socket-default: Require CAP_NET_BIND_SERVICE for ports < 1024

Since we don't know which ports are used with socket-dynamic we can't
demand the capability there, but it might still be required.

src/libcharon/plugins/socket_default/socket_default_socket.c

@@ -692,6 +692,18 @@ socket_default_socket_t *socket_default_socket_create()
 		this->natt = 0;
 	}
 
+	if ((this->port && this->port < 1024) || (this->natt && this->natt < 1024))
+	{
+		if (!lib->caps->keep(lib->caps, CAP_NET_BIND_SERVICE))
+		{
+			/* required to bind ports < 1024 */
+			DBG1(DBG_NET, "socket-default plugin requires CAP_NET_BIND_SERVICE "
+				 "capability");
+			destroy(this);
+			return NULL;
+		}
+	}
+
 	/* we allocate IPv6 sockets first as that will reserve randomly allocated
 	 * ports also for IPv4. On OS X, we have to do it the other way round
 	 * for the same effect. */

src/libstrongswan/utils/capabilities.h

@@ -32,8 +32,11 @@ typedef struct capabilities_t capabilities_t;
 # include <linux/capability.h>
 #endif
 
+#ifndef CAP_NET_BIND_SERVICE
+# define CAP_NET_BIND_SERVICE 10
+#endif
 #ifndef CAP_NET_ADMIN
-#define CAP_NET_ADMIN 12
+# define CAP_NET_ADMIN 12
 #endif
 
 /**