Re: Does mountd/statd really need to listen on a privileged port??

[Mike Frysinger <vapier@gentoo.org>]

[-- Attachment #1.1: Type: text/plain, Size: 511 bytes --]

On Thursday 12 April 2007, Mike Frysinger wrote:
> if that's true, then we could at least rewrite the socket code to bind to
> ports that do not appear in /etc/services (via getservbyport()) ... that'd
> allow admins to easily prevent things like mountd/statd from hijacking
> reserved ports ...

actually, it can be done regardless of how the socket is obtained ... attached 
is a function i wrote to address this issue but didnt get around to 
integrating into packages

what do you think ?
-mike

[-- Attachment #1.2: Type: application/pgp-signature, Size: 827 bytes --]

[-- Attachment #2: bindresport.c --]
[-- Type: text/x-csrc, Size: 1457 bytes --]

#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

/* Allocate a privileged port that is not reserved according to
 * the /etc/services database.  This allows the user to reserve
 * mark ports as "taken" by updating that file rather than having
 * a ton of packages install a ton of little files that somehow
 * magically get accumulated to reserve ports ...
 * http://bugs.gentoo.org/77810
 *
 * We do this recursively so that we dont have to worry about the
 * libc rebinding the same privileged port over and over again.
 * We keep all the sockets open until we find one we're happy
 * with and we keep it.
 */
int bind_unreserved_port(int domain, int type, char *protocol)
{
	int s;
	struct servent *serv;
	struct sockaddr_in saddr;
	socklen_t slen;

	/* allocate a socket */
	s = socket(domain, type, 0);
	if (s < 0)
		return s;

	/* attempt to bind to port */
	if (bindresvport(s, (struct sockaddr_in *) 0) != 0)
		goto err_close;

	/* make sure we only bind to non-reserved ports */
	if (getsockname(s, (struct sockaddr *)&saddr, &slen) != 0)
		goto err_close;

	serv = getservbyport(saddr.sin_port, protocol);
	if (serv != NULL) {
		/* this port is listed in /etc/services, so let's try again */
		int punt_socket = s;
		s = bind_unreserved_port(domain, type, protocol);
		close(punt_socket);
	}

	/* awesome, got ourselves a decent port */
	return s;

err_close:
	close(s);
	return -1;
}

[-- Attachment #3: Type: text/plain, Size: 345 bytes --]

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

[-- Attachment #4: Type: text/plain, Size: 140 bytes --]

_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs