Maciej Żenczykowski
05665fed98
BACKPORT: FROMLIST: net: introduce ip_local_unbindable_ports sysctl ...
and associated inet_is_local_unbindable_port() helper function:
use it to make explicitly binding to an unbindable port return
-EPERM 'Operation not permitted'.
Autobind doesn't honour this new sysctl since:
(a) you can simply set both if that's the behaviour you desire
(b) there could be a use for preventing explicit while allowing auto
(c) it's faster in the relatively critical path of doing port selection
during connect() to only check one bitmap instead of both
Various ports may have special use cases which are not suitable for
use by general userspace applications. Currently, ports specified in
ip_local_reserved_ports sysctl will not be returned only in case of
automatic port assignment, but nothing prevents you from explicitly
binding to them - even from an entirely unprivileged process.
In certain cases it is desirable to prevent the host from assigning the
ports even in case of explicit binds, even from superuser processes.
Example use cases might be:
- a port being stolen by the nic for remote serial console, remote
power management or some other sort of debugging functionality
(crash collection, gdb, direct access to some other microcontroller
on the nic or motherboard, remote management of the nic itself).
- a transparent proxy where packets are being redirected: in case
a socket matches this connection, packets from this application
would be incorrectly sent to one of the endpoints.
Initially I wanted to solve this problem via the simple one line:
static inline bool inet_port_requires_bind_service(struct net *net, unsigned short port) {
- return port < net->ipv4.sysctl_ip_prot_sock;
+ return port < net->ipv4.sysctl_ip_prot_sock || inet_is_local_reserved_port(net, port);
}
However, this doesn't work for two reasons:
(a) it changes userspace visible behaviour of the existing local
reserved ports sysctl, and there appears to be enough documentation
on the internet talking about setting it to make this a bad idea
(b) it doesn't prevent privileged apps from using these ports,
CAP_BIND_SERVICE is relatively likely to be available to, for example,
a recursive DNS server so it can listed on port 53, which also needs
to do src port randomization for outgoing queries due to security
reasons (and it thus does manual port binding).
If we *know* that certain ports are simply unusable, then it's better
nothing even gets the opportunity to try to use them. This way we at
least get a quick failure, instead of some sort of timeout (or possibly
even corruption of the data stream of the non-kernel based use case).
Test:
vm:~# cat /proc/sys/net/ipv4/ip_local_unbindable_ports
vm:~# python -c 'import socket; s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM, 0); s.bind(("::", 3967))'
vm:~# python -c 'import socket; s = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM, 0); s.bind(("::", 3967))'
vm:~# echo 3967 > /proc/sys/net/ipv4/ip_local_unbindable_ports
vm:~# cat /proc/sys/net/ipv4/ip_local_unbindable_ports
3967
vm:~# python -c 'import socket; s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM, 0); s.bind(("::", 3967))'
socket.error: (1, 'Operation not permitted')
vm:~# python -c 'import socket; s = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM, 0); s.bind(("::", 3967))'
socket.error: (1, 'Operation not permitted')
Cc: Sean Tranchetti <stranche@codeaurora.org>
Cc: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Linux SCTP <linux-sctp@vger.kernel.org>
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Bug: 140404597
Link: https://patchwork.ozlabs.org/patch/1206704/
Change-Id: Ie96207bea90ae1345adf7b45724d0caf4d6e52c2
Signed-off-by: Todd Kjos <tkjos@google.com>
2019-12-13 09:50:32 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 188
2019-05-30 11:29:21 -07:00
Bluetooth: Add support for utilizing Fast Advertising Interval
2019-09-05 17:27:21 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 194
2019-05-30 11:29:22 -07:00
net/af_iucv: locate IUCV header via skb_network_header()
2018-09-26 09:56:07 -07:00
netfilter: nf_tables: Align nft_expr private data to 64-bit
2019-11-04 20:58:32 +01:00
BACKPORT: FROMLIST: net: introduce ip_local_unbindable_ports sysctl
2019-12-13 09:50:32 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234
2019-06-19 17:09:07 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336
2019-06-05 17:37:07 +02:00
sctp: cache netns in sctp_ep_common
2019-12-04 22:30:57 +01:00
net: sched: take reference to psample group in flow_action infra
2019-09-16 09:18:03 +02:00
net: sched: use get_dev() action API in flow_action infra
2019-09-16 09:18:03 +02:00
Linux 5.3-rc7
2019-09-02 20:29:11 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: split out functions related to registering inflight socket files
2019-02-28 08:24:23 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321
2019-06-05 17:37:05 +02:00
ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled
2019-05-05 11:25:49 -07:00
ax25: fix possible use-after-free
2019-01-23 11:18:00 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 90
2019-05-24 17:37:53 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 5
2019-05-21 11:28:40 +02:00
bonding: add an option to specify a delay between peer notifications
2019-07-04 12:30:48 -07:00
bonding: fix state transition issue in link monitoring
2019-11-05 17:40:16 -08:00
bpf: support cloning sk storage on accept()
2019-08-17 23:18:54 +02:00
net: annotate lockless accesses to sk->sk_napi_id
2019-10-30 17:34:35 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
mac80211: fix scan when operating on DFS channels in ETSI domains
2019-10-07 22:10:50 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: rework SIOCGSTAMP ioctl handling
2019-04-19 14:07:40 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201
2019-05-30 11:29:52 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201
2019-05-30 11:29:52 -07:00
devlink: disallow reload operation during device cleanup
2019-11-09 19:38:36 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 24
2019-05-21 11:52:39 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 24
2019-05-21 11:52:39 +02:00
drop_monitor: Add basic infrastructure for hardware drops
2019-08-17 12:40:08 -07:00
net: dsa: Pass ndo_setup_tc slave callback to drivers
2019-09-16 21:32:57 +02:00
net: dst.h: Fix shifting signed 32-bit value by 31 bits problem
2019-07-01 10:48:34 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
net: fib: drop include of module.h from fib_notifier.h
2019-04-22 21:50:53 -07:00
net: fib_rules: do not flow dissect local packets
2019-07-11 14:22:53 -07:00
route: Add multipath_hash in flowi_common to make user-define hash
2019-02-27 12:50:17 -08:00
net/flow_dissector: switch to siphash
2019-10-23 20:13:22 -07:00
net: sched: extend flow_action_entry with destructor
2019-09-16 09:18:02 +02:00
net/flow_dissector: switch to siphash
2019-10-23 20:13:22 -07:00
net/fq_impl: Switch to kvmalloc() for memory allocation
2019-11-08 09:11:49 +01:00
net: align gnet_stats_basic_cpu struct
2018-11-17 21:37:29 -08:00
genetlink: optionally validate strictly/dumps
2019-04-27 17:07:22 -04:00
net: Move the definition of the default Geneve udp port to public header file
2019-03-22 12:09:31 -07:00
net: Add netif_is_gretap()/netif_is_ip6gretap()
2018-12-10 15:53:04 -08:00
net:gue.h:Fix shifting signed 32-bit value by 31 bits problem
2019-07-01 10:58:23 -07:00
net: hwbm: if CONFIG_NET_HWBM unset, make stub functions static
2019-10-25 16:24:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
wireless-drivers-next patches for 5.1
2019-02-22 12:56:24 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
ipv6: shrink struct ipv6_mc_socklist
2019-08-28 14:43:03 -07:00
net: ife: drop include of module.h from net/ife.h
2019-04-22 21:50:53 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
inet: factor out inet_send_prepare()
2019-07-03 13:51:54 -07:00
net/tls: use RCU protection on icsk->icsk_ulp_data
2019-08-31 23:44:28 -07:00
inet: Refactor INET_ECN_decapsulate()
2018-10-17 17:45:07 -07:00
inet: frags: re-introduce skb coalescing for local delivery
2019-08-08 15:55:10 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
ip: support SO_MARK cmsg
2019-09-13 21:44:19 +02:00
tcp: honor SO_PRIORITY in TIME_WAIT state
2019-09-27 12:05:02 +02:00
net: ipv4: use a dedicated counter for icmp_v4 redirect packets
2019-02-08 21:50:15 -08:00
BACKPORT: FROMLIST: net: introduce ip_local_unbindable_ports sysctl
2019-12-13 09:50:32 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
ipv6: Dump route exceptions if requested
2019-06-24 10:18:49 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2019-06-27 21:06:39 -07:00
ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
2019-06-18 20:48:45 -04:00
net: Properly update v4 routes with v6 nexthop
2019-09-05 12:35:58 +02:00
route: Add multipath_hash in flowi_common to make user-define hash
2019-02-27 12:50:17 -08:00
ipvs: move old_secure_tcp into struct netns_ipvs
2019-10-24 11:56:02 +02:00
ipv6: add priority parameter to ip6_xmit()
2019-09-27 12:05:02 +02:00
inet: fix various use-after-free in defrags units
2019-06-19 11:37:47 -04:00
ipv6: export function to send route updates
2019-05-22 17:48:43 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
llc: avoid blocking in llc_sap_close()
2018-09-13 09:04:58 -07:00
llc: fix sk_buff leak in llc_conn_service()
2019-10-08 13:23:05 -07:00
lwtunnel: Pass encap and encap type attributes to lwtunnel_fill_encap
2019-04-23 19:42:29 -07:00
mac80211: allow drivers to set max MTU
2019-09-11 09:33:29 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295
2019-06-05 17:36:38 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295
2019-06-05 17:36:38 +02:00
UPSTREAM: net-ipv6-ndisc: add support for RFC7710 RA Captive Portal Identifier
2019-08-05 19:10:36 +00:00
net: fix data-race in neigh_event_send()
2019-11-08 13:59:53 -08:00
netns: fix GFP flags in rtnl_net_notifyid()
2019-10-25 20:14:42 -07:00
net: ipv4: Notify about changes to ip_forward_update_priority
2018-08-01 09:52:30 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
netlink: Fix nlmsg_parse as a wrapper for strict message parsing
2019-08-13 20:37:16 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: netrom: Fix error cleanup path of nr_proto_init
2019-04-11 13:59:49 -07:00
net: Properly update v4 routes with v6 nexthop
2019-09-05 12:35:58 +02:00
net: core: page_pool: add user refcnt and reintroduce page_pool_destroy
2019-07-08 14:58:04 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: sched: take reference to action dev before calling offloads
2019-08-26 14:17:43 -07:00
Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net
2019-09-17 23:51:10 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: sched: take reference to psample group in flow_action infra
2019-09-16 09:18:03 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
cfg80211: make wmm_rule part of the reg_rule structure
2018-08-28 11:11:47 +02:00
net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head
2019-10-09 21:34:31 -07:00
ipv4: Revert removal of rt_uses_gateway
2019-09-20 18:23:33 -07:00
net: Add extack argument to rtnl_create_link
2018-11-06 15:00:45 -08:00
net: Rename net/nexthop.h net/rtnh.h
2019-04-22 21:47:25 -07:00
net: sched: prevent duplicate flower rules from tcf_proto destroy race
2019-11-05 17:47:26 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net/smc: add smcd support to the pnet table
2019-02-21 10:34:37 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: prevent load/store tearing on sk->sk_stamp
2019-11-05 18:22:30 -08:00
udp: correct reuseport selection with connected sockets
2019-09-16 09:02:18 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
tcp: annotate sk->sk_rcvbuf lockless reads
2019-10-13 10:13:08 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net/tls: use sg_next() to walk sg entries
2019-12-04 22:31:02 +01:00
udp: Remove unlikely() from IS_ERR*() condition
2019-08-30 19:49:37 -07:00
ipv6: Move ipv6 stubs to a separate header file
2019-03-29 10:53:45 -07:00
ANDROID: virt_wifi: Add data ops for scan data simulation
2019-10-26 01:16:30 +00:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321
2019-06-05 17:37:05 +02:00
vxlan: add adjacent link to limit depth level
2019-10-24 14:53:49 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 268
2019-06-05 17:30:29 +02:00
xdp: page_pool related fix to cpumap
2019-06-19 11:23:13 -04:00
xdp: add tracepoints for XDP mem
2019-06-19 11:23:13 -04:00
xsk: add support to allow unaligned chunk placement
2019-08-31 01:08:26 +02:00
xfrm interface: fix management of phydev
2019-07-17 10:03:54 +02:00
05665fed98