fix(settings): coerce local-bind ports to non-root range >= 1025 - #46
Merged
Conversation
Android apps cannot bind TCP/UDP ports 1..1024 without root. Five local-bind sites validated user input with coerceIn(1, 65535), so a user entering 80, 443, or 53 for any locally-bound port would pass validation, get the value saved, then hit BindException: EACCES at connect time on a non-rooted device -- surfacing as a generic "Go core error" with no clue that the port was the problem. Tighten the five local-bind sites to coerceIn(1025, 65535): - GlobalSettingsStore.kt: internet-sharing SOCKS + HTTP ports - MainActivity.kt: TOML-import listen port - ProfilesScreen.kt: TOML-import listen port - SettingsViewModel.kt: manual field-update listen port Leave the two coerceIn(1, 65535) calls in MasterDnsVpnService.kt parseConnectTarget() untouched: those parse the *remote destination* port from an HTTP CONNECT request, and browsers legitimately CONNECT to :80 and :443 -- clamping them to >= 1025 would break the proxy's primary use case. Add GlobalSettingsPortRangeTest with 3 JVM-runnable tests pinning the new floor (80 -> 1025, 443 -> 1025, 99999 -> 65535, 8090 -> 8090, 18000 -> 18000) so a future refactor that drops the coerceIn or renames the literal fails loudly. Plan 020.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Android apps cannot bind TCP/UDP ports 1..1024 without root. Five local-bind sites validated user input with coerceIn(1, 65535), so a user entering 80, 443, or 53 for any locally-bound port would pass validation, get the value saved, then hit BindException: EACCES at connect time on a non-rooted device -- surfacing as a generic "Go core error" with no clue that the port was the problem.
Tighten the five local-bind sites to coerceIn(1025, 65535):
Leave the two coerceIn(1, 65535) calls in MasterDnsVpnService.kt parseConnectTarget() untouched: those parse the remote destination port from an HTTP CONNECT request, and browsers legitimately CONNECT to :80 and :443 -- clamping them to >= 1025 would break the proxy's primary use case.
Add GlobalSettingsPortRangeTest with 3 JVM-runnable tests pinning the new floor (80 -> 1025, 443 -> 1025, 99999 -> 65535, 8090 -> 8090, 18000 -> 18000) so a future refactor that drops the coerceIn or renames the literal fails loudly.
Plan 020.