File rpc.statd-Bind-downcall-socket-to-loopback-addr... of Package nfs-utils

Overview Repositories Revisions Requests Users Attributes Meta

File rpc.statd-Bind-downcall-socket-to-loopback-address.patch of Package nfs-utils (Revision 8e1314a04b60e6d58608f69be421ed05)

Currently displaying revision 8e1314a04b60e6d58608f69be421ed05 , Show latest

From c7e224a75f480f955532c96937a5d58cc6e10272 Mon Sep 17 00:00:00 2001
From: Chuck Lever <chuck.lever@oracle.com>
Date: Wed, 3 Aug 2011 13:22:52 -0400
Subject: [PATCH] rpc.statd: Bind downcall socket to loopback address

In the past, rpc.statd posted SM_NOTIFY requests using the same socket
it used for sending downcalls to the kernel.  To receive replies from
remote hosts, the socket was bound to INADDR_ANY.

With commit f113db52 "Remove notify functionality from statd in
favour of sm-notify" (Mar 20, 2007), the downcall socket is no longer
used for sending requests to remote hosts.  However, the downcall
socket is still bound to INADDR_ANY.

Thus a remote host can inject data on this socket since it is an
unconnected UDP socket listening for RPC replies.  Thanks to f113db52,
the port number of this socket is no longer controlled by a command
line option, making it difficult to firewall.

We have demonstrated that data injection on this socket can result in
a DoS by causing rpc.statd to consume CPU and log bandwidth, but so
far we have not found a breach.

To prevent unwanted data injection, bind this socket to the loopback
address.

BugLink: https://bugzilla.linux-nfs.org/show_bug.cgi?id=177

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
---
 utils/statd/rmtcall.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/utils/statd/rmtcall.c b/utils/statd/rmtcall.c
index 0e52fe2..4ecb03c 100644
--- a/utils/statd/rmtcall.c
+++ b/utils/statd/rmtcall.c
@@ -85,7 +85,7 @@ statd_get_socket(void)
 
 		memset(&sin, 0, sizeof(sin));
 		sin.sin_family = AF_INET;
-		sin.sin_addr.s_addr = INADDR_ANY;
+		sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
 
 		if (bindresvport(sockfd, &sin) < 0) {
 			xlog(D_GENERAL, "%s: can't bind to reserved port",
-- 
1.7.3.4

Places

File rpc.statd-Bind-downcall-socket-to-loopback-address.patch of Package nfs-utils (Revision 8e1314a04b60e6d58608f69be421ed05)

Places