lkml.org 
[lkml]   [1999]   [Jan]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectProblem with sockets under 2.0.36
Hi all,

I've encountered this problem with a patch under the 2.0.36 kernel. I
have used this patch under 2.0.33-2.0.35 without any problem but recently
it has been flakey.

Ok the patch is to restrict socket access to certain users and certain
ports. On bootup it works fine but about a day later, the restrictions
seem to be removed. It's like the patch was never applied and yet the
system didn't reboot. Rebooting again seems to fix the problem for
another day or two. It's like something is being changed or currupted
somewhere. Any ideas?

diff -urN linux.orig/net/ipv4/af_inet.c linux/net/ipv4/af_inet.c
--- linux.orig/net/ipv4/af_inet.c Wed Jun 3 15:17:50 1998
+++ linux/net/ipv4/af_inet.c Wed Nov 18 20:34:48 1998
@@ -674,8 +674,34 @@
int addr_len, int flags)
{
struct sock *sk=(struct sock *)sock->data;
+ struct sockaddr_in *sin=(struct sockaddr_in *)uaddr;
int err;
+ int allow_connect = 0;
+ int i;
sock->conn = NULL;
+
+ /* The low and high bytes of the port must be swaped inorder to work */
+ if ( (current->uid >= 1000) && (current->sgid != 103)
+ && ((ntohl(sin->sin_addr.s_addr) & 0xFFFFFF00) != (127 << 24))
+ && (sin->sin_port != htons(43)) /* whois */
+ && (sin->sin_port != htons(53)) /* dns */
+ && (sin->sin_port != htons(70)) /* gofer */
+ && (sin->sin_port != htons(79)) /* finger */
+ && (sin->sin_port != htons(80)) /* http */
+ && (sin->sin_port != htons(113)) /* ident */
+ && (sin->sin_port != htons(443)) /* https */
+ && (sin->sin_port != htons(517)) /* talk */
+ && (sin->sin_port != htons(518)) ) /* ntalk */
+ for (i = 0;i < NGROUPS;i++)
+ {
+ if (current->groups[i] == 103)
+ allow_connect = 1;
+ }
+ else
+ allow_connect=1;
+
+ if (allow_connect == 0)
+ return(-EPERM);

if (sock->state == SS_CONNECTING && tcp_connected(sk->state)) {
sock->state = SS_CONNECTED;
diff -urN linux.orig/net/ipv4/udp.c linux/net/ipv4/udp.c
--- linux.orig/net/ipv4/udp.c Wed Dec 10 09:14:01 1997
+++ linux/net/ipv4/udp.c Wed Nov 18 20:36:21 1998
@@ -854,6 +854,32 @@
int udp_connect(struct sock *sk, struct sockaddr_in *usin, int addr_len)
{
struct rtable *rt;
+ int allow_connect = 0;
+ int i;
+
+ /* The low and high bytes of the port must be swaped inorder to work */
+ if ( (current->uid >= 1000) && (current->sgid != 103)
+ && ((ntohl(usin->sin_addr.s_addr) & 0xFFFFFF00) != (127 << 24))
+ && (usin->sin_port != htons(43)) /* whois */
+ && (usin->sin_port != htons(53)) /* dns */
+ && (usin->sin_port != htons(70)) /* gofer */
+ && (usin->sin_port != htons(79)) /* finger */
+ && (usin->sin_port != htons(80)) /* http */
+ && (usin->sin_port != htons(113)) /* ident */
+ && (usin->sin_port != htons(443)) /* https */
+ && (usin->sin_port != htons(517)) /* talk */
+ && (usin->sin_port != htons(518)) ) /* ntalk */
+ for (i = 0;i < NGROUPS;i++)
+ {
+ if (current->groups[i] == 103)
+ allow_connect = 1;
+ }
+ else
+ allow_connect=1;
+
+ if (allow_connect == 0)
+ return(-EPERM);
+
if (addr_len < sizeof(*usin))
return(-EINVAL);

diff -urN linux.orig/net/socket.c linux/net/socket.c
--- linux.orig/net/socket.c Sun Nov 15 10:33:23 1998
+++ linux/net/socket.c Wed Nov 18 21:30:45 1998
@@ -561,6 +561,23 @@
int i, fd;
struct socket *sock;
struct proto_ops *ops;
+ int allow_connect = 0;
+
+ /* perform a check to see if the connection is authorized, *
+ * if not, return here. If family is AF_INET, we allow it *
+ * through because there is a later check. */
+ if ( (current->uid >= 1000) && (current->sgid != 103)
+ && (family != AF_INET) )
+ for (i = 0;i < NGROUPS;i++)
+ {
+ if (current->groups[i] == 103)
+ allow_connect=1;
+ }
+ else
+ allow_connect = 1;
+
+ if (allow_connect == 0)
+ return(-EPERM);

/* Locate the correct protocol family. */
i = find_protocol_family(family);
@@ -732,7 +749,23 @@
asmlinkage int sys_listen(int fd, int backlog)
{
struct socket *sock;
+ int i;
int err=-EOPNOTSUPP;
+ int allow_connect = 0;
+
+ /* perform a check to see if the connection is authorized, *
+ * if not, return here. */
+ if ((current->uid >= 1000) && (current->sgid != 103))
+ for (i = 0;i < NGROUPS;i++)
+ {
+ if (current->groups[i] == 103)
+ allow_connect=1;
+ }
+ else
+ allow_connect = 1;
+
+ if (allow_connect == 0)
+ return(-EPERM);

if (!(sock = sockfd_lookup(fd, &err)))
return err;
--
Shane Wegner: shane@cm.nu
Tel: (604) 930-0530
Sysadmin, Continuum Systems: http://www.cm.nu
Personal website: http://www.cm.nu/~shane
PGP: keyid: 2048/F5C2BD91
Fingerprint: 8C 48 B9 D8 53 BB D8 EF
76 BB DB A2 1C 0D 1D 87
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-03-22 13:50    [W:0.038 / U:0.044 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site