Do not fence connections without valid greeting. (replaces #190)

kmod/src/net.c

@@ -1278,6 +1278,17 @@ static void scoutfs_net_reconn_free_worker(struct work_struct *work)
 			set_conn_fl(acc, reconn_freeing);
 			spin_unlock(&conn->lock);
 			if (!test_conn_fl(conn, shutting_down)) {
+				/*
+				 * If we haven't seen a vg for this connection, don't bother fencing
+				 * it - instead just drop it. If this was a real client, it will try
+				 * again to connect.
+				 */
+				if (!test_conn_fl(acc, valid_greeting)) {
+					/* delete the conn */
+					list_del_init(&acc->accepted_head);
+					goto restart;
+				}
+
 				scoutfs_info(sb, "client "SIN_FMT" reconnect timed out, fencing",
 					     SIN_ARG(&acc->last_peername));
 				ret = scoutfs_fence_start(sb, acc->rid,

tests/golden/portscan

@@ -0,0 +1,7 @@
+== empty packets
+Ncat: Connection refused.
+Ncat: Connection refused.
+== find portscan in connections
+
+== find portscan in connections
+

tests/sequence

@@ -57,4 +57,5 @@ archive-light-cycle.sh
 block-stale-reads.sh
 inode-deletion.sh
 renameat2-noreplace.sh
+portscan.sh
 xfstests.sh

tests/tests/portscan.sh

@@ -0,0 +1,24 @@
+#
+# portscan tests - assure malformed packets do not cause issues
+#
+
+t_require_commands scoutfs nc
+
+echo "== empty packets"
+sleep 1
+echo "    " | nc -p 33033 127.0.0.1 42000
+echo "    " | nc -p 33133 127.0.0.1 42001
+echo "    " | nc -p 33233 127.0.0.1 42002
+
+echo "== find portscan in connections"
+L=$(grep 'peer 127.0.0.1:33.33' /sys/kernel/debug/scoutfs/*/connections)
+echo $L
+
+# wait for fencing timeout (20s)
+sleep 30
+
+echo "== find portscan in connections"
+L=$(grep 'peer 127.0.0.1:33.33' /sys/kernel/debug/scoutfs/*/connections)
+echo $L
+
+t_pass