Re: NFS/credentials leak in 2.6.29-rc1

["J. Bruce Fields" <bfields@fieldses.org>]

On Thu, Jan 22, 2009 at 01:46:59AM +0300, Evgeniy Polyakov wrote:
> On Wed, Jan 21, 2009 at 05:39:19PM -0500, J. Bruce Fields (bfields@fieldses.org) wrote:
> > > I got following fun tcpdump and failed mount (it stuck, but can be interrupted):
> > 
> > I'm really bad at reading tcpdump.  Where's the problem here?  It looks
> > like every call gets a reply.
> 
> Port fields are fun
> 
> > > 15:34:41.253911 IP addr1.1835336279 > addr2.2049: 44 null
>                              ^^^^^^^^^^   vs    ^^^^
> 
> It is likely copied skb corruption, ports change, but acks correspond
> sometimes.

Obviously it's normal that the client- and server- side ports would
differ, so I assume you meant to point out the variation in the client
port number?  (1835336279, 728, 1852113495, 1868890711, 1885667927).

--b.

> 
> > > 15:34:41.253916 IP addr2.2049 > addr1.728: . ack 44 win 88 <nop,nop,timestamp 125462 37402358>
> > > 15:34:41.254103 IP addr2.2049 > addr1.1835336279: reply ok 28 null
> > > 15:34:41.254229 IP addr1.728 > addr2.2049: . ack 29 win 89 <nop,nop,timestamp 37402358 125463>
> > > 15:34:41.254238 IP addr1.1852113495 > addr2.2049: 44 null
> > > 15:34:41.254271 IP addr2.2049 > addr1.1852113495: reply ok 28 null
> > > 15:34:41.254378 IP addr1.1868890711 > addr2.2049: 100 fsinfo [|nfs]
> > > 15:34:41.254411 IP addr2.2049 > addr1.1868890711: reply ok 36 fsinfo [|nfs]
> > > 15:34:41.254528 IP addr1.1885667927 > addr2.2049: 100 fsinfo [|nfs]
> > > 15:34:41.254555 IP addr2.2049 > addr1.1885667927: reply ok 36 fsinfo [|nfs]
> 
> -- 
> 	Evgeniy Polyakov