Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20210401155704.35341-1-otto.hollmann@suse.com>
In-Reply-To: <20210401155704.35341-1-otto.hollmann@suse.com>
From:   Eric Dumazet <edumazet@google.com>
Date:   Thu, 1 Apr 2021 18:04:05 +0200
Message-ID: <CANn89iJvtuT4q-djaCzoGJTY68vE8wT+LVDkYGm=8_XzC9gchg@mail.gmail.com>
Subject: Re: [PATCH net-next] net: document a side effect of ip_local_reserved_ports
To:     Otto Hollmann <otto.hollmann@suse.com>
Cc:     "David S. Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>,
        netdev <netdev@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Jonathan Corbet <corbet@lwn.net>,
        David Ahern <dsahern@kernel.org>,
        Michal Kubecek <mkubecek@suse.cz>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Thu, Apr 1, 2021 at 5:58 PM Otto Hollmann <otto.hollmann@suse.com> wrote=
:
>
>     If there is overlapp between ip_local_port_range and ip_local_reserve=
d_ports with a huge reserved block, it will affect probability of selecting=
 ephemeral ports, see file net/ipv4/inet_hashtables.c:723
>
>     int __inet_hash_connect(
>     ...
>             for (i =3D 0; i < remaining; i +=3D 2, port +=3D 2) {
>                     if (unlikely(port >=3D high))
>                             port -=3D remaining;
>                     if (inet_is_local_reserved_port(net, port))
>                             continue;
>
>     E.g. if there is reserved block of 10000 ports, two ports right after=
 this block will be 5000 more likely selected than others.
>     If this was intended, we can/should add note into documentation as pr=
oposed in this commit, otherwise we should think about different solution. =
One option could be mapping table of continuous port ranges. Second option =
could be letting user to modify step (port+=3D2) in above loop, e.g. using =
new sysctl parameter.
>
> Signed-off-by: Otto Hollmann <otto.hollmann@suse.com>

I think we can view this as a security bug that needs a fix.