From 6cbb7d9d57e5f7e0090b538c92b3eafe9c2656b0 Mon Sep 17 00:00:00 2001
From: Mark Vitale <mvitale@sinenomine.net>
Date: Fri, 6 Jul 2018 03:21:26 -0400
Subject: [PATCH] OPENAFS-SA-2018-003 volser: prevent unbounded input to
 various AFSVol* RPCs

Several AFSVol* RPCs are defined with an unbounded XDR "string" as
input.

RPCs with unbounded arrays as inputs are susceptible to remote
denial-of-service (DOS) attacks.  A malicious client may submit an
AFSVol* request with an arbitrarily large string, forcing the volserver
to expend large amounts of network bandwidth, cpu cycles, and heap
memory to unmarshal the input.

Instead, give each input "string" an appropriate size.
Volume names are inherently capped to 32 octets (including trailing NUL)
by the protocol, but there is less clearly a hard limit on partition names.
The Vol_PartitionInfo{,64} functions accept a partition name as input and
also return a partition name in the output structure; the output values
have wire-protocol limits, so larger values could not be retrieved by clients,
but for denial-of-service purposes, a more generic PATH_MAX-like value seems
appropriate.  We have several varying sources of such a limit in the tree, but
pick 4k as the least-restrictive.

[kaduk@mit.edu: use a larger limit for pathnames and expand on PATH_MAX in
commit message]

(cherry picked from commit 8b92d015ccdfcb70c7acfc38e330a0475a1fbe28)

(cherry picked from commit fe41fa565be6e325da75f3e9b8fbdac2c521b027)

(cherry picked from commit 39b675e243be70237ba9460b49b461c128aedffd)

Change-Id: Idad0b0abf582b356042245398e1317a610ff321e
---
 src/volser/volint.xg | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/volser/volint.xg b/src/volser/volint.xg
index 0fdb9edf26..8c48da36b4 100644
--- a/src/volser/volint.xg
+++ b/src/volser/volint.xg
@@ -256,7 +256,7 @@ typedef  volintXInfo volXEntries<>;
 
 proc CreateVolume(
   IN afs_int32 partition,
-  string name<>,
+  string name<VNAMESIZE>,
   IN afs_int32 type,
   IN afs_uint32 parent,
   INOUT afs_uint32 *volid,
@@ -290,7 +290,7 @@ proc Clone(
   IN afs_int32 trans,
   IN afs_uint32 purgeVol,
   IN afs_int32 newType,
-  IN string newName<>,
+  IN string newName<VNAMESIZE>,
   INOUT afs_uint32 *newVol
 ) = VOLCLONE;
 
@@ -338,7 +338,7 @@ proc GetStatus(
 ) = VOLGETSTATUS;
 
 proc SignalRestore(
-  IN string name<>,
+  IN string name<VNAMESIZE>,
   int type,
   afs_uint32 pid,
   afs_uint32 cloneid
@@ -356,7 +356,7 @@ proc ListVolumes(
 
 proc SetIdsTypes(
   IN afs_int32 tId,
-  string name<>,
+  string name<VNAMESIZE>,
   afs_int32 type,
   afs_uint32 pId,
   afs_uint32 cloneId,
@@ -368,7 +368,7 @@ proc Monitor(
 ) = VOLMONITOR;
 
 proc PartitionInfo(
-  IN string name<>,
+  IN string name<4096>,
   OUT struct diskPartition *partition
 ) = VOLDISKPART;
 
@@ -441,7 +441,7 @@ proc DumpV2(
 ) split = VOLDUMPV2;
 
 proc PartitionInfo64(
-    IN string name<>,
+    IN string name<4096>,
     OUT struct diskPartition64 *partition
 ) = VOLDISKPART64;