Bug 1854147

Summary:	libtirpc: Suggestions for bindresvport denylist additions
Product:	Red Hat Enterprise Linux 8	Reporter:	Florian Weimer <fweimer>
Component:	libtirpc	Assignee:	Steve Dickson <steved>
Status:	CLOSED ERRATA	QA Contact:	Zhi Li <yieli>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.4	CC:	sbonnevi, xzhou, yoyang
Target Milestone:	rc	Keywords:	Patch, Triaged
Target Release:	8.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	libtirpc-1.1.4-5.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-09 19:33:10 UTC	Type:	Enhancement
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Florian Weimer 2020-07-06 14:47:39 UTC

Bug 103401 contains a suggestion for denylist entries for bindresvport:

The glibc algorithm already blacklists all reserved ports below 600, presumably
to avoid this exact problem.  Consider altering the code to blacklist 5 to 8
additional ports in the 600-1023 range that are or may be in common use:

  631     (IPP == CUPS)
  636     (LDAPS)
  749     (Kerberos V kadmin)
  873     (rsyncd)
  992-995 (SSL-enabled telnet, IMAP, IRC, and POP3)

Some of these ports are missing from the default denylist in libtirpc, which only contains:

623     # ASF, used by IPMI on some cards
631     # cups
636     # ldaps
664     # Secure ASF, used by IPMI on some cards
921     # lwresd
993     # imaps
995     # pops

It may make sense to incorporate the additional suggested ports.

Comment 1 Steve Dickson 2020-07-09 15:17:09 UTC

posted upstream patch
https://sourceforge.net/p/libtirpc/mailman/libtirpc-devel/?viewmonth=202007

Comment 3 Steve Dickson 2021-04-07 14:41:46 UTC

commit 0c106998414d81d5a10b72d6e9763b23379bd254 (HEAD -> master)
Author: Florian Weimer <fweimer>
Date:   Wed Apr 7 10:37:14 2021 -0400

    blacklist: Add a few more well known ports

Comment 4 Florian Weimer 2021-04-07 14:50:02 UTC

(In reply to Steve Dickson from comment #3)
> commit 0c106998414d81d5a10b72d6e9763b23379bd254 (HEAD -> master)
> Author: Florian Weimer <fweimer>
> Date:   Wed Apr 7 10:37:14 2021 -0400
> 
>     blacklist: Add a few more well known ports

For the record, I wouldn't use that kind of terminology today.

Is this commit in a public repository?

Comment 5 Steve Dickson 2021-04-07 15:26:32 UTC

(In reply to Florian Weimer from comment #4)
> (In reply to Steve Dickson from comment #3)
> > commit 0c106998414d81d5a10b72d6e9763b23379bd254 (HEAD -> master)
> > Author: Florian Weimer <fweimer>
> > Date:   Wed Apr 7 10:37:14 2021 -0400
> > 
> >     blacklist: Add a few more well known ports
> 
> For the record, I wouldn't use that kind of terminology today.
> 
> Is this commit in a public repository?
Yes...  git://linux-nfs.org/~steved/libtirpc

My apologies if I mis-spoke for you... that was the
terminology I used when I posted the patch.

Comment 11 Zhi Li 2021-05-06 08:12:02 UTC

Have finished regression tests and no new issue found with libtirpc-1.1.4-5.el8 already.

I'm verifying this as sanity only for now.

Comment 15 errata-xmlrpc 2021-11-09 19:33:10 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (libtirpc bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:4375