Commit 8ab523ce authored by Trond Myklebust's avatar Trond Myklebust Committed by Anna Schumaker
Browse files

pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS 



The default setting for the transport security policy must be
RPC_XPRTSEC_NONE, when using a TCP or RDMA connection without TLS.
Conversely, when using TLS, the security policy needs to be set.

Fixes: 6c0a8c5f ("NFS: Have struct nfs_client carry a TLS policy field")
Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
Reviewed-by: default avatarChuck Lever <chuck.lever@oracle.com>
Signed-off-by: default avatarAnna Schumaker <anna.schumaker@oracle.com>
parent 28e19737

fs/nfs/nfs3client.c

+12 −2
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@ 
#include <linux/nfs_fs.h>

#include <linux/nfs_mount.h>

#include <linux/sunrpc/addr.h>

#include <net/handshake.h>

#include "internal.h"

#include "nfs3_fs.h"

#include "netns.h"
@@ -98,7 +99,11 @@ struct nfs_client *nfs3_set_ds_client(struct nfs_server *mds_srv, 
		.net = mds_clp->cl_net,

		.timeparms = &ds_timeout,

		.cred = mds_srv->cred,

		.xprtsec = mds_clp->cl_xprtsec,

		.xprtsec = {

			.policy = RPC_XPRTSEC_NONE,

			.cert_serial = TLS_NO_CERT,

			.privkey_serial = TLS_NO_PRIVKEY,

		},

		.connect_timeout = connect_timeout,

		.reconnect_timeout = connect_timeout,

	};
@@ -111,9 +116,14 @@ struct nfs_client *nfs3_set_ds_client(struct nfs_server *mds_srv, 
	cl_init.hostname = buf;



	switch (ds_proto) {

	case XPRT_TRANSPORT_TCP_TLS:

		if (mds_clp->cl_xprtsec.policy != RPC_XPRTSEC_NONE)

			cl_init.xprtsec = mds_clp->cl_xprtsec;

		else

			ds_proto = XPRT_TRANSPORT_TCP;

		fallthrough;

	case XPRT_TRANSPORT_RDMA:

	case XPRT_TRANSPORT_TCP:

	case XPRT_TRANSPORT_TCP_TLS:

		if (mds_clp->cl_nconnect > 1)

			cl_init.nconnect = mds_clp->cl_nconnect;

	}

fs/nfs/nfs4client.c

+12 −2
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ 
#include <linux/sunrpc/xprt.h>

#include <linux/sunrpc/bc_xprt.h>

#include <linux/sunrpc/rpc_pipe_fs.h>

#include <net/handshake.h>

#include "internal.h"

#include "callback.h"

#include "delegation.h"
@@ -983,7 +984,11 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv, 
		.net = mds_clp->cl_net,

		.timeparms = &ds_timeout,

		.cred = mds_srv->cred,

		.xprtsec = mds_srv->nfs_client->cl_xprtsec,

		.xprtsec = {

			.policy = RPC_XPRTSEC_NONE,

			.cert_serial = TLS_NO_CERT,

			.privkey_serial = TLS_NO_PRIVKEY,

		},

	};

	char buf[INET6_ADDRSTRLEN + 1];
@@ -992,9 +997,14 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv, 
	cl_init.hostname = buf;



	switch (ds_proto) {

	case XPRT_TRANSPORT_TCP_TLS:

		if (mds_srv->nfs_client->cl_xprtsec.policy != RPC_XPRTSEC_NONE)

			cl_init.xprtsec = mds_srv->nfs_client->cl_xprtsec;

		else

			ds_proto = XPRT_TRANSPORT_TCP;

		fallthrough;

	case XPRT_TRANSPORT_RDMA:

	case XPRT_TRANSPORT_TCP:

	case XPRT_TRANSPORT_TCP_TLS:

		if (mds_clp->cl_nconnect > 1) {

			cl_init.nconnect = mds_clp->cl_nconnect;

			cl_init.max_connect = NFS_MAX_TRANSPORTS;