netdev - Re: Add a SOCK_DESTROY operation to close sockets from userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1447819493.22599.137.camel@edumazet-glaptop2.roam.corp.google.com>
Date:	Tue, 17 Nov 2015 20:04:53 -0800
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Stephen Hemminger <stephen@...workplumber.org>
Cc:	Lorenzo Colitti <lorenzo@...gle.com>, netdev@...r.kernel.org,
	edumazet@...gle.com, ek@...gle.com, maze@...gle.com,
	dtor@...gle.com
Subject: Re: Add a SOCK_DESTROY operation to close sockets from userspace

On Tue, 2015-11-17 at 19:27 -0800, Stephen Hemminger wrote:

> I understand why you might want this, but it smells like the same
> kind of problems that the "forced unmount" patch had which eventually
> led to it not being accepted in mainline.  Lots of corner
> cases and race conditions waiting to blow up.

Well, disconnecting a TCP socket seems straightforward, once you get a
sk pointer.

Code looks good.

> 
> Look at the issues that the multi-thread socket close has.
> This looks worse.

I do not see a problem here. A RST packet has roughly same effect, and
we do process them.

Cookies are 64bits and uniquely identify a socket.

Once you make sure the request comes from a privileged user, we are
good.

This user could easily install some iptables rules to generate RST
packets anyway.


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html