From nobody Thu Mar 10 00:54:17 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 6536819F8B8E; Thu, 10 Mar 2022 00:54:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4KDVvF2NQsz4pB2; Thu, 10 Mar 2022 00:54:17 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1646873657; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=F6cJRWqMAleENl0i6Nrx1yqDd0/QQEn8Iva5ztEVajA=; b=G1trHC0IG/BpG36qd9xayO4KdkrZ/yrlJ8+BO7M2jeHHkI0QYU6kT4mAAIoM+OyYpMtA0o PEeDUOtaLvp1uXbcShp0kHEfwlrhfKwaIkQ+gjPYG6asJuKyDaS/nZ19oUu9C9QgXo/GsN nX4FK3dRpV7eG6v5Ve1K+QGpBdLN6wVLitVE0X37LE39Bfe0lmxyHe06s0wo2IdF3qlAKo xkP2xspguxGmfHD/wey+KM/U2dlRtMZOe9/4qRrAcRJmJ/F9ger3ZJ2KkR3Np589vZEju9 6pK7OWJhwvPhNqtklGFbX4B0eiliZW5MA2n9iuwLW+o33t0AK+ssWAipiW7ztA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 318EF1B3E3; Thu, 10 Mar 2022 00:54:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 22A0sHcm086700; Thu, 10 Mar 2022 00:54:17 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 22A0sHCt086699; Thu, 10 Mar 2022 00:54:17 GMT (envelope-from git) Date: Thu, 10 Mar 2022 00:54:17 GMT Message-Id: <202203100054.22A0sHCt086699@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Rick Macklem Subject: git: 3fc3fe90915f - main - nfsd: Do not exempt NFSv3 Fsinfo from the TLS check List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rmacklem X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 3fc3fe90915f02e25b4f1d5070e8e01e465e873d Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1646873657; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=F6cJRWqMAleENl0i6Nrx1yqDd0/QQEn8Iva5ztEVajA=; b=L/4IIp3jQ723WEXRQ0b/S6hsVC8pu97eakyhQiJjsl9QiC73zTNKb+MhkTjYVtqiktX0Y9 GgSbCZbpQFDnPQ4vqcPa2Sn/kBhvEEvs2yi5boRVw7Rc/p5VYKtFUf5Iy3bQfg7cbrv8Ff QZaGDC7gwX/sQNAkuzuvnnd6Glpyj1FkXTcNA7FZKT947sGa1PaupsSZCAgTL75W44Gf+6 b2NCxVB2G0xjxcZBa74las/7ItwMwdH6q2apwNNja8KHyW+xuq80vUV6g9XYYqaJlVClCK EXxyuGeKHt0iT/slryRRhs4v2K8M0D87ntxAzUgaDuqdrVb0FHQwkxzDnvxoAg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1646873657; a=rsa-sha256; cv=none; b=yt1WMhbh3RC9X++fRBq/DX41w4V95I1SK0wAnNNX1L9t8UEkWry/2e17RiEeSg+c1Rwc4d R3p5+TG2vpJusV5UOs9zyxLET2MlP5aWDhLVNT9hzMrIpExuF1wplVB1grC2K9Wh7lyySp t0srQ0JKIpq3NcI319KlEOXUGRlUMA/xRuKuTZWnKbkDNYGamLdpsb5UubehBs19/NevsD m2OjqozTMqcC7BVsFF7767504u8rOJXPCJn0koxwfDgbLlM+r3tSFaBH8FNrwKYN4e0N2e LLJC4xrO/YprTiZbjgdWxjwpGP4V0DSg8s79joNS9SMGqsL4nVByP4hZsqINaA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=3fc3fe90915f02e25b4f1d5070e8e01e465e873d commit 3fc3fe90915f02e25b4f1d5070e8e01e465e873d Author: Rick Macklem AuthorDate: 2022-03-10 00:52:42 +0000 Commit: Rick Macklem CommitDate: 2022-03-10 00:52:42 +0000 nfsd: Do not exempt NFSv3 Fsinfo from the TLS check The Fsinfo RPC is exempt from the check for Kerberized NFS being required, as recommended by RFC2623. However, there is no reason to exempt Fsinfo from the requirement to use TLS. This patch fixes the code so that the exemption only applies to Kerberized NFS and not NFS-over-TLS. This only affects NFS-over-TLS for an NFSv3 mount when it is required, but the client does not do so. MFC after: 1 month --- sys/fs/nfsserver/nfs_nfsdport.c | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) diff --git a/sys/fs/nfsserver/nfs_nfsdport.c b/sys/fs/nfsserver/nfs_nfsdport.c index 8afcc9400f95..03f299ff0a10 100644 --- a/sys/fs/nfsserver/nfs_nfsdport.c +++ b/sys/fs/nfsserver/nfs_nfsdport.c @@ -4051,16 +4051,11 @@ nfsvno_testexp(struct nfsrv_descript *nd, struct nfsexstuff *exp) { int i; - /* - * Allow NFSv3 Fsinfo per RFC2623. - */ - if (((nd->nd_flag & ND_NFSV4) != 0 || - nd->nd_procnum != NFSPROC_FSINFO) && - ((NFSVNO_EXTLS(exp) && (nd->nd_flag & ND_TLS) == 0) || - (NFSVNO_EXTLSCERT(exp) && - (nd->nd_flag & ND_TLSCERT) == 0) || - (NFSVNO_EXTLSCERTUSER(exp) && - (nd->nd_flag & ND_TLSCERTUSER) == 0))) { + if ((NFSVNO_EXTLS(exp) && (nd->nd_flag & ND_TLS) == 0) || + (NFSVNO_EXTLSCERT(exp) && + (nd->nd_flag & ND_TLSCERT) == 0) || + (NFSVNO_EXTLSCERTUSER(exp) && + (nd->nd_flag & ND_TLSCERTUSER) == 0)) { if ((nd->nd_flag & ND_NFSV4) != 0) return (NFSERR_WRONGSEC); #ifdef notnow @@ -4074,6 +4069,13 @@ nfsvno_testexp(struct nfsrv_descript *nd, struct nfsexstuff *exp) return (NFSERR_AUTHERR | AUTH_TOOWEAK); } + /* + * RFC2623 suggests that the NFSv3 Fsinfo RPC be allowed to use + * AUTH_NONE or AUTH_SYS for file systems requiring RPCSEC_GSS. + */ + if ((nd->nd_flag & ND_NFSV3) != 0 && nd->nd_procnum == NFSPROC_FSINFO) + return (0); + /* * This seems odd, but allow the case where the security flavor * list is empty. This happens when NFSv4 is traversing non-exported @@ -6936,18 +6938,15 @@ nfsm_trimtrailing(struct nfsrv_descript *nd, struct mbuf *mb, char *bpos, * Check to see if a put file handle operation should test for * NFSERR_WRONGSEC, although NFSv3 actually returns NFSERR_AUTHERR. * When Open is the next operation, NFSERR_WRONGSEC cannot be - * replied for the Open cases that use a component. Thia can + * replied for the Open cases that use a component. This can * be identified by the fact that the file handle's type is VDIR. */ bool nfsrv_checkwrongsec(struct nfsrv_descript *nd, int nextop, enum vtype vtyp) { - if ((nd->nd_flag & ND_NFSV4) == 0) { - if (nd->nd_procnum == NFSPROC_FSINFO) - return (false); + if ((nd->nd_flag & ND_NFSV4) == 0) return (true); - } if ((nd->nd_flag & ND_LASTOP) != 0) return (false);