Subject: TCP Port reuse related ...

From: "Ramesh Shankar" <[email-masked]>
Date: Wed, 26 Jan 2000 20:22:08 -0700

While trying to figure out the details related to SO_REUSEADDR/SO_REUSEPORT, I found that there are considerable differences between Linux, NetBSD/FreeBSD, Winsock.

While looking at Linux v2.2.14 source, (and in the previous versions of the source), there are some comments related to port reuse and FTP servers which I don't seem to understand.

Specifically, if I bind <*, port #> to socket1 and bind <*, port #> to socket2 (Port #s are the same, * is INADDR_ANY) and specify SO_REUSEADDR for both bind operations, then the bind()s succeed. 

However, if I call listen() for socket1 before binding socket2, then socket2's bind() *fails* (even if we use SO_REUSEADDR). This is somewhat understandable. (Note: The same operation succeeds in NetBSD/FreeBSD). Any combination of IP address (one being *, other not being * or vice versa or both being the same IP address) when socket1 is put on listen fails. When listen() is used on socket1, the only allowed way seems to be:

socket1: bind(IP1, port #)
listen(socket1)
socket2: bind(IP2, port#)

(Where IP1 and IP2 are valid local IP addresses)

I don't understand why the following combination should not be allowed:

socket1: bind(*, port #)
listen(socket1)
socket2: bind(IP1, port #)

For a multihomed host, socket2 (if put on listen()), would field all packets destined for IP1, while socket1 will field the others.

(Refer tcp_v4_get_port() in net/ipv4/tcp_ipv4.c)

Thanks,

S.R.

P.S.:

If anyone can explain me what the comments in the file include/net/tcp.h near the definition of the structure tcp_bind_bucket really mean, it would be greatly appreciated!

Even though this is kind of a Linux question, it still is related to TCP implementation, and hence I posted on this list.

---

From: Kacheong Poon <[email-masked]>
Date: Thu, 27 Jan 2000 14:03:55 -0800 (PST)

> For a multihomed host, socket2 (if put on listen()), would field all packets
> destined for IP1, while socket1 will field the others.

Suppose this is allowed and assume that socket1 belongs to a server app.  
Then socket2, which belongs to a malicious app, can steal all service
requests originated from IP1.  Further assume that the malicious app does
the above for all "known" IP addresses in that network, then it basically
hijacks all service requests from the server app.  The bad thing is the
server app does not even know about this...

> If anyone can explain me what the comments in the file include/net/tcp.h
> near the definition of the structure tcp_bind_bucket really mean, it would
> be greatly appreciated!

It is a nice optimization.  What is not clear in that?

							K. Poon.
							[email-masked]