Re: IPv6 in Java on FreeBSD

On Thu, Feb 20, 2025 at 02:55:27PM +0100, Harald Eilertsen wrote:
> On Wed, Feb 19, 2025 at 01:18:03PM -0800, Jeff Anton wrote:
> > I believe the security issue is that if you have an ipv4 mapped into
> > ipv6 arrangement, another process may be able to set up an ipv4 only
> > socket to capture or intercept ipv4 traffic instead of the ipv4 mapped
> > into ipv6 socket already established.
>
> This seems to be a BSD problem, as it allows a bind to a port on a
> specific addess (localhost or an interface address) even if the port is
> bound by the wildcard address. I don't know the rationale for that.

I did a bit of research, and god a lot of help from Tom Jones to get to
the bottom of this yesterday. And I think the culprit is SO_REUSEADDR.

For a server socket, Java will set the SO_REUSEADDR socket option by
default. But this option behaves quite differently on BSD (at least
FreeBSD) than in Linux (and presumably AIX and macOS, which are the
other platforms using this code path.)

While Linux (and the others?) will refuse to create a socket to the same
port as an already active listening socket bound to INADDR_ANY – even
with the SO_REUSEADDR set, BSD will allow this.
(https://www.man7.org/linux/man-pages/man7/socket.7.html)

From the testing I've done so far, it seems like it would be safe to
not set the SO_REUSEADDR option on FreeBSD. This should allow the Java
use of dual protocol sockets without opening for port higjacking from
other processes.

Anything else I've missed regarding this issue then? :)

Take care!
Harald