Project

General

Profile

Bug #3389

nfsv3: UDP server sends packets with wrong Source IP in header

Added by Vitaliy Gusev about 8 years ago. Updated about 8 years ago.

Status:
New
Priority:
Normal
Assignee:
Category:
-
Start date:
2012-11-26
Due date:
% Done:

0%

Estimated time:
Difficulty:
Medium
Tags:
needs-triage
Gerrit CR:

Description

If two nfs clients are from different subnetworks and connects to a server via UDP,
one of client (Linux) gets state:

nfs: server 1.1.1.2 not responding, still trying
nfs: server 1.1.1.2 OK
nfs: server 1.1.1.2 not responding, still trying
nfs: server 1.1.1.2 OK
#1

Updated by Vitaliy Gusev about 8 years ago

client1: 1.1.1.1/8
client2: 2.2.2.1/8

server: ip-1: 1.1.1.2/8
ip-2: 2.2.2.2/8

Snoop on client1 shows that server sends wrongs his source address:

snoop -ta -r -d e1000g1 host 1.1.1.2
19:46:22.13538      1.1.1.2 -> 2.2.2.1      RPC R XID=1227480841 Success
19:46:30.50783 1.1.1.2 -> 2.2.2.1 RPC R XID=1984814857 Success
19:46:30.56963 1.1.1.2 -> 2.2.2.1 RPC R XID=2035146505 Success
#2

Updated by Vitaliy Gusev about 8 years ago

kernel stack when sends data to a client:

  ip`ire_send_wire_v4+0x345
  ip`conn_ip_output+0x250
  ip`udp_output_ancillary+0x537 -> ... -> conn_prepend_hdr()
  ip`udp_wput+0x4e4
  unix`putnext+0x21e
  rpcmod`rpcmodwput+0x9b
  rpcmod`rmm_wput+0x1e
  unix`put+0x1aa
  rpcmod`svc_clts_ksend+0x2ac
  rpcmod`svc_sendreply+0x59
  nfssrv`common_dispatch+0x696
  nfssrv`rfs_dispatch+0x2d
  rpcmod`svc_getreq+0x19c
  rpcmod`svc_run+0x16e
  rpcmod`svc_do_run+0x81
  nfs`nfssys+0x765

Also available in: Atom PDF