Permalink
Browse files

disable UDP port by default

As reported, UDP amplification attacks have started to use insecure
internet-exposed memcached instances. UDP used to be a lot more popular as a
transport for memcached many years ago, but I'm not aware of many recent
users.

Ten years ago, the TCP connection overhead from many clients was relatively
high (dozens or hundreds per client server), but these days many clients are
batched, or user fewer processes, or simply anre't worried about it.

While changing the default to listen on localhost only would also help, the
true culprit is UDP. There are many more use cases for using memcached over
the network than there are for using the UDP protocol.
  • Loading branch information...
dormando committed Feb 27, 2018
1 parent 1276ad2 commit dbb7a8af90054bf4ef51f5814ef7ceb17d83d974
Showing with 4 additions and 6 deletions.
  1. +2 −4 memcached.c
  2. +2 −2 t/issue_67.t
@@ -222,7 +222,7 @@ static void settings_init(void) {
settings.use_cas = true;
settings.access = 0700;
settings.port = 11211;
settings.udpport = 11211;
settings.udpport = 0;
/* By default this string should be NULL for getaddrinfo() */
settings.inter = NULL;
settings.maxbytes = 64 * 1024 * 1024; /* default is 64MB */
@@ -7479,9 +7479,7 @@ int main (int argc, char **argv) {
}
}

if (tcp_specified && settings.port != 0 && !udp_specified) {
settings.udpport = settings.port;
} else if (udp_specified && settings.udpport != 0 && !tcp_specified) {
if (udp_specified && settings.udpport != 0 && !tcp_specified) {
settings.port = settings.udpport;
}

@@ -77,11 +77,11 @@ sub when {

# Disabling the defaults since it conflicts with a running instance.
# when('no arguments', '', 11211, 11211);
when('specifying tcp port', '-p 11212', 11212, 11212);
when('specifying tcp port', '-p 11212', 11212, -1);
when('specifying udp port', '-U 11222', 11222, 11222);
when('specifying tcp ephemeral port', '-p -1', 0, 0);
when('specifying udp ephemeral port', '-U -1', 0, 0);
when('tcp port disabled', '-p 0', -1, 11211);
when('tcp port disabled', '-p 0', -1, -1);
when('udp port disabled', '-U 0', 11211, -1);
when('specifying tcp and udp ports', '-p 11232 -U 11233', 11232, 11233);
when('specifying tcp and disabling udp', '-p 11242 -U 0', 11242, -1);

2 comments on commit dbb7a8a

@xuy1202

This comment has been minimized.

Copy link

xuy1202 replied Mar 6, 2018

good job~

@random-atom

This comment has been minimized.

Copy link

random-atom replied Mar 19, 2018

Good decision, but a change like this should include a comment in the code explaining why the port is set to 0 so that it isn't accidentally "fixed" by someone in the future.

Please sign in to comment.