Re: Does mountd/statd really need to listen on a privileged port??

[Neil Brown <neilb@suse.de>]

On Wednesday April 18, neilb@suse.de wrote:
> On Tuesday April 17, olaf.kirch@oracle.com wrote:
> > 
> > I think portmap let's joe doe replace registrations for non-privileged
> > ports. Joe Doe can't do that if the port is < 1024.
> 
> What... really?  
> 
> [[Goes to read portmap source code]]
> Yuck!  From pmap_check.c:
> 
> 
> #define reserved_port(p) (IPPORT_RESERVED/2 < (p) && (p) < IPPORT_RESERVED)
> 
> #define unreserved_port(p) (IPPORT_RESERVED <= (p) && (p) != NFS_PORT)
> 
> #define	legal_port(a,p) \
>   (reserved_port(ntohs((a)->sin_port)) || unreserved_port(p))
> 
> and elsewhere (un)registrations are only allowed if legal_port
> returns true for the source-address, port-number values.
> 
> So Joe Doe can unregister any port >= 1024 other than 2049.  How
> gross!
> That fact that 2049 has to be an exception should show that the whole
> idea is wrong.  It should record whether a registration was made with
> a privilege port and if it was, the unregistration must come from a
> privilege port too... but no.
> 
> I guess I'll put back the code to bind to privileges ports by default.
> But I'll avoid using ports listed in /etc/services.

But that doesn't help with lockd, does it?
Lockd registers a non-priv port, and fixing that is not trivial.
We really should be fixing portmap.

Portmap appeared to be a 10 year old program that each distro
maintains their own copy of...

What would people think if I added it to the nfs-utils release and
made some improvements?  Would that get into distros in parallel with
nfs-utils?


NeilBrown

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs