[PATCH] net: ip: Do not allow connection to remote port zero

[PATCH] net: ip: Do not allow connection to remote port zero

[Tom Marshall]

Port zero is reserved according to IANA.

Note UDP sendto is already disallowed if dport is zero.

Signed-off-by: Tom Marshall <tom@cyngn.com>
---
 net/ipv4/datagram.c | 3 +++
 net/ipv4/tcp_ipv4.c | 3 +++
 net/ipv6/datagram.c | 3 +++
 net/ipv6/tcp_ipv6.c | 3 +++
 4 files changed, 12 insertions(+)

diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 90c0e83..e732382 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -37,6 +37,9 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	if (usin->sin_family != AF_INET)
 		return -EAFNOSUPPORT;
 
+	if (!usin->sin_port)
+		return -EINVAL;
+
 	sk_dst_reset(sk);
 
 	lock_sock(sk);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index d22f544..fef2f9f 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -156,6 +156,9 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	if (usin->sin_family != AF_INET)
 		return -EAFNOSUPPORT;
 
+	if (!usin->sin_port)
+		return -EINVAL;
+
 	nexthop = daddr = usin->sin_addr.s_addr;
 	inet_opt = rcu_dereference_protected(inet->inet_opt,
 					     sock_owned_by_user(sk));
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 49f5e73..fb6934e 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -66,6 +66,9 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	if (usin->sin6_family != AF_INET6)
 		return -EAFNOSUPPORT;
 
+	if (!usin->sin6_port)
+		return -EINVAL;
+
 	memset(&fl6, 0, sizeof(fl6));
 	if (np->sndflow) {
 		fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 9c0b54e..1ae8bf1 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -146,6 +146,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 	if (usin->sin6_family != AF_INET6)
 		return -EAFNOSUPPORT;
 
+	if (!usin->sin6_port)
+		return -EINVAL;
+
 	memset(&fl6, 0, sizeof(fl6));
 
 	if (np->sndflow) {
-- 
2.1.4

Re: [PATCH] net: ip: Do not allow connection to remote port zero

[Eric Dumazet]

On Wed, 2015-02-11 at 16:58 -0800, Tom Marshall wrote:
> Port zero is reserved according to IANA.
> 
> Note UDP sendto is already disallowed if dport is zero.

I have no idea why we should prevent such thing.

There is nothing wrong sending a TCP frame with dport=0, even if
practically it is not possible to setup a listener on such port using
BSD API.

Maybe some tools are actually using this already to send probes...

Re: [PATCH] net: ip: Do not allow connection to remote port zero

[Tom Marshall]

On Wed, Feb 11, 2015 at 08:06:14PM -0800, Eric Dumazet wrote:
> On Wed, 2015-02-11 at 16:58 -0800, Tom Marshall wrote:
> > Port zero is reserved according to IANA.
> > 
> > Note UDP sendto is already disallowed if dport is zero.
> 
> I have no idea why we should prevent such thing.

* It is marked "reserved" by IANA.

* UDP packets with dport=0 are already prevented from being sent.

* Many routers will either drop the packets or, worse, send back a RST to a
  SYN destined for port 0.

> There is nothing wrong sending a TCP frame with dport=0, even if
> practically it is not possible to setup a listener on such port using
> BSD API.

Then why not allow UDP packets with dport=0?



For background, I encountered this via a test fail in Google's Android CTS. 
Their test suite tries to ensure that a Java level connect with a specified
timeout functions properly by establishing a TCPv4 connection to a verified
unreachable address on the internet.  It happens to use port 0 as a
destination port.  I observed that sometimes this test succeeds and
sometimes it fails.  When it fails, tcpdump shows a RST coming back.  And
that RST is coming from a local router on one of the networks that I am
frequently on.

After doing some research and seeing the UDP sendto behavior, I figured it
would be good to have consistency between sendto() and connect(), and also
make it obvious to userspace that dport=0 is not permitted in any form.

Note that the latest CTS code does have a "fix" for this ... which was not
to switch ports, but to handle the case where ECONNREFUSED is returned
before the connect timeout expires... :/

Re: [PATCH] net: ip: Do not allow connection to remote port zero

[Tom Marshall]

> * UDP packets with dport=0 are already prevented from being sent.

FYI, I tried to trace where this code (disallowing udp packets with dport=0)
came from.  It predates git history, and I don't have any way to access
anything prior.

Re: [PATCH] net: ip: Do not allow connection to remote port zero

[Sergei Shtylyov]

Hello.

On 2/12/2015 9:23 AM, Tom Marshall wrote:

>> * UDP packets with dport=0 are already prevented from being sent.

> FYI, I tried to trace where this code (disallowing udp packets with dport=0)
> came from.  It predates git history, and I don't have any way to access
> anything prior.

    Tried https://git.kernel.org/cgit/linux/kernel/git/tglx/history.git/?

WBR, Sergei

Re: [PATCH] net: ip: Do not allow connection to remote port zero

[Tom Marshall]

On Thu, Feb 12, 2015 at 04:54:10PM +0300, Sergei Shtylyov wrote:
> Hello.
> 
> On 2/12/2015 9:23 AM, Tom Marshall wrote:
> 
> >>* UDP packets with dport=0 are already prevented from being sent.
> 
> >FYI, I tried to trace where this code (disallowing udp packets with dport=0)
> >came from.  It predates git history, and I don't have any way to access
> >anything prior.
> 
>    Tried https://git.kernel.org/cgit/linux/kernel/git/tglx/history.git/?

Thanks, I didn't know about that.

The logic predates that tree also.  Which means prior to 2.5.0 or so.

Re: [PATCH] net: ip: Do not allow connection to remote port zero

[Eric Dumazet]

On Wed, 2015-02-11 at 21:24 -0800, Tom Marshall wrote:
> On Wed, Feb 11, 2015 at 08:06:14PM -0800, Eric Dumazet wrote:
> > On Wed, 2015-02-11 at 16:58 -0800, Tom Marshall wrote:
> > > Port zero is reserved according to IANA.
> > > 
> > > Note UDP sendto is already disallowed if dport is zero.
> > 
> > I have no idea why we should prevent such thing.
> 
> * It is marked "reserved" by IANA.
> 
> * UDP packets with dport=0 are already prevented from being sent.
> 
> * Many routers will either drop the packets or, worse, send back a RST to a
>   SYN destined for port 0.

Some networking/supervision applications might use this knowledge to
send TCP probes with dport=0, expecting to get an RST, knowing no
listener could possibly answer with a SYNACK.

If you take a look at traceroute -p TCP, you'll be shocked that it sends
malformed TCP packets. IANA never complained about this, so far.