linux-kernel - [PATCH 1/5] nfs: Fix support for NFS3 mount with -o sec=none from Linux MNTv3 server

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240912130220.17032-2-pali@kernel.org>
Date: Thu, 12 Sep 2024 15:02:16 +0200
From: Pali Rohár <pali@...nel.org>
To: Trond Myklebust <trondmy@...nel.org>,
	Anna Schumaker <anna@...nel.org>
Cc: linux-nfs@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH 1/5] nfs: Fix support for NFS3 mount with -o sec=none from Linux MNTv3 server

Linux MNTv3 server does not announce AUTH_NULL in auth_info response.
This is a MNTv3 server bug and prevents kernel to mount exports with
AUTH_NULL flavor. So as a workaround when user explicitly specifies
only AUTH_NULL flavor via mount option -o sec=none then allow to
continue mounting export via AUTH_NULL.

This change fixes mounting of NFS3 AUTH_NULL exports from Linux NFS3
servers.

Signed-off-by: Pali Rohár <pali@...nel.org>
Cc: stable@...r.kernel.org
---
 fs/nfs/super.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 97b386032b71..3fef2afd94bd 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -819,6 +819,20 @@ static int nfs_verify_authflavors(struct nfs_fs_context *ctx,
 		goto out;
 	}
 
+	/*
+	 * Linux MNTv3 server does not announce AUTH_NULL in auth_info response.
+	 * This is a MNTv3 server bug and prevents kernel to mount exports with
+	 * AUTH_NULL flavor. So as a workaround when user explicitly specifies
+	 * only AUTH_NULL flavor via mount option -o sec=none then allow to
+	 * continue mounting export via AUTH_NULL.
+	 */
+	if (ctx->auth_info.flavor_len == 1 && ctx->auth_info.flavors[0] == RPC_AUTH_NULL) {
+		dfprintk(MOUNT,
+			 "NFS: requested auth flavor \"none\" is not announced by server, continuing anyway\n");
+		flavor = RPC_AUTH_NULL;
+		goto out;
+	}
+
 	dfprintk(MOUNT,
 		 "NFS: specified auth flavors not supported by server\n");
 	return -EACCES;
-- 
2.20.1