51 lines
1.8 KiB
Diff
51 lines
1.8 KiB
Diff
|
From c7e224a75f480f955532c96937a5d58cc6e10272 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Chuck Lever <chuck.lever@oracle.com>
|
||
|
|
Date: Wed, 3 Aug 2011 13:22:52 -0400
|
||
|
|
Subject: [PATCH] rpc.statd: Bind downcall socket to loopback address
|
||
|
|
|
||
|
|
In the past, rpc.statd posted SM_NOTIFY requests using the same socket
|
||
|
|
it used for sending downcalls to the kernel. To receive replies from
|
||
|
|
remote hosts, the socket was bound to INADDR_ANY.
|
||
|
|
|
||
|
|
With commit f113db52 "Remove notify functionality from statd in
|
||
|
|
favour of sm-notify" (Mar 20, 2007), the downcall socket is no longer
|
||
|
|
used for sending requests to remote hosts. However, the downcall
|
||
|
|
socket is still bound to INADDR_ANY.
|
||
|
|
|
||
|
|
Thus a remote host can inject data on this socket since it is an
|
||
|
|
unconnected UDP socket listening for RPC replies. Thanks to f113db52,
|
||
|
|
the port number of this socket is no longer controlled by a command
|
||
|
|
line option, making it difficult to firewall.
|
||
|
|
|
||
|
|
We have demonstrated that data injection on this socket can result in
|
||
|
|
a DoS by causing rpc.statd to consume CPU and log bandwidth, but so
|
||
|
|
far we have not found a breach.
|
||
|
|
|
||
|
|
To prevent unwanted data injection, bind this socket to the loopback
|
||
|
|
address.
|
||
|
|
|
||
|
|
BugLink: https://bugzilla.linux-nfs.org/show_bug.cgi?id=177
|
||
|
|
|
||
|
|
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
|
||
|
|
Signed-off-by: Steve Dickson <steved@redhat.com>
|
||
|
|
---
|
||
|
|
utils/statd/rmtcall.c | 2 +-
|
||
|
|
1 files changed, 1 insertions(+), 1 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/utils/statd/rmtcall.c b/utils/statd/rmtcall.c
|
||
|
|
index 0e52fe2..4ecb03c 100644
|
||
|
|
--- a/utils/statd/rmtcall.c
|
||
|
|
+++ b/utils/statd/rmtcall.c
|
||
|
|
@@ -85,7 +85,7 @@ statd_get_socket(void)
|
||
|
|
|
||
|
|
memset(&sin, 0, sizeof(sin));
|
||
|
|
sin.sin_family = AF_INET;
|
||
|
|
- sin.sin_addr.s_addr = INADDR_ANY;
|
||
|
|
+ sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
|
||
|
|
|
||
|
|
if (bindresvport(sockfd, &sin) < 0) {
|
||
|
|
xlog(D_GENERAL, "%s: can't bind to reserved port",
|
||
|
|
--
|
||
|
|
1.7.3.4
|
||
|
|
|