2.5.42: accessfs 1/3: new networking hooks

PATCH New Olaf Dietsche 1 participant 1 message Oct 13, 2002

Subsystems (2)

Networking Sockets

lore

Share & tools

lore

Olaf Dietsche

author

2002-10-13 21:36 UTC #0 lore raw

PATCH 1/1 2.5.42: accessfs 1/3: new networking hooks

This patch adds two hooks to IPv4 and IPv6. These hooks allow modules to control, who may bind to low numbered ports (< 1024).

Regards, Olaf.

include/net/sock.h +17 -0

diff -urN a/include/net/sock.h b/include/net/sock.h
@@ -830,4 +830,21 @@
 extern __u32 sysctl_wmem_max;
 extern __u32 sysctl_rmem_max;
 
+/* Networking hooks */
+#ifdef	CONFIG_NET_HOOKS
+struct net_hook_operations {
+	int	(*ip_prot_sock)(struct socket *sock,
+				struct sockaddr *uaddr, int addr_len);
+	int	(*ip6_prot_sock)(struct socket *sock,
+				 struct sockaddr *uaddr, int addr_len);
+};
+
+extern struct net_hook_operations	*net_ops;
+
+extern int default_ip_prot_sock(struct socket *sock, struct sockaddr *uaddr, int addr_len);
+extern int default_ip6_prot_sock(struct socket *sock, struct sockaddr *uaddr, int addr_len);
+extern void net_hooks_register(struct net_hook_operations *ops);
+extern void net_hooks_unregister(struct net_hook_operations *ops);
+#endif
+
 #endif	/* _SOCK_H */

net/Config.help +7 -0

diff -urN a/net/Config.help b/net/Config.help
@@ -512,3 +512,10 @@
   performance will be written to /proc/net/profile. If you don't know
   what it is about, you don't need it: say N.
 
+CONFIG_NET_HOOKS
+  This option enables other kernel parts or modules to hook into the
+  networking area and provide fine grained control over the access to
+  IP ports.
+
+  If you're unsure, say N.
+

net/Config.in +2 -0

diff -urN a/net/Config.in b/net/Config.in
@@ -29,6 +29,8 @@
    if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
       source net/sctp/Config.in
    fi
+
+   dep_bool '  Networking hooks (EXPERIMENTAL)' CONFIG_NET_HOOKS $CONFIG_EXPERIMENTAL
 fi
 if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
    bool 'Asynchronous Transfer Mode (ATM) (EXPERIMENTAL)' CONFIG_ATM

net/Makefile +2 -1

diff -urN a/net/Makefile b/net/Makefile
@@ -5,7 +5,7 @@
 # Rewritten to use lists instead of if-statements.
 #
 
-export-objs :=	netsyms.o
+export-objs :=	netsyms.o hooks.o
 
 obj-y	:= socket.o core/

@@ -34,6 +34,7 @@
 obj-$(CONFIG_ECONET)		+= econet/
 obj-$(CONFIG_VLAN_8021Q)	+= 8021q/
 obj-$(CONFIG_IP_SCTP)		+= sctp/
+obj-$(CONFIG_NET_HOOKS)		+= hooks.o
 
 ifeq ($(CONFIG_NET),y)
 obj-$(CONFIG_MODULES)		+= netsyms.o

net/hooks.c +56 -0

56 lines not on this page · raw message

net/ipv4/af_inet.c +4 -0

diff -urN a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
@@ -528,7 +528,11 @@
 
 	snum = ntohs(addr->sin_port);
 	err = -EACCES;
+#ifdef	CONFIG_NET_HOOKS
+	if (net_ops->ip_prot_sock(sock, uaddr, addr_len))
+#else
 	if (snum && snum < PROT_SOCK && !capable(CAP_NET_BIND_SERVICE))
+#endif
 		goto out;
 
 	/*      We keep a pair of addresses. rcv_saddr is the one

net/ipv6/af_inet6.c +4 -0

diff -urN a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
@@ -313,7 +313,11 @@
 	}
 
 	snum = ntohs(addr->sin6_port);
+#ifdef	CONFIG_NET_HOOKS
+	if (net_ops->ip6_prot_sock(sock, uaddr, addr_len))
+#else
 	if (snum && snum < PROT_SOCK && !capable(CAP_NET_BIND_SERVICE))
+#endif
 		return -EACCES;
 
 	lock_sock(sk);