iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8a765471a6
linux/net/ipv4
History
Kuniyuki Iwashima 335759211a tcp: Forbid to bind more than one sockets haveing SO_REUSEADDR and SO_REUSEPORT per EUID. 
If there is no TCP_LISTEN socket on a ephemeral port, we can bind multiple
sockets having SO_REUSEADDR to the same port. Then if all sockets bound to
the port have also SO_REUSEPORT enabled and have the same EUID, all of them
can be listened. This is not safe.

Let's say, an application has root privilege and binds sockets to an
ephemeral port with both of SO_REUSEADDR and SO_REUSEPORT. When none of
sockets is not listened yet, a malicious user can use sudo, exhaust
ephemeral ports, and bind sockets to the same ephemeral port, so he or she
can call listen and steal the port.

To prevent this issue, we must not bind more than one sockets that have the
same EUID and both of SO_REUSEADDR and SO_REUSEPORT.

On the other hand, if the sockets have different EUIDs, the issue above does
not occur. After sockets with different EUIDs are bound to the same port and
one of them is listened, no more socket can be listened. This is because the
condition below is evaluated true and listen() for the second socket fails.

			} else if (!reuseport_ok ||
				   !reuseport || !sk2->sk_reuseport ||
				   rcu_access_pointer(sk->sk_reuseport_cb) ||
				   (sk2->sk_state != TCP_TIME_WAIT &&
				    !uid_eq(uid, sock_i_uid(sk2)))) {
				if (inet_rcv_saddr_equal(sk, sk2, true))
					break;
			}

Therefore, on the same port, we cannot do listen() for multiple sockets with
different EUIDs and any other listen syscalls fail, so the problem does not
happen. In this case, we can still call connect() for other sockets that
cannot be listened, so we have to succeed to call bind() in order to fully
utilize 4-tuples.

Summarizing the above, we should be able to bind only one socket having
SO_REUSEADDR and SO_REUSEPORT per EUID.

Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-12 12:08:09 -07:00
..
bpfilter SPDX update for 5.2-rc2, round 1 2019-05-21 12:33:38 -07:00
netfilter proc: convert everything to "struct proc_ops" 2020-02-04 03:05:26 +00:00
af_inet.c net: port < inet_prot_sock(net) --> inet_port_requires_bind_service(net, port) 2019-11-26 13:20:46 -08:00
ah4.c xfrm: remove type and offload_type map from xfrm_state_afinfo 2019-06-06 08:34:50 +02:00
arp.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
bpf_tcp_ca.c bpf: Add BPF_FUNC_tcp_send_ack helper 2020-01-09 08:46:18 -08:00
cipso_ipv4.c ipv4: ensure rcu_read_lock() in cipso_v4_error() 2020-02-22 21:45:55 -08:00
datagram.c inet: stop leaking jiffies on the wire 2019-11-01 14:57:52 -07:00
devinet.c inet: protect against too small mtu values. 2019-12-07 11:55:11 -08:00
esp4_offload.c xfrm: support output_mark for offload ESP packets 2020-01-15 12:18:35 +01:00
esp4.c xfrm: add espintcp (RFC 8229) 2019-12-09 09:59:07 +01:00
fib_frontend.c ipv4: move fib4_has_custom_rules() helper to public header 2019-11-21 14:45:55 -08:00
fib_lookup.h ipv4: Add "offload" and "trap" indications to routes 2020-01-14 18:53:35 -08:00
fib_notifier.c net: fib_notifier: propagate extack down to the notifier block callback 2019-10-04 11:10:56 -07:00
fib_rules.c net: fib_notifier: propagate extack down to the notifier block callback 2019-10-04 11:10:56 -07:00
fib_semantics.c ipv4: Add "offload" and "trap" indications to routes 2020-01-14 18:53:35 -08:00
fib_trie.c net: remove unused macro from fib_trie.c 2020-02-20 10:02:23 -08:00
fou.c fou: Fix IPv6 netlink policy 2020-01-23 14:32:52 +01:00
gre_demux.c gre: refetch erspan header from skb->data after pskb_may_pull() 2019-12-07 11:53:27 -08:00
gre_offload.c net: remove the check argument from __skb_gro_checksum_convert 2020-01-03 12:24:34 -08:00
icmp.c icmp: introduce helper for nat'd source address in network device context 2020-02-13 14:19:00 -08:00
igmp.c igmp: remove unused macro IGMP_Vx_UNSOLICITED_REPORT_INTERVAL 2020-02-23 21:15:36 -08:00
inet_connection_sock.c tcp: Forbid to bind more than one sockets haveing SO_REUSEADDR and SO_REUSEPORT per EUID. 2020-03-12 12:08:09 -07:00
inet_diag.c bpf: inet_diag: Dump bpf_sk_storages in inet_diag_dump() 2020-02-27 18:50:19 -08:00
inet_fragment.c inet: frags: re-introduce skb coalescing for local delivery 2019-08-08 15:55:10 -07:00
inet_hashtables.c tcp/dccp: fix possible race __inet_lookup_established() 2019-12-13 21:40:49 -08:00
inet_timewait_sock.c treewide: Add SPDX license identifier for missed files 2019-05-21 10:50:45 +02:00
inetpeer.c inetpeer: fix data-race in inet_putpeer / inet_putpeer 2019-11-07 16:15:56 -08:00
ip_forward.c ipv4: Revert removal of rt_uses_gateway 2019-09-20 18:23:33 -07:00
ip_fragment.c inet: frags: re-introduce skb coalescing for local delivery 2019-08-08 15:55:10 -07:00
ip_gre.c treewide: Use sizeof_field() macro 2019-12-09 10:36:44 -08:00
ip_input.c ipv4: use dst hint for ipv4 list receive 2019-11-21 14:45:55 -08:00
ip_options.c netfilter: nf_tables: add support for matching IPv4 options 2019-06-21 18:35:51 +02:00
ip_output.c net: ipv4: use skb_list_walk_safe helper for gso segments 2020-01-14 11:48:41 -08:00
ip_sockglue.c ip_sockglue: Fix missing-check bug in ip_ra_control() 2019-05-25 11:00:50 -07:00
ip_tunnel_core.c lwtunnel: check erspan options before allocating tun_info 2019-11-21 11:47:39 -08:00
ip_tunnel.c net, ip_tunnel: fix namespaces move 2020-01-21 16:05:21 +01:00
ip_vti.c vti[6]: fix packet tx through bpf_redirect() 2020-01-14 08:55:38 +01:00
ipcomp.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next 2019-07-05 15:01:15 -07:00
ipconfig.c proc: convert everything to "struct proc_ops" 2020-02-04 03:05:26 +00:00
ipip.c ipip: validate header length in ipip_tunnel_xmit 2019-07-25 17:23:40 -07:00
ipmr_base.c net: fib_notifier: propagate extack down to the notifier block callback 2019-10-04 11:10:56 -07:00
ipmr.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-11-16 21:51:42 -08:00
Kconfig xfrm: add espintcp (RFC 8229) 2019-12-09 09:59:07 +01:00
Makefile bpf: tcp: Support tcp_congestion_ops in bpf 2020-01-09 08:46:18 -08:00
metrics.c treewide: Add SPDX license identifier for missed files 2019-05-21 10:50:45 +02:00
netfilter.c netfilter: ipv4: remove useless export_symbol 2019-01-28 11:32:58 +01:00
netlink.c treewide: Add SPDX license identifier for missed files 2019-05-21 10:50:45 +02:00
nexthop.c net: include struct nhmsg size in nh nlmsg size 2020-01-27 10:54:08 +01:00
ping.c ip: support SO_MARK cmsg 2019-09-13 21:44:19 +02:00
proc.c tcp: export count for rehash attempts 2020-01-26 15:28:47 +01:00
protocol.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
raw_diag.c inet_diag: Move the INET_DIAG_REQ_BYTECODE nlattr to cb->data 2020-02-27 18:50:19 -08:00
raw.c raw: Add missing annotations to raw_seq_start() and raw_seq_stop() 2020-03-11 23:19:40 -07:00
route.c net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc. 2020-02-24 13:31:42 -08:00
syncookies.c mptcp: handle tcp fallback when using syn cookies 2020-01-29 17:45:20 +01:00
sysctl_net_ipv4.c tcp: bind(0) remove the SO_REUSEADDR restriction when ephemeral ports are exhausted. 2020-03-12 12:08:09 -07:00
tcp_bbr.c tcp_bbr: improve arithmetic division in bbr_update_bw() 2020-01-21 10:45:49 +01:00
tcp_bic.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
tcp_bpf.c tcp_bpf: Don't let child socket inherit parent protocol ops on copy 2020-02-21 22:29:45 +01:00
tcp_cdg.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
tcp_cong.c bpf: tcp: Support tcp_congestion_ops in bpf 2020-01-09 08:46:18 -08:00
tcp_cubic.c tcp_cubic: refactor code to perform a divide only when needed 2019-12-30 14:44:27 -08:00
tcp_dctcp.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
tcp_dctcp.h tcp: refactor DCTCP ECN ACK handling 2018-10-10 22:26:00 -07:00
tcp_diag.c inet_diag: Move the INET_DIAG_REQ_BYTECODE nlattr to cb->data 2020-02-27 18:50:19 -08:00
tcp_fastopen.c tcp: add TCP_INFO status for failed client TFO 2019-10-25 19:25:37 -07:00
tcp_highspeed.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
tcp_htcp.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
tcp_hybla.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
tcp_illinois.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
tcp_input.c tcp: fix TFO SYNACK undo to avoid double-timestamp-undo 2020-02-23 17:23:35 -08:00
tcp_ipv4.c tcp: ipv4: Pass lockdep expression to RCU lists 2020-02-24 13:07:03 -08:00
tcp_lp.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
tcp_metrics.c net-tcp: Disable TCP ssthresh metrics cache by default 2019-12-09 20:17:48 -08:00
tcp_minisocks.c tcp: Add missing annotation for tcp_child_process() 2020-03-11 23:19:41 -07:00
tcp_nv.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
tcp_offload.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
tcp_output.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-01-26 10:40:21 +01:00
tcp_rate.c treewide: Add SPDX license identifier for missed files 2019-05-21 10:50:45 +02:00
tcp_recovery.c
tcp_scalable.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
tcp_timer.c tcp: export count for rehash attempts 2020-01-26 15:28:47 +01:00
tcp_ulp.c tcp, ulp: Pass lockdep expression to RCU lists 2020-02-24 13:01:54 -08:00
tcp_vegas.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
tcp_vegas.h
tcp_veno.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
tcp_westwood.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
tcp_yeah.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
tcp.c tcp: add bytes not sent to SCM_TIMESTAMPING_OPT_STATS 2020-03-09 17:56:33 -07:00
tunnel4.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
udp_diag.c inet_diag: Move the INET_DIAG_REQ_BYTECODE nlattr to cb->data 2020-02-27 18:50:19 -08:00
udp_impl.h udp: add missing rehash callback to udplite 2019-01-17 15:01:08 -08:00
udp_offload.c udp: Support UDP fraglist GRO/GSO. 2020-01-27 11:00:21 +01:00
udp_tunnel.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
udp.c net: datagram: drop 'destructor' argument from several helpers 2020-02-28 12:12:53 -08:00
udplite.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
xfrm4_input.c
xfrm4_output.c netfilter: Support iif matches in POSTROUTING 2019-11-15 23:44:48 +01:00
xfrm4_policy.c net: add bool confirm_neigh parameter for dst_ops.update_pmtu 2019-12-24 22:28:54 -08:00
xfrm4_protocol.c xfrm: add route lookup to xfrm4_rcv_encap 2019-12-09 09:59:07 +01:00
xfrm4_state.c xfrm: remove eth_proto value from xfrm_state_afinfo 2019-06-06 08:34:50 +02:00
xfrm4_tunnel.c xfrm: remove type and offload_type map from xfrm_state_afinfo 2019-06-06 08:34:50 +02:00