From: Tobias Brunner <tobias@strongswan.org>
Date: Tue, 25 Jun 2013 06:23:35 +0000 (+0200)
Subject: socket-default: Require CAP_NET_BIND_SERVICE for ports < 1024
X-Git-Tag: 5.1.0dr1~32^2~9
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1dd61bf13d688dfa71b25d3eb7872dc784f1e57c;p=thirdparty%2Fstrongswan.git

socket-default: Require CAP_NET_BIND_SERVICE for ports < 1024

Since we don't know which ports are used with socket-dynamic we can't
demand the capability there, but it might still be required.
---

diff --git a/src/libcharon/plugins/socket_default/socket_default_socket.c b/src/libcharon/plugins/socket_default/socket_default_socket.c
index aa3d795fcd..494bf57b1b 100644
--- a/src/libcharon/plugins/socket_default/socket_default_socket.c
+++ b/src/libcharon/plugins/socket_default/socket_default_socket.c
@@ -692,6 +692,18 @@ socket_default_socket_t *socket_default_socket_create()
 		this->natt = 0;
 	}
 
+	if ((this->port && this->port < 1024) || (this->natt && this->natt < 1024))
+	{
+		if (!lib->caps->keep(lib->caps, CAP_NET_BIND_SERVICE))
+		{
+			/* required to bind ports < 1024 */
+			DBG1(DBG_NET, "socket-default plugin requires CAP_NET_BIND_SERVICE "
+				 "capability");
+			destroy(this);
+			return NULL;
+		}
+	}
+
 	/* we allocate IPv6 sockets first as that will reserve randomly allocated
 	 * ports also for IPv4. On OS X, we have to do it the other way round
 	 * for the same effect. */
diff --git a/src/libstrongswan/utils/capabilities.h b/src/libstrongswan/utils/capabilities.h
index ebcca46db9..543af32cc3 100644
--- a/src/libstrongswan/utils/capabilities.h
+++ b/src/libstrongswan/utils/capabilities.h
@@ -32,8 +32,11 @@ typedef struct capabilities_t capabilities_t;
 # include <linux/capability.h>
 #endif
 
+#ifndef CAP_NET_BIND_SERVICE
+# define CAP_NET_BIND_SERVICE 10
+#endif
 #ifndef CAP_NET_ADMIN
-#define CAP_NET_ADMIN 12
+# define CAP_NET_ADMIN 12
 #endif
 
 /**