Skip to content

Commit c31a7b1

Browse files
bradfitzzx2c4
bradfitz
authored and
zx2c4
committed
conn, device, tun: set CLOEXEC on fds
Signed-off-by: Brad Fitzpatrick <[email protected]> Signed-off-by: Jason A. Donenfeld <[email protected]>
1 parent 6a08d81 commit c31a7b1

File tree

6 files changed

+36
-24
lines changed

6 files changed

+36
-24
lines changed

‎conn/bind_linux.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -331,7 +331,7 @@ func create4(port uint16) (int, uint16, error) {
331331

332332
fd, err := unix.Socket(
333333
unix.AF_INET,
334-
unix.SOCK_DGRAM,
334+
unix.SOCK_DGRAM|unix.SOCK_CLOEXEC,
335335
0,
336336
)
337337
if err != nil {
@@ -373,7 +373,7 @@ func create6(port uint16) (int, uint16, error) {
373373

374374
fd, err := unix.Socket(
375375
unix.AF_INET6,
376-
unix.SOCK_DGRAM,
376+
unix.SOCK_DGRAM|unix.SOCK_CLOEXEC,
377377
0,
378378
)
379379
if err != nil {

‎device/sticky_linux.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ func (device *Device) routineRouteListener(bind conn.Bind, netlinkSock int, netl
204204
}
205205

206206
func createNetlinkRouteSocket() (int, error) {
207-
sock, err := unix.Socket(unix.AF_NETLINK, unix.SOCK_RAW, unix.NETLINK_ROUTE)
207+
sock, err := unix.Socket(unix.AF_NETLINK, unix.SOCK_RAW|unix.SOCK_CLOEXEC, unix.NETLINK_ROUTE)
208208
if err != nil {
209209
return -1, err
210210
}

‎tun/tun_darwin.go‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ func CreateTUN(name string, mtu int) (Device, error) {
107107
}
108108
}
109109

110-
fd, err := unix.Socket(unix.AF_SYSTEM, unix.SOCK_DGRAM, 2)
110+
fd, err := socketCloexec(unix.AF_SYSTEM, unix.SOCK_DGRAM, 2)
111111
if err != nil {
112112
return nil, err
113113
}
@@ -173,7 +173,7 @@ func CreateTUNFromFile(file *os.File, mtu int) (Device, error) {
173173
return nil, err
174174
}
175175

176-
tun.routeSocket, err = unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)
176+
tun.routeSocket, err = socketCloexec(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)
177177
if err != nil {
178178
tun.tunFile.Close()
179179
return nil, err
@@ -276,7 +276,7 @@ func (tun *NativeTun) Close() error {
276276
}
277277

278278
func (tun *NativeTun) setMTU(n int) error {
279-
fd, err := unix.Socket(
279+
fd, err := socketCloexec(
280280
unix.AF_INET,
281281
unix.SOCK_DGRAM,
282282
0,
@@ -299,7 +299,7 @@ func (tun *NativeTun) setMTU(n int) error {
299299
}
300300

301301
func (tun *NativeTun) MTU() (int, error) {
302-
fd, err := unix.Socket(
302+
fd, err := socketCloexec(
303303
unix.AF_INET,
304304
unix.SOCK_DGRAM,
305305
0,
@@ -317,3 +317,15 @@ func (tun *NativeTun) MTU() (int, error) {
317317

318318
return int(ifr.MTU), nil
319319
}
320+
321+
func socketCloexec(family, sotype, proto int) (fd int, err error) {
322+
// See go/src/net/sys_cloexec.go for background.
323+
syscall.ForkLock.RLock()
324+
defer syscall.ForkLock.RUnlock()
325+
326+
fd, err = unix.Socket(family, sotype, proto)
327+
if err == nil {
328+
unix.CloseOnExec(fd)
329+
}
330+
return
331+
}

‎tun/tun_freebsd.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ func tunName(fd uintptr) (string, error) {
143143

144144
// Destroy a named system interface
145145
func tunDestroy(name string) error {
146-
fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
146+
fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM|unix.SOCK_CLOEXEC, 0)
147147
if err != nil {
148148
return err
149149
}
@@ -170,7 +170,7 @@ func CreateTUN(name string, mtu int) (Device, error) {
170170
return nil, fmt.Errorf("interface %s already exists", name)
171171
}
172172

173-
tunFile, err := os.OpenFile("/dev/tun", unix.O_RDWR, 0)
173+
tunFile, err := os.OpenFile("/dev/tun", unix.O_RDWR|unix.O_CLOEXEC, 0)
174174
if err != nil {
175175
return nil, err
176176
}
@@ -213,7 +213,7 @@ func CreateTUN(name string, mtu int) (Device, error) {
213213
// Disable link-local v6, not just because WireGuard doesn't do that anyway, but
214214
// also because there are serious races with attaching and detaching LLv6 addresses
215215
// in relation to interface lifetime within the FreeBSD kernel.
216-
confd6, err := unix.Socket(unix.AF_INET6, unix.SOCK_DGRAM, 0)
216+
confd6, err := unix.Socket(unix.AF_INET6, unix.SOCK_DGRAM|unix.SOCK_CLOEXEC, 0)
217217
if err != nil {
218218
tunFile.Close()
219219
tunDestroy(assignedName)
@@ -238,7 +238,7 @@ func CreateTUN(name string, mtu int) (Device, error) {
238238
}
239239

240240
if name != "" {
241-
confd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
241+
confd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM|unix.SOCK_CLOEXEC, 0)
242242
if err != nil {
243243
tunFile.Close()
244244
tunDestroy(assignedName)
@@ -295,7 +295,7 @@ func CreateTUNFromFile(file *os.File, mtu int) (Device, error) {
295295
return nil, err
296296
}
297297

298-
tun.routeSocket, err = unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)
298+
tun.routeSocket, err = unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW|unix.SOCK_CLOEXEC, unix.AF_UNSPEC)
299299
if err != nil {
300300
tun.tunFile.Close()
301301
return nil, err
@@ -397,7 +397,7 @@ func (tun *NativeTun) Close() error {
397397
}
398398

399399
func (tun *NativeTun) setMTU(n int) error {
400-
fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
400+
fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM|unix.SOCK_CLOEXEC, 0)
401401
if err != nil {
402402
return err
403403
}
@@ -414,7 +414,7 @@ func (tun *NativeTun) setMTU(n int) error {
414414
}
415415

416416
func (tun *NativeTun) MTU() (int, error) {
417-
fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
417+
fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM|unix.SOCK_CLOEXEC, 0)
418418
if err != nil {
419419
return 0, err
420420
}

‎tun/tun_linux.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ func (tun *NativeTun) routineHackListener() {
9999
}
100100

101101
func createNetlinkSocket() (int, error) {
102-
sock, err := unix.Socket(unix.AF_NETLINK, unix.SOCK_RAW, unix.NETLINK_ROUTE)
102+
sock, err := unix.Socket(unix.AF_NETLINK, unix.SOCK_RAW|unix.SOCK_CLOEXEC, unix.NETLINK_ROUTE)
103103
if err != nil {
104104
return -1, err
105105
}
@@ -194,7 +194,7 @@ func (tun *NativeTun) routineNetlinkListener() {
194194
func getIFIndex(name string) (int32, error) {
195195
fd, err := unix.Socket(
196196
unix.AF_INET,
197-
unix.SOCK_DGRAM,
197+
unix.SOCK_DGRAM|unix.SOCK_CLOEXEC,
198198
0,
199199
)
200200
if err != nil {
@@ -228,7 +228,7 @@ func (tun *NativeTun) setMTU(n int) error {
228228
// open datagram socket
229229
fd, err := unix.Socket(
230230
unix.AF_INET,
231-
unix.SOCK_DGRAM,
231+
unix.SOCK_DGRAM|unix.SOCK_CLOEXEC,
232232
0,
233233
)
234234
if err != nil {
@@ -264,7 +264,7 @@ func (tun *NativeTun) MTU() (int, error) {
264264
// open datagram socket
265265
fd, err := unix.Socket(
266266
unix.AF_INET,
267-
unix.SOCK_DGRAM,
267+
unix.SOCK_DGRAM|unix.SOCK_CLOEXEC,
268268
0,
269269
)
270270
if err != nil {
@@ -400,7 +400,7 @@ func (tun *NativeTun) Close() error {
400400
}
401401

402402
func CreateTUN(name string, mtu int) (Device, error) {
403-
nfd, err := unix.Open(cloneDevicePath, os.O_RDWR, 0)
403+
nfd, err := unix.Open(cloneDevicePath, unix.O_RDWR|unix.O_CLOEXEC, 0)
404404
if err != nil {
405405
if os.IsNotExist(err) {
406406
return nil, fmt.Errorf("CreateTUN(%q) failed; %s does not exist", name, cloneDevicePath)

‎tun/tun_openbsd.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -114,10 +114,10 @@ func CreateTUN(name string, mtu int) (Device, error) {
114114
var err error
115115

116116
if ifIndex != -1 {
117-
tunfile, err = os.OpenFile(fmt.Sprintf("/dev/tun%d", ifIndex), unix.O_RDWR, 0)
117+
tunfile, err = os.OpenFile(fmt.Sprintf("/dev/tun%d", ifIndex), unix.O_RDWR|unix.O_CLOEXEC, 0)
118118
} else {
119119
for ifIndex = 0; ifIndex < 256; ifIndex++ {
120-
tunfile, err = os.OpenFile(fmt.Sprintf("/dev/tun%d", ifIndex), unix.O_RDWR, 0)
120+
tunfile, err = os.OpenFile(fmt.Sprintf("/dev/tun%d", ifIndex), unix.O_RDWR|unix.O_CLOEXEC, 0)
121121
if err == nil || !errors.Is(err, syscall.EBUSY) {
122122
break
123123
}
@@ -165,7 +165,7 @@ func CreateTUNFromFile(file *os.File, mtu int) (Device, error) {
165165
return nil, err
166166
}
167167

168-
tun.routeSocket, err = unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)
168+
tun.routeSocket, err = unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW|unix.SOCK_CLOEXEC, unix.AF_UNSPEC)
169169
if err != nil {
170170
tun.tunFile.Close()
171171
return nil, err
@@ -270,7 +270,7 @@ func (tun *NativeTun) setMTU(n int) error {
270270

271271
fd, err := unix.Socket(
272272
unix.AF_INET,
273-
unix.SOCK_DGRAM,
273+
unix.SOCK_DGRAM|unix.SOCK_CLOEXEC,
274274
0,
275275
)
276276
if err != nil {
@@ -304,7 +304,7 @@ func (tun *NativeTun) MTU() (int, error) {
304304

305305
fd, err := unix.Socket(
306306
unix.AF_INET,
307-
unix.SOCK_DGRAM,
307+
unix.SOCK_DGRAM|unix.SOCK_CLOEXEC,
308308
0,
309309
)
310310
if err != nil {

0 commit comments

Comments
 (0)