d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nfsserver: Fix handling of SP4_NONE

Browse Source 
For NFSv4.1/4.2, when the client specifies SP4_NONE for
state protection in the ExchangeID operation arguments,
the server MUST allow the state management operations for
any user credentials.  (I misread the RFC and thought that
SP4_NONE meant "at the server's discression" and not MUST
be allowed.)

This means that the "sec=XXX" field of the "V4:" exports(5)
line only applies to NFSv4.0.

This patch fixes the server to always allow state management
operations for SP4_NONE, which is the only state management
option currently supported. (I have patches that add support
for SP4_MACH_CRED to the server. These will be in a future commit.)

In practice, this bug does not seem to have caused
interoperability problems.

MFC after:	2 weeks
This commit is contained in:
Rick Macklem 2023-01-15 14:07:40 -08:00
parent f97a19ecb9
commit 5a0050e68a
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/fs/nfsserver/nfs_nfsdstate.c
View File

@ -5867,12 +5867,17 @@ nfsrv_throwawayopens(NFSPROC_T *p)
/*
* This function checks to see if the credentials are the same.
* Returns 1 for not same, 0 otherwise.
* The check for same credentials is needed for state management operations
* for NFSv4.0 where 1 is returned if not same, 0 is returned otherwise.
*/
static int
nfsrv_notsamecredname(struct nfsrv_descript *nd, struct nfsclient *clp)
{
/* For NFSv4.1/4.2, SP4_NONE always allows this. */
if ((nd->nd_flag & ND_NFSV41) != 0)
return (0);
if (nd->nd_flag & ND_GSS) {
if (!(clp->lc_flags & LCL_GSS))
return (1);

8
sys/fs/nfsserver/nfs_nfsdsubs.c
View File

@ -2121,6 +2121,14 @@ nfsd_checkrootexp(struct nfsrv_descript *nd)
if (nfs_rootfhset == 0)
return (NFSERR_AUTHERR | AUTH_FAILED);
/*
* For NFSv4.1/4.2, if the client specifies SP4_NONE, then these
* operations are allowed regardless of the value of the "sec=XXX"
* field in the V4: exports line.
* As such, these Kerberos checks only apply to NFSv4.0 mounts.
*/
if ((nd->nd_flag & ND_NFSV41) != 0)
goto checktls;
if ((nd->nd_flag & (ND_GSS | ND_EXAUTHSYS)) == ND_EXAUTHSYS)
goto checktls;
if ((nd->nd_flag & (ND_GSSINTEGRITY | ND_EXGSSINTEGRITY)) ==