From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932100AbcGAXOk (ORCPT ); Fri, 1 Jul 2016 19:14:40 -0400 Received: from smtprelay0003.hostedemail.com ([216.40.44.3]:34266 "EHLO smtprelay.hostedemail.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752296AbcGAXOi convert rfc822-to-8bit (ORCPT ); Fri, 1 Jul 2016 19:14:38 -0400 X-Session-Marker: 726F737465647440676F6F646D69732E6F7267 X-Spam-Summary: 2,0,0,,d41d8cd98f00b204,rostedt@goodmis.org,:::::::::::::::::,RULES_HIT:41:152:355:379:541:599:800:960:973:988:989:1260:1277:1311:1313:1314:1345:1359:1434:1437:1513:1515:1516:1518:1521:1535:1544:1593:1594:1605:1711:1730:1747:1777:1792:2198:2199:2393:2553:2559:2562:2689:3138:3139:3140:3141:3142:3622:3865:3866:3867:3868:3870:3871:3872:3873:3874:4117:4250:4321:4605:5007:6117:6119:6248:6261:6996:6997:7875:7903:8777:9038:9164:10004:10848:10967:11232:11233:11473:11658:11914:12114:12296:12517:12519:12555:12740:13255:13870:14181:14196:14659:14721:21080:21325:21433:30003:30012:30034:30054:30060:30064:30070:30075:30090:30091,0,RBL:none,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fn,MSBL:0,DNSBL:none,Custom_rules:0:0:0,LFtime:19,LUA_SUMMARY:none X-HE-Tag: thumb62_7b808c4e81f03 X-Filterd-Recvd-Size: 6206 Date: Fri, 1 Jul 2016 19:14:07 -0400 From: Steven Rostedt To: Trond Myklebust Cc: LKML , Linux NFS Mailing List , "Jeff Layton" , Eric Dumazet , Schumaker Anna , Andrew Morton , Fields Bruce , "Torvalds Linus" Subject: Re: Revert: SUNRPC: xs_sock_mark_closed() does not need to trigger socket autoclose Message-ID: <20160701191407.795361d5@gandalf.local.home> In-Reply-To: <0A51DE9E-81B2-474A-BA07-55C3BE19629A@primarydata.com> References: <20160701172401.3ba89015@gandalf.local.home> <0A51DE9E-81B2-474A-BA07-55C3BE19629A@primarydata.com> X-Mailer: Claws Mail 3.13.2 (GTK+ 2.24.30; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 1 Jul 2016 22:34:02 +0000 Trond Myklebust wrote: > > On Jul 1, 2016, at 17:24, Steven Rostedt wrote: > > > > A while back, rkhunter reported a "hidden port" on my main server, > > making me nervous that I had been hacked. Doing lots of debugging, I > > found that it was happening from xprt code in NFS. I found a way to > > trigger the bug, which happened because my wife's machine was NFS > > mounting a directory of my main server. She does this to upload her > > photos quickly to gallery2. > > > > "Warning: Hidden ports found: > > Port number: TCP:871" > > > > A hidden port is one that has no socket connected to it. That is, it's > > a dead resource. Nothing can ever use that port. It's not something > > that is "reserved", it's just a leaked bit of info. rkhunter treats > > this as a possible root kit attack. [ missed this part when replying last time ] > > No, it’s not leaked at all; it is still being tracked by the RPC layer. How so? I watched on wireshark and the port is closed (FIN/ACK are sent, and I watch it go in "netstat -tapn" from ESTABLISHED to TIME_WAIT to nothing at all), and then it is never reused. I kicked off lots of copies to and from that mounted directory, and that port never shows up. > > Furthermore, you haven’t unmounted the NFS partition, so it is a port > that can and SHOULD, according to the NFSv3 rules be reused by the > same NFS client when it reconnects. It uses another port. Maybe I missed saying that. But there's two ports that show up. Not to mention, when I unmount that port still exists as unhidden. It's not till I remount it that the port goes away until it goes into it times out again. > The server attaches a duplicate > reply cache to the source IP address and port number and expects RPC > calls that were lost by the server to be replayed through the same IP > address and port number. > Is this what is expected? [ from Wife's machine ] # mount /upload [ from my server ] # netstat -tapn | grep '192.168.23.22' tcp 0 0 192.168.23.9:931 192.168.23.22:42546 ESTABLISHED - tcp 0 0 192.168.23.9:2049 192.168.23.22:879 ESTABLISHED - # while :; do if ! netstat -tapn |grep :931; then break; fi; sleep 1; done; netstat -tapn | grep '192.168.23.22' tcp 0 0 192.168.23.9:931 192.168.23.22:42546 ESTABLISHED - tcp 0 0 192.168.23.9:931 192.168.23.22:42546 ESTABLISHED - tcp 0 0 192.168.23.9:931 192.168.23.22:42546 ESTABLISHED - tcp 0 0 192.168.23.9:931 192.168.23.22:42546 ESTABLISHED - tcp 0 0 192.168.23.9:931 192.168.23.22:42546 ESTABLISHED - [...] tcp 0 0 192.168.23.9:931 192.168.23.22:42546 ESTABLISHED - tcp 0 0 192.168.23.9:931 192.168.23.22:42546 ESTABLISHED - tcp 0 0 192.168.23.9:931 192.168.23.22:42546 ESTABLISHED - tcp 0 0 192.168.23.9:931 192.168.23.22:42546 ESTABLISHED - tcp 0 0 192.168.23.9:931 192.168.23.22:42546 TIME_WAIT - tcp 0 0 192.168.23.9:931 192.168.23.22:42546 TIME_WAIT - tcp 0 0 192.168.23.9:931 192.168.23.22:42546 TIME_WAIT - tcp 0 0 192.168.23.9:931 192.168.23.22:42546 TIME_WAIT - [...] tcp 0 0 192.168.23.9:931 192.168.23.22:42546 TIME_WAIT - tcp 0 0 192.168.23.9:931 192.168.23.22:42546 TIME_WAIT - tcp 0 0 192.168.23.9:931 192.168.23.22:42546 TIME_WAIT - # netstat -tapn | grep '192.168.23.22' tcp 0 0 192.168.23.9:2049 192.168.23.22:879 ESTABLISHED - At this point port 931 is hidden and never shows up again. All connection (according to wireshark) goes through port 2049 from this point on. I unmount, and the port is still hidden, but if I remount, the port goes away and another two ports are connect (2049 along with another one) [ form Wife's machine ] # umount /upload # mount /upload [ from my server ] # netstat -tapn | grep '192.168.23.22' tcp 0 0 192.168.23.9:2049 192.168.23.22:859 ESTABLISHED - tcp 0 0 192.168.23.9:975 192.168.23.22:39281 ESTABLISHED - Is this expected? -- Steve