Re: [nfsv4] AD review of draft-ietf-nfsv4-rpc-tls

[Chuck Lever <[e-mail]>]

Hi Sorin-

> On Apr 28, 2020, at 8:54 AM, [e-mail] wrote:
> 
> [sf] I reviewed the latest draft and I have some questions and concerns related to section 7.2 it is defined the TLS management on clients:

> "The RPC-on-TLS protocol by itself cannot protect against exposure of a user's RPC requests to
> other users on the same client.
> Moreover, client implementations are free to transmit RPC requests
> for more than one RPC user using the same TLS session. Depending on
> the details of the client RPC implementation, this means that the
> client's TLS identity material is potentially visible to every RPC
> user that shares a TLS session."
> 
> I see two issues with this:
> 1.	If there is a compromised user running on same client it is possible that the compromised user can "see" the identity material of the legitimate users.

I believe that's correct. Section 7.2 explains this point so that
implementers can be aware and address the issue appropriately. There
isn't anything the on-the-wire protocol can do to address it, as
far as I can tell.


> 2.	It is possible that a compromised user initiate a DDoS attack on the server and the server will not detect the attack as it comes from a legitimate host and encrypted. This may expose a server to undetected DDoS attacks.

IIUC, this attack is possible with RPC without TLS protection? Thus it
does not seem particular to the protocol defined in this document.


> Also the question is do we allow a mix of users using TLS and others not using TLS on same client? I understand that we don't support multiple TLS on same connection but do we support a mix? Some explanation/clarification text will be useful.

The document does not forbid a mix of TLS-protected and unprotected
connections to the same server or even to the same RPC program on that
server.


--
Chuck Lever