socket-default: Require CAP_NET_BIND_SERVICE for ports < 1024

Since we don't know which ports are used with socket-dynamic we can't
demand the capability there, but it might still be required.

diff --git a/src/libcharon/plugins/socket_default/socket_default_socket.c b/src/libcharon/plugins/socket_default/socket_default_socket.c
index aa3d795fcd28d2f3e1544538af3512fe4ae886ba..494bf57b1becdeded53f364c2af457a7ce34043a 100644 (file)
--- a/src/libcharon/plugins/socket_default/socket_default_socket.c
+++ b/src/libcharon/plugins/socket_default/socket_default_socket.c
@@ -692,6 +692,18 @@ socket_default_socket_t *socket_default_socket_create()
                this->natt = 0;
        }
 
+       if ((this->port && this->port < 1024) || (this->natt && this->natt < 1024))
+       {
+               if (!lib->caps->keep(lib->caps, CAP_NET_BIND_SERVICE))
+               {
+                       /* required to bind ports < 1024 */
+                       DBG1(DBG_NET, "socket-default plugin requires CAP_NET_BIND_SERVICE "
+                                "capability");
+                       destroy(this);
+                       return NULL;
+               }
+       }
+
        /* we allocate IPv6 sockets first as that will reserve randomly allocated
         * ports also for IPv4. On OS X, we have to do it the other way round
         * for the same effect. */

diff --git a/src/libstrongswan/utils/capabilities.h b/src/libstrongswan/utils/capabilities.h
index ebcca46db9edfd1d1a0bd2bca356cf99207f934b..543af32cc3db87595af1b656d2d18f86188ad0a8 100644 (file)
--- a/src/libstrongswan/utils/capabilities.h
+++ b/src/libstrongswan/utils/capabilities.h
@@ -32,8 +32,11 @@ typedef struct capabilities_t capabilities_t;
 # include <linux/capability.h>
 #endif
 
+#ifndef CAP_NET_BIND_SERVICE
+# define CAP_NET_BIND_SERVICE 10
+#endif
 #ifndef CAP_NET_ADMIN
-#define CAP_NET_ADMIN 12
+# define CAP_NET_ADMIN 12
 #endif
 
 /**