binddynport.c honor ip_local_reserved_ports (RHEL-27005)
Signed-off-by: Steve Dickson <steved@redhat.com> Resolves: RHEL-27005
This commit is contained in:
Steve Dickson
parent
b1d2c0b914
commit
589b33251d
185
libtirpc-1.1.4-ip_local_reserved_ports.patch
Normal file
185
libtirpc-1.1.4-ip_local_reserved_ports.patch
Normal file
@ -0,0 +1,185 @@
|
|||||||
|
From 20148930201b732c5dd1003933dd70543d3e929d Mon Sep 17 00:00:00 2001
|
||||||
|
From: Otto Hollmann <otto.hollmann@suse.com>
|
||||||
|
Date: Sat, 7 Oct 2023 03:48:22 -0400
|
||||||
|
Subject: [PATCH] binddynport.c honor ip_local_reserved_ports
|
||||||
|
|
||||||
|
Read reserved ports from /proc/sys/net/ipv4/ip_local_reserved_ports,
|
||||||
|
store them into bit-wise array and before binding to random port check
|
||||||
|
if port is not reserved.
|
||||||
|
|
||||||
|
Currently, there is no way how to reserve ports so then will not be
|
||||||
|
used by rpcbind.
|
||||||
|
|
||||||
|
Random ports are opened by rpcbind because of rmtcalls. There is
|
||||||
|
compile-time flag for disabling them, but in some cases we can not
|
||||||
|
simply disable them.
|
||||||
|
|
||||||
|
One solution would be run time option --enable-rmtcalls as already
|
||||||
|
discussed, but it was rejected. So if we want to keep rmtcalls enabled
|
||||||
|
and also be able to reserve some ports, there is no other way than
|
||||||
|
filtering available ports. The easiest and clearest way seems to be
|
||||||
|
just respect kernel list of ip_reserved_ports.
|
||||||
|
|
||||||
|
Unfortunately there is one known disadvantage/side effect - it affects
|
||||||
|
probability of ports which are right after reserved ones. The bigger
|
||||||
|
reserved block is, the higher is probability of selecting following
|
||||||
|
unreserved port. But if there is no reserved port, impact of this patch
|
||||||
|
is minimal/none.
|
||||||
|
|
||||||
|
Signed-off-by: Otto Hollmann <otto.hollmann@suse.com>
|
||||||
|
Signed-off-by: Steve Dickson <steved@redhat.com>
|
||||||
|
---
|
||||||
|
src/binddynport.c | 108 ++++++++++++++++++++++++++++++++++++++++++----
|
||||||
|
1 file changed, 100 insertions(+), 8 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/binddynport.c b/src/binddynport.c
|
||||||
|
index 062629a..c2e9a20 100644
|
||||||
|
--- a/src/binddynport.c
|
||||||
|
+++ b/src/binddynport.c
|
||||||
|
@@ -37,6 +37,7 @@
|
||||||
|
#include <unistd.h>
|
||||||
|
#include <errno.h>
|
||||||
|
#include <string.h>
|
||||||
|
+#include <syslog.h>
|
||||||
|
|
||||||
|
#include <rpc/rpc.h>
|
||||||
|
|
||||||
|
@@ -56,6 +57,84 @@ enum {
|
||||||
|
NPORTS = ENDPORT - LOWPORT + 1,
|
||||||
|
};
|
||||||
|
|
||||||
|
+/*
|
||||||
|
+ * This function decodes information about given port from provided array and
|
||||||
|
+ * return if port is reserved or not.
|
||||||
|
+ *
|
||||||
|
+ * @reserved_ports an array of size at least "NPORTS / (8*sizeof(char)) + 1".
|
||||||
|
+ * @port port number within range LOWPORT and ENDPORT
|
||||||
|
+ *
|
||||||
|
+ * Returns 0 if port is not reserved, non-negative if port is reserved.
|
||||||
|
+ */
|
||||||
|
+static int is_reserved(char *reserved_ports, int port) {
|
||||||
|
+ port -= LOWPORT;
|
||||||
|
+ if (port < 0 || port >= NPORTS)
|
||||||
|
+ return 0;
|
||||||
|
+ return reserved_ports[port/(8*sizeof(char))] & 1<<(port%(8*sizeof(char)));
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+/*
|
||||||
|
+ * This function encodes information about given *reserved* port into provided
|
||||||
|
+ * array. Don't call this function for ports which are not reserved.
|
||||||
|
+ *
|
||||||
|
+ * @reserved_ports an array of size at least "NPORTS / (8*sizeof(char)) + 1".
|
||||||
|
+ * @port port number within range LOWPORT and ENDPORT
|
||||||
|
+ *
|
||||||
|
+ */
|
||||||
|
+static void set_reserved(char *reserved_ports, int port) {
|
||||||
|
+ port -= LOWPORT;
|
||||||
|
+ if (port < 0 || port >= NPORTS)
|
||||||
|
+ return;
|
||||||
|
+ reserved_ports[port/(8*sizeof(char))] |= 1<<(port%(8*sizeof(char)));
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+/*
|
||||||
|
+ * Parse local reserved ports obtained from
|
||||||
|
+ * /proc/sys/net/ipv4/ip_local_reserved_ports into bit array.
|
||||||
|
+ *
|
||||||
|
+ * @reserved_ports a zeroed array of size at least
|
||||||
|
+ * "NPORTS / (8*sizeof(char)) + 1". Will be used for bit-wise encoding of
|
||||||
|
+ * reserved ports.
|
||||||
|
+ *
|
||||||
|
+ * On each call, reserved ports are read from /proc and bit-wise stored into
|
||||||
|
+ * provided array
|
||||||
|
+ *
|
||||||
|
+ * Returns 0 on success, -1 on failure.
|
||||||
|
+ */
|
||||||
|
+
|
||||||
|
+static int parse_reserved_ports(char *reserved_ports) {
|
||||||
|
+ int from=0, to;
|
||||||
|
+ char delimiter = ',';
|
||||||
|
+ int res;
|
||||||
|
+ FILE * file_ptr = fopen("/proc/sys/net/ipv4/ip_local_reserved_ports","r");
|
||||||
|
+ if (file_ptr == NULL) {
|
||||||
|
+ (void) syslog(LOG_ERR,
|
||||||
|
+ "Unable to open open /proc/sys/net/ipv4/ip_local_reserved_ports.");
|
||||||
|
+ return -1;
|
||||||
|
+ }
|
||||||
|
+ do {
|
||||||
|
+ if ((res = fscanf(file_ptr, "%d", &to)) != 1) {
|
||||||
|
+ if (res == EOF) break;
|
||||||
|
+ goto err;
|
||||||
|
+ }
|
||||||
|
+ if (delimiter != '-') {
|
||||||
|
+ from = to;
|
||||||
|
+ }
|
||||||
|
+ for (int i = from; i <= to; ++i) {
|
||||||
|
+ set_reserved(reserved_ports, i);
|
||||||
|
+ }
|
||||||
|
+ } while ((res = fscanf(file_ptr, "%c", &delimiter)) == 1);
|
||||||
|
+ if (res != EOF)
|
||||||
|
+ goto err;
|
||||||
|
+ fclose(file_ptr);
|
||||||
|
+ return 0;
|
||||||
|
+err:
|
||||||
|
+ (void) syslog(LOG_ERR,
|
||||||
|
+ "An error occurred while parsing ip_local_reserved_ports.");
|
||||||
|
+ fclose(file_ptr);
|
||||||
|
+ return -1;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* Bind a socket to a dynamically-assigned IP port.
|
||||||
|
*
|
||||||
|
@@ -81,7 +160,8 @@ int __binddynport(int fd)
|
||||||
|
in_port_t port, *portp;
|
||||||
|
struct sockaddr *sap;
|
||||||
|
socklen_t salen;
|
||||||
|
- int i, res;
|
||||||
|
+ int i, res, array_size;
|
||||||
|
+ char *reserved_ports = NULL;
|
||||||
|
|
||||||
|
if (__rpc_sockisbound(fd))
|
||||||
|
return 0;
|
||||||
|
@@ -119,21 +199,33 @@ int __binddynport(int fd)
|
||||||
|
gettimeofday(&tv, NULL);
|
||||||
|
seed = tv.tv_usec * getpid();
|
||||||
|
}
|
||||||
|
+ array_size = NPORTS / (8*sizeof(char)) + 1;
|
||||||
|
+ reserved_ports = malloc(array_size);
|
||||||
|
+ if (!reserved_ports) {
|
||||||
|
+ goto out;
|
||||||
|
+ }
|
||||||
|
+ memset(reserved_ports, 0, array_size);
|
||||||
|
+ if (parse_reserved_ports(reserved_ports) < 0)
|
||||||
|
+ goto out;
|
||||||
|
+
|
||||||
|
port = (rand_r(&seed) % NPORTS) + LOWPORT;
|
||||||
|
for (i = 0; i < NPORTS; ++i) {
|
||||||
|
- *portp = htons(port++);
|
||||||
|
- res = bind(fd, sap, salen);
|
||||||
|
- if (res >= 0) {
|
||||||
|
- res = 0;
|
||||||
|
- break;
|
||||||
|
+ *portp = htons(port);
|
||||||
|
+ if (!is_reserved(reserved_ports, port++)) {
|
||||||
|
+ res = bind(fd, sap, salen);
|
||||||
|
+ if (res >= 0) {
|
||||||
|
+ res = 0;
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+ if (errno != EADDRINUSE)
|
||||||
|
+ break;
|
||||||
|
}
|
||||||
|
- if (errno != EADDRINUSE)
|
||||||
|
- break;
|
||||||
|
if (port > ENDPORT)
|
||||||
|
port = LOWPORT;
|
||||||
|
}
|
||||||
|
|
||||||
|
out:
|
||||||
|
+ free(reserved_ports);
|
||||||
|
mutex_unlock(&port_lock);
|
||||||
|
return res;
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.40.1
|
||||||
|
|
||||||
@ -2,7 +2,7 @@
|
|||||||
|
|
||||||
Name: libtirpc
|
Name: libtirpc
|
||||||
Version: 1.1.4
|
Version: 1.1.4
|
||||||
Release: 11%{?dist}
|
Release: 12%{?dist}
|
||||||
Summary: Transport Independent RPC Library
|
Summary: Transport Independent RPC Library
|
||||||
Group: System Environment/Libraries
|
Group: System Environment/Libraries
|
||||||
License: SISSL and BSD
|
License: SISSL and BSD
|
||||||
@ -53,6 +53,7 @@ Patch009: libtirpc-1.1.4-multithr-cleanup.patch
|
|||||||
Patch010: libtirpc-1.1.4-null-ptrs-not-reused.patch
|
Patch010: libtirpc-1.1.4-null-ptrs-not-reused.patch
|
||||||
Patch011: libtirpc-1.1.4-double-free.patch
|
Patch011: libtirpc-1.1.4-double-free.patch
|
||||||
Patch012: libtirpc-1.1.4-null-ptrs-not-reused-fixed.patch
|
Patch012: libtirpc-1.1.4-null-ptrs-not-reused-fixed.patch
|
||||||
|
Patch013: libtirpc-1.1.4-ip_local_reserved_ports.patch
|
||||||
|
|
||||||
BuildRequires: automake, autoconf, libtool, pkgconfig
|
BuildRequires: automake, autoconf, libtool, pkgconfig
|
||||||
BuildRequires: krb5-devel
|
BuildRequires: krb5-devel
|
||||||
@ -173,6 +174,9 @@ mv %{buildroot}%{_mandir}/man3 %{buildroot}%{_mandir}/man3t
|
|||||||
%{_mandir}/*/*
|
%{_mandir}/*/*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Apr 26 2024 Steve Dickson <steved@redhat.com> 1.1.4-12
|
||||||
|
- binddynport.c honor ip_local_reserved_ports (RHEL-27005)
|
||||||
|
|
||||||
* Tue Mar 19 2024 Steve Dickson <steved@redhat.com> 1.1.4-11
|
* Tue Mar 19 2024 Steve Dickson <steved@redhat.com> 1.1.4-11
|
||||||
- rpcb_clnt.c (fixed): Eliminate double frees in delete_cache() (RHEL-11293)
|
- rpcb_clnt.c (fixed): Eliminate double frees in delete_cache() (RHEL-11293)
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user