Hacker News Reader

Comment by rockskon | Hacker News Reader

*65536 ports

Port 0 is a port some operating systems can and do host services on accessible over the Internet.

Also - if there's any MariaDB devs reading this - your default setting making the database listen on port 0 to disable Internet access does not, in fact, disable Internet access of the DB for quite a few thousand systems.

View on HN

MariaDB explicitly checks if the port is non-zero before listening on a TCP socket:

https://github.com/MariaDB/server/blob/ae998c22b2ce4f1023a6c...

> if (mysqld_port)

> activate_tcp_port(mysqld_port, &listen_sockets, false);

if (mysqld_port) means "if mysqld_port is different from 0"

This seems to be at least in MariaDB 5.5 (year 2012)

And if you set MariaDB to not have Internet connectivity, it attempts to accomplish this by setting the TCP port to 0. Ostensibly because it's not supposed to be a valid TCP port, except it actually is on thousands and thousands of systems.

So I don't know if the check you're referencing is evaluated when someone sets their instance of MariaDB to "not" be internet accessible.

This is the place where the listening socket is initialized, and you can see that if the port is 0, it doesn't do anything. Are you observing different behavior?

You can even use it under Linux if you wish btw, you just can't bind to it, but you can have your firewall redirect port 0 to something else.

You can bind to it on some versions of Linux. I've scanned a bunch of Linux systems that host stuff on port 0.

Your observation doesn't contradict the use of firewall rules to accomplish this.

It's not some ufw rule that normally prevents hosting a service on port 0.

That's not what was said. They said that a firewall rule can redirect traffic coming in on port 0 to a running service even when a service cannot bind directly to port 0.

Binding with port 0 as argument for AF_INET binds a random available port, not port 0. This is documented behavior of Linux and likely every other OS implementing a BSD-style socket interface.

Also note that ufw is just a tiny, non-standard wrapper for the much more powerful nftables/iptables interfaces

Reply on news.ycombinator.com