google / google/gvisor

SO_BINDTODEVICE does not affect TCP connect

Open
#8,276 2 comments 0 reactions 0 assignees View on GitHub
area: networking no-auto-close type: bug
Dominant language
Go
Stars
19.3k
Forks
2k
Avg merge
3d 7h
Merged PRs (30d)
275

Description

### Description

Setting SO_BINDTODEVICE on a bound TCP socket does not restrict the routes considered when initiating a connection with that socket.

With two interfaces set up with routes to the same destination subnet, and a TCP socket bound on * (all-zeroes address), setting the bound device for the socket before connecting does not restrict which interface the connection is attempted on.

The code in question is [here](https://github.com/google/gvisor/blob/05bf4695223dac314b390c7b61cda6f0f819a4b1/pkg/tcpip/transport/tcp/endpoint.go#L2380-L2391); it checks `e.boundNICID`, which comes from the scope of the bound address, but not `e.boundBindToDevice`.

### Steps to reproduce

With two interfaces set up with routes to the same destination subnet,
1. Create a TCP socket
2. Set SO_BINDTODEVICE on it with one of the interfaces
3. Then bind the socket to some port on the all-zeroes address
4. Call connect on the socket with some destination address
5. Observe that the connection is not necessarily performed over the requested interface (though it might be, since one of the interfaces is chosen arbitrarily).

### runsc version

_No response_

### docker version (if using docker)

_No response_

### uname

_No response_

### kubectl (if using Kubernetes)

_No response_

### repo state (if built from source)

_No response_

### runsc debug logs (if available)

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.