SO_BINDTODEVICE does not affect TCP connect
- Dominant language
- Go
- Stars
- 19.3k
- Forks
- 2k
- Avg merge
- 3d 7h
- Merged PRs (30d)
- 275
Description
### Description
Setting SO_BINDTODEVICE on a bound TCP socket does not restrict the routes considered when initiating a connection with that socket.
With two interfaces set up with routes to the same destination subnet, and a TCP socket bound on * (all-zeroes address), setting the bound device for the socket before connecting does not restrict which interface the connection is attempted on.
The code in question is [here](https://github.com/google/gvisor/blob/05bf4695223dac314b390c7b61cda6f0f819a4b1/pkg/tcpip/transport/tcp/endpoint.go#L2380-L2391); it checks `e.boundNICID`, which comes from the scope of the bound address, but not `e.boundBindToDevice`.
### Steps to reproduce
With two interfaces set up with routes to the same destination subnet,
1. Create a TCP socket
2. Set SO_BINDTODEVICE on it with one of the interfaces
3. Then bind the socket to some port on the all-zeroes address
4. Call connect on the socket with some destination address
5. Observe that the connection is not necessarily performed over the requested interface (though it might be, since one of the interfaces is chosen arbitrarily).
### runsc version
_No response_
### docker version (if using docker)
_No response_
### uname
_No response_
### kubectl (if using Kubernetes)
_No response_
### repo state (if built from source)
_No response_
### runsc debug logs (if available)
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.