daemon: add configurability for low source port check

In commit c0482d5a8a this check was added.  Now one can e.g. disable by
> require('ffi').C.the_network.min_udp_source_port = 0
(typically used inside YAML config at /lua/script or /lua/script-file)

diff --git a/daemon/io.c b/daemon/io.c
index 3f0f1065e25f1f2c76c3bc1a7ff3b9f69f3f1bd0..fa99ac036f81cfee411edab7e5e872f3266523b5 100644 (file)
--- a/daemon/io.c
+++ b/daemon/io.c
@@ -78,9 +78,7 @@ void udp_recv(uv_udp_t *handle, ssize_t nread, const uv_buf_t *buf,
                }
        }
 
-       // We're aware of no use cases for low source ports,
-       // and they might be useful for attacks with spoofed source IPs.
-       if (!s->outgoing && kr_inaddr_port(comm_addr) < 1024) {
+       if (!s->outgoing && kr_inaddr_port(comm_addr) < the_network->min_udp_source_port) {
                kr_log_debug(IO, "<= ignoring UDP from suspicious port: '%s'\n",
                                kr_straddr(comm_addr));
                return;

diff --git a/daemon/lua/kres-gen-33.lua b/daemon/lua/kres-gen-33.lua
index efe0d68564fb0ecece2cc7231b7deced696f55b6..83269222ca51b42c72421d9a52f45d008bbac38d 100644 (file)
--- a/daemon/lua/kres-gen-33.lua
+++ b/daemon/lua/kres-gen-33.lua
@@ -608,6 +608,7 @@ struct network {
                int rcv;
        } listen_tcp_buflens;
        _Bool enable_connect_udp;
+       uint16_t min_udp_source_port;
 };
 struct args *the_args;
 struct endpoint {

diff --git a/daemon/network.c b/daemon/network.c
index 5551b15a04cfbef9fd245bd80a9ae835450c02a5..9bedfc929924e80c8c0242e6f6d5da57a26c935b 100644 (file)
--- a/daemon/network.c
+++ b/daemon/network.c
@@ -79,6 +79,7 @@ void network_init(uv_loop_t *loop, int tcp_backlog)
        the_network->tcp.user_timeout = 1000; // 1s should be more than enough
        the_network->tcp_backlog = tcp_backlog;
        the_network->enable_connect_udp = true;
+       the_network->min_udp_source_port = 1024;
 
        // On Linux, unset means some auto-tuning mechanism also depending on RAM,
        // which might be OK default (together with the user_timeout above)

diff --git a/daemon/network.h b/daemon/network.h
index 9d50e46d3a912f9430fde6618bc6d2db3d0f6837..00fa10a19e254346ba6f9cc1eabdcc517d55cbb4 100644 (file)
--- a/daemon/network.h
+++ b/daemon/network.h
@@ -122,6 +122,9 @@ struct network {
         * a slight improvement in syscall processing efficiency.
         * Note: This does not necessarily lead to overall performance gains. */
        bool enable_connect_udp;
+
+       /** Low source port (e.g. 53) might be useful for attacks with spoofed source IPs. */
+       uint16_t min_udp_source_port;
 };
 
 /** Pointer to the singleton network state. NULL if not initialized. */