D27354.1791493596.diff
No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

D27354.1791493596.diff
View Options

	Index: sys/netinet/ip_icmp.c
	===================================================================
	--- sys/netinet/ip_icmp.c
	+++ sys/netinet/ip_icmp.c
	@@ -89,6 +89,12 @@
	&VNET_NAME(icmplim), 0,
	"Maximum number of ICMP responses per second");

	+VNET_DEFINE_STATIC(int, icmplim_inc) = 3;
	+#define V_icmplim_inc VNET(icmplim_inc)
	+SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim_inc, CTLFLAG_VNET \| CTLFLAG_RW,
	+ &VNET_NAME(icmplim_inc), 0,
	+ "Increment value for randomizing the number of ICMP responses per second");
	+
	VNET_DEFINE_STATIC(int, icmplim_output) = 1;
	#define V_icmplim_output VNET(icmplim_output)
	SYSCTL_INT(_net_inet_icmp, OID_AUTO, icmplim_output, CTLFLAG_VNET \| CTLFLAG_RW,
	@@ -1094,6 +1100,11 @@
	};
	#define V_icmp_rates VNET(icmp_rates)

	+/*
	+ * Adjust limit +/- to jitter the measurement for security.
	+ * CVE-2020-25705
	+ */
	+
	static void
	icmp_bandlimit_init(void)
	{
	@@ -1128,8 +1139,20 @@
	("%s: which %d", __func__, which));

	pps = counter_ratecheck(&V_icmp_rates[which].cr, V_icmplim);
	- if (pps == -1)
	+
	+ if (pps == -1) {
	+ /*
	+ * Add random jitter to the administratively set limit.
	+ */
	+ if (V_icmplim_inc > 0) {
	+ int32_t inc = arc4random_uniform(V_icmplim_inc);
	+ if (inc % 2)
	+ V_icmplim -= inc;
	+ else
	+ V_icmplim += inc;
	+ }
	return (-1);
	+ }
	if (pps > 0 && V_icmplim_output)
	log(LOG_NOTICE, "Limiting %s from %jd to %d packets/sec\n",
	V_icmp_rates[which].descr, (intmax_t )pps, V_icmplim);