On 09/21/16 at 05:45pm, Pablo Neira Ayuso wrote: > On Tue, Sep 20, 2016 at 06:43:35PM +0200, Daniel Mack wrote: > > The point is that from an application's perspective, restricting the > > ability to bind a port and dropping packets that are being sent is a > > very different thing. Applications will start to behave differently if > > they can't bind to a port, and that's something we do not want to happen. > > What is exactly the problem? Applications are not checking for return > value from bind? They should be fixed. If you want to collect > statistics, I see no reason why you couldn't collect them for every > EACCESS on each bind() call.
It's not about applications not checking the return value of bind(). Unfortunately, many applications (or the respective libraries they use) retry on connect() failure but handle bind() errors as a hard failure and exit. Yes, it's an application or library bug but these applications have very specific exceptions how something fails. Sometimes even going from drop to RST will break applications. Paranoia speaking: by returning errors where no error was returned before, undefined behaviour occurs. In Murphy speak: things break. This is given and we can't fix it from the kernel side. Returning at system call level has many benefits but it's not always an option. Adding the late hook does not prevent filtering at socket layer to also be added. I think we need both.
