port_util.cc 5.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/base/port_util.h"
  5. #include <limits>
  6. #include <set>
  7. #include "base/containers/fixed_flat_map.h"
  8. #include "base/lazy_instance.h"
  9. #include "base/logging.h"
  10. #include "base/metrics/histogram_functions.h"
  11. #include "base/notreached.h"
  12. #include "base/strings/string_number_conversions.h"
  13. #include "base/strings/string_util.h"
  14. #include "url/url_constants.h"
  15. namespace net {
  16. namespace {
  17. // The general list of blocked ports. Will be blocked unless a specific
  18. // protocol overrides it. (Ex: ftp can use port 21)
  19. // When adding a port to the list, consider also adding it to kAllowablePorts,
  20. // below.
  21. const int kRestrictedPorts[] = {
  22. 1, // tcpmux
  23. 7, // echo
  24. 9, // discard
  25. 11, // systat
  26. 13, // daytime
  27. 15, // netstat
  28. 17, // qotd
  29. 19, // chargen
  30. 20, // ftp data
  31. 21, // ftp access
  32. 22, // ssh
  33. 23, // telnet
  34. 25, // smtp
  35. 37, // time
  36. 42, // name
  37. 43, // nicname
  38. 53, // domain
  39. 69, // tftp
  40. 77, // priv-rjs
  41. 79, // finger
  42. 87, // ttylink
  43. 95, // supdup
  44. 101, // hostriame
  45. 102, // iso-tsap
  46. 103, // gppitnp
  47. 104, // acr-nema
  48. 109, // pop2
  49. 110, // pop3
  50. 111, // sunrpc
  51. 113, // auth
  52. 115, // sftp
  53. 117, // uucp-path
  54. 119, // nntp
  55. 123, // NTP
  56. 135, // loc-srv /epmap
  57. 137, // netbios
  58. 139, // netbios
  59. 143, // imap2
  60. 161, // snmp
  61. 179, // BGP
  62. 389, // ldap
  63. 427, // SLP (Also used by Apple Filing Protocol)
  64. 465, // smtp+ssl
  65. 512, // print / exec
  66. 513, // login
  67. 514, // shell
  68. 515, // printer
  69. 526, // tempo
  70. 530, // courier
  71. 531, // chat
  72. 532, // netnews
  73. 540, // uucp
  74. 548, // AFP (Apple Filing Protocol)
  75. 554, // rtsp
  76. 556, // remotefs
  77. 563, // nntp+ssl
  78. 587, // smtp (rfc6409)
  79. 601, // syslog-conn (rfc3195)
  80. 636, // ldap+ssl
  81. 989, // ftps-data
  82. 990, // ftps
  83. 993, // ldap+ssl
  84. 995, // pop3+ssl
  85. 1719, // h323gatestat
  86. 1720, // h323hostcall
  87. 1723, // pptp
  88. 2049, // nfs
  89. 3659, // apple-sasl / PasswordServer
  90. 4045, // lockd
  91. 5060, // sip
  92. 5061, // sips
  93. 6000, // X11
  94. 6566, // sane-port
  95. 6665, // Alternate IRC [Apple addition]
  96. 6666, // Alternate IRC [Apple addition]
  97. 6667, // Standard IRC [Apple addition]
  98. 6668, // Alternate IRC [Apple addition]
  99. 6669, // Alternate IRC [Apple addition]
  100. 6697, // IRC + TLS
  101. 10080, // Amanda
  102. };
  103. base::LazyInstance<std::multiset<int>>::Leaky g_explicitly_allowed_ports =
  104. LAZY_INSTANCE_INITIALIZER;
  105. // List of ports which are permitted to be reenabled despite being in
  106. // kRestrictedList. When adding an port to this list you should also update the
  107. // enterprise policy to document the fact that the value can be set. Ports
  108. // should only remain in this list for about a year to give time for users to
  109. // migrate off while stopping them from becoming permanent parts of the web
  110. // platform.
  111. constexpr int kAllowablePorts[] = {};
  112. int g_scoped_allowable_port = 0;
  113. } // namespace
  114. bool IsPortValid(int port) {
  115. return port >= 0 && port <= std::numeric_limits<uint16_t>::max();
  116. }
  117. bool IsWellKnownPort(int port) {
  118. return port >= 0 && port < 1024;
  119. }
  120. bool IsPortAllowedForScheme(int port, base::StringPiece url_scheme) {
  121. // Reject invalid ports.
  122. if (!IsPortValid(port))
  123. return false;
  124. // Allow explicitly allowed ports for any scheme.
  125. if (g_explicitly_allowed_ports.Get().count(port) > 0)
  126. return true;
  127. // Finally check against the generic list of restricted ports for all
  128. // schemes.
  129. for (int restricted_port : kRestrictedPorts) {
  130. if (restricted_port == port)
  131. return false;
  132. }
  133. return true;
  134. }
  135. size_t GetCountOfExplicitlyAllowedPorts() {
  136. return g_explicitly_allowed_ports.Get().size();
  137. }
  138. // Specifies a comma separated list of port numbers that should be accepted
  139. // despite bans. If the string is invalid no allowed ports are stored.
  140. void SetExplicitlyAllowedPorts(base::span<const uint16_t> allowed_ports) {
  141. std::multiset<int> ports(allowed_ports.begin(), allowed_ports.end());
  142. g_explicitly_allowed_ports.Get() = std::move(ports);
  143. }
  144. ScopedPortException::ScopedPortException(int port) : port_(port) {
  145. g_explicitly_allowed_ports.Get().insert(port);
  146. }
  147. ScopedPortException::~ScopedPortException() {
  148. auto it = g_explicitly_allowed_ports.Get().find(port_);
  149. if (it != g_explicitly_allowed_ports.Get().end())
  150. g_explicitly_allowed_ports.Get().erase(it);
  151. else
  152. NOTREACHED();
  153. }
  154. NET_EXPORT bool IsAllowablePort(int port) {
  155. for (auto allowable_port : kAllowablePorts) {
  156. if (port == allowable_port) {
  157. return true;
  158. }
  159. }
  160. if (port == g_scoped_allowable_port)
  161. return true;
  162. return false;
  163. }
  164. ScopedAllowablePortForTesting::ScopedAllowablePortForTesting(int port) {
  165. DCHECK_EQ(g_scoped_allowable_port, 0);
  166. g_scoped_allowable_port = port;
  167. }
  168. ScopedAllowablePortForTesting::~ScopedAllowablePortForTesting() {
  169. g_scoped_allowable_port = 0;
  170. }
  171. } // namespace net