Commit d3399a5f authored by Tomáš Trnka's avatar Tomáš Trnka Committed by Ben Hutchings

sunrpc: fix stripping of padded MIC tokens

commit c0cb8bf3 upstream.

The length of the GSS MIC token need not be a multiple of four bytes.
It is then padded by XDR to a multiple of 4 B, but unwrap_integ_data()
would previously only trim mic.len + 4 B. The remaining up to three
bytes would then trigger a check in nfs4svc_decode_compoundargs(),
leading to a "garbage args" error and mount failure:

nfs4svc_decode_compoundargs: compound not properly padded!
nfsd: failed to decode arguments!

This would prevent older clients using the pre-RFC 4121 MIC format
(37-byte MIC including a 9-byte OID) from mounting exports from v3.9+
servers using krb5i.

The trimming was introduced by commit 4c190e2f ("sunrpc: trim off
trailing checksum before returning decrypted or integrity authenticated
buffer").

Fixes: 4c190e2f "unrpc: trim off trailing checksum..."
Signed-off-by: default avatarTomáš Trnka <ttrnka@mail.muni.cz>
Acked-by: default avatarJeff Layton <jlayton@poochiereds.net>
Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
parent a888f891
...@@ -855,8 +855,8 @@ unwrap_integ_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct g ...@@ -855,8 +855,8 @@ unwrap_integ_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct g
goto out; goto out;
if (svc_getnl(&buf->head[0]) != seq) if (svc_getnl(&buf->head[0]) != seq)
goto out; goto out;
/* trim off the mic at the end before returning */ /* trim off the mic and padding at the end before returning */
xdr_buf_trim(buf, mic.len + 4); xdr_buf_trim(buf, round_up_to_quad(mic.len) + 4);
stat = 0; stat = 0;
out: out:
kfree(mic.data); kfree(mic.data);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment