Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS 

The default setting for the transport security policy must be
RPC_XPRTSEC_NONE, when using a TCP or RDMA connection without TLS.
Conversely, when using TLS, the security policy needs to be set.

Fixes: 6c0a8c5fcf ("NFS: Have struct nfs_client carry a TLS policy field")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
This commit is contained in:
Trond Myklebust 2025-10-18 20:10:35 -04:00 committed by Anna Schumaker
parent 28e19737e1
commit 8ab523ce78
2 changed files with 24 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
fs/nfs/nfs3client.c
View File

@ -2,6 +2,7 @@
#include <linux/nfs_fs.h>
#include <linux/nfs_mount.h>
#include <linux/sunrpc/addr.h>
#include <net/handshake.h>
#include "internal.h"
#include "nfs3_fs.h"
#include "netns.h"
@ -98,7 +99,11 @@ struct nfs_client *nfs3_set_ds_client(struct nfs_server *mds_srv,
.net = mds_clp->cl_net,
.timeparms = &ds_timeout,
.cred = mds_srv->cred,
.xprtsec = mds_clp->cl_xprtsec,
.xprtsec = {
.policy = RPC_XPRTSEC_NONE,
.cert_serial = TLS_NO_CERT,
.privkey_serial = TLS_NO_PRIVKEY,
},
.connect_timeout = connect_timeout,
.reconnect_timeout = connect_timeout,
};
@ -111,9 +116,14 @@ struct nfs_client *nfs3_set_ds_client(struct nfs_server *mds_srv,
cl_init.hostname = buf;
switch (ds_proto) {
case XPRT_TRANSPORT_TCP_TLS:
if (mds_clp->cl_xprtsec.policy != RPC_XPRTSEC_NONE)
cl_init.xprtsec = mds_clp->cl_xprtsec;
else
ds_proto = XPRT_TRANSPORT_TCP;
fallthrough;
case XPRT_TRANSPORT_RDMA:
case XPRT_TRANSPORT_TCP:
case XPRT_TRANSPORT_TCP_TLS:
if (mds_clp->cl_nconnect > 1)
cl_init.nconnect = mds_clp->cl_nconnect;
}

14
fs/nfs/nfs4client.c
View File

@ -11,6 +11,7 @@
#include <linux/sunrpc/xprt.h>
#include <linux/sunrpc/bc_xprt.h>
#include <linux/sunrpc/rpc_pipe_fs.h>
#include <net/handshake.h>
#include "internal.h"
#include "callback.h"
#include "delegation.h"
@ -983,7 +984,11 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv,
.net = mds_clp->cl_net,
.timeparms = &ds_timeout,
.cred = mds_srv->cred,
.xprtsec = mds_srv->nfs_client->cl_xprtsec,
.xprtsec = {
.policy = RPC_XPRTSEC_NONE,
.cert_serial = TLS_NO_CERT,
.privkey_serial = TLS_NO_PRIVKEY,
},
};
char buf[INET6_ADDRSTRLEN + 1];
@ -992,9 +997,14 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv,
cl_init.hostname = buf;
switch (ds_proto) {
case XPRT_TRANSPORT_TCP_TLS:
if (mds_srv->nfs_client->cl_xprtsec.policy != RPC_XPRTSEC_NONE)
cl_init.xprtsec = mds_srv->nfs_client->cl_xprtsec;
else
ds_proto = XPRT_TRANSPORT_TCP;
fallthrough;
case XPRT_TRANSPORT_RDMA:
case XPRT_TRANSPORT_TCP:
case XPRT_TRANSPORT_TCP_TLS:
if (mds_clp->cl_nconnect > 1) {
cl_init.nconnect = mds_clp->cl_nconnect;
cl_init.max_connect = NFS_MAX_TRANSPORTS;