[PATCH 1/2] alfred: drop CAP_NET_RAW when binding to the device fails

[Sven Eckelmann <sven@narfation.org>]

netsock_open() and netsock_open4() raise the CAP_NET_RAW effective
capability around the two SO_BINDTODEVICE setsockopt() calls and drop it
again with enable_raw_bind_capability(0). When either setsockopt() fails
the "goto err" jumps straight to the socket cleanup and skipped the drop.
The daemon was then still using the CAP_NET_RAW.

Route the bind failures through a new err_bind label that drops the
capability before the existing error cleanup.

Fixes: b0877b387ba1 ("alfred: Drop capabilities when not needed")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
 netsock.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/netsock.c b/netsock.c
index 60b2285..54148e2 100644
--- a/netsock.c
+++ b/netsock.c
@@ -317,14 +317,14 @@ static int netsock_open(struct globals *globals, struct interface *interface)
 	if (setsockopt(sock, SOL_SOCKET, SO_BINDTODEVICE, interface->interface,
 		       strlen(interface->interface) + 1)) {
 		perror("can't bind to device");
-		goto err;
+		goto err_bind;
 	}
 
 	if (setsockopt(sock_mc, SOL_SOCKET, SO_BINDTODEVICE,
 		       interface->interface,
 		       strlen(interface->interface) + 1)) {
 		perror("can't bind to device");
-		goto err;
+		goto err_bind;
 	}
 	enable_raw_bind_capability(0);
 
@@ -408,6 +408,9 @@ static int netsock_open(struct globals *globals, struct interface *interface)
 	interface->netsock_mcast = sock_mc;
 
 	return 0;
+
+err_bind:
+	enable_raw_bind_capability(0);
 err:
 	close(sock);
 	close(sock_mc);
@@ -464,13 +467,13 @@ static int netsock_open4(struct globals *globals, struct interface *interface)
 	if (setsockopt(sock, SOL_SOCKET, SO_BINDTODEVICE, interface->interface,
 		       strlen(interface->interface) + 1)) {
 		perror("ipv4: can't bind to device");
-		goto err;
+		goto err_bind;
 	}
 
 	if (setsockopt(sock_mc, SOL_SOCKET, SO_BINDTODEVICE,
 		       interface->interface, strlen(interface->interface) + 1)) {
 		perror("ipv4: can't bind to device");
-		goto err;
+		goto err_bind;
 	}
 	enable_raw_bind_capability(0);
 
@@ -558,6 +561,9 @@ static int netsock_open4(struct globals *globals, struct interface *interface)
 	interface->netsock_mcast = sock_mc;
 
 	return 0;
+
+err_bind:
+	enable_raw_bind_capability(0);
 err:
 	close(sock);
 	close(sock_mc);

-- 
2.47.3