Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: Commit f211ac154577ec9ccf07c15f18a6abf0d9bdb4ab breaks Smack TCP
 connections
To:     =?UTF-8?B?5YiY5Lqa54G/?= <yacanliu@163.com>
Cc:     "David S. Miller" <davem@davemloft.net>,
        LKML <linux-kernel@vger.kernel.org>,
        Linux Security Module list 
        <linux-security-module@vger.kernel.org>,
        Casey Schaufler <casey@schaufler-ca.com>
References: <3f8328fe-e648-9d0e-729d-eb6787f11bf9.ref@schaufler-ca.com>
 <3f8328fe-e648-9d0e-729d-eb6787f11bf9@schaufler-ca.com>
 <9b85945.3cfb.178862aa787.Coremail.yacanliu@163.com>
From:   Casey Schaufler <casey@schaufler-ca.com>
Message-ID: <83947731-d800-9a1f-71f9-4460c46e322a@schaufler-ca.com>
Date:   Wed, 31 Mar 2021 08:40:54 -0700
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.9.0
MIME-Version: 1.0
In-Reply-To: <9b85945.3cfb.178862aa787.Coremail.yacanliu@163.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Language: en-US
Content-Length: 1580
Precedence: bulk

On 3/30/2021 7:44 PM, =E5=88=98=E4=BA=9A=E7=81=BF wrote:
> Hi Casev:
>
> A quote from the listen(2) man page on my Ubuntu system:
> The backlog argument defines the maximum length to which=C2=A0
> the queue of pending connections for sockfd may grow.
> I think this implies that the 'backlog' must be greater than zero.
> In the test source file (tools/smack-ipv4-tcp-peersec.c) Line 60
> I found the following code:
> if (listen(firstsock, 0) < 0) {
> 	=C2=A0 =C2=A0 printf("%s-listen\n", argv[0]);
> 	=C2=A0 =C2=A0 exit(1);
> }
> That means that sock will not accept any requests,=C2=A0
> so client=C2=A0TCP connections hang with SYN_SENT.

Interesting. Prior to this change the code above was
accepting connections. I also tried code that uses a
backlog of 0 on a system without an LSM and discovered
the same behavior. That is, it accepted connections
with a 0 backlog before the change, and hangs after.

Is this a bug fix?

> In openssh case,=C2=A0it use SSH_LISTEN_BACKLOG as 128.
>
> At 2021-03-30 23:42:04, "Casey Schaufler" <casey@schaufler-ca.com> wrot=
e:
>> Commit f211ac154577ec9ccf07c15f18a6abf0d9bdb4ab 'net: correct
>> sk_acceptq_is_full()' breaks a system with the Smack LSM.
>> Reverting this change results in a return to correct behavior.
>>
>> The Smack testsuite can be found at:
>> 	https://github.com/smack-team/smack-testsuite.git
>>
>> The failing test is ipv4-tcp-local-peersec.sh, but it seems
>> that most TCP connections hang with SYN_SENT. Oddly, ssh
>> to 127.0.0.1 works, but other TCP connections timeout.
>>
>>
>>
>>
>
>
> =C2=A0
>
>
> =C2=A0