netdev - Re: SO_REUSEADDR with UDP (again)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 13 Apr 2010 13:27:26 +0200
From:	Michal Svoboda <michal.svoboda@...nts.felk.cvut.cz>
To:	netdev@...r.kernel.org
Subject: Re: SO_REUSEADDR with UDP (again)

Eric Dumazet wrote:
> Why do you use REUSEADDR ? This is doing what is documented.
> 
>        SO_REUSEADDR
>               Indicates that the rules used in validating addresses  supplied
>               in  a  bind(2) call should allow reuse of local addresses.  For
>               AF_INET sockets this means that a socket may bind, except  when
>               there is an active listening socket bound to the address.  When
>               the listening socket is bound to  INADDR_ANY  with  a  specific
>               port then it is not possible to bind to this port for any local
>               address.  Argument is an integer boolean flag.

I read it 10 times but it doesn't say anything about stealing frames, or
implementation-defined behavior in this case.

> An UDP application wanting a port for its exclusive use dont set
> REUSEADDR, or basically allows anybody to bind an udp socket to same
> port, and potentially steal incoming frames.

That's fair enough, I will talk to the developers of the "very buggy"
applications that use this flag and ask them to reconsider.
 
> REUSEADDR is usually used when an application has several sockets bound
> to same port, but different IP addresses (or bound to different devices)

I just tried that and you can bind to different IPs without REUSEADDR.


Michal Svoboda


Content of type "application/pgp-signature" skipped