netdev - [PATCH] net: ip: Do not allow connection to remote port zero

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150212005844.GB3829@nwwn.com>
Date:	Wed, 11 Feb 2015 16:58:45 -0800
From:	Tom Marshall <tom@...gn.com>
To:	netdev@...r.kernel.org
Subject: [PATCH] net: ip: Do not allow connection to remote port zero

Port zero is reserved according to IANA.

Note UDP sendto is already disallowed if dport is zero.

Signed-off-by: Tom Marshall <tom@...gn.com>
---
 net/ipv4/datagram.c | 3 +++
 net/ipv4/tcp_ipv4.c | 3 +++
 net/ipv6/datagram.c | 3 +++
 net/ipv6/tcp_ipv6.c | 3 +++
 4 files changed, 12 insertions(+)

diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 90c0e83..e732382 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -37,6 +37,9 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	if (usin->sin_family != AF_INET)
 		return -EAFNOSUPPORT;
 
+	if (!usin->sin_port)
+		return -EINVAL;
+
 	sk_dst_reset(sk);
 
 	lock_sock(sk);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index d22f544..fef2f9f 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -156,6 +156,9 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	if (usin->sin_family != AF_INET)
 		return -EAFNOSUPPORT;
 
+	if (!usin->sin_port)
+		return -EINVAL;
+
 	nexthop = daddr = usin->sin_addr.s_addr;
 	inet_opt = rcu_dereference_protected(inet->inet_opt,
 					     sock_owned_by_user(sk));
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 49f5e73..fb6934e 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -66,6 +66,9 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	if (usin->sin6_family != AF_INET6)
 		return -EAFNOSUPPORT;
 
+	if (!usin->sin6_port)
+		return -EINVAL;
+
 	memset(&fl6, 0, sizeof(fl6));
 	if (np->sndflow) {
 		fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 9c0b54e..1ae8bf1 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -146,6 +146,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 	if (usin->sin6_family != AF_INET6)
 		return -EAFNOSUPPORT;
 
+	if (!usin->sin6_port)
+		return -EINVAL;
+
 	memset(&fl6, 0, sizeof(fl6));
 
 	if (np->sndflow) {
-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html