[rpcbind PATCH 6/6] rpcbind: only free the forward slot if the reply xid matched the request xid

[Scott Mayhew <smayhew@redhat.com>]

If remote calls are enabled and if the ephemeral forwarding ports are
exposed, it's possible to spoof replies to forwarded requests using a
bogus xid, causing the forward slots to be freed and potentially
interfering with sending replies to legitimate remote call requesters.

Only free the forward slot in handle_reply() if the reply xid matched
the original request xid.

Signed-off-by: Scott Mayhew <smayhew@redhat.com>
---
 src/rpcb_svc_com.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/rpcb_svc_com.c b/src/rpcb_svc_com.c
index 0763fc4..2c007eb 100644
--- a/src/rpcb_svc_com.c
+++ b/src/rpcb_svc_com.c
@@ -1196,6 +1196,7 @@ handle_reply(int fd, SVCXPRT *xprt)
 	struct r_rmtcall_args a;
 	struct sockaddr_storage ss;
 	socklen_t fromlen;
+	bool_t matched_xid = FALSE;
 
 	buffer = malloc(RPC_BUF_MAX);
 	if (buffer == NULL)
@@ -1234,6 +1235,7 @@ handle_reply(int fd, SVCXPRT *xprt)
 	if (fi == NULL) {
 		goto done;
 	}
+	matched_xid = TRUE;
 	_seterr_reply(&reply_msg, &reply_error);
 	if (reply_error.re_status != RPC_SUCCESS) {
 		if (debugging)
@@ -1271,7 +1273,8 @@ done:
 		xlog(LOG_DEBUG, "handle_reply:  NULL xid on exit!\n");
 	}
 #endif
-	} else
+	}
+	if (matched_xid == TRUE)
 		(void) free_slot_by_xid(reply_msg.rm_xid);
 	return;
 }
-- 
2.55.0