diff options
Diffstat (limited to 'sys-kernel/linux-sources-redcore-lts-legacy/files')
| -rw-r--r-- | sys-kernel/linux-sources-redcore-lts-legacy/files/4.19-amd64.config | 1 | ||||
| -rw-r--r-- | sys-kernel/linux-sources-redcore-lts-legacy/files/4.19-linux-hardened-disable-stealth-networking.patch | 426 |
2 files changed, 1 insertions, 426 deletions
diff --git a/sys-kernel/linux-sources-redcore-lts-legacy/files/4.19-amd64.config b/sys-kernel/linux-sources-redcore-lts-legacy/files/4.19-amd64.config index a04d18cc..7dbc8f7a 100644 --- a/sys-kernel/linux-sources-redcore-lts-legacy/files/4.19-amd64.config +++ b/sys-kernel/linux-sources-redcore-lts-legacy/files/4.19-amd64.config @@ -8749,6 +8749,7 @@ CONFIG_DEFAULT_SECURITY="apparmor" # Hardened Enhancements # CONFIG_HARDENED_RANDOM=y +CONFIG_HARDENED_STEALTH_NETWORKING=y CONFIG_HARDENED_NO_SIMULT_CONNECT=y CONFIG_HARDENED_SYSFS_RESTRICT=y CONFIG_HARDENED_FIFO=y diff --git a/sys-kernel/linux-sources-redcore-lts-legacy/files/4.19-linux-hardened-disable-stealth-networking.patch b/sys-kernel/linux-sources-redcore-lts-legacy/files/4.19-linux-hardened-disable-stealth-networking.patch deleted file mode 100644 index d290f937..00000000 --- a/sys-kernel/linux-sources-redcore-lts-legacy/files/4.19-linux-hardened-disable-stealth-networking.patch +++ /dev/null @@ -1,426 +0,0 @@ -diff -Nur a/include/uapi/linux/ip.h b/include/uapi/linux/ip.h ---- a/include/uapi/linux/ip.h 2020-03-07 21:59:46.833570272 +0000 -+++ b/include/uapi/linux/ip.h 2020-03-07 22:06:28.909470648 +0000 -@@ -66,9 +66,6 @@ - - #define IPVERSION 4 - #define MAXTTL 255 --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING --#define IPDEFTTL 128 --#else - #define IPDEFTTL 64 - #endif - -diff -Nur a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c ---- a/net/core/sysctl_net_core.c 2020-03-07 21:59:46.853570565 +0000 -+++ b/net/core/sysctl_net_core.c 2020-03-07 22:07:10.190076177 +0000 -@@ -36,10 +36,6 @@ - int sysctl_fb_tunnels_only_for_init_net __read_mostly = 0; - EXPORT_SYMBOL(sysctl_fb_tunnels_only_for_init_net); - --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING --int sysctl_stealth_blackhole __read_mostly = 1; --#endif -- - #ifdef CONFIG_RPS - static int rps_sock_flow_sysctl(struct ctl_table *table, int write, - void __user *buffer, size_t *lenp, loff_t *ppos) -@@ -509,17 +505,6 @@ - .proc_handler = set_default_qdisc - }, - #endif --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- { -- .procname = "ip_blackhole", -- .data = &sysctl_stealth_blackhole, -- .maxlen = sizeof(int), -- .mode = 0644, -- .proc_handler = proc_dointvec_minmax, -- .extra1 = &zero, -- .extra2 = &one, -- }, --#endif - #endif /* CONFIG_NET */ - { - .procname = "netdev_budget", -diff -Nur a/net/ipv4/icmp.c b/net/ipv4/icmp.c ---- a/net/ipv4/icmp.c 2020-03-07 21:59:46.853570565 +0000 -+++ b/net/ipv4/icmp.c 2020-03-07 22:08:25.271177396 +0000 -@@ -195,10 +195,6 @@ - short error; /* This ICMP is classed as an error message */ - }; - --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING --extern int sysctl_stealth_blackhole; --#endif -- - static const struct icmp_control icmp_pointers[NR_ICMP_TYPES+1]; - - /* -@@ -938,11 +934,6 @@ - { - struct net *net; - --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- if (likely(sysctl_stealth_blackhole) && !(skb->dev->flags & IFF_LOOPBACK)) -- return true; --#endif -- - net = dev_net(skb_dst(skb)->dev); - if (!net->ipv4.sysctl_icmp_echo_ignore_all) { - struct icmp_bxm icmp_param; -@@ -970,11 +961,6 @@ - { - struct icmp_bxm icmp_param; - --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- if (likely(sysctl_stealth_blackhole) && !(skb->dev->flags & IFF_LOOPBACK)) -- return true; --#endif -- - /* - * Too short. - */ -diff -Nur a/net/ipv4/igmp.c b/net/ipv4/igmp.c ---- a/net/ipv4/igmp.c 2020-03-07 21:59:46.853570565 +0000 -+++ b/net/ipv4/igmp.c 2020-03-07 22:09:13.161879736 +0000 -@@ -136,10 +136,6 @@ - ((in_dev)->mr_v2_seen && \ - time_before(jiffies, (in_dev)->mr_v2_seen))) - --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING --extern int sysctl_stealth_blackhole; --#endif -- - static int unsolicited_report_interval(struct in_device *in_dev) - { - int interval_ms, interval_jiffies; -@@ -741,11 +737,6 @@ - __be32 dst; - int hlen, tlen; - --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- if (likely(sysctl_stealth_blackhole)) -- return -1; --#endif -- - if (type == IGMPV3_HOST_MEMBERSHIP_REPORT) - return igmpv3_send_report(in_dev, pmc); - -diff -Nur a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c ---- a/net/ipv4/tcp_ipv4.c 2020-03-07 21:59:46.853570565 +0000 -+++ b/net/ipv4/tcp_ipv4.c 2020-03-07 22:12:16.564568875 +0000 -@@ -95,10 +95,6 @@ - struct inet_hashinfo tcp_hashinfo; - EXPORT_SYMBOL(tcp_hashinfo); - --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING --extern int sysctl_stealth_blackhole; --#endif -- - static u32 tcp_v4_init_seq(const struct sk_buff *skb) - { - return secure_tcp_seq(ip_hdr(skb)->daddr, -@@ -1565,9 +1561,6 @@ - return 0; - - reset: --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- if (!likely(sysctl_stealth_blackhole)) --#endif - tcp_v4_send_reset(rsk, skb); - discard: - kfree_skb(skb); -@@ -1716,27 +1709,6 @@ - if (!pskb_may_pull(skb, th->doff * 4)) - goto discard_it; - --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- if (likely(sysctl_stealth_blackhole) && -- ( -- th->res1 || !tcp_flag_word(th) || -- tcp_flag_word(th) == TCP_FLAG_PSH || -- tcp_flag_word(th) & (TCP_FLAG_CWR | TCP_FLAG_ECE) || -- ( -- tcp_flag_word(th) & -- (TCP_FLAG_SYN | TCP_FLAG_FIN | TCP_FLAG_RST) && -- tcp_flag_word(th) & TCP_FLAG_URG -- ) || -- ( -- tcp_flag_word(th) & -- (TCP_FLAG_FIN | TCP_FLAG_RST) && -- tcp_flag_word(th) & TCP_FLAG_SYN -- ) -- ) -- ) -- goto discard_it; --#endif -- - /* An explanation is required here, I think. - * Packet length and doff are validated by header prediction, - * provided case of th->doff==0 is eliminated. -@@ -1750,22 +1722,12 @@ - lookup: - sk = __inet_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th), th->source, - th->dest, sdif, &refcounted); -- if (!sk) { --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- ret = 1; --#endif -- -+ if (!sk) - goto no_tcp_socket; -- } - - process: -- if (sk->sk_state == TCP_TIME_WAIT) { --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- ret = 2; --#endif -- -+ if (sk->sk_state == TCP_TIME_WAIT) - goto do_time_wait; -- } - - if (sk->sk_state == TCP_NEW_SYN_RECV) { - struct request_sock *req = inet_reqsk(sk); -@@ -1879,10 +1841,6 @@ - bad_packet: - __TCP_INC_STATS(net, TCP_MIB_INERRS); - } else { --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- if (!sysctl_stealth_blackhole || (ret == 1 && -- (skb->dev->flags & IFF_LOOPBACK))) --#endif - - tcp_v4_send_reset(NULL, skb); - } -diff -Nur a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c ---- a/net/ipv4/tcp_minisocks.c 2020-03-07 21:59:46.853570565 +0000 -+++ b/net/ipv4/tcp_minisocks.c 2020-03-07 22:12:39.754908842 +0000 -@@ -29,10 +29,6 @@ - #include <net/xfrm.h> - #include <net/busy_poll.h> - --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING --extern int sysctl_stealth_blackhole; --#endif -- - static bool tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win) - { - if (seq == s_win) -@@ -813,10 +809,6 @@ - * avoid becoming vulnerable to outside attack aiming at - * resetting legit local connections. - */ --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- if (!sysctl_stealth_blackhole || skb->dev->flags & IFF_LOOPBACK) --#endif -- - req->rsk_ops->send_reset(sk, skb); - } else if (fastopen) { /* received a valid RST pkt */ - reqsk_fastopen_remove(sk, req, true); -diff -Nur a/net/ipv4/udp.c b/net/ipv4/udp.c ---- a/net/ipv4/udp.c 2020-03-07 21:59:46.853570565 +0000 -+++ b/net/ipv4/udp.c 2020-03-07 22:13:06.595302301 +0000 -@@ -128,10 +128,6 @@ - #define MAX_UDP_PORTS 65536 - #define PORTS_PER_CHAIN (MAX_UDP_PORTS / UDP_HTABLE_SIZE_MIN) - --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING --extern int sysctl_stealth_blackhole; --#endif -- - /* IPCB reference means this can not be used from early demux */ - static bool udp_lib_exact_dif_match(struct net *net, struct sk_buff *skb) - { -@@ -2266,9 +2262,6 @@ - goto csum_error; - - __UDP_INC_STATS(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE); --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- if (!likely(sysctl_stealth_blackhole) || (skb->dev->flags & IFF_LOOPBACK)) --#endif - icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0); - - /* -diff -Nur a/net/ipv6/icmp.c b/net/ipv6/icmp.c ---- a/net/ipv6/icmp.c 2020-03-07 21:59:46.853570565 +0000 -+++ b/net/ipv6/icmp.c 2020-03-07 22:16:58.198696714 +0000 -@@ -72,10 +72,6 @@ - - #include <linux/uaccess.h> - --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING --extern int sysctl_stealth_blackhole; --#endif -- - /* - * The ICMP socket(s). This is the most convenient way to flow control - * our ICMP output as well as maintain a clean interface throughout -@@ -852,9 +848,6 @@ - - switch (type) { - case ICMPV6_ECHO_REQUEST: --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- if (!sysctl_stealth_blackhole || skb->dev->flags & IFF_LOOPBACK) --#endif - if (!net->ipv6.sysctl.icmpv6_echo_ignore_all) - icmpv6_echo_reply(skb); - break; -diff -Nur a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c ---- a/net/ipv6/tcp_ipv6.c 2020-03-07 21:59:46.853570565 +0000 -+++ b/net/ipv6/tcp_ipv6.c 2020-03-07 22:20:43.832029273 +0000 -@@ -71,10 +71,6 @@ - - #include <trace/events/tcp.h> - --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING --extern int sysctl_stealth_blackhole; --#endif -- - static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb); - static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb, - struct request_sock *req); -@@ -1360,10 +1356,6 @@ - return 0; - - reset: --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- if (!likely(sysctl_stealth_blackhole)) --#endif -- - tcp_v6_send_reset(sk, skb); - discard: - if (opt_skb) -@@ -1461,27 +1453,6 @@ - if (!pskb_may_pull(skb, th->doff*4)) - goto discard_it; - --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- if (likely(sysctl_stealth_blackhole) && -- ( -- th->res1 || !tcp_flag_word(th) || -- tcp_flag_word(th) == TCP_FLAG_PSH || -- tcp_flag_word(th) & (TCP_FLAG_CWR | TCP_FLAG_ECE) || -- ( -- tcp_flag_word(th) & -- (TCP_FLAG_SYN | TCP_FLAG_FIN | TCP_FLAG_RST) && -- tcp_flag_word(th) & TCP_FLAG_URG -- ) || -- ( -- tcp_flag_word(th) & -- (TCP_FLAG_FIN | TCP_FLAG_RST) && -- tcp_flag_word(th) & TCP_FLAG_SYN -- ) -- ) -- ) -- goto discard_it; --#endif -- - if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo)) - goto csum_error; - -@@ -1492,22 +1463,12 @@ - sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th), - th->source, th->dest, inet6_iif(skb), sdif, - &refcounted); -- if (!sk) { --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- ret = 1; --#endif -- -+ if (!sk) - goto no_tcp_socket; -- } - - process: -- if (sk->sk_state == TCP_TIME_WAIT) { --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- ret = 2; --#endif -- -+ if (sk->sk_state == TCP_TIME_WAIT) - goto do_time_wait; -- } - - if (sk->sk_state == TCP_NEW_SYN_RECV) { - struct request_sock *req = inet_reqsk(sk); -@@ -1615,11 +1576,6 @@ - bad_packet: - __TCP_INC_STATS(net, TCP_MIB_INERRS); - } else { --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- if (!sysctl_stealth_blackhole || (ret == 1 && -- (skb->dev->flags & IFF_LOOPBACK))) --#endif -- - tcp_v6_send_reset(NULL, skb); - } - -diff -Nur a/net/ipv6/udp.c b/net/ipv6/udp.c ---- a/net/ipv6/udp.c 2020-03-07 21:59:46.853570565 +0000 -+++ b/net/ipv6/udp.c 2020-03-07 22:21:22.692605157 +0000 -@@ -56,10 +56,6 @@ - #include <trace/events/skb.h> - #include "udp_impl.h" - --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING --extern int sysctl_stealth_blackhole; --#endif -- - static bool udp6_lib_exact_dif_match(struct net *net, struct sk_buff *skb) - { - #if defined(CONFIG_NET_L3_MASTER_DEV) -@@ -867,9 +863,6 @@ - goto csum_error; - - __UDP6_INC_STATS(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE); --#ifdef CONFIG_HARDENED_STEALTH_NETWORKING -- if (!likely(sysctl_stealth_blackhole) || skb->dev->flags & IFF_LOOPBACK) --#endif - icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0); - - kfree_skb(skb); -diff -Nur a/security/Kconfig b/security/Kconfig ---- a/security/Kconfig 2020-03-07 21:59:46.853570565 +0000 -+++ b/security/Kconfig 2020-03-07 22:21:47.792977092 +0000 -@@ -345,38 +345,6 @@ - enhances the random number generator. - - --config HARDENED_STEALTH_NETWORKING -- bool "Enable stealth networking [GRSECURITY]" -- default n -- depends on NET -- help -- If you say Y here, neither TCP resets nor ICMP -- destination-unreachable packets will be sent in response to packets -- sent to ports for which no associated listening process exists. -- This feature supports both IPV4 and IPV6 and exempts the -- loopback interface from blackholing. Enabling this feature -- makes a host more resilient to DoS attacks and reduces network -- visibility against scanners. -- -- The blackhole feature as-implemented is equivalent to the FreeBSD -- blackhole feature, as it prevents RST responses to all packets, not -- just SYNs. Under most application behavior this causes no -- problems, but applications (like haproxy) may not close certain -- connections in a way that cleanly terminates them on the remote -- end, leaving the remote host in LAST_ACK state. Because of this -- side-effect and to prevent intentional LAST_ACK DoSes, this -- feature also adds automatic mitigation against such attacks. -- The mitigation drastically reduces the amount of time a socket -- can spend in LAST_ACK state. If you're using haproxy and not -- all servers it connects to have this option enabled, consider -- disabling this feature on the haproxy host. -- -- If the sysctl option is enabled, a sysctl option with names -- "ip_blackhole" will be created. -- This sysctl, "ip_blackhole" takes the standard zero/non-zero -- on/off toggle to enable or disable this feature. -- -- - config HARDENED_NO_SIMULT_CONNECT - bool "Disable simultaneous TCP connections [GRSECURITY]" - default n |