Date: Tue, 2 Mar 2004 21:10:30 +0000 From: Bruce M Simpson <bms@spc.org> To: freebsd-security@FreeBSD.org Subject: [PATCH] Force mountd(8) to a specified port. Message-ID: <20040302211030.GJ7115@saboteur.dek.spc.org>
next in thread | raw e-mail | index | archive | help
--osDK9TLjxFScVI/L Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Hi all, I have a requirement to run NFS read-only in an Internet-facing colocation environment. I am not happy with packet filters alone around rpcbind, call me paranoid, so I just spent the last few minutes cutting this patch. As you are aware, RPC applications can be forced to listen on a known port through the sin/sa argument to bindresvport[_sa](). Why several Linux distributions have this feature yet none of the BSDs do is beyond me... Please let me know your thoughts. If there are no valid objections I plan to commit it. Regards, BMS --osDK9TLjxFScVI/L Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="mountd-force-port.diff" Index: mountd.8 =================================================================== RCS file: /home/ncvs/src/usr.sbin/mountd/mountd.8,v retrieving revision 1.24 diff -u -r1.24 mountd.8 --- mountd.8 12 Dec 2002 17:26:02 -0000 1.24 +++ mountd.8 2 Mar 2004 20:55:37 -0000 @@ -43,6 +43,7 @@ .Sh SYNOPSIS .Nm .Op Fl 2dlnr +.Op Fl p Ar port .Op Ar exportsfile .Sh DESCRIPTION The @@ -77,6 +78,18 @@ that require it. It will automatically clear the vfs.nfsrv.nfs_privport sysctl flag, which controls if the kernel will accept NFS requests from reserved ports only. +.It Fl p Ar port +Force +.Nm +to bind to the specified port, for both +.Vt AF_INET +and +.Vt AF_INET6 +address families. +If +.Nm +cannot bind to this port, an appropriate error will be recorded in +the system log, and the daemon will then exit. .It Fl r Allow mount RPCs requests for regular files to be served. Although this seems to violate the mount protocol specification, Index: mountd.c =================================================================== RCS file: /home/ncvs/src/usr.sbin/mountd/mountd.c,v retrieving revision 1.74 diff -u -r1.74 mountd.c --- mountd.c 30 Oct 2003 22:57:43 -0000 1.74 +++ mountd.c 2 Mar 2004 21:08:17 -0000 @@ -272,11 +272,15 @@ fd_set readfds; SVCXPRT *udptransp, *tcptransp, *udp6transp, *tcp6transp; struct netconfig *udpconf, *tcpconf, *udp6conf, *tcp6conf; + struct sockaddr_in sin; + struct sockaddr_in6 sin6; int udpsock, tcpsock, udp6sock, tcp6sock; + char *endptr; + in_port_t svcport = 0; int xcreated = 0, s; int maxrec = RPC_MAXDATASIZE; int one = 1; - int c; + int c, r; udp6conf = tcp6conf = NULL; udp6sock = tcp6sock = NULL; @@ -298,7 +302,7 @@ errx(1, "NFS server is not available or loadable"); } - while ((c = getopt(argc, argv, "2dlnr")) != -1) + while ((c = getopt(argc, argv, "2dlnp:r")) != -1) switch (c) { case '2': force_v2 = 1; @@ -315,6 +319,14 @@ case 'l': dolog = 1; break; + case 'p': + endptr = NULL; + svcport = (in_port_t)strtoul(optarg, &endptr, 10); + if (endptr == NULL || *endptr != '\0' || + svcport < IPPORT_RESERVEDSTART || + svcport >= IPPORT_MAX) + usage(); + break; default: usage(); }; @@ -390,8 +402,26 @@ exit(1); } } + if (svcport != 0) { + bzero(&sin, sizeof(struct sockaddr_in)); + sin.sin_len = sizeof(struct sockaddr_in); + sin.sin_family = AF_INET; + sin.sin_port = htons(svcport); + + bzero(&sin6, sizeof(struct sockaddr_in6)); + sin6.sin6_len = sizeof(struct sockaddr_in6); + sin6.sin6_family = AF_INET6; + sin6.sin6_port = htons(svcport); + } if (udpsock != -1 && udpconf != NULL) { - bindresvport(udpsock, NULL); + if (svcport != 0) { + r = bindresvport(udpsock, &sin); + if (r != 0) { + syslog(LOG_ERR, "bindresvport: %m"); + exit(1); + } + } else + (void)bindresvport(udpsock, NULL); udptransp = svc_dg_create(udpsock, 0, 0); if (udptransp != NULL) { if (!svc_reg(udptransp, RPCPROG_MNT, RPCMNT_VER1, @@ -411,7 +441,14 @@ } if (tcpsock != -1 && tcpconf != NULL) { - bindresvport(tcpsock, NULL); + if (svcport != 0) { + r = bindresvport(tcpsock, &sin); + if (r != 0) { + syslog(LOG_ERR, "bindresvport: %m"); + exit(1); + } + } else + (void)bindresvport(tcpsock, NULL); listen(tcpsock, SOMAXCONN); tcptransp = svc_vc_create(tcpsock, RPC_MAXDATASIZE, RPC_MAXDATASIZE); if (tcptransp != NULL) { @@ -432,7 +469,15 @@ } if (have_v6 && udp6sock != -1 && udp6conf != NULL) { - bindresvport(udp6sock, NULL); + if (svcport != 0) { + r = bindresvport_sa(udp6sock, + (struct sockaddr *)&sin6); + if (r != 0) { + syslog(LOG_ERR, "bindresvport_sa: %m"); + exit(1); + } + } else + (void)bindresvport_sa(udp6sock, NULL); udp6transp = svc_dg_create(udp6sock, 0, 0); if (udp6transp != NULL) { if (!svc_reg(udp6transp, RPCPROG_MNT, RPCMNT_VER1, @@ -452,7 +497,15 @@ } if (have_v6 && tcp6sock != -1 && tcp6conf != NULL) { - bindresvport(tcp6sock, NULL); + if (svcport != 0) { + r = bindresvport_sa(tcp6sock, + (struct sockaddr *)&sin6); + if (r != 0) { + syslog(LOG_ERR, "bindresvport_sa: %m"); + exit(1); + } + } else + (void)bindresvport_sa(tcp6sock, NULL); listen(tcp6sock, SOMAXCONN); tcp6transp = svc_vc_create(tcp6sock, RPC_MAXDATASIZE, RPC_MAXDATASIZE); if (tcp6transp != NULL) { @@ -502,7 +555,8 @@ usage() { fprintf(stderr, - "usage: mountd [-2] [-d] [-l] [-n] [-r] [export_file]\n"); + "usage: mountd [-2] [-d] [-l] [-n] [-p <port>] [-r] " + "[export_file]\n"); exit(1); } --osDK9TLjxFScVI/L--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040302211030.GJ7115>