• J. Bruce Fields's avatar
    nfsd4: catch some false session retries · 53da6a53
    J. Bruce Fields authored
    The spec allows us to return NFS4ERR_SEQ_FALSE_RETRY if we notice that
    the client is making a call that matches a previous (slot, seqid) pair
    but that *isn't* actually a replay, because some detail of the call
    doesn't actually match the previous one.
    
    Catching every such case is difficult, but we may as well catch a few
    easy ones.  This also handles the case described in the previous patch,
    in a different way.
    
    The spec does however require us to catch the case where the difference
    is in the rpc credentials.  This prevents somebody from snooping another
    user's replies by fabricating retries.
    
    (But the practical value of the attack is limited by the fact that the
    replies with the most sensitive data are READ replies, which are not
    normally cached.)
    Tested-by: default avatarOlga Kornievskaia <aglo@umich.edu>
    Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
    53da6a53
state.h 22.6 KB