[PATCH] TCP ipv4 source port randomization

[PATCH] TCP ipv4 source port randomization

[Lorenzo Hernández García-Hierro]

[-- Attachment #1.1: Type: text/plain, Size: 912 bytes --]

Hi,

"When source port is generated on the fly for the TCP protocol (ie. with
connect() ) will
be altered so that the source port is generated at random, instead of a simple
incrementing algorithm."

Ported from grsecurity (http://www.grsecurity.net by Brad Spengler).

Instead of using the PaX & grsecurity-dependent get_random_long() function, we use
the new randomization infrastructure introduced by Arjan van de Ven <arjanv@redhat.com>,
providing the helpers get_random_int() and randomize_range().

More information at:
http://people.redhat.com/arjanv/randomize/02-randomize-infrastructure

The patch is also available at:
http://pearls.tuxedo-es.org/patches/security/tcp-rand_src-ports.patch

Signed-off-by: Lorenzo Hernandez Garcia-Hierro <lorenzo@gnu.org>

Cheers,
-- 
Lorenzo Hernández García-Hierro <lorenzo@gnu.org> 
[1024D/6F2B2DEC] & [2048g/9AE91A22][http://tuxedo-es.org]

[-- Attachment #1.2: tcp-rand_src-ports.patch --]
[-- Type: text/x-patch, Size: 1550 bytes --]


When source port is generated on the fly for the TCP protocol (ie. with connect() ) will
be altered so that the source port is generated at random, instead of a simple
incrementing algorithm.

Ported from grsecurity (http://www.grsecurity.net by Brad Spengler).

Instead of using the PaX & grsecurity-dependent get_random_long() function, we use
the new randomization infrastructure introduced by Arjan van de Ven <arjanv@redhat.com>,
providing the helpers get_random_int() and randomize_range().

More information at:
http://people.redhat.com/arjanv/randomize/02-randomize-infrastructure

Signed-off-by: Lorenzo Hernandez Garcia-Hierro <lorenzo@gnu.org>
---

 linux-2.6.11-lorenzo/net/ipv4/tcp_ipv4.c |    5 +++++
 1 files changed, 5 insertions(+)

diff -puN net/ipv4/tcp_ipv4.c~tcp-rand_src-ports net/ipv4/tcp_ipv4.c
--- linux-2.6.11/net/ipv4/tcp_ipv4.c~tcp-rand_src-ports	2005-04-17 17:31:27.233438208 +0200
+++ linux-2.6.11-lorenzo/net/ipv4/tcp_ipv4.c	2005-04-17 17:37:03.528313616 +0200
@@ -224,6 +224,9 @@ static int tcp_v4_get_port(struct sock *
 		spin_lock(&tcp_portalloc_lock);
 		rover = tcp_port_rover;
 
+		if (high > low)
+			rover = low + (get_random_int() % remaining);
+
 		do {
 			rover++;
 			if (rover < low || rover > high)
@@ -666,6 +669,8 @@ static inline int tcp_v4_hash_connect(st
 		struct hlist_node *node;
  		struct tcp_tw_bucket *tw = NULL;
 
+ 		offset = get_random_int();
+
  		local_bh_disable();
 		for (i = 1; i <= range; i++) {
 			port = low + (i + offset) % range;
_

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [PATCH] TCP ipv4 source port randomization

[David S. Miller]

Stephen Hemminger has already added TCP port randomization on
connect() to the 2.6.x tree.  See
net/ipv4/tcp_ipv4.c:tcp_v4_hash_connect(), where randomized port
selection occurs.  And unlike your patch, Stephen did add ipv6
support (via net/ipv6/tcp_ipv6.c:tcp_v6_hash_connect()) for
port randomization as well.

I'd like to ask two things:

1) That you use netdev@oss.sgi.com for networking patches as that
   is where the networking developers listen.
2) That you do some checking to see that the feature you're adding
   is not already present in the tree.

Thanks a lot.

Re: [PATCH] TCP ipv4 source port randomization

[Lorenzo Hernández García-Hierro]

[-- Attachment #1: Type: text/plain, Size: 1065 bytes --]

El lun, 18-04-2005 a las 12:26 -0700, David S. Miller escribió:
> Stephen Hemminger has already added TCP port randomization on
> connect() to the 2.6.x tree.  See
> net/ipv4/tcp_ipv4.c:tcp_v4_hash_connect(), where randomized port
> selection occurs.  And unlike your patch, Stephen did add ipv6
> support (via net/ipv6/tcp_ipv6.c:tcp_v6_hash_connect()) for
> port randomization as well.

I missed Hemminger's bits there.
I apologize for any inconvenience.

> 
> 1) That you use netdev@oss.sgi.com for networking patches as that
>    is where the networking developers listen.

OK.

> 2) That you do some checking to see that the feature you're adding
>    is not already present in the tree.

I do, just missed that ;)
Among that I have the patch done since time ago, just didn't submitted
it to the list, so, during the transition I forgot all about any change
(nor I checked the CSETs).

Thanks for the advice,
Cheers.
-- 
Lorenzo Hernández García-Hierro <lorenzo@gnu.org> 
[1024D/6F2B2DEC] & [2048g/9AE91A22][http://tuxedo-es.org]

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]