netdev - Re: [PATCH v2 net-next] tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAL+tcoAMJ+OwVp6NP4Nb0-ryij4dBC_c9O6ZiDsBWqa+iaHhmw@mail.gmail.com>
Date: Wed, 21 Aug 2024 18:02:31 +0800
From: Jason Xing <kerneljasonxing@...il.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: Paolo Abeni <pabeni@...hat.com>, davem@...emloft.net, kuba@...nel.org, 
	dsahern@...nel.org, ncardwell@...gle.com, kuniyu@...zon.com, 
	netdev@...r.kernel.org, Jason Xing <kernelxing@...cent.com>, 
	Jade Dong <jadedong@...cent.com>
Subject: Re: [PATCH v2 net-next] tcp: avoid reusing FIN_WAIT2 when trying to
 find port in connect() process

Hello Eric,

On Tue, Aug 20, 2024 at 8:54 PM Jason Xing <kerneljasonxing@...il.com> wrote:
>
> Hello Eric,
>
> On Tue, Aug 20, 2024 at 8:39 PM Eric Dumazet <edumazet@...gle.com> wrote:
> >
> > On Tue, Aug 20, 2024 at 1:04 PM Paolo Abeni <pabeni@...hat.com> wrote:
> > >
> > > On 8/15/24 13:37, Jason Xing wrote:
> > > > From: Jason Xing <kernelxing@...cent.com>
> > > >
> > > > We found that one close-wait socket was reset by the other side
> > > > which is beyond our expectation,
> > >
> > > I'm unsure if you should instead reconsider your expectation: what if
> > > the client application does:
> > >
> > > shutdown(fd, SHUT_WR)
> > > close(fd); // with unread data
> > >
> >
> > Also, I was hoping someone would mention IPv6 at some point.
>
> Thanks for reminding me. I'll dig into the IPv6 logic.
>
> >
> > Jason, instead of a lengthy ChatGPT-style changelog, I would prefer a
>
> LOL, but sorry, I manually control the length which makes it look
> strange, I'll adjust it.
>
> > packetdrill test exactly showing the issue.
>
> I will try the packetdrill.
>

Sorry that I'm not that good at writing such a case, I failed to add
TS option which will be used in tcp_twsk_unique. So I think I need
more time.

In case that I do not have much time working on this packetdrill, I
decided to copy my simple test code as follows.

The code is very very simple. Please take a look at it :)

Client:
we can use:
#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>
#include <arpa/inet.h>
#include <sys/socket.h>
#include <netinet/in.h>

int main(int argc, char *argv[])
{
        unsigned short port = 8000;
        char *server_ip = "127.0.0.1";

        int sockfd;
        sockfd = socket(AF_INET, SOCK_STREAM, 0);
        if(sockfd < 0)
        {
                perror("socket");
                exit(-1);
        }

        struct sockaddr_in server_addr;
        bzero(&server_addr,sizeof(server_addr));
        server_addr.sin_family = AF_INET;
        server_addr.sin_port = htons(port);
        inet_pton(AF_INET, server_ip, &server_addr.sin_addr);

        int err_log = connect(sockfd, (struct sockaddr*)&server_addr,
sizeof(server_addr));
        if(err_log != 0)
        {
                perror("connect");
                close(sockfd);
                exit(-1);
        }

        close(sockfd);

        return 0;
}

or use the following command:
nc -vz 127.0.0.1 8000

Server:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

int main(int argc, char *argv[])
{
        unsigned short port = 8000;

        int sockfd = socket(AF_INET, SOCK_STREAM, 0);
        if(sockfd < 0)
        {
                perror("socket");
                exit(-1);
        }

        struct sockaddr_in my_addr;
        bzero(&my_addr, sizeof(my_addr));
        my_addr.sin_family = AF_INET;
        my_addr.sin_port   = htons(port);
        my_addr.sin_addr.s_addr = htonl(INADDR_ANY);

        int err_log = bind(sockfd, (struct sockaddr*)&my_addr, sizeof(my_addr));
        if( err_log != 0)
        {
                perror("binding");
                close(sockfd);
                exit(-1);
        }

        err_log = listen(sockfd, 2);
        if(err_log != 0)
        {
                perror("listen");
                close(sockfd);
                exit(-1);
        }

        while(1)
        {

                struct sockaddr_in client_addr;
                char cli_ip[INET_ADDRSTRLEN] = "";
                socklen_t cliaddr_len = sizeof(client_addr);

                int connfd;
                connfd = accept(sockfd, (struct
sockaddr*)&client_addr, &cliaddr_len);
                if(connfd < 0)
                {
                        perror("accept");
                        continue;
                }

                sleep(20); // delay
                close(connfd);
        }
        close(sockfd);
        return 0;
}

They are the basic networking communication code. So this issue can be
easily reproduced by enabling/disabling net.ipv4.tcp_tw_reuse.

As I replied to Paolo last night, maybe I was wrong, but I still
reckon a close-wait socket receives reset skb from a new flow and then
reset, which is incredible.

After applying this patch, if we meet this case, we will find the
kernel behaves like when we switch net.ipv4.tcp_tw_reuse to zero,
notified with "connect: Cannot assign requested address".

I wonder if I understand in the right way?

Thanks,
Jason