On Mon, Sep 23, 2024 at 03:45 PM GMT, David Laight wrote: > From: Jakub Sitnicki >> Sent: 23 September 2024 15:56 >> >> On Mon, Sep 23, 2024 at 01:08 PM GMT, David Laight wrote: >> > From: Tiago Lam <tiagolam@xxxxxxxxxxxxxx> >> >> [...] >> >> >> To limit its usage, a reverse socket lookup is performed to check if the >> >> configured egress source address and/or port have any ingress sk_lookup >> >> match. If it does, traffic is allowed to proceed, otherwise it falls >> >> back to the regular egress path. >> > >> > Is that really useful/necessary? >> >> We've been asking ourselves the same question during Plumbers with >> Martin. >> >> Unprivileges processes can already source UDP traffic from (almost) any >> IP & port by binding a socket to the desired source port and passing >> IP_PKTINFO. So perhaps having a reverse socket lookup is an overkill. > > Traditionally you'd need to bind to the source port on any local IP > (or the wildcard IP) that didn't have another socket bound to that port. Right. Linux IP_PKTINFO extension relaxes this requirement. You can bind to some local IP (whichever is free, plently to choose from in 127/8 local subnet), and specify the source address to use OOB at sendmsg() time (as long as the address is local to the host, otherwise you need additional capabilities). > Modern Linux might have more restrictions and SO_REUSADDR muddies things. > > And I don't think you can do a connect() on an unbound UDP socket to > set the source port at the same time as the destination IP+port. > (That would actually be useful.) You can. It's somewhat recent (v6.3+) [1]: https://manpages.debian.org/unstable/manpages/ip.7.en.html#IP_LOCAL_PORT_RANGE It's not on par with TCP when it comes to local port sharing because we hash UDP sockets only by 2-tuple. Though, some effort to improve that is taking place I see. The recipe is: 1. delay the auto-bind until connect() time with IP_BIND_ADDRESS_NO_PORT socket option, and 2. tell the udp stack to consider only a single local port during the free port search with IP_LOCAL_PORT_RANGE option. That amounts to something like (in pseudocode): s = socket(AF_INET, SOCK_DGRAM) s.setsockopt(SOL_IP, IP_BIND_ADDRESS_NO_PORT, 1) s.setsockopt(SOL_IP, IP_LOCAL_PORT_RANGE, 44_444 << 16 | 44_444) s.bind(("192.0.2.42", 0)) s.connect(("1.1.1.1", 53)) You can combine it with SO_REUSEADDR to share the local address between sockets, but you have to ensure manually that you don't run into conflicts between sockets (two sockets using the same 4-tuple). That's something we're hoping to improve in the future. > OTOH if you just want to send a UDP message you can just use another > system on the same network. > You might need to spoof the source mac - but that isn't hard (although > it might confuse any ethernet switches). > >> We should probably respect net.ipv4.ip_local_reserved_ports and >> net.ipv4.ip_unprivileged_port_start system settings, though, or check >> for relevant caps. > > True. > >> Open question if it is acceptable to disregard exclusive UDP port >> ownership by sockets binding to a wildcard address without SO_REUSEADDR? > > We've often suffered from the opposite - a program binds to the wildcard > IP and everything works until something else binds to the same port and > a specific local IP. Let me see if I understand - what would happen today for UDP is: app #1 - bind(("0.0.0.0", 53)) -> OK app #2 - bind(("192.0.2.1", 53)) -> EADDRINUSE ... unless both are setting SO_REUSEADDR (or SO_REUSEPORT and run under same UID). That is why if we allow selecting the source port at sendmsg() time, we would be relaxing the existing UDP port ownership guarantees for wildcard binds. Perhaps this merits a sysctl, so the admin can decide if it is an acceptable trade-off in their environment. > I'm sure this is grief some on both TCP and UDP - especially since you > often need to set SO_REUSADDR to stop other things breaking. > > David > > > - > Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK > Registration No: 1397386 (Wales)
