git: 3fc3fe90915f - main - nfsd: Do not exempt NFSv3 Fsinfo from the TLS check

The branch main has been updated by rmacklem:

URL: https://cgit.FreeBSD.org/src/commit/?id=3fc3fe90915f02e25b4f1d5070e8e01e465e873d

commit 3fc3fe90915f02e25b4f1d5070e8e01e465e873d
Author:     Rick Macklem <rmacklem@FreeBSD.org>
AuthorDate: 2022-03-10 00:52:42 +0000
Commit:     Rick Macklem <rmacklem@FreeBSD.org>
CommitDate: 2022-03-10 00:52:42 +0000

    nfsd: Do not exempt NFSv3 Fsinfo from the TLS check
    
    The Fsinfo RPC is exempt from the check for
    Kerberized NFS being required, as recommended
    by RFC2623.  However, there is no reason to
    exempt Fsinfo from the requirement to use TLS.
    
    This patch fixes the code so that the exemption
    only applies to Kerberized NFS and not
    NFS-over-TLS.
    
    This only affects NFS-over-TLS for an NFSv3
    mount when it is required, but the client does
    not do so.
    
    MFC after:      1 month
---
 sys/fs/nfsserver/nfs_nfsdport.c | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/sys/fs/nfsserver/nfs_nfsdport.c b/sys/fs/nfsserver/nfs_nfsdport.c
index 8afcc9400f95..03f299ff0a10 100644
--- a/sys/fs/nfsserver/nfs_nfsdport.c
+++ b/sys/fs/nfsserver/nfs_nfsdport.c
@@ -4051,16 +4051,11 @@ nfsvno_testexp(struct nfsrv_descript *nd, struct nfsexstuff *exp)
 {
 	int i;
 
-	/*
-	 * Allow NFSv3 Fsinfo per RFC2623.
-	 */
-	if (((nd->nd_flag & ND_NFSV4) != 0 ||
-	     nd->nd_procnum != NFSPROC_FSINFO) &&
-	    ((NFSVNO_EXTLS(exp) && (nd->nd_flag & ND_TLS) == 0) ||
-	     (NFSVNO_EXTLSCERT(exp) &&
-	      (nd->nd_flag & ND_TLSCERT) == 0) ||
-	     (NFSVNO_EXTLSCERTUSER(exp) &&
-	      (nd->nd_flag & ND_TLSCERTUSER) == 0))) {
+	if ((NFSVNO_EXTLS(exp) && (nd->nd_flag & ND_TLS) == 0) ||
+	    (NFSVNO_EXTLSCERT(exp) &&
+	     (nd->nd_flag & ND_TLSCERT) == 0) ||
+	    (NFSVNO_EXTLSCERTUSER(exp) &&
+	     (nd->nd_flag & ND_TLSCERTUSER) == 0)) {
 		if ((nd->nd_flag & ND_NFSV4) != 0)
 			return (NFSERR_WRONGSEC);
 #ifdef notnow
@@ -4074,6 +4069,13 @@ nfsvno_testexp(struct nfsrv_descript *nd, struct nfsexstuff *exp)
 			return (NFSERR_AUTHERR | AUTH_TOOWEAK);
 	}
 
+	/*
+	 * RFC2623 suggests that the NFSv3 Fsinfo RPC be allowed to use
+	 * AUTH_NONE or AUTH_SYS for file systems requiring RPCSEC_GSS.
+	 */
+	if ((nd->nd_flag & ND_NFSV3) != 0 && nd->nd_procnum == NFSPROC_FSINFO)
+		return (0);
+
 	/*
 	 * This seems odd, but allow the case where the security flavor
 	 * list is empty. This happens when NFSv4 is traversing non-exported
@@ -6936,18 +6938,15 @@ nfsm_trimtrailing(struct nfsrv_descript *nd, struct mbuf *mb, char *bpos,
  * Check to see if a put file handle operation should test for
  * NFSERR_WRONGSEC, although NFSv3 actually returns NFSERR_AUTHERR.
  * When Open is the next operation, NFSERR_WRONGSEC cannot be
- * replied for the Open cases that use a component.  Thia can
+ * replied for the Open cases that use a component.  This can
  * be identified by the fact that the file handle's type is VDIR.
  */
 bool
 nfsrv_checkwrongsec(struct nfsrv_descript *nd, int nextop, enum vtype vtyp)
 {
 
-	if ((nd->nd_flag & ND_NFSV4) == 0) {
-		if (nd->nd_procnum == NFSPROC_FSINFO)
-			return (false);
+	if ((nd->nd_flag & ND_NFSV4) == 0)
 		return (true);
-	}
 
 	if ((nd->nd_flag & ND_LASTOP) != 0)
 		return (false);