>From lenny's glibc-2.7/debian/patches/any/local-bindresvport_blacklist.diff
the code to read and parse a single line is:
+ unsigned long port;
+ char *tmp, *cp;
+ ssize_t n = __getline (&buf, &buflen, fp);
+ if (n < 1)
+ break;
+
+ cp = buf;
+ tmp = strchr (cp, '#'); /* remove comments */
+ if (tmp)
+ *tmp = '\0';
+ while (isspace ((int)*cp)) /* remove spaces and tabs */
+ ++cp;
+ if (*cp == '\0') /* ignore empty lines */
+ continue;
+ if (cp[strlen (cp) - 1] == '\n')
+ cp[strlen (cp) - 1] = '\0';
+
+ port = strtoul (cp, &tmp, 0);
+ if (*tmp != '\0' || (port == ULONG_MAX && errno == ERANGE))
+ continue;
This has a couple of issues.
The one that causes a problem is that it skips leading but not trailing
spaces. If the last digit of the number is followed by anything other
than '\0', '#', or '\n', the line will be skipped.
Code should be added after strtoul() to skip the spaces:
while (isspace ((int)*tmp)) /* remove spaces and tabs */
++tmp;
Also, a comment purports to "ignore empty lines" by checking for a null
character, but it does this *before* replacing a newline at the end with
a null character. As it happens, lines consisting solely of a newline
will be ignored, but only because of this code:
+ /* Don't bother with out-of-range ports */
+ if (port < LOWPORT || port > ENDPORT)
+ continue;
Therefore, the "ignore empty lines" comment is misleading.
In an Ubuntu bug report, I gave good directions for testing this.
https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/306007
I have confirmed the directions work on lenny (I have an Ubuntu desktop
and a lenny server). (Of course, I got different port numbers, but still
in the 600-999 range I reserved.)
0. Backup the file:
$ sudo mv /etc/bindresvport.blacklist /etc/bindresvport.blacklist.bak
1. Reserve all ports 600-999, with the format used for shipped
bindresvport.blacklist (e.g., "631\t# cups")
$ perl -e 'for ($i=600; $i<1000; $i++) {print "$i\t# foo\n";}' | sudo
dd of=/etc/bindresvport.blacklist
7+1 records in
7+1 records out
4011 bytes (4.0 kB) copied, 6.5962e-05 s, 60.8 MB/s
2. Restart nis (or a different service as available).
$ sudo /etc/init.d/nis restart
* Starting NIS service
3. Check what port it got:
$ sudo netstat --inet -nap | grep ypbind
tcp 0 0 0.0.0.0:724 0.0.0.0:* LISTEN 29803/ypbind
udp 0 0 0.0.0.0:723 0.0.0.0:* 29803/ypbind
udp 0 0 0.0.0.0:724 0.0.0.0:* 29803/ypbind
4. Note that it falls in the range 600-999 (there is a small 24 out of
424 chance it will not -- try again).
This also fails with spaces, substituting the perl command in step 1:
$ perl -e 'for ($i=600; $i<1000; $i++) {print "$i # foo\n";}' | sudo
dd of=/etc/bindresvport.blacklist
It works with the '#' character directly following the port number:
$ perl -e 'for ($i=600; $i<1000; $i++) {print "$i# foo\n";}' | sudo dd
of=/etc/bindresvport.blacklist
or with the port number on the line by itself:
$ perl -e 'for ($i=600; $i<1000; $i++) {print "$i\n";}' | sudo dd
of=/etc/bindresvport.blacklist
In the last two cases I get:
tcp 0 0 0.0.0.0:1001 0.0.0.0:* LISTEN 29923/ypbind
udp 0 0 0.0.0.0:1000 0.0.0.0:* 29923/ypbind
udp 0 0 0.0.0.0:1001 0.0.0.0:* 29923/ypbind
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
