From: Tobias Brunner <tobias@strongswan.org>
Date: Tue, 25 Jun 2013 06:35:06 +0000 (+0200)
Subject: dhcp: Require CAP_NET_BIND_SERVICE and CAP_NET_RAW to open/bind sockets
X-Git-Tag: 5.1.0dr1~32^2~8
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6f15f5e632917775db9ecf2826532884f34877e8;p=thirdparty%2Fstrongswan.git

dhcp: Require CAP_NET_BIND_SERVICE and CAP_NET_RAW to open/bind sockets
---

diff --git a/src/libcharon/plugins/dhcp/dhcp_plugin.c b/src/libcharon/plugins/dhcp/dhcp_plugin.c
index a31f12689b..31195e25b3 100644
--- a/src/libcharon/plugins/dhcp/dhcp_plugin.c
+++ b/src/libcharon/plugins/dhcp/dhcp_plugin.c
@@ -107,6 +107,17 @@ plugin_t *dhcp_plugin_create()
 {
 	private_dhcp_plugin_t *this;
 
+	if (!lib->caps->keep(lib->caps, CAP_NET_BIND_SERVICE))
+	{	/* required to bind DHCP socket (port 68) */
+		DBG1(DBG_NET, "dhcp plugin requires CAP_NET_BIND_SERVICE capability");
+		return NULL;
+	}
+	else if (!lib->caps->keep(lib->caps, CAP_NET_RAW))
+	{	/* required to open DHCP receive socket (AF_PACKET) */
+		DBG1(DBG_NET, "dhcp plugin requires CAP_NET_RAW capability");
+		return NULL;
+	}
+
 	INIT(this,
 		.public = {
 			.plugin = {
diff --git a/src/libstrongswan/utils/capabilities.h b/src/libstrongswan/utils/capabilities.h
index 543af32cc3..34937577a5 100644
--- a/src/libstrongswan/utils/capabilities.h
+++ b/src/libstrongswan/utils/capabilities.h
@@ -38,6 +38,9 @@ typedef struct capabilities_t capabilities_t;
 #ifndef CAP_NET_ADMIN
 # define CAP_NET_ADMIN 12
 #endif
+#ifndef CAP_NET_RAW
+# define CAP_NET_RAW 13
+#endif
 
 /**
  * POSIX capability dropping abstraction layer.