icmp: randomize the global rate limiter

Browse source

Keyu Man reported that the ICMP rate limiter could be used
by attackers to get useful signal. Details will be provided
in an upcoming academic publication.

Our solution is to add some noise, so that the attackers
no longer can get help from the predictable token bucket limiter.

Fixes: 4cdf507d54 ("icmp: add a global rate limitation")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Keyu Man <kman001@ucr.edu>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Eric Dumazet 2020-10-15 11:42:00 -07:00 • committed by Jakub Kicinski

parent 137d23cea1

commit b38e7819ca

2 changed files with 8 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

Documentation/networking/ip-sysctl.rst

View file

7

net/ipv4/icmp.c

View file