From nobody Sat Jan 11 16:51:07 2025 X-Original-To: freebsd-net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YVl0J3P4Nz5kb1d for ; Sat, 11 Jan 2025 16:51:12 +0000 (UTC) (envelope-from markjdb@gmail.com) Received: from mail-qt1-x833.google.com (mail-qt1-x833.google.com [IPv6:2607:f8b0:4864:20::833]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YVl0J1QWbz4pWj for ; Sat, 11 Jan 2025 16:51:12 +0000 (UTC) (envelope-from markjdb@gmail.com) Authentication-Results: mx1.freebsd.org; none Received: by mail-qt1-x833.google.com with SMTP id d75a77b69052e-4679fc9b5f1so23542201cf.1 for ; Sat, 11 Jan 2025 08:51:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1736614271; x=1737219071; darn=freebsd.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:sender:from:to:cc:subject:date:message-id :reply-to; bh=N3MGvEA9rDYZ3NKFJMzgsut/XahJp+Dcrdi+JWvQePk=; b=KTgTV9g+RcKWouW3pyLrnAuIvHeihWZSxFAhHRmauimTkjU9d2rzI3Q5LFi03KR7jq qrN+wUU6bS0/ofzTLDur6isl/c+jimX9+HokJCI7qOKglp78GQct7hf2w72IoieUYxcF GLBwx8Pl9ZpwNMWk7xrellXAnaS6ApuuiTlK/+QAo4Kw0fzUeyM8ND+MpB1j3UiQ4gAl LwrU/mu2xm8SBPvecuuYcbmgp8ffWnj0M1vDHzECn59fWWak5g1S18yj2CSqqCcK3YC/ 1PFrUVlhjdJ/YkufVLu+tZtwzeqflRaKh0aFXhUsd8/RhCy7aPo+HqvxwCXHQ25B2W/k 4oKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1736614271; x=1737219071; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:sender:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=N3MGvEA9rDYZ3NKFJMzgsut/XahJp+Dcrdi+JWvQePk=; b=vG/D0qEVexQjj+cgysnrKe9MLSeuWPYHGz+hff+JGRhKUOp10c63x9+cBriOL68m8V IBk3lqLOsmenRXJ4zEv5EITIZGqD/zuMIBBVVAK4WCPu9fZhepIRux8DjWN1ufG1NT09 W5yIzJtxtsem1UJdieGLG6s0OFTcgXpDODJeYu66yha7bti56tU0S3l1r+yTT+ZkzqQu r0DzGcgfy/cApmm/IA0mr0sQcWGOsrWqBdfPoixFcjeuONrnW30fnUiuD1ZchnYyN5ZD qhOlI1FyEpCpCfgth1mCDsJQVLbNvNEHkrWNKJJp+lz/hxz3zzDcRi5+89GvVUodFuAv XAbQ== X-Gm-Message-State: AOJu0YzToFhgkTXs5D1lJetmoKGQTnthKg0Bx9BBlilaEDdFslWtiE9+ SdboJv49wan+VYsnGSeZWuVzacaL2TN25eWzJ3nsu/8GdwBN0R5UIP68Nw== X-Gm-Gg: ASbGnctsuC7xLnuJB5KXGBn50TCkBZ1Y2YxdGfE55bSjxfizFPWl1ZX96Lg2oZq3S9t Q17MSdKz0RYyWm96CdAKLoZ1u12DiWBZr8ZVlvoWq/GbPUN5wP10zDFBskkKcMfMRXORZY8G35S ABuOizYqcTBAQDx3OBzWIWlTCbEXO0THMj2/OlXNnBjfXqWaplUw+jLVYd/nODFasM6Iq5Vf7VB CTf++U3NVK9maK8QIr9kTm9TgxF0yboFmbOD90hTGnvA+bdwBQlmetCXmz0K8qEsKmyw10= X-Google-Smtp-Source: AGHT+IEmjYzTRoyhLuOYnK4F/JVs7F9xGaisKoyI2tw7cPbnnx1XxKtvj9Xpt+oJ0aVp7H5i8HMAOA== X-Received: by 2002:ac8:5fd1:0:b0:467:8651:40a2 with SMTP id d75a77b69052e-46c7108ee68mr266995271cf.13.1736614271181; Sat, 11 Jan 2025 08:51:11 -0800 (PST) Received: from nuc (192-0-220-237.cpe.teksavvy.com. [192.0.220.237]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-46c873216dbsm21652031cf.7.2025.01.11.08.51.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 11 Jan 2025 08:51:10 -0800 (PST) Date: Sat, 11 Jan 2025 11:51:07 -0500 From: Mark Johnston To: Paul Vixie Cc: freebsd-net@freebsd.org Subject: Re: per-FIB socket binding Message-ID: References: <7772475.EvYhyI6sBW@dhcp-151.access.rits.tisf.net> <38589000.XM6RcZxFsP@dhcp-151.access.rits.tisf.net> <3330519.aeNJFYEL58@localhost> List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <3330519.aeNJFYEL58@localhost> X-Rspamd-Queue-Id: 4YVl0J1QWbz4pWj X-Spamd-Bar: ---- X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US] On Sat, Jan 11, 2025 at 06:25:22AM +0000, Paul Vixie wrote: > On Monday, January 6, 2025 3:56:55 PM UTC Mark Johnston wrote: > > On Fri, Dec 27, 2024 at 08:48:48AM +0000, Paul Vixie wrote: > > > ... > > > I think the patch is probably a good idea, and the trick of only > > inheriting the packet's FIB if the socket's is non-zero would avoid > > breaking compatibility for most cases. > > note, i often feel that integers aren't booleans and shouldn't be treated as > booleans. however, i can't easily look at > > x = (y != 0) ? y : z; > > when i know it could be written instead > > x = y || z; > > so if this is forbidden by today's freebsd kernel rules, please educate me. i > know that GCC and CLang will optimize down to the same instruction sequence > for either, but i prefer the shorter form since in this rare case it is > clearer. We are not super consistent about it, but style(9) does prescribe explicit comparisons, i.e., "if (count != 0)" rather than "if (count)". In any case, I'd add a comment, since that assignment is a bit subtle. > > One side effect of the patch is that a service listening in FIB 0 that > > has no route to the source address of a connection attempt from a > > different FIB would previously not accept such a connection, but now it > > will. Perhaps that's drastic enough to warrant a sysctl and/or sockopt > > to control this behaviour. > > i hope not. the SYN|ACK will always use the FIB from the interface where the > SYN arrived (this is in tcp_syncache.c). This isn't clear to me. The initial SYN will create a syncache entry in the if (tp->t_state == TCPS_LISTEN && SOLISTENING(so)) case in tcp_input_with_port(). In this case we define inc.inc_fibnum = so->so_fibnum, i.e., the FIB of the listening socket. Then, syncache_add() copies inc to sc_inc, so sc_inc.inc_fibnum for the syncache entry comes from the listening socket, and syncache_respond() sets the SYN|ACK mbuf FIB with M_SETFIB(m, sc->sc_inc.inc_fibnum). What am I missing? (Yes, I should actually do an experiement to check the behaviour.) > if the SYN's source address isn't > allowed by uRPF or other checking (in PF or IPFW) this will be determined by > the FIB in the SYN's PKTHDR not the one we put into the PCB. whereas if there > is some user-mode ACL processing (for example in BIND9's "allow-transfer") > there is no way to learn the socket's FIB. i think this excludes the case > where we would have rejected a connection if only the interface's FIB had not > been stamped onto the PCB. as before please educate me if i'm misunderstanding > you, and i apologize in advance for the extra work involved in doing so. > > > It would be better to pass the fibnum to solisten_clone() and assign it > > there. Otherwise, the value of so_fibnum will be wrong for a short > > window during which the socket is passed to MAC and other hooks, which > > might have some surprising effects. > > it shall be done. thanks for your review. > > more reviews would be welcome. i'm working on the bind() case now, so that the > socket's FIB if still zero will be made equal to the FIB of the interface > where the laddr is found. this still won't handle UDP responses but it will > take care of TCP, UDP, and SCTP initiators. and i think i'm going to implement > this for SCTP responders even though i can't test it here since it looks > simple. (famous last words, i know.) > > -- > Paul Vixie > >