From a4f3594322709943c245779bd73fc205ccd5ad22 Mon Sep 17 00:00:00 2001
From: Viktor Ashirov <vashirov@redhat.com>
Date: Fri, 3 Feb 2017 18:26:52 +0100
Subject: [PATCH] Ticket 49108 - ds_selinux_port_query doesn't detect ports
 labeled with range

Bug Description:
If ports were labeled using range, ds_selinux_port_query still thinks that they are not labeled:

Fix Description:
Rewrite ds_selinux_port_query to use sepolicy instead of semanage to be
able to use range lookup.

https://fedorahosted.org/389/ticket/49108

Reviewed by: ???
---
 ldap/admin/src/scripts/ds_selinux_port_query.in | 66 +++++++++++--------------
 1 file changed, 29 insertions(+), 37 deletions(-)

diff --git a/ldap/admin/src/scripts/ds_selinux_port_query.in b/ldap/admin/src/scripts/ds_selinux_port_query.in
index 006f978..407478c 100644
--- a/ldap/admin/src/scripts/ds_selinux_port_query.in
+++ b/ldap/admin/src/scripts/ds_selinux_port_query.in
@@ -5,13 +5,12 @@
 # All rights reserved.
 #
 # License: GPL (version 3 or any later version).
-# See LICENSE for details. 
+# See LICENSE for details.
 # END COPYRIGHT BLOCK
 #
 
 import sys
-import selinux
-import semanage
+import sepolicy
 
 # These are python 3 capable, but el7 doesn't have libsemanage-python3
 
@@ -22,6 +21,8 @@ import semanage
 # or if a lable is given, exists AND inside of label type.
 # 2 means port exists but belongs to a different type.
 
+# Get the arguments
+# Fail if they are not set correctly.
 if len(sys.argv) <= 1:
     sys.stderr.write("Must provide port to query\n")
     sys.exit(512)
@@ -33,37 +34,28 @@ try:
 except:
     pass
 
-# Get the arguments
-
-# Fail if they are not set correctly.
-
-# Check the port in policy
-h = semanage.semanage_handle_create()
-semanage.semanage_connect(h)
-# This could check high / low values, but eh.
-(r, k) = semanage.semanage_port_key_create(h, port, port, semanage.SEMANAGE_PROTO_TCP)
-
-# Do I need to check _local too?
-(t, e) = semanage.semanage_port_exists(h, k)
-
-if label is None:
-    sys.exit(e)
-
-# See if it has a specifc label
-
-if (e == 0):
-    # No point checking the label, it doesn't exist
-    sys.exit(e)
-
-(t, sp) = semanage.semanage_port_query(h, k)
-
-# do we need to check if this is none? We already know that the port exists, so it must have a context ...
-r = semanage.semanage_port_get_con(sp)
-
-if label == semanage.semanage_context_get_type(r):
-    sys.exit(1)
-
-else:
-    sys.stderr.write('Port belongs to %s\n' % semanage.semanage_context_get_type(r))
-    sys.exit(2)
-
+# Get all defined ports from the policy
+portrecs, portrecsbynum = sepolicy.gen_port_dict()
+all_ports = []
+for i in portrecs:
+    if i[0] not in all_ports:
+        all_ports.append(i[0])
+all_ports.sort()
+
+found = False
+for i in portrecsbynum:
+    # Check if the port is in range
+    if i[0] <= port and port <= i[1] and 'tcp' == i[2]:
+        # See if it has a specific label
+        # Ignore default label types
+        if portrecsbynum[i][0] not in ['unreserved_port_t', 'reserved_port_t',
+                                       'ephemeral_port_t']:
+            # Port exists within our label type or exists if none is given
+            if label == portrecsbynum[i][0] or label == None:
+                found = True
+                sys.exit(1)
+            else:
+                sys.stderr.write("Port belongs to {}\n".format(portrecsbynum[i][0]))
+                sys.exit(2)
+if not found:
+        sys.exit(0)
-- 
2.9.3