OpenAFS Master Repository branch, openafs-stable-1_6_x, updated. openafs-stable-1_6_22_2-73-g0cdb370

[Gerrit Code Review]

The following commit has been merged in the openafs-stable-1_6_x branch:
commit 38f401ae7e0e88fb65b651125a2c8a723db1e071
Author: Mark Vitale <mvitale@sinenomine.net>
Date:   Thu Jul 5 21:11:30 2018 -0400

    OPENAFS-SA-2018-003 vlserver: prevent unbounded input to VL_RegisterAddrs
    
    VL_RegisterAddrs is defined with an input argument of type bulkaddrs,
    which is defined to XDR as an unbounded array of afs_uint32 (IPv4 addresses):
      typedef afs_uint32 bulkaddrs<>
    
    The <> with no value instructs rxgen to build client and server stubs
    that allow for a maximum size of "~0u" or 0xFFFFFFFF.
    
    Ostensibly the bulkaddrs array is unbounded to allow it to be shared
    among VL_RegisterAddrs, VL_GetAddrs, and VL_GetAddrsU.  The VL_GetAddrs*
    RPCs use bulkaddrs as an output array with a maximum size of MAXSERVERID
    (254). VL_RegisterAddrss uses bulkaddrs as an input array, with a
    nominal size of VL_MAXIPADDRS_PERMH (16).
    
    However, RPCs with unbounded array inputs are susceptible to remote
    denial-of-service attacks.  That is, a malicious client may send a
    VL_RegisterAddrs request with an arbitrarily long array, forcing the
    vlserver to expend large amounts of network bandwidth, cpu cycles, and
    heap memory to unmarshal the argument.  Even though VL_RegisterAddrs
    requires superuser authorization, this attack is exploitable by
    non-authorized actors because XDR unmarshalling happens long before any
    authorization checks can occur.
    
    Because all uses of the type that our implementation support have fixed
    bounds on valid data (whether input or output), apply an arbitrary
    implementation limit (larger than any valid structure would be), to
    prevent this class of attacks in the XDR decoder.
    
    [kaduk@mit.edu: limit the bulkaddrs type instead of introducing a new type]
    
    (cherry picked from commit 7629209219bbea3f127b33be06ac427ebc3a559e)
    
    (cherry picked from commit 4218dc0a2db75c740d1d31966e672f85ad7999bd)
    
    Change-Id: Ic3112ebe13cf3550dce03537670896457e00b3b9

 src/vlserver/vldbint.xg |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletions(-)

-- 
OpenAFS Master Repository