[PATCH net v2 0/4] Mitigate a side channel in routing exception caches

When an ICMP error that quotes a UDP packet is locally delivered, the
kernel only creates a routing exception if the quoted packet matches a
socket. This allows an off-path attacker to conduct a side-channel
attack on the routing exception caches in order to discover the
ephemeral ports used by connected UDP sockets.

Previous mitigations tried to make it harder for attackers to find hash
collisions in these caches and make the eviction of exceptions less
predictable. Amit Klein and Noam Caspi demonstrated that both of these
mitigations can be bypassed.

This patchset tries to mitigate such attacks by always creating an
exception, even before trying to find a matching socket. The exception
is created by the same helpers that are used when the quoted packet did
not originate from a socket, so that guesses (right or wrong) from an
off-path attacker always result in an exception being created or updated
in the cache that the attacker can observe.

Note that this mitigation does not make it easier for attackers to fill
these caches, since they can already create exceptions with little to no
validation. For example, by sending an ICMP error that quotes an ICMP
Echo Reply or one that quotes a UDP source port that matches a wildcard
socket.

In the good case (matched socket) this comes at the cost of an extra
route lookup, as the exception is created before the one performed by
the socket path. When the two lookups resolve to different nexthops, an
exception is created in the cache of each.

Patch #1 fixes a pre-existing bug in the handling of ICMPv6 Redirect
Message packets. Discovered while writing the selftest.

Patch #2 creates an exception from the IPv4 UDP code even before socket
matching. Other socket types do not need this: raw sockets have no
ports, and for TCP the ICMP error is discarded unless the quoted
sequence number is in window.

Patch #3 does the same for IPv6.

Patch #4 adds a selftest.

v2:
- Patch #2: Create exceptions unconditionally.
- Patch #3: Same.
- Patch #4: Add error checking in topology_setup(). Check for the
  arrival of an ICMP error in pmtu_socket().

v1: https://lore.kernel.org/netdev/20260826143735.1819315-1-idosch@nvidia.com/ (local)

Ido Schimmel (4):
  ipv6: Fix redirect exception creation for UDP/RAW sockets
  ipv4: udp: Create exceptions before socket matching
  ipv6: udp: Create exceptions before socket matching
  selftests: net: Add exception cache tests

 net/ipv4/udp.c                                |  11 +
 net/ipv6/route.c                              |   2 +-
 net/ipv6/udp.c                                |  13 +
 tools/testing/selftests/net/Makefile          |   1 +
 .../testing/selftests/net/exception_cache.sh  | 521 ++++++++++++++++++
 5 files changed, 547 insertions(+), 1 deletion(-)
 create mode 100755 tools/testing/selftests/net/exception_cache.sh

-- 
2.55.0