-
Notifications
You must be signed in to change notification settings - Fork 268
Server sockets can hijack a client socket's connection #2593
Description
When connect() is called on an unbound TCP socket, the socket is assigned a random port and the socket is associated with a network interface using the key bind_ip:bind_port|peer_ip:peer_port. Later if bind() is called on another socket (typically a server socket) using the same port that was given to the first socket, this second socket will be associated with the network interface using the key bind_ip:bind_port|0:0. There are now two sockets associated with the same bind_ip and bind_port in the network interface.
When a packet arrives and _networkinterface_process_packet_in is called, it first performs a lookup using the key packet_dest_ip:packet_dest_port|0:0. For a packet that is supposed to be arriving at the client socket, this will end up matching the entry for the server socket instead. The server socket will then receive the packet, and the packet will probably be dropped. The client socket will never receive any more packets.