linux-kernel - Re: [PATCH 05/19] SUNRPC: track whether a request is coming from a loop-back interface.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140417092504.57a49f9d@notabene.brown>
Date:	Thu, 17 Apr 2014 09:25:04 +1000
From:	NeilBrown <neilb@...e.de>
To:	Jeff Layton <jlayton@...chiereds.net>
Cc:	linux-mm@...ck.org, linux-nfs@...r.kernel.org,
	linux-kernel@...r.kernel.org, xfs@....sgi.com,
	netdev@...r.kernel.org
Subject: Re: [PATCH 05/19] SUNRPC: track whether a request is coming from a
 loop-back interface.

On Wed, 16 Apr 2014 10:47:02 -0400 Jeff Layton <jlayton@...chiereds.net>
wrote:

> On Wed, 16 Apr 2014 14:03:36 +1000
> NeilBrown <neilb@...e.de> wrote:
> 
> > If an incoming NFS request is coming from the local host, then
> > nfsd will need to perform some special handling.  So detect that
> > possibility and make the source visible in rq_local.
> > 
> > Signed-off-by: NeilBrown <neilb@...e.de>
> > ---
> >  include/linux/sunrpc/svc.h      |    1 +
> >  include/linux/sunrpc/svc_xprt.h |    1 +
> >  net/sunrpc/svcsock.c            |   10 ++++++++++
> >  3 files changed, 12 insertions(+)
> > 
> > diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
> > index 04e763221246..a0dbbd1e00e9 100644
> > --- a/include/linux/sunrpc/svc.h
> > +++ b/include/linux/sunrpc/svc.h
> > @@ -254,6 +254,7 @@ struct svc_rqst {
> >  	u32			rq_prot;	/* IP protocol */
> >  	unsigned short
> >  				rq_secure  : 1;	/* secure port */
> > +	unsigned short		rq_local   : 1;	/* local request */
> >  
> >  	void *			rq_argp;	/* decoded arguments */
> >  	void *			rq_resp;	/* xdr'd results */
> > diff --git a/include/linux/sunrpc/svc_xprt.h b/include/linux/sunrpc/svc_xprt.h
> > index b05963f09ebf..b99bdfb0fcf9 100644
> > --- a/include/linux/sunrpc/svc_xprt.h
> > +++ b/include/linux/sunrpc/svc_xprt.h
> > @@ -63,6 +63,7 @@ struct svc_xprt {
> >  #define	XPT_DETACHED	10		/* detached from tempsocks list */
> >  #define XPT_LISTENER	11		/* listening endpoint */
> >  #define XPT_CACHE_AUTH	12		/* cache auth info */
> > +#define XPT_LOCAL	13		/* connection from loopback interface */
> >  
> >  	struct svc_serv		*xpt_server;	/* service for transport */
> >  	atomic_t    	    	xpt_reserved;	/* space on outq that is rsvd */
> > diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
> > index b6e59f0a9475..193115fe968c 100644
> > --- a/net/sunrpc/svcsock.c
> > +++ b/net/sunrpc/svcsock.c
> > @@ -811,6 +811,7 @@ static struct svc_xprt *svc_tcp_accept(struct svc_xprt *xprt)
> >  	struct socket	*newsock;
> >  	struct svc_sock	*newsvsk;
> >  	int		err, slen;
> > +	struct dst_entry *dst;
> >  	RPC_IFDEBUG(char buf[RPC_MAX_ADDRBUFLEN]);
> >  
> >  	dprintk("svc: tcp_accept %p sock %p\n", svsk, sock);
> > @@ -867,6 +868,14 @@ static struct svc_xprt *svc_tcp_accept(struct svc_xprt *xprt)
> >  	}
> >  	svc_xprt_set_local(&newsvsk->sk_xprt, sin, slen);
> >  
> > +	clear_bit(XPT_LOCAL, &newsvsk->sk_xprt.xpt_flags);
> > +	rcu_read_lock();
> > +	dst = rcu_dereference(newsock->sk->sk_dst_cache);
> > +	if (dst && dst->dev &&
> > +	    (dst->dev->features & NETIF_F_LOOPBACK))
> > +		set_bit(XPT_LOCAL, &newsvsk->sk_xprt.xpt_flags);
> > +	rcu_read_unlock();
> > +
> 
> In the use-case you describe, the client is unlikely to have mounted
> "localhost", but is more likely to be mounting a floating address in
> the cluster.
> 
> Will this flag end up being set in such a situation? It looks like
> NETIF_F_LOOPBACK isn't set on all adapters -- mostly on "lo" and a few
> others that support MAC-LOOPBACK.

I was hoping someone on net-dev would have commented if it didn't work - I
probably should have explicitly asked.

My testing certainly suggests that this works if I use any local address to
perform the mount, not just 127.0.0.1.
I don't know enough about routing and neighbours and the dst cache to be
certain but my shallow understanding was always that traffic to any local
address was pseudo-routed through the lo interface and would never get
anywhere near e.g. the eth0 interface.

Can any network people confirm?

Thanks,
NeilBrown


> 
> 
> >  	if (serv->sv_stats)
> >  		serv->sv_stats->nettcpconn++;
> >  
> > @@ -1112,6 +1121,7 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
> >  
> >  	rqstp->rq_xprt_ctxt   = NULL;
> >  	rqstp->rq_prot	      = IPPROTO_TCP;
> > +	rqstp->rq_local	      = !!test_bit(XPT_LOCAL, &svsk->sk_xprt.xpt_flags);
> >  
> >  	p = (__be32 *)rqstp->rq_arg.head[0].iov_base;
> >  	calldir = p[1];
> > 
> > 
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
> > the body of a message to majordomo@...r.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
> 


Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)