Skip to contentSkip to conversation

rpcgss : RPC_GSS_PROC_DESTROY request will get a bad rpc reply message

PATCH In review Wei Yongjun 2 participants 3 messages Apr 10, 2007 – Apr 17, 2007

Subsystems (2)
NFS client NFS server
lore
Share & tools
lore

Wei Yongjun

author
#0 lore raw

PATCH 1/1 rpcgss : RPC_GSS_PROC_DESTROY request will get a bad rpc reply message

If I send a RPC_GSS_PROC_DESTROY message to NFSv4 server, I will reply us a bad rpc reply which without an authentication verifier in it. Maybe this patch is needed.

Send/recv packets as following:

send:

RemoteProcedureCall
xid
rpcvers = 2
prog = 100003
vers = 4
proc = 0
cred = AUTH_GSS
version = 1
gss_proc = 3 (RPCSEC_GSS_DESTROY)
service = 1 (RPC_GSS_SVC_NONE)
verf = AUTH_GSS
checksum

reply:

RemoteProcedureReply
xid
msg_type
reply_stat
accepted_reply

Signed-off-by Wei Yongjun <[email protected]>
sunrpc/auth_gss/svcauth_gss.c renamed from sunrpc/auth_gss/svcauth_gss.c.orig +2 -0
@@ -1088,6 +1088,8 @@ svcauth_gss_accept(struct svc_rqst *rqst
 		}
 		goto complete;
 	case RPC_GSS_PROC_DESTROY:
+		if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq))
+			goto auth_err;
 		set_bit(CACHE_NEGATIVE, &rsci->h.flags);
 		if (resv->iov_len + 4 > PAGE_SIZE)
 			goto drop;
author
#1 lore raw

Does anyone think this is a BUG of kernel RPCGSS? Although this seems not be used yet.

Quoted 43 lines

If I send a RPC_GSS_PROC_DESTROY message to NFSv4 server, I will reply us a bad rpc reply which without an authentication verifier in it. Maybe this patch is needed.

Send/recv packets as following:

send:

RemoteProcedureCall
xid
rpcvers = 2
prog = 100003
vers = 4
proc = 0
cred = AUTH_GSS
version = 1
gss_proc = 3 (RPCSEC_GSS_DESTROY)
service = 1 (RPC_GSS_SVC_NONE)
verf = AUTH_GSS
checksum

reply:

RemoteProcedureReply
xid
msg_type
reply_stat
accepted_reply

Signed-off-by Wei Yongjun <[email protected]>
sunrpc/auth_gss/svcauth_gss.c renamed from sunrpc/auth_gss/svcauth_gss.c.orig +2 -0
@@ -1088,6 +1088,8 @@ svcauth_gss_accept(struct svc_rqst *rqst
 		}
 		goto complete;
 	case RPC_GSS_PROC_DESTROY:
+		if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq))
+			goto auth_err;
 		set_bit(CACHE_NEGATIVE, &rsci->h.flags);
 		if (resv->iov_len + 4 > PAGE_SIZE)
 			goto drop;
Signature · 13 lines
A new email address of FJWAN is launched from Apr.1 2007.
The updated address is: [email protected] 
--------------------------------------------------
Wei Yongjun
Development Dept.I
Nanjing Fujitsu Nanda Software Tech. Co., Ltd.(FNST)
8/F., Civil Defense Building, No.189 Guangzhou Road,
Nanjing, 210029, China
TEL: +86+25-86630523-858
COINS: 79955-858
FAX: +86+25-83317685
MAIL: [email protected]
--------------------------------------------------
#2 lore raw
Quoted 2 lines · Wei Yongjun

Does anyone think this is a BUG of kernel RPCGSS? Although this seems not be used yet.

Apologies for not responding to the earlier mail; yes, I agree that this patch is needed; thanks! Applied.--b.