net: reserved bind port check

kernel-src/include/kernel/auth.h

@@ -39,7 +39,8 @@
 
 #define AUTH_ACTIONS_PROCESS_SIGNAL	1
 
-#define AUTH_ACTIONS_NETWORK_CONFIGURE	1
+#define AUTH_ACTIONS_NETWORK_CONFIGURE		1
+#define AUTH_ACTIONS_NETWORK_BINDRESERVED	2
 
 typedef int (*authlistener_t)(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2);
 

kernel-src/io/net/tcp.c

@@ -4,6 +4,7 @@
 #include <kernel/itimer.h>
 #include <kernel/timekeeper.h>
 #include <kernel/interrupt.h>
+#include <kernel/auth.h>
 
 #define WORKER_COUNT 12
 #define WORKER_BUFFER_SIZE (64 * 1024)
@@ -1417,6 +1418,14 @@ static int tcp_bind(socket_t *socket, sockaddr_t *addr, cred_t *cred) {
 	if (addr->ipv4addr.addr != 0) {
 		printf("tcp: bind tried to bind to non zero address %x\n", addr->ipv4addr.addr);
 	}
+
+	if (addr->ipv4addr.port != 0 && addr->ipv4addr.port < 1024) {
+		// this port is reserved for privileged users
+		int error = auth_network_check(cred, AUTH_ACTIONS_NETWORK_BINDRESERVED, socket, NULL);
+		if (error)
+			return error;
+	}
+
 	MUTEX_ACQUIRE(&socket->mutex, false);
 	tcb_t *tcb = tcpsocket->tcb;
 	if (tcb == NULL) {

kernel-src/io/net/udp.c

@@ -6,6 +6,7 @@
 #include <spinlock.h>
 #include <kernel/interrupt.h>
 #include <ringbuffer.h>
+#include <kernel/auth.h>
 
 #define SOCKET_BUFFER (256 * 1024)
 
@@ -127,6 +128,13 @@ void udp_process(netdev_t *netdev, void *buffer, uint32_t peer) {
 }
 
 static int udp_bind(socket_t *socket, sockaddr_t *addr, cred_t *cred) {
+	if (addr->ipv4addr.port != 0 && addr->ipv4addr.port < 1024) {
+		// this port is reserved for privileged users
+		int error = auth_network_check(cred, AUTH_ACTIONS_NETWORK_BINDRESERVED, socket, NULL);
+		if (error)
+			return error;
+	}
+
 	int e;
 	MUTEX_ACQUIRE(&socket->mutex, false);
 	if (socket->state != SOCKET_STATE_UNBOUND) {