d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

When checking for possible port theft, skip over a TCP inpcb

Browse Source 
unless it's in the closed or listening state (remote address
== INADDR_ANY).

If a TCP inpcb is in any other state, it's impossible to steal
its local port or use it for port theft.  And if there are
both closed/listening and connected TCP inpcbs on the same
localIP:port couple, the call to in_pcblookup_local() will
find the former due to the design of that function.

No objections raised in:	-net, -arch
MFC after:			1 month
This commit is contained in:
Yaroslav Tykhiy 2004-05-20 06:35:02 +00:00
parent 5aedc78012
commit 4658dc8325
1 changed files with 3 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sys/netinet/in_pcb.c
View File

@ -332,14 +332,10 @@ in_pcbbind_setup(inp, nam, laddrp, lportp, cred)
* XXX
* This entire block sorely needs a rewrite.
*/
if (t && (t->inp_vflag & INP_TIMEWAIT)) {
if ((ntohl(sin->sin_addr.s_addr) != INADDR_ANY ||
ntohl(t->inp_laddr.s_addr) != INADDR_ANY ||
(intotw(t)->tw_so_options & SO_REUSEPORT) == 0) &&
(so->so_cred->cr_uid != intotw(t)->tw_cred->cr_uid))
return (EADDRINUSE);
} else
if (t &&
((t->inp_vflag & INP_TIMEWAIT) == 0) &&
(so->so_type != SOCK_STREAM ||
ntohl(t->inp_faddr.s_addr) == INADDR_ANY) &&
(ntohl(sin->sin_addr.s_addr) != INADDR_ANY ||
ntohl(t->inp_laddr.s_addr) != INADDR_ANY ||
(t->inp_socket->so_options &