From nobody Sun Jan 15 22:08:38 2023 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Nw8S71NzSz2smjp; Sun, 15 Jan 2023 22:08:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Nw8S70svyz46vK; Sun, 15 Jan 2023 22:08:39 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1673820519; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2fael6xgzXR5IDcLvOjSm/r9/WT7PjtabTYu/4qYph4=; b=fMrjeHUa42Xj+/9q6JN8PFEF83ay5Yl2nXwDqRqLevGK6/b13Kz2t0PQrmGzDkvYgAtaQX WAsC8q99RjKbXWzOsSK0ivXdHBWEUnKFBo0KrhZzycSdEpw1cWBW6bidMCWUpvOGj+ARG8 VWlzsIypwhTpArjJZYbAYefG6saIGlqcEQRBeL/QxjizUF1lzHPG44noLtmLexOUrfflgA cUeBdWqeAHJdlmAgHOj1z9AgmX+awzFZeVbwpsEe7PGJJTjB/uOthM8DlVOp4GdcCWqo+E qpmla2JFRGmDXT8+cLEUnndq9f6b1vWttOhH3VqlaeybZGJVAtDlCqje2DlZ0A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1673820519; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2fael6xgzXR5IDcLvOjSm/r9/WT7PjtabTYu/4qYph4=; b=FRwDg+FcymA/AadNoLT9HCsxDuIgKVpS4l/mmFCa+bJYE6Y2nfmNtoloQQSPUhnkacGRzk xsffj5H22NFgRiocmFTSUgvlYI5eym20Ux7F8/RZE0Xy4NSoXNgSrsVWjtFC8LCQ8qkh6l zH6C+t2IxlBg3NCtGEe58zC9bbF31UpnpWE0SLe+QRos6NtGKnwSuJlYd8QOIWPeOmp0Wh nWJSItIIWbQ9+/EaWVJG6iMk81CL0W8xN8HjBn6Dgv8P7xNhWj8jZ7CCAeweZcRUjFB4L0 jTgndbd//jpcg79d5N2WYQg+rdeGABxyH2GDq/eVedxiuuffw9z+fQyJt+R6iw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1673820519; a=rsa-sha256; cv=none; b=BiEFgv0/pFVgu0P67uQJGYlfvkJSmkxwwOwKSGTJHztQOs3S/vbyLXZ5w1uCJ0yX8UynUf 8To5LwJ+VYV+BQFAU9WeTzoP3I8jWJ4QXOmyjR1pcPjvSdOeP+Xn8YnUpZ/PamEtDA4COC xYtPVrXU4c9Hk6mshHcNxuNnKoBiKPYvPncYMVDDE0mSCUrCw/YBAG505j/S2/QUF/jpqn cS7ZtmjjDU2EC2ww3eIyNxCJpVYExr4NIf6BFgd8bu84ZhBS6zgBRa6AjkgELyLxM7jcgl QtWKyBy+eISN6lsTpx3XBV3RAHt/Qu1N1S1PmynEX9xmdWaGBM7o+M290ydmdQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Nw8S66kvkzjlG; Sun, 15 Jan 2023 22:08:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 30FM8cHu031892; Sun, 15 Jan 2023 22:08:38 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 30FM8cMv031891; Sun, 15 Jan 2023 22:08:38 GMT (envelope-from git) Date: Sun, 15 Jan 2023 22:08:38 GMT Message-Id: <202301152208.30FM8cMv031891@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Rick Macklem Subject: git: 5a0050e68a54 - main - nfsserver: Fix handling of SP4_NONE List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rmacklem X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 5a0050e68a54353af53ac28df90854797ebbef16 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=5a0050e68a54353af53ac28df90854797ebbef16 commit 5a0050e68a54353af53ac28df90854797ebbef16 Author: Rick Macklem AuthorDate: 2023-01-15 22:07:40 +0000 Commit: Rick Macklem CommitDate: 2023-01-15 22:07:40 +0000 nfsserver: Fix handling of SP4_NONE For NFSv4.1/4.2, when the client specifies SP4_NONE for state protection in the ExchangeID operation arguments, the server MUST allow the state management operations for any user credentials. (I misread the RFC and thought that SP4_NONE meant "at the server's discression" and not MUST be allowed.) This means that the "sec=XXX" field of the "V4:" exports(5) line only applies to NFSv4.0. This patch fixes the server to always allow state management operations for SP4_NONE, which is the only state management option currently supported. (I have patches that add support for SP4_MACH_CRED to the server. These will be in a future commit.) In practice, this bug does not seem to have caused interoperability problems. MFC after: 2 weeks --- sys/fs/nfsserver/nfs_nfsdstate.c | 7 ++++++- sys/fs/nfsserver/nfs_nfsdsubs.c | 8 ++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/sys/fs/nfsserver/nfs_nfsdstate.c b/sys/fs/nfsserver/nfs_nfsdstate.c index 84da1d9561cd..7430f1f200b3 100644 --- a/sys/fs/nfsserver/nfs_nfsdstate.c +++ b/sys/fs/nfsserver/nfs_nfsdstate.c @@ -5867,12 +5867,17 @@ nfsrv_throwawayopens(NFSPROC_T *p) /* * This function checks to see if the credentials are the same. - * Returns 1 for not same, 0 otherwise. + * The check for same credentials is needed for state management operations + * for NFSv4.0 where 1 is returned if not same, 0 is returned otherwise. */ static int nfsrv_notsamecredname(struct nfsrv_descript *nd, struct nfsclient *clp) { + /* For NFSv4.1/4.2, SP4_NONE always allows this. */ + if ((nd->nd_flag & ND_NFSV41) != 0) + return (0); + if (nd->nd_flag & ND_GSS) { if (!(clp->lc_flags & LCL_GSS)) return (1); diff --git a/sys/fs/nfsserver/nfs_nfsdsubs.c b/sys/fs/nfsserver/nfs_nfsdsubs.c index ca691941ed0d..20f62211f53e 100644 --- a/sys/fs/nfsserver/nfs_nfsdsubs.c +++ b/sys/fs/nfsserver/nfs_nfsdsubs.c @@ -2121,6 +2121,14 @@ nfsd_checkrootexp(struct nfsrv_descript *nd) if (nfs_rootfhset == 0) return (NFSERR_AUTHERR | AUTH_FAILED); + /* + * For NFSv4.1/4.2, if the client specifies SP4_NONE, then these + * operations are allowed regardless of the value of the "sec=XXX" + * field in the V4: exports line. + * As such, these Kerberos checks only apply to NFSv4.0 mounts. + */ + if ((nd->nd_flag & ND_NFSV41) != 0) + goto checktls; if ((nd->nd_flag & (ND_GSS | ND_EXAUTHSYS)) == ND_EXAUTHSYS) goto checktls; if ((nd->nd_flag & (ND_GSSINTEGRITY | ND_EXGSSINTEGRITY)) ==