Deny guest binds to host ephemeral port range in mirrored mode#40597
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds enforcement in mirrored networking mode to deny guest binds to ports within the host's TCP/UDP ephemeral port ranges (except when those ports also fall in the guest's own reserved ephemeral range), preventing port conflicts with host applications.
Changes:
- Query host TCP/UDP dynamic (ephemeral) port ranges from WMI when creating the guest network service and store them on the service instance.
- Reject guest port allocation requests for ports that lie in the host ephemeral range but outside the guest's reserved range.
- Add two new mirrored-mode tests verifying that TCP and UDP binds to host-ephemeral-range ports are denied.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| src/windows/service/exe/WslCoreGuestNetworkService.h | Declares new helpers and members for storing host ephemeral port ranges. |
| src/windows/service/exe/WslCoreGuestNetworkService.cpp | Implements WMI-based ephemeral range lookup and new denial logic in OnPortAllocationRequest. |
| test/windows/NetworkTests.cpp | Adds two mirrored-mode tests for TCP and UDP host-ephemeral-port denial. |
keith-horton
requested changes
May 19, 2026
keith-horton
approved these changes
May 22, 2026
benhillis
approved these changes
May 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of the Pull Request
In mirrored mode, we pre-reserve a range for the guest to be used as guest ephemeral port range, but we don't prevent the guest from explicitly binding to the host ephemeral range
Update the wsl service to query the host ephemeral range and deny guest binds to that range
Validation Steps Performed
Manual testing of binds to non-ephemeral ports, host ephemeral port range and guest ephemeral port range.
Added new automated tests to cover the fixed scenario
Ran existing Network Tests, which include multiple port tracker/bind tests