[Security] caclmgrd: remove permit source port 179

[bluecmd]

Why I did it

Fixes #9916.

I detected that all traffic that uses a source port TCP/179 will be allowed with no option of disabling this.

An attacker can trivially send packets with any source port they wish, so this would allow bypassing any control plane ACL.

How I did it

I removed these statements. They appear to be for allowing BGP, but the needed rules are already present:

• Allow destination port 179
• Allow established connections

How to verify it

If this patch is wrong BGP would not work, so test BGP and see that it works.
Also, you can check in a running instance /without/ this patch that iptables -vnL shows that 0 packets have been accepted into the tcp spt:179 rule.

Which release branch to backport (provide reason below if selected)

• 201811
• 201911
• 202006
• 202012
• 202106
• 202111

Reason: Security patch. caclmgrd was introduced in 202012 it seems.

Description for the changelog

caclmgrd: Remove explicit permit source port 179

A picture of a cute animal (not mandatory but encouraged)

[bluecmd]

I managed to create an easy repro. With a loopback interface configured as 11.11.11.111/32 a normal nmap -sT 11.11.11.111 hits the DROP rule 224 11200 DROP all -- * * 0.0.0.0/0 11.11.11.111. Scan takes very long time and no results.

However, using sudo nmap -g 179 -sS 11.11.11.111 allows one to bypass all control plane ACLs:

Starting Nmap 7.70 ( https://nmap.org ) at 2022-01-27 20:22 UTC
Nmap scan report for 11.11.11.111
Host is up (0.000064s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
179/tcp  open  bgp
443/tcp  open  https
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 14.91 seconds

Iptables output:

Chain INPUT (policy ACCEPT 22132 packets, 1362K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 339M  123G ACCEPT     all  --  lo     *       127.0.0.1            0.0.0.0/0           
4019K  325M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    1    84 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 0
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
  297 97416 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:67:68
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:546:547
    1    44 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:179
 1060 46640 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp spt:179
    0     0 DROP       all  --  *      *       0.0.0.0/0            10.0.0.11           
  224 11200 DROP       all  --  *      *       0.0.0.0/0            11.11.11.111         

[bluecmd]

@yxieca as you are reviewing my other ACL PR, do you think you could review this one as well?