-
Notifications
You must be signed in to change notification settings - Fork 5.2k
WasmAppHost: block port# 5060 and 5061, for the webserver #76485
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
to avoid slipstream attack https://chromestatus.com/feature/5064283639513088
|
I couldn't figure out the best area label to add to this PR. If you have write-permissions please help me learn by adding exactly one area label. |
|
You don't need to loop. It's easy to just specify smaller range and +2 to the result if it's >= 5060. |
|
this is future-proof for additional port blocking |
|
You can apply the same idea in a generic way. Just subtract the size of the array of the blocked ports from the random range. Then loop over the array of blocked ports and increment the random number R by 1 for each array[i] >= R. |
|
Tagging subscribers to this area: @directhex Issue Detailsto avoid slipstream attack https://chromestatus.com/feature/5064283639513088
|
|
Could you please add comment on why we are avoiding the ports ? Also see what browsers consider unsafe |
|
comments added.
combination of those lists in case it is needed: 1, // tcpmux
7, // echo
9, // discard
11, // systat
13, // daytime
15, // netstat
17, // qotd
19, // chargen
20, // FTP-data
21, // FTP-control
22, // SSH
23, // telnet
25, // SMTP
37, // time
42, // name
43, // nicname
53, // domain
69, // TFTP
77, // priv-rjs
79, // finger
87, // ttylink
95, // supdup
101, // hostriame
102, // iso-tsap
103, // gppitnp
104, // acr-nema
109, // POP2
110, // POP3
111, // sunrpc
113, // auth
115, // SFTP
117, // uucp-path
119, // nntp
123, // NTP
135, // loc-srv / epmap
137, // NetBIOS
139, // netbios
143, // IMAP2
161, // SNMP
179, // BGP
389, // LDAP
427, // SLP (Also used by Apple Filing Protocol)
465, // SMTP+SSL
512, // print / exec
513, // login
514, // shell
515, // printer
526, // tempo
530, // courier
531, // Chat
532, // netnews
540, // UUCP
548, // afpovertcp [Apple addition]
554, // rtsp
556, // remotefs
563, // NNTP+SSL
587, // ESMTP
601, // syslog-conn
636, // LDAP+SSL
989, // ftps-data
990, // ftps
993, // IMAP+SSL
995, // POP3+SSL
1719, // H323 (RAS)
1720, // H323 (Q931)
1723, // H323 (H245)
2049, // NFS
3659, // apple-sasl / PasswordServer [Apple addition]
4045, // lockd
5060, // SIP
5061, // SIPS
6000, // X11
6566, // SANE
6665, // Alternate IRC [Apple addition]
6666, // Alternate IRC [Apple addition]
6667, // Standard IRC [Apple addition]
6668, // Alternate IRC [Apple addition]
6669, // Alternate IRC [Apple addition]
6697, // IRC+SSL [Apple addition]
10080, // amanda
4190, // ManageSieve [Apple addition]
6679, // Alternate IRC SSL [Apple addition] |
pavelsavara
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM after whitespace fix
|
Tagging subscribers to 'arch-wasm': @lewing Issue Detailsto avoid slipstream attack https://chromestatus.com/feature/5064283639513088
|
to avoid slipstream attack https://chromestatus.com/feature/5064283639513088