Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-24 13:21:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1698503 - robuster port blocking r=dragana,necko-reviewers

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D108451
This commit is contained in:
Frederik Braun 2021-03-19 14:08:03 +00:00
parent c158d070c8
commit 62c411e5e9
2 changed files with 63 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
netwerk/base/nsIOService.cpp
View File

@ -1417,7 +1417,7 @@ nsIOService::AllowPort(int32_t inPort, const char* scheme, bool* _retval) {
return NS_OK;
}
if (port == 0) {
if (port <= 0 || port >= std::numeric_limits<uint16_t>::max()) {
*_retval = false;
return NS_OK;
}
@ -1427,7 +1427,6 @@ nsIOService::AllowPort(int32_t inPort, const char* scheme, bool* _retval) {
MutexAutoLock lock(mMutex);
restrictedPortList.Assign(mRestrictedPortList);
}
// first check to see if the port is in our blacklist:
int32_t badPortListCnt = restrictedPortList.Length();
for (int i = 0; i < badPortListCnt; i++) {

62
netwerk/test/unit/test_altsvc.js
View File

@ -514,6 +514,68 @@ function doTest18() {
do_test_finished();
},
});
nextTest = doTest19;
do_test_pending();
doTest();
}
// Check we don't connect to blocked ports
function doTest19() {
dump("doTest19()\n");
origin = httpFooOrigin;
nextTest = testsDone;
otherServer = Cc["@mozilla.org/network/server-socket;1"].createInstance(
Ci.nsIServerSocket
);
const BAD_PORT_U32 = 6667 + 65536;
otherServer.init(BAD_PORT_U32, true, -1);
Assert.ok(
otherServer.port == 6667,
"Trying to listen on port 6667"
);
xaltsvc = "localhost:" + BAD_PORT_U32;
dump("Blocked port: " + otherServer.port);
waitFor = 500;
otherServer.asyncListen({
onSocketAccepted() {
Assert.ok(false, "Got connection to socket when we didn't expect it!");
},
onStopListening() {
// We get closed when the entire file is done, which guarantees we get the socket accept
// if we do connect to the alt-svc header
do_test_finished();
},
});
nextTest = doTest20;
do_test_pending();
doTest();
}
function doTest20() {
dump("doTest20()\n");
origin = httpFooOrigin;
nextTest = testsDone;
otherServer = Cc["@mozilla.org/network/server-socket;1"].createInstance(
Ci.nsIServerSocket
);
const BAD_PORT_U64 = 6666 + 429496729;
otherServer.init(6666, true, -1);
Assert.ok(
otherServer.port == 6666,
"Trying to listen on port 6666"
);
xaltsvc = "localhost:" + BAD_PORT_U64;
dump("Blocked port: " + otherServer.port);
waitFor = 500;
otherServer.asyncListen({
onSocketAccepted() {
Assert.ok(false, "Got connection to socket when we didn't expect it!");
},
onStopListening() {
// We get closed when the entire file is done, which guarantees we get the socket accept
// if we do connect to the alt-svc header
do_test_finished();
},
});
do_test_pending();
doTest();
}