Very Computer

Quote:>Unfortunately, changes in routing can happen dynamically and may change
>which interface packets are coming from,
>We need a real solution.

        if (connect(fsock, (struct sockaddr *) &server_addr,
            sizeof (server_addr)) < 0) {
                perror("nfs connect");
                goto fail;
        }

Note, that this change will make the mount program incompatible with
older kernels or kernels without the patch below. You could test for
the kernel release with some code like this:

  uname(&my_utsname)
  if (strcmp(my_utsname.release, "1.1.83") < 0)
    {
        /* code with connect() */
    }
  else
    {
        /* code without connect() */
    }

Unfortunately, you have to do this yourself, since Linus refused to
put in the patch below into the official kernel, so there is no
definite release which could go into the mount program to keep it
compatible. Perhaps you (Yes, I mean _YOU_) can convince Linus, that
this patch is no security hole (perhaps we can add an option to the
mount program, which will connect() the socket regardless of the
kernel revision for security).

Greetings, Swen

Here's the patch. Apply with "cd /usr/src; patch -p < whateveryounamedit"

diff -u -r linux.orig/fs/nfs/inode.c linux/fs/nfs/inode.c
--- linux.orig/fs/nfs/inode.c   Tue Jan 10 16:02:18 1995

        server->acdirmin = data->acdirmin*HZ;
        server->acdirmax = data->acdirmax*HZ;
        strcpy(server->hostname, data->hostname);
+       memcpy(&server->addr, &data->addr, sizeof(struct sockaddr_in));
        sb->u.nfs_sb.s_root = data->root;
        unlock_super(sb);
        if (!(sb->s_mounted = nfs_fhget(sb, &data->root, NULL))) {
diff -u -r linux.orig/fs/nfs/sock.c linux/fs/nfs/sock.c
--- linux.orig/fs/nfs/sock.c    Thu Jan  5 12:55:40 1995

        fs = get_fs();
        set_fs(get_ds());
        for (n = 0, timeout = init_timeout; ; n++, timeout <<= 1) {
-               result = sock->ops->send(sock, (void *) start, len, 0, 0);
+               result = sock->ops->sendto(sock, (void *) start, len, 0, 0, (struct sockaddr *)&server->addr, sizeof(server->addr));
                if (result < 0) {
                        printk("nfs_rpc_call: send error = %d\n", result);

                 * we don't now need, so discard it */
                result = sock->ops->recvfrom(sock, (void *)&recv_xid,
                                             sizeof(recv_xid), 1, MSG_PEEK,
-                                            NULL, &addrlen);
+                                            NULL, NULL);
                if (result < 0) {
                        if (result == -EAGAIN) {

                 * a null buffer yet. */
                (void)sock->ops->recvfrom(sock, (void *)&recv_xid,
                                          sizeof(recv_xid), 1, 0, NULL,
-                                         &addrlen);
+                                         NULL);
 #if 0
                printk("nfs_rpc_call: XID mismatch\n");

         *
         */
        result=sock->ops->recvfrom(sock, (void *)start,
-                                 size + 1024, 1, 0, NULL,
+                                 size + 1024, 1, 0, (struct sockaddr *)&server->addr,
                        /* Here is NFS_SLACK_SPACE..., hack */
                                  &addrlen);
        if (result < 0) {
diff -u -r linux.orig/include/linux/nfs_fs_sb.h linux/include/linux/nfs_fs_sb.h
--- linux.orig/include/linux/nfs_fs_sb.h        Wed Dec  1 13:44:15 1993

 #define _NFS_FS_SB

 #include <linux/nfs.h>
+#include <linux/in.h>

 struct nfs_server {

        int acdirmin;
        int acdirmax;
        char hostname[256];
+       struct sockaddr_in addr;
 };

 /*

 -------------------------------------------------------------------------
| Steve McIntyre            \<a href="http://club.eng.cam.ac.uk/~93sam/"> |

| Room 47C, Churchill College,\ Tongue-tied and twisted,                  |
| Cambridge, England CB3 0DS   \ Just an earth-bound misfit, I" (c) PF    |
| ^^ CURS Secretary 1994/95 ^^  \ ** CUWoCS: Honorary Vice-Chair-Thing ** |
 -------------------------------------------------------------------------