Skip to content

Server sockets can hijack a client socket's connection #2593

@stevenengler

Description

@stevenengler

When connect() is called on an unbound TCP socket, the socket is assigned a random port and the socket is associated with a network interface using the key bind_ip:bind_port|peer_ip:peer_port. Later if bind() is called on another socket (typically a server socket) using the same port that was given to the first socket, this second socket will be associated with the network interface using the key bind_ip:bind_port|0:0. There are now two sockets associated with the same bind_ip and bind_port in the network interface.

When a packet arrives and _networkinterface_process_packet_in is called, it first performs a lookup using the key packet_dest_ip:packet_dest_port|0:0. For a packet that is supposed to be arriving at the client socket, this will end up matching the entry for the server socket instead. The server socket will then receive the packet, and the packet will probably be dropped. The client socket will never receive any more packets.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type: BugError or flaw producing unexpected results

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions