* [PATCH net 0/2] inet: use siphash in exception handling
@ 2021-08-25 23:17 Eric Dumazet
2021-08-25 23:17 ` [PATCH net 1/2] ipv6: use siphash in rt6_exception_hash() Eric Dumazet
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Eric Dumazet @ 2021-08-25 23:17 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski
Cc: netdev, Eric Dumazet, Eric Dumazet, Willy Tarreau, Keyu Man
From: Eric Dumazet <edumazet@google.com>
A group of security researchers brought to our attention
the weakness of hash functions used in rt6_exception_hash()
and fnhe_hashfun()
I made two distinct patches to help backports, since IPv6
part was added in 4.15
Eric Dumazet (2):
ipv6: use siphash in rt6_exception_hash()
ipv4: use siphash instead of Jenkins in fnhe_hashfun()
net/ipv4/route.c | 12 ++++++------
net/ipv6/route.c | 20 ++++++++++++++------
2 files changed, 20 insertions(+), 12 deletions(-)
--
2.33.0.rc2.250.ged5fa647cd-goog
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH net 1/2] ipv6: use siphash in rt6_exception_hash()
2021-08-25 23:17 [PATCH net 0/2] inet: use siphash in exception handling Eric Dumazet
@ 2021-08-25 23:17 ` Eric Dumazet
2021-08-26 0:11 ` Wei Wang
2021-08-25 23:17 ` [PATCH net 2/2] ipv4: use siphash instead of Jenkins in fnhe_hashfun() Eric Dumazet
2021-08-26 9:30 ` [PATCH net 0/2] inet: use siphash in exception handling patchwork-bot+netdevbpf
2 siblings, 1 reply; 5+ messages in thread
From: Eric Dumazet @ 2021-08-25 23:17 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski
Cc: netdev, Eric Dumazet, Eric Dumazet, Willy Tarreau, Keyu Man,
Wei Wang, Martin KaFai Lau
From: Eric Dumazet <edumazet@google.com>
A group of security researchers brought to our attention
the weakness of hash function used in rt6_exception_hash()
Lets use siphash instead of Jenkins Hash, to considerably
reduce security risks.
Following patch deals with IPv4.
Fixes: 35732d01fe31 ("ipv6: introduce a hash table to store dst cache")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Keyu Man <kman001@ucr.edu>
Cc: Wei Wang <weiwan@google.com>
Cc: Martin KaFai Lau <kafai@fb.com>
---
net/ipv6/route.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index b6ddf23d38330ded88509b8507998ce82a72799b..c5e8ecb96426bda619fe242351e40dcf6ff68bcf 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -41,6 +41,7 @@
#include <linux/nsproxy.h>
#include <linux/slab.h>
#include <linux/jhash.h>
+#include <linux/siphash.h>
#include <net/net_namespace.h>
#include <net/snmp.h>
#include <net/ipv6.h>
@@ -1484,17 +1485,24 @@ static void rt6_exception_remove_oldest(struct rt6_exception_bucket *bucket)
static u32 rt6_exception_hash(const struct in6_addr *dst,
const struct in6_addr *src)
{
- static u32 seed __read_mostly;
- u32 val;
+ static siphash_key_t rt6_exception_key __read_mostly;
+ struct {
+ struct in6_addr dst;
+ struct in6_addr src;
+ } __aligned(SIPHASH_ALIGNMENT) combined = {
+ .dst = *dst,
+ };
+ u64 val;
- net_get_random_once(&seed, sizeof(seed));
- val = jhash2((const u32 *)dst, sizeof(*dst)/sizeof(u32), seed);
+ net_get_random_once(&rt6_exception_key, sizeof(rt6_exception_key));
#ifdef CONFIG_IPV6_SUBTREES
if (src)
- val = jhash2((const u32 *)src, sizeof(*src)/sizeof(u32), val);
+ combined.src = *src;
#endif
- return hash_32(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
+ val = siphash(&combined, sizeof(combined), &rt6_exception_key);
+
+ return hash_64(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
}
/* Helper function to find the cached rt in the hash table
--
2.33.0.rc2.250.ged5fa647cd-goog
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH net 2/2] ipv4: use siphash instead of Jenkins in fnhe_hashfun()
2021-08-25 23:17 [PATCH net 0/2] inet: use siphash in exception handling Eric Dumazet
2021-08-25 23:17 ` [PATCH net 1/2] ipv6: use siphash in rt6_exception_hash() Eric Dumazet
@ 2021-08-25 23:17 ` Eric Dumazet
2021-08-26 9:30 ` [PATCH net 0/2] inet: use siphash in exception handling patchwork-bot+netdevbpf
2 siblings, 0 replies; 5+ messages in thread
From: Eric Dumazet @ 2021-08-25 23:17 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski
Cc: netdev, Eric Dumazet, Eric Dumazet, Willy Tarreau, Keyu Man
From: Eric Dumazet <edumazet@google.com>
A group of security researchers brought to our attention
the weakness of hash function used in fnhe_hashfun().
Lets use siphash instead of Jenkins Hash, to considerably
reduce security risks.
Also remove the inline keyword, this really is distracting.
Fixes: d546c621542d ("ipv4: harden fnhe_hashfun()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Keyu Man <kman001@ucr.edu>
Cc: Willy Tarreau <w@1wt.eu>
---
net/ipv4/route.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 99c06944501ab1a8de0960acfdc9f1825b7079b1..a6f20ee3533554b210d27c4ab6637ca7a05b148b 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -600,14 +600,14 @@ static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash)
return oldest;
}
-static inline u32 fnhe_hashfun(__be32 daddr)
+static u32 fnhe_hashfun(__be32 daddr)
{
- static u32 fnhe_hashrnd __read_mostly;
- u32 hval;
+ static siphash_key_t fnhe_hash_key __read_mostly;
+ u64 hval;
- net_get_random_once(&fnhe_hashrnd, sizeof(fnhe_hashrnd));
- hval = jhash_1word((__force u32)daddr, fnhe_hashrnd);
- return hash_32(hval, FNHE_HASH_SHIFT);
+ net_get_random_once(&fnhe_hash_key, sizeof(fnhe_hash_key));
+ hval = siphash_1u32((__force u32)daddr, &fnhe_hash_key);
+ return hash_64(hval, FNHE_HASH_SHIFT);
}
static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
--
2.33.0.rc2.250.ged5fa647cd-goog
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH net 1/2] ipv6: use siphash in rt6_exception_hash()
2021-08-25 23:17 ` [PATCH net 1/2] ipv6: use siphash in rt6_exception_hash() Eric Dumazet
@ 2021-08-26 0:11 ` Wei Wang
0 siblings, 0 replies; 5+ messages in thread
From: Wei Wang @ 2021-08-26 0:11 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S . Miller, Jakub Kicinski, netdev, Eric Dumazet,
Willy Tarreau, Keyu Man, Martin KaFai Lau
On Wed, Aug 25, 2021 at 4:17 PM Eric Dumazet <eric.dumazet@gmail.com> wrote:
>
> From: Eric Dumazet <edumazet@google.com>
>
> A group of security researchers brought to our attention
> the weakness of hash function used in rt6_exception_hash()
>
> Lets use siphash instead of Jenkins Hash, to considerably
> reduce security risks.
>
> Following patch deals with IPv4.
>
> Fixes: 35732d01fe31 ("ipv6: introduce a hash table to store dst cache")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: Keyu Man <kman001@ucr.edu>
> Cc: Wei Wang <weiwan@google.com>
> Cc: Martin KaFai Lau <kafai@fb.com>
Acked-by: Wei Wang <weiwan@google.com>
Thanks Eric!
> ---
>
>
>
> net/ipv6/route.c | 20 ++++++++++++++------
> 1 file changed, 14 insertions(+), 6 deletions(-)
>
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index b6ddf23d38330ded88509b8507998ce82a72799b..c5e8ecb96426bda619fe242351e40dcf6ff68bcf 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -41,6 +41,7 @@
> #include <linux/nsproxy.h>
> #include <linux/slab.h>
> #include <linux/jhash.h>
> +#include <linux/siphash.h>
> #include <net/net_namespace.h>
> #include <net/snmp.h>
> #include <net/ipv6.h>
> @@ -1484,17 +1485,24 @@ static void rt6_exception_remove_oldest(struct rt6_exception_bucket *bucket)
> static u32 rt6_exception_hash(const struct in6_addr *dst,
> const struct in6_addr *src)
> {
> - static u32 seed __read_mostly;
> - u32 val;
> + static siphash_key_t rt6_exception_key __read_mostly;
> + struct {
> + struct in6_addr dst;
> + struct in6_addr src;
> + } __aligned(SIPHASH_ALIGNMENT) combined = {
> + .dst = *dst,
> + };
> + u64 val;
>
> - net_get_random_once(&seed, sizeof(seed));
> - val = jhash2((const u32 *)dst, sizeof(*dst)/sizeof(u32), seed);
> + net_get_random_once(&rt6_exception_key, sizeof(rt6_exception_key));
>
> #ifdef CONFIG_IPV6_SUBTREES
> if (src)
> - val = jhash2((const u32 *)src, sizeof(*src)/sizeof(u32), val);
> + combined.src = *src;
> #endif
> - return hash_32(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
> + val = siphash(&combined, sizeof(combined), &rt6_exception_key);
> +
> + return hash_64(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
> }
>
> /* Helper function to find the cached rt in the hash table
> --
> 2.33.0.rc2.250.ged5fa647cd-goog
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net 0/2] inet: use siphash in exception handling
2021-08-25 23:17 [PATCH net 0/2] inet: use siphash in exception handling Eric Dumazet
2021-08-25 23:17 ` [PATCH net 1/2] ipv6: use siphash in rt6_exception_hash() Eric Dumazet
2021-08-25 23:17 ` [PATCH net 2/2] ipv4: use siphash instead of Jenkins in fnhe_hashfun() Eric Dumazet
@ 2021-08-26 9:30 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 5+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-08-26 9:30 UTC (permalink / raw)
To: Eric Dumazet; +Cc: davem, kuba, netdev, edumazet, w, kman001
Hello:
This series was applied to netdev/net.git (refs/heads/master):
On Wed, 25 Aug 2021 16:17:27 -0700 you wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> A group of security researchers brought to our attention
> the weakness of hash functions used in rt6_exception_hash()
> and fnhe_hashfun()
>
> I made two distinct patches to help backports, since IPv6
> part was added in 4.15
>
> [...]
Here is the summary with links:
- [net,1/2] ipv6: use siphash in rt6_exception_hash()
https://git.kernel.org/netdev/net/c/4785305c05b2
- [net,2/2] ipv4: use siphash instead of Jenkins in fnhe_hashfun()
https://git.kernel.org/netdev/net/c/6457378fe796
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-08-26 9:30 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-25 23:17 [PATCH net 0/2] inet: use siphash in exception handling Eric Dumazet
2021-08-25 23:17 ` [PATCH net 1/2] ipv6: use siphash in rt6_exception_hash() Eric Dumazet
2021-08-26 0:11 ` Wei Wang
2021-08-25 23:17 ` [PATCH net 2/2] ipv4: use siphash instead of Jenkins in fnhe_hashfun() Eric Dumazet
2021-08-26 9:30 ` [PATCH net 0/2] inet: use siphash in exception handling patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.