Re: [han.holl@pobox.com] libc/1172: rresvport should avoid well known ports

[Thorsten Kukuk <kukuk@suse.de>]

On Fri, Jun 25, Andreas Jaeger wrote:

> >>>>> Thorsten Kukuk writes:
> 
> Thorsten> Hello,
> 
> Thorsten> On Fri, Jun 25, Andreas Jaeger wrote:
> 
> >> 
> >> We've received the appended bug report.  I understand the problem the
> >> user has but I'm not sure that we should follow the suggestion.
> >> 
> >> Could you please comments on this?
> 
> Thorsten> I would say programs which uses fixed port numbers between 512 - 1023 are 
> Thorsten> broken. For this, we have the numbers less 512.
> Thorsten> 512 - 1023 are reserved for dynamically used privileged ports.
> 
> Check RFC1700, the ports are reserved until 1023 - and there're some
> well known programs in the range like kerberos,syslog,talk.

Stupid. 512-1023 are used on all Unix for dynamically assigned privileged ports.
If IANA uses them all for fixed programs, what should we do with RPC ?
This means, it is impossible to set up a "secure" NIS server or to make
"secure" queries, means queries from a port less 1023. 

  Thorsten

> 
> Andreas
> 
> P.S. Some exceperts from RFC1700
> 
> WELL KNOWN PORT NUMBERS
> 
> The Well Known Ports are controlled and assigned by the IANA and on
> most systems can only be used by system (or root) processes or by
> programs executed by privileged users.
> 
> Ports are used in the TCP [RFC793] to name the ends of logical
> connections which carry long term conversations.  For the purpose of
> providing services to unknown callers, a service contact port is
> defined.  This list specifies the port used by the server process as
> its contact port.  The contact port is sometimes called the
> "well-known port".
> 
> To the extent possible, these same port assignments are used with the
> UDP [RFC768].
> 
> The assigned ports use a small portion of the possible port numbers.
> For many years the assigned ports were in the range 0-255.  Recently,
> the range for assigned ports managed by the IANA has been expanded to
> the range 0-1023.
> 
> Port Assignments:
> [...]
> login           513/tcp    remote login a la telnet;
> #                          automatic authentication performed
> #                          based on priviledged port numbers
> #                          and distributed data bases which
> #                          identify "authentication domains"
> who             513/udp    maintains data bases showing who's
> #                          logged in to machines on a local
> #                          net and the load average of the
> #                          machine
> cmd             514/tcp    like exec, but automatic
> #                          authentication is performed as for
> #                          login server
> 
> 
> syslog          514/udp
> printer         515/tcp    spooler
> printer         515/udp    spooler
> #               516/tcp    Unassigned
> #               516/udp    Unassigned
> talk            517/tcp    like tenex link, but across
> #                          machine - unfortunately, doesn't
> #                          use link protocol (this is actually
> #                          just a rendezvous port from which a
> #                          tcp connection is established)
> talk            517/udp    like tenex link, but across
> #                          machine - unfortunately, doesn't
> #                          use link protocol (this is actually
> #                          just a rendezvous port from which a
>                            tcp connection is established)
> ntalk           518/tcp
> ntalk           518/udp
> utime           519/tcp    unixtime
> utime           519/udp    unixtime
> efs             520/tcp    extended file name server
> router          520/udp    local routing process (on site);
> #                          uses variant of Xerox NS routing
> #                          information protocol
> #               521-524    Unassigned
> timed           525/tcp    timeserver
> timed           525/udp    timeserver
> [...]
> mdbs_daemon     800/tcp
> mdbs_daemon     800/udp
> device          801/tcp
> device          801/udp
> xtreelic        996/tcp        Central Point Software
> xtreelic        996/udp        Central Point Software
> #                              Dale Cabell <dacabell@smtp.xtree.com>
> maitrd          997/tcp
> maitrd          997/udp
> busboy          998/tcp
> puparp          998/udp
> garcon          999/tcp
> applix          999/udp        Applix ac
> puprouter       999/tcp
> puprouter       999/udp
> cadlock         1000/tcp
> ock             1000/udp
>                 1023/tcp       Reserved
>                 1024/udp       Reserved
> #                              IANA <iana@isi.edu>
> 
> -- 
>  Andreas Jaeger   aj@arthur.rhein-neckar.de    jaeger@informatik.uni-kl.de
>   for pgp-key finger ajaeger@aixd1.rhrk.uni-kl.de

-- 
Thorsten Kukuk      http://www.suse.de/~kukuk/        kukuk@suse.de
SuSE GmbH           Schanzaeckerstr. 10             90443 Nuernberg
Linux is like a Vorlon.  It is incredibly powerful, gives terse,
cryptic answers and has a lot of things going on in the background.