linux-kernel - Re: [PATCH 4.2.y-ckt 52/53] soreuseport: fix ordering for mixed v4/v6 sockets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Tue, 24 May 2016 14:30:01 -0400
From:	Craig Gallek <kraigatgoog@...il.com>
To:	Kamal Mostafa <kamal@...onical.com>
Cc:	LKML <linux-kernel@...r.kernel.org>, stable@...r.kernel.org,
	kernel-team@...ts.ubuntu.com, Eric Dumazet <edumazet@...gle.com>,
	"David S . Miller" <davem@...emloft.net>
Subject: Re: [PATCH 4.2.y-ckt 52/53] soreuseport: fix ordering for mixed v4/v6 sockets

On Tue, May 24, 2016 at 1:55 PM, Kamal Mostafa <kamal@...onical.com> wrote:
> 4.2.8-ckt11 -stable review patch.  If anyone has any objections, please let me know.
I don't believe the bug that this patch fixes was present in the 4.2
kernel.  That issue first appeared in 4.5 and was resolved during the
4.6 release candidate iterations.

Thanks,
Craig

> ---8<------------------------------------------------------------
>
> From: Craig Gallek <kraig@...gle.com>
>
> [ Upstream commit d894ba18d4e449b3a7f6eb491f16c9e02933736e ]
>
> With the SO_REUSEPORT socket option, it is possible to create sockets
> in the AF_INET and AF_INET6 domains which are bound to the same IPv4 address.
> This is only possible with SO_REUSEPORT and when not using IPV6_V6ONLY on
> the AF_INET6 sockets.
>
> Prior to the commits referenced below, an incoming IPv4 packet would
> always be routed to a socket of type AF_INET when this mixed-mode was used.
> After those changes, the same packet would be routed to the most recently
> bound socket (if this happened to be an AF_INET6 socket, it would
> have an IPv4 mapped IPv6 address).
>
> The change in behavior occurred because the recent SO_REUSEPORT optimizations
> short-circuit the socket scoring logic as soon as they find a match.  They
> did not take into account the scoring logic that favors AF_INET sockets
> over AF_INET6 sockets in the event of a tie.
>
> To fix this problem, this patch changes the insertion order of AF_INET
> and AF_INET6 addresses in the TCP and UDP socket lists when the sockets
> have SO_REUSEPORT set.  AF_INET sockets will be inserted at the head of the
> list and AF_INET6 sockets with SO_REUSEPORT set will always be inserted at
> the tail of the list.  This will force AF_INET sockets to always be
> considered first.
>
> Fixes: e32ea7e74727 ("soreuseport: fast reuseport UDP socket selection")
> Fixes: 125e80b88687 ("soreuseport: fast reuseport TCP socket selection")
>
> Reported-by: Maciej Żenczykowski <maze@...gle.com>
> Signed-off-by: Craig Gallek <kraig@...gle.com>
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Signed-off-by: David S. Miller <davem@...emloft.net>
> Signed-off-by: Kamal Mostafa <kamal@...onical.com>
> ---