Hide Forgot
Bug 103401 contains a suggestion for denylist entries for bindresvport: The glibc algorithm already blacklists all reserved ports below 600, presumably to avoid this exact problem. Consider altering the code to blacklist 5 to 8 additional ports in the 600-1023 range that are or may be in common use: 631 (IPP == CUPS) 636 (LDAPS) 749 (Kerberos V kadmin) 873 (rsyncd) 992-995 (SSL-enabled telnet, IMAP, IRC, and POP3) Some of these ports are missing from the default denylist in libtirpc, which only contains: 623 # ASF, used by IPMI on some cards 631 # cups 636 # ldaps 664 # Secure ASF, used by IPMI on some cards 921 # lwresd 993 # imaps 995 # pops It may make sense to incorporate the additional suggested ports.
posted upstream patch https://sourceforge.net/p/libtirpc/mailman/libtirpc-devel/?viewmonth=202007
commit 0c106998414d81d5a10b72d6e9763b23379bd254 (HEAD -> master) Author: Florian Weimer <fweimer> Date: Wed Apr 7 10:37:14 2021 -0400 blacklist: Add a few more well known ports
(In reply to Steve Dickson from comment #3) > commit 0c106998414d81d5a10b72d6e9763b23379bd254 (HEAD -> master) > Author: Florian Weimer <fweimer> > Date: Wed Apr 7 10:37:14 2021 -0400 > > blacklist: Add a few more well known ports For the record, I wouldn't use that kind of terminology today. Is this commit in a public repository?
(In reply to Florian Weimer from comment #4) > (In reply to Steve Dickson from comment #3) > > commit 0c106998414d81d5a10b72d6e9763b23379bd254 (HEAD -> master) > > Author: Florian Weimer <fweimer> > > Date: Wed Apr 7 10:37:14 2021 -0400 > > > > blacklist: Add a few more well known ports > > For the record, I wouldn't use that kind of terminology today. > > Is this commit in a public repository? Yes... git://linux-nfs.org/~steved/libtirpc My apologies if I mis-spoke for you... that was the terminology I used when I posted the patch.
Have finished regression tests and no new issue found with libtirpc-1.1.4-5.el8 already. I'm verifying this as sanity only for now.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (libtirpc bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:4375