Re: [RFC] i_generation numbers.

Neil Brown (neilb@cse.unsw.edu.au)
Tue, 21 Sep 1999 10:07:04 +1000 (EST)

On Monday September 20, gam3@ixlabs.com wrote:
> > A reasonable simple "lazy" way to do this in ext2fs would be something
> > like:
> >
> > if (!inode->i_generation)
> > inode->i_generation = net_random()|1;
> > else while (! ++inode->i_generation);
> > which sets it randomly (but non zero) the first time, and then
> > increments skipping 0.
>
> Here is an attack of the above system.
>
> 1. Open a few thousand files.
>
> 2. Save the the filehandles for each of these files.
>
> 3. delete all the the files created above.
>
> 4. Incriment the the generation number in each of the
> saved filehandle.
>
> 5. Try to read files using the above filehandles. If this
> does not give you ESTALE you have opened a file that
> someone else created.
>
> Also 2^32 is not a very big number. It would be nice to be able
> to tell the difference between a stale filehandle and an attack.
>
> ---------------------------------
> G. Allen Morris III

But who is our attacker?
If they have sufficient control of an IP address that they can fake up
NFS requests from that IP address, and if that IP address is trusted
by knfsd, then they had better be a good friend. Otherwise they can
simple mount the root of the filesystem (mountd trusts the same IP's
that knfsd trusts) and walk around the filetree changing their
AUTH_UNIX identity as required.

Given that linux knfsd only allows requests from known IP addresses, I
don't think randomness in the filehandle actually is needed at all
(this only fully occured to me after I sent my previous message).

The value of randomness (and fsirand) was for other NFS servers which
rely on mountd to do all authentication, and will accept NFS requests
from any IP address providing that the filehandle is valid.

The only filehandles that are not directly available to an authorised
client are handles for files inside directories for which x access has
been squashed (with root_squash or all_squash), and you have put code
in to (mostly) check for that.

So my new suggestion is : Don't bother with random file handles, it
doesn't add anything.

NeilBrown

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/