Re: [PATCH v3 net] inetpeer: randomize RB-tree node comparison using SipHash

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

On Tue, 18 Aug 2026 15:12:13 +0000 you wrote:
> The inetpeer rate limiting system stores peer entries in a Red-Black tree
> keyed deterministically on the remote IP address. Because tree lookups walk
> the RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp),
> an off-path adversary can predict the exact topology of the tree and the
> sequence of nodes traversed during lookups (the gc_stack candidate list).
> 
> By combining deterministic tree traversal with aggressive garbage collection
> (triggered when tree size exceeds inet_peer_threshold), an attacker can
> selectively force the eviction of targeted inet_peer nodes. When an evicted
> node is subsequently re-created upon receiving a new packet, its rate-limiting
> token bucket (rate_tokens, rate_last) is reset to full capacity. This creates
> a side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP
> rate limits and infer open UDP ports (similar to SAD DNS style attacks).
> 
> [...]

Here is the summary with links:
  - [v3,net] inetpeer: randomize RB-tree node comparison using SipHash
    https://git.kernel.org/netdev/net/c/2ee66e948717

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html