netdev - Re: [PATCH v4 net-next 4/5] net: Add net.ipv4.ip_autobind

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <50c321f8-1563-2b7a-4b14-f71f48858bfd@gmail.com>
Date:   Mon, 9 Mar 2020 21:05:24 -0700
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Kuniyuki Iwashima <kuniyu@...zon.co.jp>, davem@...emloft.net,
        kuznet@....inr.ac.ru, yoshfuji@...ux-ipv6.org, edumazet@...gle.com
Cc:     kuni1840@...il.com, netdev@...r.kernel.org,
        osa-contribution-log@...zon.com
Subject: Re: [PATCH v4 net-next 4/5] net: Add net.ipv4.ip_autobind_reuse
 option.



On 3/8/20 11:16 AM, Kuniyuki Iwashima wrote:
> The two commits("tcp: bind(addr, 0) remove the SO_REUSEADDR restriction
> when ephemeral ports are exhausted" and "tcp: Forbid to automatically bind
> more than one sockets haveing SO_REUSEADDR and SO_REUSEPORT per EUID")
> introduced the new feature to reuse ports with SO_REUSEADDR when all
> ephemeral pors are exhausted. They allow connect() and listen() to share
> ports in the following way.
> 
>   1. setsockopt(sk1, SO_REUSEADDR)
>   2. setsockopt(sk2, SO_REUSEADDR)
>   3. bind(sk1, saddr, 0)
>   4. bind(sk2, saddr, 0)
>   5. connect(sk1, daddr)
>   6. listen(sk2)

Honestly, IP_BIND_ADDRESS_NO_PORT makes all these problems go away.


> 
> In this situation, new socket cannot be bound to the port, but sharing
> port between connect() and listen() may break some applications. The
> ip_autobind_reuse option is false (0) by default and disables the feature.
> If it is set true, we can fully utilize the 4-tuples.
> 
> Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.co.jp>
> ---
>  Documentation/networking/ip-sysctl.txt | 7 +++++++
>  include/net/netns/ipv4.h               | 1 +
>  net/ipv4/inet_connection_sock.c        | 2 +-
>  net/ipv4/sysctl_net_ipv4.c             | 7 +++++++
>  4 files changed, 16 insertions(+), 1 deletion(-)
> 
> diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
> index 5f53faff4e25..9506a67a33c4 100644
> --- a/Documentation/networking/ip-sysctl.txt
> +++ b/Documentation/networking/ip-sysctl.txt
> @@ -958,6 +958,13 @@ ip_nonlocal_bind - BOOLEAN
>  	which can be quite useful - but may break some applications.
>  	Default: 0
>  
> +ip_autobind_reuse - BOOLEAN
> +	By default, bind() does not select the ports automatically even if
> +	the new socket and all sockets bound to the port have SO_REUSEADDR.
> +	ip_autobind_reuse allows bind() to reuse the port and this is useful
> +	when you use bind()+connect(), but may break some applications.

I would mention that the preferred solution is to use IP_BIND_ADDRESS_NO_PORT,
which is fully supported, and that this sysctl should only be set by experts.

> +	Default: 0
> +
>  ip_dynaddr - BOOLEAN
>  	If set non-zero, enables support for dynamic addresses.
>  	If set to a non-zero value larger than 1, a kernel log
> diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
> index 08b98414d94e..154b8f01499b 100644
> --- a/include/net/netns/ipv4.h
> +++ b/include/net/netns/ipv4.h
> @@ -101,6 +101,7 @@ struct netns_ipv4 {
>  	int sysctl_ip_fwd_use_pmtu;
>  	int sysctl_ip_fwd_update_priority;
>  	int sysctl_ip_nonlocal_bind;
> +	int sysctl_ip_autobind_reuse;
>  	/* Shall we try to damage output packets if routing dev changes? */
>  	int sysctl_ip_dynaddr;
>  	int sysctl_ip_early_demux;
> diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
> index d27ed5fe7147..3b4f81790e3e 100644
> --- a/net/ipv4/inet_connection_sock.c
> +++ b/net/ipv4/inet_connection_sock.c
> @@ -246,7 +246,7 @@ inet_csk_find_open_port(struct sock *sk, struct inet_bind_bucket **tb_ret, int *
>  		goto other_half_scan;
>  	}
>  
> -	if (!relax) {
> +	if (net->ipv4.sysctl_ip_autobind_reuse && !relax) {
>  		/* We still have a chance to connect to different destinations */
>  		relax = true;
>  		goto ports_exhausted;
> diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
> index 9684af02e0a5..3b191764718b 100644
> --- a/net/ipv4/sysctl_net_ipv4.c
> +++ b/net/ipv4/sysctl_net_ipv4.c
> @@ -775,6 +775,13 @@ static struct ctl_table ipv4_net_table[] = {
>  		.mode		= 0644,
>  		.proc_handler	= proc_dointvec
>  	},
> +	{
> +		.procname	= "ip_autobind_reuse",
> +		.data		= &init_net.ipv4.sysctl_ip_autobind_reuse,
> +		.maxlen		= sizeof(int),
> +		.mode		= 0644,
> +		.proc_handler	= proc_dointvec

.proc_handler = proc_dointvec_minmax,
.extra1         = SYSCTL_ZERO,
.extra2         = SYSCTL_ONE,



> +	},
>  	{
>  		.procname	= "fwmark_reflect",
>  		.data		= &init_net.ipv4.sysctl_fwmark_reflect,
>