netdev - Fw: [Bug 201773] New: IP_FREEBIND doesn’t counteract global

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 23 Nov 2018 09:23:27 -0800
From:   Stephen Hemminger <stephen@...workplumber.org>
To:     netdev@...r.kernel.org
Subject: Fw: [Bug 201773] New: IP_FREEBIND doesn’t
 counteract global

Could be a bug, or just how it works?

Begin forwarded message:

Date: Thu, 22 Nov 2018 22:51:12 +0000
From: bugzilla-daemon@...zilla.kernel.org
To: stephen@...workplumber.org
Subject: [Bug 201773] New: IP_FREEBIND doesn’t counteract global


https://bugzilla.kernel.org/show_bug.cgi?id=201773

            Bug ID: 201773
           Summary: IP_FREEBIND doesn’t counteract global
           Product: Networking
           Version: 2.5
    Kernel Version: 3.10.0-862.11.6.el7.x86_64
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: IPV4
          Assignee: stephen@...workplumber.org
          Reporter: felipe@...ipegasper.com
        Regression: No

The following should fail, regardless of /proc/sys/net/ipv4/ip_nonlocal_bind:

-----
> strace -e socket,setsockopt,bind perl -MSocket -Mautodie -e'socket my $s,
> PF_INET, SOCK_STREAM, 0; setsockopt( $s, IPPROTO_IP, 15, 0 ); bind( $s,
> pack_sockaddr_in( 0, inet_aton("1.2.3.4") ) );'  
socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 3
setsockopt(3, SOL_IP, IP_FREEBIND, [0], 4) = 0
bind(3, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("1.2.3.4")},
16) = 0
+++ exited with 0 +++
-----

… however, it appears that setsockopt() doesn’t disable IP_FREEBIND if
ip_nonlocal_bind is set via /proc.

-- 
You are receiving this mail because:
You are the assignee for the bug.