netdev - Re: [PATCH net-next] tcp: do not allow to connect with the four-tuple symmetry socket

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAL+tcoCZQdU5H3c88g3MMoBRxvMTC81HaVzKF4TL=mA53arwWw@mail.gmail.com>
Date: Mon, 19 Aug 2024 17:41:32 +0800
From: Jason Xing <kerneljasonxing@...il.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: Kuniyuki Iwashima <kuniyu@...zon.com>, 0x7f454c46@...il.com, davem@...emloft.net, 
	dima@...sta.com, dsahern@...nel.org, kernelxing@...cent.com, kuba@...nel.org, 
	ncardwell@...gle.com, netdev@...r.kernel.org, pabeni@...hat.com, 
	Florian Westphal <fw@...len.de>, Pablo Neira Ayuso <pablo@...filter.org>
Subject: Re: [PATCH net-next] tcp: do not allow to connect with the four-tuple
 symmetry socket

On Mon, Aug 19, 2024 at 5:38 PM Eric Dumazet <edumazet@...gle.com> wrote:
>
> On Mon, Aug 19, 2024 at 11:32 AM Jason Xing <kerneljasonxing@...il.com> wrote:
>
> > After investigating such an issue more deeply in the customers'
> > machines, the main reason why it can happen is the listener exits
> > while another thread starts to connect, which can cause
> > self-connection, even though the chance is slim. Later, the listener
> > tries to listen and for sure it will fail due to that single
> > self-connection.
>
> This would happen if the range of ephemeral ports include the listening port,
> which is discouraged.

Yes.

>
> ip_local_reserved_ports is supposed to help.

Sure, I workarounded it by using this and it worked.

>
> This looks like a security issue to me, and netfilter can handle it.

I have to admit setting netfilter rules for each flow is not a very
user-friendly way.

Anyway, really thanks for your suggestion :)

Thanks,
Jason