netdev - Re: [PATCH v4 net-next 4/5] net: Add net.ipv4.ip_autobind

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 10 Mar 2020 16:42:32 +0900
From:   Kuniyuki Iwashima <kuniyu@...zon.co.jp>
To:     <eric.dumazet@...il.com>
CC:     <davem@...emloft.net>, <edumazet@...gle.com>, <kuni1840@...il.com>,
        <kuniyu@...zon.co.jp>, <kuznet@....inr.ac.ru>,
        <netdev@...r.kernel.org>, <osa-contribution-log@...zon.com>,
        <yoshfuji@...ux-ipv6.org>
Subject: Re: [PATCH v4 net-next 4/5] net: Add net.ipv4.ip_autobind_reuse option.

From:   Eric Dumazet <eric.dumazet@...il.com>
Date:   Mon, 9 Mar 2020 21:05:24 -0700
> On 3/8/20 11:16 AM, Kuniyuki Iwashima wrote:
> > The two commits("tcp: bind(addr, 0) remove the SO_REUSEADDR restriction
> > when ephemeral ports are exhausted" and "tcp: Forbid to automatically bind
> > more than one sockets haveing SO_REUSEADDR and SO_REUSEPORT per EUID")
> > introduced the new feature to reuse ports with SO_REUSEADDR when all
> > ephemeral pors are exhausted. They allow connect() and listen() to share
> > ports in the following way.
> > 
> >   1. setsockopt(sk1, SO_REUSEADDR)
> >   2. setsockopt(sk2, SO_REUSEADDR)
> >   3. bind(sk1, saddr, 0)
> >   4. bind(sk2, saddr, 0)
> >   5. connect(sk1, daddr)
> >   6. listen(sk2)
> 
> Honestly, IP_BIND_ADDRESS_NO_PORT makes all these problems go away.
> 
> 
> >
> > In this situation, new socket cannot be bound to the port, but sharing
> > port between connect() and listen() may break some applications. The
> > ip_autobind_reuse option is false (0) by default and disables the feature.
> > If it is set true, we can fully utilize the 4-tuples.
> > 
> > Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.co.jp>
> > ---
> >  Documentation/networking/ip-sysctl.txt | 7 +++++++
> >  include/net/netns/ipv4.h               | 1 +
> >  net/ipv4/inet_connection_sock.c        | 2 +-
> >  net/ipv4/sysctl_net_ipv4.c             | 7 +++++++
> >  4 files changed, 16 insertions(+), 1 deletion(-)
> > 
> > diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
> > index 5f53faff4e25..9506a67a33c4 100644
> > --- a/Documentation/networking/ip-sysctl.txt
> > +++ b/Documentation/networking/ip-sysctl.txt
> > @@ -958,6 +958,13 @@ ip_nonlocal_bind - BOOLEAN
> >  	which can be quite useful - but may break some applications.
> >  	Default: 0
> >  
> > +ip_autobind_reuse - BOOLEAN
> > +	By default, bind() does not select the ports automatically even if
> > +	the new socket and all sockets bound to the port have SO_REUSEADDR.
> > +	ip_autobind_reuse allows bind() to reuse the port and this is useful
> > +	when you use bind()+connect(), but may break some applications.
> 
> I would mention that the preferred solution is to use IP_BIND_ADDRESS_NO_PORT,
> which is fully supported, and that this sysctl should only be set by experts.

I will add these to description.


> > +	Default: 0
> > +
> >  ip_dynaddr - BOOLEAN
> >  	If set non-zero, enables support for dynamic addresses.
> >  	If set to a non-zero value larger than 1, a kernel log
> > diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
> > index 08b98414d94e..154b8f01499b 100644
> > --- a/include/net/netns/ipv4.h
> > +++ b/include/net/netns/ipv4.h
> > @@ -101,6 +101,7 @@ struct netns_ipv4 {
> >  	int sysctl_ip_fwd_use_pmtu;
> >  	int sysctl_ip_fwd_update_priority;
> >  	int sysctl_ip_nonlocal_bind;
> > +	int sysctl_ip_autobind_reuse;
> >  	/* Shall we try to damage output packets if routing dev changes? */
> >  	int sysctl_ip_dynaddr;
> >  	int sysctl_ip_early_demux;
> > diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
> > index d27ed5fe7147..3b4f81790e3e 100644
> > --- a/net/ipv4/inet_connection_sock.c
> > +++ b/net/ipv4/inet_connection_sock.c
> > @@ -246,7 +246,7 @@ inet_csk_find_open_port(struct sock *sk, struct inet_bind_bucket **tb_ret, int *
> >  		goto other_half_scan;
> >  	}
> >  
> > -	if (!relax) {
> > +	if (net->ipv4.sysctl_ip_autobind_reuse && !relax) {
> >  		/* We still have a chance to connect to different destinations */
> >  		relax = true;
> >  		goto ports_exhausted;
> > diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
> > index 9684af02e0a5..3b191764718b 100644
> > --- a/net/ipv4/sysctl_net_ipv4.c
> > +++ b/net/ipv4/sysctl_net_ipv4.c
> > @@ -775,6 +775,13 @@ static struct ctl_table ipv4_net_table[] = {
> >  		.mode		= 0644,
> >  		.proc_handler	= proc_dointvec
> >  	},
> > +	{
> > +		.procname	= "ip_autobind_reuse",
> > +		.data		= &init_net.ipv4.sysctl_ip_autobind_reuse,
> > +		.maxlen		= sizeof(int),
> > +		.mode		= 0644,
> > +		.proc_handler	= proc_dointvec
> 
> .proc_handler = proc_dointvec_minmax,
> .extra1         = SYSCTL_ZERO,
> .extra2         = SYSCTL_ONE,

I will fix this and respin patches.

Thank you.