Re: [rpcbind PATCH 0/6] rpcbind: various hardening fixes

[Steve Dickson <steved@redhat.com>]

On 9/3/26 1:42 PM, Scott Mayhew wrote:
> Various hardening fixes for rpcbind.  Many of these are related to
> CALLIT/BCAST/INDIRECT processing, which in theory should be disabled
> when --enable-rmtcalls was not passed to the configure script, except
> currently that only prevents the forwarding port from being created.
> Patch 3/6 addresses this by completely disabling remote call
> functionality when --enable-rmtcalls is unset.
> 
> Scott Mayhew (6):
>    rpcbind: only log failures in check_callit() if connection logging is
>      enabled
>    rpcbind: bound stats lists in rpcbs_getaddr() and rpcbs_rmtcall()
>    rpcbind: fully disable remote calls when --enable-rmtcalls is unset
>    rpcbind: restrict RPCBPROC_GETSTAT to loopback callers
>    rpcbind: check for null netmask in addrmerge()
>    rpcbind: only free the forward slot if the reply xid matched the
>      request xid
> 
>   src/pmap_svc.c     |  2 ++
>   src/rpcb_stat.c    | 37 ++++++++++++++++++++++++++++++++++---
>   src/rpcb_svc.c     |  2 ++
>   src/rpcb_svc_4.c   |  2 ++
>   src/rpcb_svc_com.c | 24 ++++++++++++++++++++----
>   src/rpcbind.h      |  5 +++++
>   src/security.c     | 16 +++++++++++-----
>   src/util.c         |  3 ++-
>   8 files changed, 78 insertions(+), 13 deletions(-)
> 
Committed... (tag: rpcbind-1_2_9-rc3)

steved.