1)];
+			if (hlist_empty(list))
 				goto gotit;
-			}
-			size = 0;
+
 			sk_for_each(sk2, node, list)
 				if (++size >= best_size_so_far)
 					goto next;
 			best_size_so_far = size;
-			best = result;
-		next:;
+			best = rover;
+		next:
+			/* fold back if end of range */
+			if (++rover > high)
+				rover = low + ((rover - low)
+				            & (UDP_HTABLE_SIZE - 1));
 		}
-		result = best;
-		for(i = 0; i < (1 << 16) / UDP_HTABLE_SIZE; i++, result += UDP_HTABLE_SIZE) {
-			if (result > high)
-				result = low + ((result - low) &
-					   (UDP_HTABLE_SIZE - 1));
-			if (!udp_lport_inuse(result))
-				break;
+		/* 2nd pass: find hole in shortest hash chain */
+		rover = best;
+		for (i = 0; i < (1 << 16) / UDP_HTABLE_SIZE; i++) {
+			if (!udp_lport_inuse(rover))
+				goto gotit;
+			rover += UDP_HTABLE_SIZE;
+			if (rover > high)
+				rover = low + ((rover - low)
+				            & (UDP_HTABLE_SIZE - 1));
 		}
-		if (i >= (1 << 16) / UDP_HTABLE_SIZE)
-			goto fail;
+		/* All ports in use! */
+		goto fail;
+
 gotit:
-		udp_port_rover = snum = result;
+		snum = rover;
 	} else {
 		sk_for_each(sk2, node,
 			    &udp_hash[snum & (UDP_HTABLE_SIZE - 1)]) {
@@ -1638,7 +1639,6 @@ EXPORT_SYMBOL(udp_disconnect);
 EXPORT_SYMBOL(udp_hash);
 EXPORT_SYMBOL(udp_hash_lock);
 EXPORT_SYMBOL(udp_ioctl);
-EXPORT_SYMBOL(udp_port_rover);
 EXPORT_SYMBOL(udp_prot);
 EXPORT_SYMBOL(udp_sendmsg);
 EXPORT_SYMBOL(udp_poll);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 56a69b4..ac58df5 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -70,45 +70,51 @@ static int udp_v6_get_port(struct sock *sk, unsigned short snum)
 	struct hlist_node *node;
 
 	write_lock_bh(&udp_hash_lock);
-	if (snum == 0) {
-		int best_size_so_far, best, result, i, low, high;
+	if (!snum) {
+		int i, low, high, remaining;
+		unsigned rover, best, best_size_so_far;
 
 		inet_get_local_port_range(&low, &high);
-		if (udp_port_rover > high || udp_port_rover < low)
-			udp_port_rover = low;
-		best_size_so_far = 32767;
-		best = result = udp_port_rover;
-		for (i = 0; i < UDP_HTABLE_SIZE; i++, result++) {
-			int size;
+		remaining = (high - low) + 1;
+
+		best_size_so_far = UINT_MAX;
+		best = rover = net_random() % remaining + low;
+
+		/* 1st pass: look for empty (or shortest) hash chain */
+		for (i = 0; i < UDP_HTABLE_SIZE; i++) {
+			int size = 0;
 			struct hlist_head *list;
 
-			list = &udp_hash[result & (UDP_HTABLE_SIZE - 1)];
-			if (hlist_empty(list)) {
-				if (result > high)
-					result = low + ((result - low) &
-						 (UDP_HTABLE_SIZE - 1));
+			list = &udp_hash[rover & (UDP_HTABLE_SIZE - 1)];
+			if (hlist_empty(list))
 				goto gotit;
-			}
-			size = 0;
+
 			sk_for_each(sk2, node, list)
 				if (++size >= best_size_so_far)
 					goto next;
 			best_size_so_far = size;
-			best = result;
-		next:;
+			best = rover;
+		next:
+			/* fold back if end of range */
+			if (++rover > high)
+				rover = low + ((rover - low)
+				            & (UDP_HTABLE_SIZE - 1));
 		}
-		result = best;
-		for(i = 0; i < (1 << 16) / UDP_HTABLE_SIZE; i++, result += UDP_HTABLE_SIZE) {
-			if (result > high)
-				result = low + ((result - low) &
-					   (UDP_HTABLE_SIZE - 1));
-			if (!udp_lport_inuse(result))
-				break;
+		/* 2nd pass: find hole in shortest hash chain */
+		rover = best;
+		for (i = 0; i < (1 << 16) / UDP_HTABLE_SIZE; i++) {
+			if (!udp_lport_inuse(rover))
+				goto gotit;
+			rover += UDP_HTABLE_SIZE;
+			if (rover > high)
+				rover = low + ((rover - low)
+				            & (UDP_HTABLE_SIZE - 1));
 		}
-		if (i >= (1 << 16) / UDP_HTABLE_SIZE)
-			goto fail;
+		/* All ports in use! */
+		goto fail;
+
 gotit:
-		udp_port_rover = snum = result;
+		snum = rover;
 	} else {
 		sk_for_each(sk2, node,
 			    &udp_hash[snum & (UDP_HTABLE_SIZE - 1)]) {

Perl :: Catalyst :: PostgreSQL :: RPM Valid HTML 4.01 Transitional