lkml.org 
[lkml]   [2016]   [Nov]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 019/152] NFS: Don't drop CB requests with invalid principals
    3.2.84-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Chuck Lever <chuck.lever@oracle.com>

    commit a4e187d83d88eeaba6252aac0a2ffe5eaa73a818 upstream.

    Before commit 778be232a207 ("NFS do not find client in NFSv4
    pg_authenticate"), the Linux callback server replied with
    RPC_AUTH_ERROR / RPC_AUTH_BADCRED, instead of dropping the CB
    request. Let's restore that behavior so the server has a chance to
    do something useful about it, and provide a warning that helps
    admins correct the problem.

    Fixes: 778be232a207 ("NFS do not find client in NFSv4 ...")
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Tested-by: Steve Wise <swise@opengridcomputing.com>
    Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    fs/nfs/callback_xdr.c | 6 +++++-
    net/sunrpc/svc.c | 5 +++++
    2 files changed, 10 insertions(+), 1 deletion(-)

    --- a/fs/nfs/callback_xdr.c
    +++ b/fs/nfs/callback_xdr.c
    @@ -878,7 +878,7 @@ static __be32 nfs4_callback_compound(str
    if (hdr_arg.minorversion == 0) {
    cps.clp = nfs4_find_client_ident(hdr_arg.cb_ident);
    if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp))
    - return rpc_drop_reply;
    + goto out_invalidcred;
    }

    hdr_res.taglen = hdr_arg.taglen;
    @@ -905,6 +905,10 @@ static __be32 nfs4_callback_compound(str
    nfs_put_client(cps.clp);
    dprintk("%s: done, status = %u\n", __func__, ntohl(status));
    return rpc_success;
    +
    +out_invalidcred:
    + pr_warn_ratelimited("NFS: NFSv4 callback contains invalid cred\n");
    + return rpc_autherr_badcred;
    }

    /*
    --- a/net/sunrpc/svc.c
    +++ b/net/sunrpc/svc.c
    @@ -1172,6 +1172,11 @@ svc_process_common(struct svc_rqst *rqst
    procp->pc_release(rqstp, NULL, rqstp->rq_resp);
    goto dropit;
    }
    + if (*statp == rpc_autherr_badcred) {
    + if (procp->pc_release)
    + procp->pc_release(rqstp, NULL, rqstp->rq_resp);
    + goto err_bad_auth;
    + }
    if (*statp == rpc_success &&
    (xdr = procp->pc_encode) &&
    !xdr(rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) {
    \
     
     \ /
      Last update: 2016-11-14 04:11    [W:4.081 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site