Date: Mon, 30 Jun 2014 03:03:53 -0400 From: Rich Felker <dalias@...c.org> To: musl@...ts.openwall.com Cc: alpine-devel@...ts.alpinelinux.org Subject: Re: Re: cups debugging, continued...ugly patch On Sun, Jun 29, 2014 at 10:34:27PM -0700, Isaac Dunham wrote: > Thanks to Rich's comment, I've found a solution that works here. > The patch doesn't exactly look nice, though. I agree it's ugly. The clean way to do it would be to use getaddrinfo to request an AI_PASSIVE address for the desired family. Then you get the right sockaddr type and size for free, and you can subsequently fill in the port to try. That wouldn't work for AF_LOCAL (at least not on musl) but this whole function makes no sense for AF_LOCAL. Of course binding a reserved port like this is a serious security smell -- it sounds like they're trying to facilitate port-based authentication, which is unsafe if used for anything except localhost. I would see if it's possible to remove the binding completely and have it work. Remote lpd's would not be able to trust the ldp that omits the bind based on its port, but this kind of trust is fundamentally wrong and insecure anyway. If such a trust relationship is needed, a proper authentication channel must be used. Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.