From owner-svn-src-head@FreeBSD.ORG Thu Nov 13 14:36:52 2008 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 950A2106567E; Thu, 13 Nov 2008 14:36:52 +0000 (UTC) (envelope-from dfr@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 85FEE8FC0C; Thu, 13 Nov 2008 14:36:52 +0000 (UTC) (envelope-from dfr@FreeBSD.org) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id mADEaqa5061129; Thu, 13 Nov 2008 14:36:52 GMT (envelope-from dfr@svn.freebsd.org) Received: (from dfr@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id mADEaqTR061127; Thu, 13 Nov 2008 14:36:52 GMT (envelope-from dfr@svn.freebsd.org) Message-Id: <200811131436.mADEaqTR061127@svn.freebsd.org> From: Doug Rabson Date: Thu, 13 Nov 2008 14:36:52 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r184921 - in head/sys: nfsserver xdr X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Nov 2008 14:36:52 -0000 Author: dfr Date: Thu Nov 13 14:36:52 2008 New Revision: 184921 URL: http://svn.freebsd.org/changeset/base/184921 Log: Use the remote address for access control, not the local address. This fixes the nfsd problems that some people have with the new code. Add support for the vfs.nfsrv.nfs_privport sysctl which denies access unless the client is using a port number less than 1024. Not really sure if this is particularly useful since it doesn't add any real security. Modified: head/sys/nfsserver/nfs_srvkrpc.c head/sys/xdr/xdr_mbuf.c Modified: head/sys/nfsserver/nfs_srvkrpc.c ============================================================================== --- head/sys/nfsserver/nfs_srvkrpc.c Thu Nov 13 11:35:18 2008 (r184920) +++ head/sys/nfsserver/nfs_srvkrpc.c Thu Nov 13 14:36:52 2008 (r184921) @@ -348,19 +348,61 @@ nfssvc_program(struct svc_req *rqst, SVC nfs_realign(&mreq); /* - * Note: we want rq_addr, not svc_getrpccaller - + * Note: we want rq_addr, not svc_getrpccaller for nd_nam2 - * NFS_SRVMAXDATA uses a NULL value for nd_nam2 to detect TCP * mounts. */ memset(&nd, 0, sizeof(nd)); nd.nd_md = nd.nd_mrep = mreq; nd.nd_dpos = mtod(mreq, caddr_t); - nd.nd_nam = (struct sockaddr *) &xprt->xp_ltaddr; + nd.nd_nam = svc_getrpccaller(rqst); nd.nd_nam2 = rqst->rq_addr; nd.nd_procnum = procnum; nd.nd_cr = NULL; nd.nd_flag = flag; + if (nfs_privport) { + /* Check if source port is privileged */ + u_short port; + struct sockaddr *nam = nd.nd_nam; + struct sockaddr_in *sin; + + sin = (struct sockaddr_in *)nam; + /* + * INET/INET6 - same code: + * sin_port and sin6_port are at same offset + */ + port = ntohs(sin->sin_port); + if (port >= IPPORT_RESERVED && + nd.nd_procnum != NFSPROC_NULL) { +#ifdef INET6 + char b6[INET6_ADDRSTRLEN]; +#if defined(KLD_MODULE) + /* Do not use ip6_sprintf: the nfs module should work without INET6. */ +#define ip6_sprintf(buf, a) \ + (sprintf((buf), "%x:%x:%x:%x:%x:%x:%x:%x", \ + (a)->s6_addr16[0], (a)->s6_addr16[1], \ + (a)->s6_addr16[2], (a)->s6_addr16[3], \ + (a)->s6_addr16[4], (a)->s6_addr16[5], \ + (a)->s6_addr16[6], (a)->s6_addr16[7]), \ + (buf)) +#endif +#endif + printf("NFS request from unprivileged port (%s:%d)\n", +#ifdef INET6 + sin->sin_family == AF_INET6 ? + ip6_sprintf(b6, &satosin6(sin)->sin6_addr) : +#if defined(KLD_MODULE) +#undef ip6_sprintf +#endif +#endif + inet_ntoa(sin->sin_addr), port); + svcerr_weakauth(rqst); + svc_freereq(rqst); + return; + } + } + if (proc != nfsrv_null) { if (!svc_getcred(rqst, &nd.nd_cr, &nd.nd_credflavor)) { svcerr_weakauth(rqst); Modified: head/sys/xdr/xdr_mbuf.c ============================================================================== --- head/sys/xdr/xdr_mbuf.c Thu Nov 13 11:35:18 2008 (r184920) +++ head/sys/xdr/xdr_mbuf.c Thu Nov 13 14:36:52 2008 (r184921) @@ -65,6 +65,7 @@ void xdrmbuf_create(XDR *xdrs, struct mbuf *m, enum xdr_op op) { + KASSERT(m != NULL, ("xdrmbuf_create with NULL mbuf chain")); xdrs->x_op = op; xdrs->x_ops = &xdrmbuf_ops; xdrs->x_base = (char *) m;