Kirk McKusick 96438eb911 The code checks each fragment mark to see if it's valid; if the fragment ... is less than NFS_MINPACKET or greater than NFS_MAXPACKET in size, it barfs and, I think, drops the connection. However, there's no guarantee that in a multi-fragment RPC, all the fragments will be at least as large as NFS_MINPACKET. In fact, with the version of "tclnfs" we have here, which supports NFS over TCP, at least when built under SunOS 4.1.3 (i.e., with 4.1.3's user-mode ONC RPC library), I can *repeatably* cause "tclnfs" to send a request with more than one fragment, one of which is only 8 bytes long. I just do a 3877-byte write to a file, at an offset of 0. The check that "slp->ns_reclen" is greater than or equal to NFS_MINPACKET serves no useful purpose - if the NFS server code can't handle packets < NFS_MINPACKET bytes, it can't handle them over *any* protocol, so the check has to be done above the RPC-over-TCP layer - and should be removed. Obtained from: Fix from Guy Harris, forwarded by Rick Macklem.		1998-09-29 22:33:05 +00:00
..
nfs_serv.c
nfs_srvcache.c
nfs_srvsock.c	The code checks each fragment mark to see if it's valid; if the fragment	1998-09-29 22:33:05 +00:00
nfs_srvsubs.c
nfs_syscalls.c
nfs.h
nfsm_subs.h
nfsproto.h
nfsrvcache.h
nfsrvstats.h