FreeBSD/sys/security/mac_portacl/mac_portacl.c
/*
 * Note, this only limits the ability to explicitly bind a port, it
 * doesn't limit implicitly bound ports for outgoing connections where
 * the source port is left up to the IP stack to determine automatically.
 */
Note, this only limits the ability to explicitly bind a port, it
doesn't limit implicitly bound ports for outgoing connections where
the source port is left up to the IP stack to determine automatically.
Note this only limits the ability to explicitly bind a port it doesn ' t limit implicitly bound ports for outgoing connections where the source port is left up to the IP stack to determine automatically .
static int
socket_check_bind(struct ucred *cred, struct socket *so,
    struct label *solabel, struct sockaddr *sa)
{
	struct sockaddr_in *sin;
	struct inpcb *inp;
	int family, type;
	u_int16_t port;
	if (portacl_enabled == 0)
		return (0);
	if (so->so_proto->pr_domain->dom_family != PF_INET &&
	    so->so_proto->pr_domain->dom_family != PF_INET6)
		return (0);
	if (so->so_type != SOCK_DGRAM &&
	    so->so_type != SOCK_STREAM)
		return (0);
	if (sa->sa_family != AF_INET && sa->sa_family != AF_INET6)
		return (EINVAL);
	family = so->so_proto->pr_domain->dom_family;
	type = so->so_type;
	sin = (struct sockaddr_in *) sa;
	port = ntohs(sin->sin_port);
	if (portacl_autoport_exempt && port == 0) {
		inp = sotoinpcb(so);
		if ((inp->inp_flags & INP_LOWPORT) == 0)
			return (0);
	}
	return (rules_check(cred, family, type, port));
}
static int socket_check_bind ( struct ucred * cred , struct socket * so , struct label * solabel , struct sockaddr * sa ) { struct sockaddr_in * sin ; struct inpcb * inp ; int family , type ; u_int16_t port ; if ( portacl_enabled == 0 ) return ( 0 ) ; if ( so -> so_proto -> pr_domain -> dom_family != PF_INET && so -> so_proto -> pr_domain -> dom_family != PF_INET6 ) return ( 0 ) ; if ( so -> so_type != SOCK_DGRAM && so -> so_type != SOCK_STREAM ) return ( 0 ) ; if ( sa -> sa_family != AF_INET && sa -> sa_family != AF_INET6 ) return ( EINVAL ) ; family = so -> so_proto -> pr_domain -> dom_family ; type = so -> so_type ; sin = ( struct sockaddr_in * ) sa ; port = ntohs ( sin -> sin_port ) ; if ( portacl_autoport_exempt && port == 0 ) { inp = sotoinpcb ( so ) ; if ( ( inp -> inp_flags & INP_LOWPORT ) == 0 ) return ( 0 ) ; } return ( rules_check ( cred , family , type , port ) ) ; }
Note, this only limits the ability to explicitly bind a port, it
 doesn't limit implicitly bound ports for outgoing connections where
 the source port is left up to the IP stack to determine automatically.
Note this only limits the ability to explicitly bind a port it doesn ' t limit implicitly bound ports for outgoing connections where the source port is left up to the IP stack to determine automatically .
/* Only run if we are enabled. */ /* Only interested in IPv4 and IPv6 sockets. */ /* Currently, we don't attempt to deal with SOCK_RAW, etc. */ /* Reject addresses we don't understand; fail closed. */ /*
	 * Sockets are frequently bound with a specific IP address but a port
	 * number of '0' to request automatic port allocation.  This is often
	 * desirable as long as IP_PORTRANGELOW isn't set, which might permit
	 * automatic allocation of a "privileged" port.  The autoport exempt
	 * flag exempts port 0 allocation from rule checking as long as a low
	 * port isn't required.
	 */