Messages in this thread Patch in this message | | | Date | Fri, 29 Jan 1999 13:19:59 -0800 | From | Shane Wegner <> | Subject | Problem with sockets under 2.0.36 |
| |
Hi all,
I've encountered this problem with a patch under the 2.0.36 kernel. I have used this patch under 2.0.33-2.0.35 without any problem but recently it has been flakey.
Ok the patch is to restrict socket access to certain users and certain ports. On bootup it works fine but about a day later, the restrictions seem to be removed. It's like the patch was never applied and yet the system didn't reboot. Rebooting again seems to fix the problem for another day or two. It's like something is being changed or currupted somewhere. Any ideas?
diff -urN linux.orig/net/ipv4/af_inet.c linux/net/ipv4/af_inet.c --- linux.orig/net/ipv4/af_inet.c Wed Jun 3 15:17:50 1998 +++ linux/net/ipv4/af_inet.c Wed Nov 18 20:34:48 1998 @@ -674,8 +674,34 @@ int addr_len, int flags) { struct sock *sk=(struct sock *)sock->data; + struct sockaddr_in *sin=(struct sockaddr_in *)uaddr; int err; + int allow_connect = 0; + int i; sock->conn = NULL; + + /* The low and high bytes of the port must be swaped inorder to work */ + if ( (current->uid >= 1000) && (current->sgid != 103) + && ((ntohl(sin->sin_addr.s_addr) & 0xFFFFFF00) != (127 << 24)) + && (sin->sin_port != htons(43)) /* whois */ + && (sin->sin_port != htons(53)) /* dns */ + && (sin->sin_port != htons(70)) /* gofer */ + && (sin->sin_port != htons(79)) /* finger */ + && (sin->sin_port != htons(80)) /* http */ + && (sin->sin_port != htons(113)) /* ident */ + && (sin->sin_port != htons(443)) /* https */ + && (sin->sin_port != htons(517)) /* talk */ + && (sin->sin_port != htons(518)) ) /* ntalk */ + for (i = 0;i < NGROUPS;i++) + { + if (current->groups[i] == 103) + allow_connect = 1; + } + else + allow_connect=1; + + if (allow_connect == 0) + return(-EPERM); if (sock->state == SS_CONNECTING && tcp_connected(sk->state)) { sock->state = SS_CONNECTED; diff -urN linux.orig/net/ipv4/udp.c linux/net/ipv4/udp.c --- linux.orig/net/ipv4/udp.c Wed Dec 10 09:14:01 1997 +++ linux/net/ipv4/udp.c Wed Nov 18 20:36:21 1998 @@ -854,6 +854,32 @@ int udp_connect(struct sock *sk, struct sockaddr_in *usin, int addr_len) { struct rtable *rt; + int allow_connect = 0; + int i; + + /* The low and high bytes of the port must be swaped inorder to work */ + if ( (current->uid >= 1000) && (current->sgid != 103) + && ((ntohl(usin->sin_addr.s_addr) & 0xFFFFFF00) != (127 << 24)) + && (usin->sin_port != htons(43)) /* whois */ + && (usin->sin_port != htons(53)) /* dns */ + && (usin->sin_port != htons(70)) /* gofer */ + && (usin->sin_port != htons(79)) /* finger */ + && (usin->sin_port != htons(80)) /* http */ + && (usin->sin_port != htons(113)) /* ident */ + && (usin->sin_port != htons(443)) /* https */ + && (usin->sin_port != htons(517)) /* talk */ + && (usin->sin_port != htons(518)) ) /* ntalk */ + for (i = 0;i < NGROUPS;i++) + { + if (current->groups[i] == 103) + allow_connect = 1; + } + else + allow_connect=1; + + if (allow_connect == 0) + return(-EPERM); + if (addr_len < sizeof(*usin)) return(-EINVAL); diff -urN linux.orig/net/socket.c linux/net/socket.c --- linux.orig/net/socket.c Sun Nov 15 10:33:23 1998 +++ linux/net/socket.c Wed Nov 18 21:30:45 1998 @@ -561,6 +561,23 @@ int i, fd; struct socket *sock; struct proto_ops *ops; + int allow_connect = 0; + + /* perform a check to see if the connection is authorized, * + * if not, return here. If family is AF_INET, we allow it * + * through because there is a later check. */ + if ( (current->uid >= 1000) && (current->sgid != 103) + && (family != AF_INET) ) + for (i = 0;i < NGROUPS;i++) + { + if (current->groups[i] == 103) + allow_connect=1; + } + else + allow_connect = 1; + + if (allow_connect == 0) + return(-EPERM); /* Locate the correct protocol family. */ i = find_protocol_family(family); @@ -732,7 +749,23 @@ asmlinkage int sys_listen(int fd, int backlog) { struct socket *sock; + int i; int err=-EOPNOTSUPP; + int allow_connect = 0; + + /* perform a check to see if the connection is authorized, * + * if not, return here. */ + if ((current->uid >= 1000) && (current->sgid != 103)) + for (i = 0;i < NGROUPS;i++) + { + if (current->groups[i] == 103) + allow_connect=1; + } + else + allow_connect = 1; + + if (allow_connect == 0) + return(-EPERM); if (!(sock = sockfd_lookup(fd, &err))) return err; -- Shane Wegner: shane@cm.nu Tel: (604) 930-0530 Sysadmin, Continuum Systems: http://www.cm.nu Personal website: http://www.cm.nu/~shane PGP: keyid: 2048/F5C2BD91 Fingerprint: 8C 48 B9 D8 53 BB D8 EF 76 BB DB A2 1C 0D 1D 87 [unhandled content-type:application/pgp-signature] | |