colin/passt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

tcp: "TCP" hash secret doesn't need to be TCP specific

Browse Source 
The TCP state structure includes a 128-bit hash_secret which we use for
SipHash calculations to mitigate attacks on the TCP hash table and initial
sequence number.

We have plans to use SipHash in places that aren't TCP related, and there's
no particular reason they'd need their own secret.  So move the hash_secret
to the general context structure.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
David Gibson
2023-11-30 13:02:21 +11:00
committed by Stefano Brivio
parent cf83988e96
commit e21b6d69b1
4 changed files with 44 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
tcp.h
View File

@@ -52,7 +52,6 @@ union tcp_listen_epoll_ref {
/**
* struct tcp_ctx - Execution context for TCP routines
* @hash_secret: 128-bit secret for hash functions, ISN and hash table
* @port_to_tap: Ports bound host-side, packets to tap or spliced
* @fwd_in: Port forwarding configuration for inbound packets
* @fwd_out: Port forwarding configuration for outbound packets
@@ -61,7 +60,6 @@ union tcp_listen_epoll_ref {
* @pipe_size: Size of pipes for spliced connections
*/
struct tcp_ctx {
uint64_t hash_secret[2];
struct port_fwd fwd_in;
struct port_fwd fwd_out;
struct timespec timer_run;