* tcp_ipv6_check_established
@ 2004-05-11 23:37 Mark Huth
2004-05-18 7:22 ` tcp_ipv6_check_established YOSHIFUJI Hideaki / 吉藤英明
0 siblings, 1 reply; 3+ messages in thread
From: Mark Huth @ 2004-05-11 23:37 UTC (permalink / raw)
To: netdev
[-- Attachment #1: Type: text/plain, Size: 1449 bytes --]
There appears to be a long-standing bug in tcp_ipv6_check_established
that results in the return of EADDRNOTAVAILABLE from connect(). It can
be demonstrated in the following scenario:
The following scenario fails in most known ipv6 linuxes
All within a single node.
Host has two IPv6 addresses:
dead:dead:dead:dead::1/128
dead:dead:dead:dead::2/128
Application A creates two listening sockets:
dead:dead:dead:dead::1 49997
dead:dead:dead:dead::2 49997
Application B creates a TCP-connection:
from dead:dead:dead:dead::1 49998 to dead:dead:dead:dead::2 49997
Application C creates a TCP-connection:
from dead:dead:dead:dead::2 49998 to dead:dead:dead:dead::1 49997
However, the latter operation fails, and connect() returns
EADDRNOTAVAILABLE. Meaning that the host already has such a connection and
the new one cannot be created. Clearly there is no identical connection
used (different ports), thus connect() misbehaves.
All sockets use SO_REUSEADDR-option, and all sockets bind() their source
address and source ports before the attempted connect().
While the above may be somewhat contrived, the code is wrong by inspection.
The check for the established connections interates on sk2, while the macro
argument for TCP_IPV6_MATCH is sk. Thus the check result is invarient over the loop.
A proposed patch for 2.6.6 is attached. A similar patch is required for 2.4 kernels, and is
also attached.
Mark Huth
[-- Attachment #2: tcp_ipv6_check_est-2.6.6.patch --]
[-- Type: application/octet-stream, Size: 456 bytes --]
diff -ur linux-2.6.6/net/ipv6/tcp_ipv6.c linux-2.6.6-patch/net/ipv6/tcp_ipv6.c
--- linux-2.6.6/net/ipv6/tcp_ipv6.c 2004-05-09 19:32:38.000000000 -0700
+++ linux-2.6.6-patch/net/ipv6/tcp_ipv6.c 2004-05-11 11:19:24.000000000 -0700
@@ -479,7 +479,7 @@
/* And established part... */
sk_for_each(sk2, node, &head->chain) {
- if(TCP_IPV6_MATCH(sk, saddr, daddr, ports, dif))
+ if(TCP_IPV6_MATCH(sk2, saddr, daddr, ports, dif))
goto not_unique;
}
[-- Attachment #3: tcp_ipv6_check_est-2.4.20.patch --]
[-- Type: application/octet-stream, Size: 450 bytes --]
diff -ur --exclude CVS linux/net/ipv6/tcp_ipv6.c linux_patch/net/ipv6/tcp_ipv6.c
--- linux/net/ipv6/tcp_ipv6.c 2003-10-02 12:03:53.000000000 -0700
+++ linux_patch/net/ipv6/tcp_ipv6.c 2004-05-10 18:00:14.000000000 -0700
@@ -454,7 +454,7 @@
tw = NULL;
for(skp = &head->chain; (sk2=*skp)!=NULL; skp = &sk2->next) {
- if(TCP_IPV6_MATCH(sk, saddr, daddr, ports, dif))
+ if(TCP_IPV6_MATCH(sk2, saddr, daddr, ports, dif))
goto not_unique;
}
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2004-05-20 6:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-05-11 23:37 tcp_ipv6_check_established Mark Huth
2004-05-18 7:22 ` tcp_ipv6_check_established YOSHIFUJI Hideaki / 吉藤英明
2004-05-20 6:29 ` tcp_ipv6_check_established David S. Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).