net: Fix a documentation bug wrt. ip_unprivileged_port_start
diff mbox series

Message ID 20191122221204.160964-1-zenczykowski@gmail.com
State Changes Requested
Delegated to: David Miller
Headers show
Series
  • net: Fix a documentation bug wrt. ip_unprivileged_port_start
Related show

Commit Message

Maciej Żenczykowski Nov. 22, 2019, 10:12 p.m. UTC
From: Maciej Żenczykowski <maze@google.com>

It cannot overlap with the local port range - ie. with autobind selectable
ports - and not with reserved ports.

Indeed 'ip_local_reserved_ports' isn't even a range, it's a (by default
empty) set.

Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: Maciej Żenczykowski <maze@google.com>
---
 Documentation/networking/ip-sysctl.txt | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

Comments

Jakub Kicinski Nov. 24, 2019, 2:17 a.m. UTC | #1
On Fri, 22 Nov 2019 14:12:04 -0800, Maciej Żenczykowski wrote:
> From: Maciej Żenczykowski <maze@google.com>
> 
> It cannot overlap with the local port range - ie. with autobind selectable
> ports - and not with reserved ports.
> 
> Indeed 'ip_local_reserved_ports' isn't even a range, it's a (by default
> empty) set.
> 
> Cc: Eric Dumazet <edumazet@google.com>
> Signed-off-by: Maciej Żenczykowski <maze@google.com>

Since this is a documentation _bug_ :) we probably need a Fixes tag.
The mistake is almost 3 years old, could be worth giving the backport
bots^W folks a chance to pick it up.

Is this all the way from 4548b683b781 ("Introduce a sysctl that
modifies the value of PROT_SOCK.") ?
Maciej Żenczykowski Nov. 24, 2019, 9:16 a.m. UTC | #2
> Since this is a documentation _bug_ :) we probably need a Fixes tag.
> The mistake is almost 3 years old, could be worth giving the backport
> bots^W folks a chance to pick it up.
>
> Is this all the way from 4548b683b781 ("Introduce a sysctl that
> modifies the value of PROT_SOCK.") ?

Yes, indeed.
That commit adds the documentation itself, and:

// ipv4_local_port_range()
-               if (range[1] < range[0])
+               /* Ensure that the upper limit is not smaller than the lower,
+                * and that the lower does not encroach upon the privileged
+                * port limit.
+                */
+               if ((range[1] < range[0]) ||
+                   (range[0] < net->ipv4.sysctl_ip_prot_sock))

and

// ipv4_privileged_ports()

+       pports = net->ipv4.sysctl_ip_prot_sock;
+
+       ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
+
+       if (write && ret == 0) {
+               inet_get_local_port_range(net, &range[0], &range[1]);
+               /* Ensure that the local port range doesn't overlap with the
+                * privileged port range.
+                */
+               if (range[0] < pports)
+                       ret = -EINVAL;
+               else
+                       net->ipv4.sysctl_ip_prot_sock = pports;
+       }

Anyway, I guess this means this commit should have:

Fixes: 4548b683b781 ("Introduce a sysctl that modifies the value of PROT_SOCK.")

(which is in v4.10-rc4-733-g4548b683b781)

Should I resubmit with the new tag, or will you just pick it up?
Jakub Kicinski Nov. 25, 2019, 12:09 a.m. UTC | #3
On Sun, 24 Nov 2019 01:16:35 -0800, Maciej Żenczykowski wrote:
> > Since this is a documentation _bug_ :) we probably need a Fixes tag.
> > The mistake is almost 3 years old, could be worth giving the backport
> > bots^W folks a chance to pick it up.
> >
> > Is this all the way from 4548b683b781 ("Introduce a sysctl that
> > modifies the value of PROT_SOCK.") ?  
> 
> Yes, indeed.
> That commit adds the documentation itself, and:
> 
> // ipv4_local_port_range()
> -               if (range[1] < range[0])
> +               /* Ensure that the upper limit is not smaller than the lower,
> +                * and that the lower does not encroach upon the privileged
> +                * port limit.
> +                */
> +               if ((range[1] < range[0]) ||
> +                   (range[0] < net->ipv4.sysctl_ip_prot_sock))
> 
> and
> 
> // ipv4_privileged_ports()
> 
> +       pports = net->ipv4.sysctl_ip_prot_sock;
> +
> +       ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
> +
> +       if (write && ret == 0) {
> +               inet_get_local_port_range(net, &range[0], &range[1]);
> +               /* Ensure that the local port range doesn't overlap with the
> +                * privileged port range.
> +                */
> +               if (range[0] < pports)
> +                       ret = -EINVAL;
> +               else
> +                       net->ipv4.sysctl_ip_prot_sock = pports;
> +       }
> 
> Anyway, I guess this means this commit should have:
> 
> Fixes: 4548b683b781 ("Introduce a sysctl that modifies the value of PROT_SOCK.")
> 
> (which is in v4.10-rc4-733-g4548b683b781)
> 
> Should I resubmit with the new tag, or will you just pick it up?

Thanks for the tag, now that you showed me the code I'm not 100% sure
the doc is correct :S

The first unprivileged port has to be lower than the
ip_local_port_range, IOW ip_local_port_range must fall 
into unprivileged range entirely.

So does "It may not overlap with the ip_local_port_range." really
express that? Should it say something like "ip_local_port_range must
fall into the unprivileged range" or "It must be lower or equal to start
of ip_local_port_range" or "Unprivileged port range must contain
ip_local_port_range" or...
Maciej Żenczykowski Nov. 25, 2019, 10:35 p.m. UTC | #4
I'm not entirely certain what would be better.
It does seem sensible to me... but perhaps, it would be better if
'may' was 'must' and 'it' was 'they',
since it's referring to the 'privileged ports' which is plural.
Jakub Kicinski Nov. 25, 2019, 10:43 p.m. UTC | #5
On Mon, 25 Nov 2019 14:35:11 -0800, Maciej Żenczykowski wrote:
> I'm not entirely certain what would be better.
> It does seem sensible to me... but perhaps, it would be better if
> 'may' was 'must' and 'it' was 'they',
> since it's referring to the 'privileged ports' which is plural.

Ack, sounds good

Patch
diff mbox series

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 099a55bd1432..dcf05fd1143a 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -904,8 +904,9 @@  ip_local_port_range - 2 INTEGERS
 	Defines the local port range that is used by TCP and UDP to
 	choose the local port. The first number is the first, the
 	second the last local port number.
-	If possible, it is better these numbers have different parity.
-	(one even and one odd values)
+	If possible, it is better these numbers have different parity
+	(one even and one odd value).
+	Must be greater than or equal to ip_unprivileged_port_start.
 	The default values are 32768 and 60999 respectively.
 
 ip_local_reserved_ports - list of comma separated ranges
@@ -944,7 +945,7 @@  ip_unprivileged_port_start - INTEGER
 	unprivileged port in the network namespace.  Privileged ports
 	require root or CAP_NET_BIND_SERVICE in order to bind to them.
 	To disable all privileged ports, set this to 0.  It may not
-	overlap with the ip_local_reserved_ports range.
+	overlap with the ip_local_port_range.
 
 	Default: 1024