All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Mickaël Salaün" <mic@digikod.net>
To: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>,
	willemdebruijn.kernel@gmail.com
Cc: linux-security-module@vger.kernel.org, netdev@vger.kernel.org,
	netfilter-devel@vger.kernel.org, yusongping@huawei.com,
	artem.kuzin@huawei.com, anton.sirazetdinov@huawei.com
Subject: Re: [RFC PATCH v4 03/15] landlock: landlock_find/insert_rule refactoring (TCP port 0)
Date: Tue, 12 Apr 2022 13:07:39 +0200	[thread overview]
Message-ID: <0e5afeaf-0569-d0b5-b701-0f611d103732@digikod.net> (raw)
In-Reply-To: <212ac1b3-b78b-4030-1f3d-f5cd1001bb7d@huawei.com>


On 23/03/2022 09:41, Konstantin Meskhidze wrote:
> 
> 
> 3/22/2022 4:24 PM, Mickaël Salaün пишет:
>>

[...]
>> The remaining question is: should we need to accept 0 as a valid TCP 
>> port? Can it be used? How does the kernel handle it?
> 
>   I agree that must be a check for port 0 in add_rule_net_service(), 
> cause unlike most port numbers, port 0 is a reserved port in TCP/IP 
> networking, meaning that it should not be used in TCP or UDP messages.
> Also network traffic sent across the internet to hosts listening on port 
> 0 might be generated from network attackers or accidentally by 
> applications programmed incorrectly.
> Source: https://www.lifewire.com/port-0-in-tcp-and-udp-818145

OK, so denying this port by default without a way to allow it should not 
be an issue. I guess an -EINVAL error would make sense when trying to 
allow this port. This should be documented in a comment (with a link to 
the RFC/section) and a dedicated test should check that behavior.

What is the behavior of firewalls (e.g. Netfiler) when trying to filter 
port 0?

This doesn't seem to be settle though: 
https://www.austingroupbugs.net/view.php?id=1068

Interesting article: 
https://z3r0trust.medium.com/socket-programming-the-bizarre-tcp-ip-port-0-saga-fcfbc0e0a276

  reply	other threads:[~2022-04-12 12:03 UTC|newest]

Thread overview: 63+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-03-09 13:44 [RFC PATCH v4 00/15] Landlock LSM Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 01/15] landlock: access mask renaming Konstantin Meskhidze
2022-04-01 16:47   ` Mickaël Salaün
2022-04-04  8:17     ` Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 02/15] landlock: filesystem access mask helpers Konstantin Meskhidze
2022-03-15 17:48   ` Mickaël Salaün
2022-03-17 13:25     ` Konstantin Meskhidze
2022-03-17 18:03       ` Mickaël Salaün
2022-03-18 11:36         ` Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 03/15] landlock: landlock_find/insert_rule refactoring Konstantin Meskhidze
2022-03-16  8:27   ` Mickaël Salaün
2022-03-17 14:29     ` Konstantin Meskhidze
2022-03-18 18:33       ` Mickaël Salaün
2022-03-22 12:33         ` Konstantin Meskhidze
2022-03-22 13:24           ` Mickaël Salaün
2022-03-23  8:41             ` Konstantin Meskhidze
2022-04-12 11:07               ` Mickaël Salaün [this message]
2022-04-26  9:15                 ` [RFC PATCH v4 03/15] landlock: landlock_find/insert_rule refactoring (TCP port 0) Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 04/15] landlock: merge and inherit function refactoring Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 05/15] landlock: unmask_layers() " Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 06/15] landlock: landlock_add_rule syscall refactoring Konstantin Meskhidze
2022-04-12 11:12   ` Mickaël Salaün
2022-04-26  8:30     ` Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 07/15] landlock: user space API network support Konstantin Meskhidze
2022-04-12 11:21   ` Mickaël Salaün
2022-04-12 13:48     ` Mickaël Salaün
2022-04-12 14:05       ` Konstantin Meskhidze
2022-04-12 16:10         ` Mickaël Salaün
2022-04-26 10:17           ` Konstantin Meskhidze
2022-04-25 14:29     ` Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 08/15] landlock: add support network rules Konstantin Meskhidze
2022-04-08 16:30   ` Mickaël Salaün
2022-04-11 13:44     ` Konstantin Meskhidze
2022-04-11 16:20       ` Mickaël Salaün
2022-04-12  8:38         ` Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 09/15] landlock: TCP network hooks implementation Konstantin Meskhidze
2022-04-11 16:24   ` Mickaël Salaün
2022-04-26  8:36     ` Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 10/15] seltest/landlock: add tests for bind() hooks Konstantin Meskhidze
2022-04-01 16:52   ` Mickaël Salaün
2022-04-04  8:28     ` Konstantin Meskhidze
2022-04-04  9:44       ` Mickaël Salaün
2022-04-06 14:12         ` Konstantin Meskhidze
2022-04-08 16:41           ` Mickaël Salaün
2022-04-26  9:35             ` Konstantin Meskhidze
2022-05-16 10:10     ` Mickaël Salaün
2022-05-16 10:22       ` Konstantin Meskhidze
2022-04-04 18:32   ` Mickaël Salaün
2022-04-06 14:17     ` Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 11/15] seltest/landlock: add tests for connect() hooks Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 12/15] seltest/landlock: connect() with AF_UNSPEC tests Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 13/15] seltest/landlock: rules overlapping test Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 14/15] seltest/landlock: ruleset expanding test Konstantin Meskhidze
2022-03-09 13:44 ` [RFC PATCH v4 15/15] seltest/landlock: invalid user input data test Konstantin Meskhidze
2022-03-15 17:02 ` [RFC PATCH v4 00/15] Landlock LSM Mickaël Salaün
2022-03-17 13:01   ` Konstantin Meskhidze
2022-03-17 17:26     ` Mickaël Salaün
2022-03-18 15:55       ` Konstantin Meskhidze
2022-03-23 16:30       ` Konstantin Meskhidze
2022-03-24 12:27         ` Mickaël Salaün
2022-03-24 13:34           ` Konstantin Meskhidze
2022-03-24 15:30             ` Mickaël Salaün
2022-03-24 16:19               ` Konstantin Meskhidze

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=0e5afeaf-0569-d0b5-b701-0f611d103732@digikod.net \
    --to=mic@digikod.net \
    --cc=anton.sirazetdinov@huawei.com \
    --cc=artem.kuzin@huawei.com \
    --cc=konstantin.meskhidze@huawei.com \
    --cc=linux-security-module@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=willemdebruijn.kernel@gmail.com \
    --cc=yusongping@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.