Tcp port blocking: block accepts based on the accept socket port
instead of the ephemeral port.
@@ -3517,6 +3517,13 @@ syscall(long number, ...)
long rc;
rc = g_fn.syscall(number, fArgs.arg[0], fArgs.arg[1],
fArgs.arg[2], fArgs.arg[3]);
+
+ if ((rc != -1) && (doBlockConnection(fArgs.arg[0], (struct sockaddr*)&g_netinfo[fArgs.arg[0]].localConn) == 1)) {
+ if (g_fn.close) g_fn.close(rc);
+ errno = ECONNABORTED;
+ return -1;
+ }
+
if (rc != -1) {
doAccept(rc, (struct sockaddr *)fArgs.arg[1],
(socklen_t *)fArgs.arg[2], "accept4");
@@ -3781,6 +3788,13 @@ accept$NOCANCEL(int sockfd, struct sockaddr *addr, socklen_t *addrlen)
WRAP_CHECK(accept$NOCANCEL, -1);
sd = g_fn.accept$NOCANCEL(sockfd, addr, addrlen);
+
+ if ((sd != -1) && (doBlockConnection(sockfd, (struct sockaddr*)&g_netinfo[sockfd].localConn) == 1)) {
+ if (g_fn.close) g_fn.close(sd);
+ errno = ECONNABORTED;
+ return -1;
+ }
+
if (sd != -1) {
doAccept(sd, addr, addrlen, "accept$NOCANCEL");
} else {
@@ -4479,7 +4493,7 @@ accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen)
WRAP_CHECK(accept, -1);
sd = g_fn.accept(sockfd, addr, addrlen);
- if ((sd != -1) && (doBlockConnection(sockfd, addr) == 1)) {
+ if ((sd != -1) && (doBlockConnection(sockfd, (struct sockaddr*)&g_netinfo[sockfd].localConn) == 1)) {
if (g_fn.close) g_fn.close(sd);
errno = ECONNABORTED;
return -1;
@@ -4501,7 +4515,8 @@ accept4(int sockfd, struct sockaddr *addr, socklen_t *addrlen, int flags)
WRAP_CHECK(accept4, -1);
sd = g_fn.accept4(sockfd, addr, addrlen, flags);
- if ((sd != -1) && (doBlockConnection(sockfd, addr) == 1)) {
+
+ if ((sd != -1) && (doBlockConnection(sockfd, (struct sockaddr*)&g_netinfo[sockfd].localConn) == 1)) {
if (g_fn.close) g_fn.close(sd);
errno = ECONNABORTED;
return -1;
