Fix the NFSv4 server to obey vfs.nfsd.nfs_privport.
When the NFSv4 server was coded, I believed that the specification authors did not want NFSv4 servers to require a client to use a reserved port#. However, recently it has been noted that the Linux NFSv4 server does support a check for a reserved port#. Since both the FreeBSD and Linux NFSv4 clients use a reserved port# by default, enabling vfs.nfsd.nfs_privport to require a reserved port# for NFSv4 the same as it does for NFSv2, 3 seems reasonable. The only case where this could cause a POLA violation is a FreeBSD NFSv4 server with vfs.nfsd.nfs_privport set, but with NFSv4 clients doing mounts without using a reserved port# (< 1024). Tested by: chaz.newton58@gmail.com PR: 234106 MFC after: 1 week
This commit is contained in:
parent
0c3bbec309
commit
23114c6c2a
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=342286
@ -90,7 +90,7 @@ SVCPOOL *nfsrvd_pool;
|
||||
static int nfs_privport = 0;
|
||||
SYSCTL_INT(_vfs_nfsd, OID_AUTO, nfs_privport, CTLFLAG_RWTUN,
|
||||
&nfs_privport, 0,
|
||||
"Only allow clients using a privileged port for NFSv2 and 3");
|
||||
"Only allow clients using a privileged port for NFSv2, 3 and 4");
|
||||
|
||||
static int nfs_minvers = NFS_VER2;
|
||||
SYSCTL_INT(_vfs_nfsd, OID_AUTO, server_min_nfsvers, CTLFLAG_RWTUN,
|
||||
@ -166,7 +166,7 @@ nfssvc_program(struct svc_req *rqst, SVCXPRT *xprt)
|
||||
nd.nd_mreq = NULL;
|
||||
nd.nd_cred = NULL;
|
||||
|
||||
if (nfs_privport && (nd.nd_flag & ND_NFSV4) == 0) {
|
||||
if (nfs_privport != 0) {
|
||||
/* Check if source port is privileged */
|
||||
u_short port;
|
||||
struct sockaddr *nam = nd.nd_nam;
|
||||
|
Loading…
Reference in New Issue
Block a user