Re: [PATCH net 2/2] inetpeer: randomize RB-tree node comparison using SipHash

On Wed, Aug 12, 2026 at 10:59 PM Eric Dumazet <[email protected]> wrote:
>
> The inetpeer rate limiting system stores peer entries in a Red-Black tree
> keyed deterministically on the remote IP address. Because tree lookups walk
> the RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp),
> an off-path adversary can predict the exact topology of the tree and the
> sequence of nodes traversed during lookups (the gc_stack candidate list).
>
> By combining deterministic tree traversal with aggressive garbage collection
> (triggered when tree size exceeds inet_peer_threshold), an attacker can
> selectively force the eviction of targeted inet_peer nodes. When an evicted
> node is subsequently re-created upon receiving a new packet, its rate-limiting
> token bucket (rate_tokens, rate_last) is reset to full capacity. This creates
> a side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP
> rate limits and infer open UDP ports (similar to SAD DNS style attacks).
>
> Mitigate this by randomizing the RB-tree node comparison logic using SipHash
> with a secret boot-time key (inetpeer_hash_key). Nodes are ordered in the tree
> by SipHash(addr, key) rather than raw IP addresses. Because the secret key is
> unknown to external entities, the tree layout and lookup traversal paths are
> unpredictable to off-path adversaries, breaking the deterministic eviction
> gadget.
>
> Cache the computed 64-bit SipHash (hash) in struct inet_peer and compute the
> target hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing
> SipHash at every step of the RB-tree walk.
>
> Fixes: b145425f269a ("inetpeer: remove AVL implementation in favor of RB tree")
> Reported-by: Michael Blunt <[email protected]>
> Suggested-by: Michael Blunt <[email protected]>
> Signed-off-by: Eric Dumazet <[email protected]>
> ---

I will send a V2 to address sashiko's feedback (
https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260812205946.356185-1-edumazet%40google.com
)

pw-bot: cr