From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.9 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EEAEDC4BA0A for ; Wed, 26 Feb 2020 07:46:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C563921D7E for ; Wed, 26 Feb 2020 07:46:57 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=amazon.co.jp header.i=@amazon.co.jp header.b="GYzxMqIt" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727426AbgBZHq5 (ORCPT ); Wed, 26 Feb 2020 02:46:57 -0500 Received: from smtp-fw-6001.amazon.com ([52.95.48.154]:28442 "EHLO smtp-fw-6001.amazon.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727276AbgBZHq4 (ORCPT ); Wed, 26 Feb 2020 02:46:56 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.co.jp; i=@amazon.co.jp; q=dns/txt; s=amazon201209; t=1582703215; x=1614239215; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=3vezOoOWgsJ4V4lu7//7IhJSKybYYvn/FqtnOEQJJu4=; b=GYzxMqItv8A7I327L0YZwOC6OKNZje1b9K7/XdeTE1pcJ2HfBUwejhfS z5UIzRYbSajxw7oElnbqL0k+zwtvyLVyRWUOlADTIqdgJY1fwRgQeaD0w eOO8tY1N4nYgMn3lfnnj26V/lnmaXC2rLy8jun+lRJZLASH2EEzID9kEa o=; IronPort-SDR: TQDXEotAWUWS2EpePcbZNyUxHOYKUu6E91LJodW5HVM5UZ2Eb48LgobhqXu/n8152Y/s8iFsSU Mx0dYRzgqBVw== X-IronPort-AV: E=Sophos;i="5.70,487,1574121600"; d="scan'208";a="19712359" Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-1a-807d4a99.us-east-1.amazon.com) ([10.43.8.6]) by smtp-border-fw-out-6001.iad6.amazon.com with ESMTP; 26 Feb 2020 07:46:54 +0000 Received: from EX13MTAUWA001.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan2.iad.amazon.com [10.40.159.162]) by email-inbound-relay-1a-807d4a99.us-east-1.amazon.com (Postfix) with ESMTPS id B3A09A1CAB; Wed, 26 Feb 2020 07:46:52 +0000 (UTC) Received: from EX13D04ANC001.ant.amazon.com (10.43.157.89) by EX13MTAUWA001.ant.amazon.com (10.43.160.58) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Wed, 26 Feb 2020 07:46:51 +0000 Received: from 38f9d3582de7.ant.amazon.com.com (10.43.160.8) by EX13D04ANC001.ant.amazon.com (10.43.157.89) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Wed, 26 Feb 2020 07:46:48 +0000 From: Kuniyuki Iwashima To: , , , CC: , , , Subject: [PATCH v2 net-next 3/3] tcp: Prevent port hijacking when ports are exhausted. Date: Wed, 26 Feb 2020 16:46:31 +0900 Message-ID: <20200226074631.67688-4-kuniyu@amazon.co.jp> X-Mailer: git-send-email 2.17.2 (Apple Git-113) In-Reply-To: <20200226074631.67688-1-kuniyu@amazon.co.jp> References: <20200226074631.67688-1-kuniyu@amazon.co.jp> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.43.160.8] X-ClientProxiedBy: EX13D21UWA003.ant.amazon.com (10.43.160.184) To EX13D04ANC001.ant.amazon.com (10.43.157.89) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org If all of the sockets bound to the same port have SO_REUSEADDR and SO_REUSEPORT enabled, any other user can hijack the port by exhausting all ephemeral ports, binding sockets to (addr, 0) and calling listen(). If both of SO_REUSEADDR and SO_REUSEPORT are enabled, the restriction of SO_REUSEPORT should be taken into account so that can only one socket be in TCP_LISTEN. Signed-off-by: Kuniyuki Iwashima --- net/ipv4/inet_connection_sock.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index cddeab240ea6..d27ed5fe7147 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -131,7 +131,7 @@ static int inet_csk_bind_conflict(const struct sock *sk, { struct sock *sk2; bool reuse = sk->sk_reuse; - bool reuseport = !!sk->sk_reuseport && reuseport_ok; + bool reuseport = !!sk->sk_reuseport; kuid_t uid = sock_i_uid((struct sock *)sk); /* @@ -148,10 +148,16 @@ static int inet_csk_bind_conflict(const struct sock *sk, sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) { if (reuse && sk2->sk_reuse && sk2->sk_state != TCP_LISTEN) { - if (!relax && + if ((!relax || + (!reuseport_ok && + reuseport && sk2->sk_reuseport && + !rcu_access_pointer(sk->sk_reuseport_cb) && + (sk2->sk_state == TCP_TIME_WAIT || + uid_eq(uid, sock_i_uid(sk2))))) && inet_rcv_saddr_equal(sk, sk2, true)) break; - } else if (!reuseport || !sk2->sk_reuseport || + } else if (!reuseport_ok || + !reuseport || !sk2->sk_reuseport || rcu_access_pointer(sk->sk_reuseport_cb) || (sk2->sk_state != TCP_TIME_WAIT && !uid_eq(uid, sock_i_uid(sk2)))) { -- 2.17.2 (Apple Git-113)