Messages in this thread | | | From | Neil Brown <> | Date | Tue, 21 Sep 1999 10:07:04 +1000 (EST) | Subject | Re: [RFC] i_generation numbers. |
| |
On Monday September 20, gam3@ixlabs.com wrote: > > A reasonable simple "lazy" way to do this in ext2fs would be something > > like: > > > > if (!inode->i_generation) > > inode->i_generation = net_random()|1; > > else while (! ++inode->i_generation); > > which sets it randomly (but non zero) the first time, and then > > increments skipping 0. > > Here is an attack of the above system. > > 1. Open a few thousand files. > > 2. Save the the filehandles for each of these files. > > 3. delete all the the files created above. > > 4. Incriment the the generation number in each of the > saved filehandle. > > 5. Try to read files using the above filehandles. If this > does not give you ESTALE you have opened a file that > someone else created. > > Also 2^32 is not a very big number. It would be nice to be able > to tell the difference between a stale filehandle and an attack. > > --------------------------------- > G. Allen Morris III
But who is our attacker? If they have sufficient control of an IP address that they can fake up NFS requests from that IP address, and if that IP address is trusted by knfsd, then they had better be a good friend. Otherwise they can simple mount the root of the filesystem (mountd trusts the same IP's that knfsd trusts) and walk around the filetree changing their AUTH_UNIX identity as required.
Given that linux knfsd only allows requests from known IP addresses, I don't think randomness in the filehandle actually is needed at all (this only fully occured to me after I sent my previous message).
The value of randomness (and fsirand) was for other NFS servers which rely on mountd to do all authentication, and will accept NFS requests from any IP address providing that the filehandle is valid.
The only filehandles that are not directly available to an authorised client are handles for files inside directories for which x access has been squashed (with root_squash or all_squash), and you have put code in to (mostly) check for that.
So my new suggestion is : Don't bother with random file handles, it doesn't add anything.
NeilBrown
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |