summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJeff Layton <jlayton@poochiereds.net>2015-06-04 18:40:13 -0400
committerTrond Myklebust <trond.myklebust@primarydata.com>2015-06-11 14:06:34 -0400
commit6f02dc88be1d5ecfcc2b708250f4e5d49295326c (patch)
tree94e3f486b1133cec11a42e07cc32800c08b1a336
parent5fd23f7e1d74c0fd100ffb0b04dc85727760d9ea (diff)
downloadop-kernel-dev-6f02dc88be1d5ecfcc2b708250f4e5d49295326c.zip
op-kernel-dev-6f02dc88be1d5ecfcc2b708250f4e5d49295326c.tar.gz
nfs: deny backchannel RPCs with an incorrect authflavor instead of dropping them
A drop should really only be done when the frame is malformed or we have reason to think that there is some sort of DoS going on. When we get an RPC with bad auth, we should send back an error instead. Cc: Andy Adamson <William.Adamson@netapp.com> Signed-off-by: Jeff Layton <jeff.layton@primarydata.com> Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
-rw-r--r--fs/nfs/callback.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index 8d129bb..682529c 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -458,7 +458,7 @@ check_gss_callback_principal(struct nfs_client *clp, struct svc_rqst *rqstp)
* pg_authenticate method for nfsv4 callback threads.
*
* The authflavor has been negotiated, so an incorrect flavor is a server
- * bug. Drop packets with incorrect authflavor.
+ * bug. Deny packets with incorrect authflavor.
*
* All other checking done after NFS decoding where the nfs_client can be
* found in nfs4_callback_compound
@@ -468,12 +468,12 @@ static int nfs_callback_authenticate(struct svc_rqst *rqstp)
switch (rqstp->rq_authop->flavour) {
case RPC_AUTH_NULL:
if (rqstp->rq_proc != CB_NULL)
- return SVC_DROP;
+ return SVC_DENIED;
break;
case RPC_AUTH_GSS:
/* No RPC_AUTH_GSS support yet in NFSv4.1 */
if (svc_is_backchannel(rqstp))
- return SVC_DROP;
+ return SVC_DENIED;
}
return SVC_OK;
}
OpenPOWER on IntegriCloud