d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nfsd: Do not exempt NFSv3 Fsinfo from the TLS check

Browse Source 
The Fsinfo RPC is exempt from the check for
Kerberized NFS being required, as recommended
by RFC2623.  However, there is no reason to
exempt Fsinfo from the requirement to use TLS.

This patch fixes the code so that the exemption
only applies to Kerberized NFS and not
NFS-over-TLS.

This only affects NFS-over-TLS for an NFSv3
mount when it is required, but the client does
not do so.

MFC after:	1 month
This commit is contained in:
Rick Macklem 2022-03-09 16:52:42 -08:00
parent 67e751f167
commit 3fc3fe9091
1 changed files with 14 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
sys/fs/nfsserver/nfs_nfsdport.c
View File

@ -4051,16 +4051,11 @@ nfsvno_testexp(struct nfsrv_descript *nd, struct nfsexstuff *exp)
{
int i;
/*
* Allow NFSv3 Fsinfo per RFC2623.
*/
if (((nd->nd_flag & ND_NFSV4) != 0 ||
nd->nd_procnum != NFSPROC_FSINFO) &&
((NFSVNO_EXTLS(exp) && (nd->nd_flag & ND_TLS) == 0) ||
(NFSVNO_EXTLSCERT(exp) &&
(nd->nd_flag & ND_TLSCERT) == 0) ||
(NFSVNO_EXTLSCERTUSER(exp) &&
(nd->nd_flag & ND_TLSCERTUSER) == 0))) {
if ((NFSVNO_EXTLS(exp) && (nd->nd_flag & ND_TLS) == 0) ||
(NFSVNO_EXTLSCERT(exp) &&
(nd->nd_flag & ND_TLSCERT) == 0) ||
(NFSVNO_EXTLSCERTUSER(exp) &&
(nd->nd_flag & ND_TLSCERTUSER) == 0)) {
if ((nd->nd_flag & ND_NFSV4) != 0)
return (NFSERR_WRONGSEC);
#ifdef notnow
@ -4074,6 +4069,13 @@ nfsvno_testexp(struct nfsrv_descript *nd, struct nfsexstuff *exp)
return (NFSERR_AUTHERR | AUTH_TOOWEAK);
}
/*
* RFC2623 suggests that the NFSv3 Fsinfo RPC be allowed to use
* AUTH_NONE or AUTH_SYS for file systems requiring RPCSEC_GSS.
*/
if ((nd->nd_flag & ND_NFSV3) != 0 && nd->nd_procnum == NFSPROC_FSINFO)
return (0);
/*
* This seems odd, but allow the case where the security flavor
* list is empty. This happens when NFSv4 is traversing non-exported
@ -6936,18 +6938,15 @@ nfsm_trimtrailing(struct nfsrv_descript *nd, struct mbuf *mb, char *bpos,
* Check to see if a put file handle operation should test for
* NFSERR_WRONGSEC, although NFSv3 actually returns NFSERR_AUTHERR.
* When Open is the next operation, NFSERR_WRONGSEC cannot be
* replied for the Open cases that use a component. Thia can
* replied for the Open cases that use a component. This can
* be identified by the fact that the file handle's type is VDIR.
*/
bool
nfsrv_checkwrongsec(struct nfsrv_descript *nd, int nextop, enum vtype vtyp)
{
if ((nd->nd_flag & ND_NFSV4) == 0) {
if (nd->nd_procnum == NFSPROC_FSINFO)
return (false);
if ((nd->nd_flag & ND_NFSV4) == 0)
return (true);
}
if ((nd->nd_flag & ND_LASTOP) != 0)
return (false);