Re: [nfsv4] AD review of draft-ietf-nfsv4-rpc-tls

[Magnus Westerlund <[e-mail]>]

On Fri, 2020-04-17 at 08:32 -0400, Chuck Lever wrote:
> > On Apr 16, 2020, at 4:49 PM, Chuck Lever <[e-mail]> wrote:
> > 
> > 
> > 
> > > On Apr 16, 2020, at 4:30 PM, Magnus Westerlund <
> > > [e-mail]> wrote:
> > > 
> > > Hi, 
> > > 
> > > I have reviewed the text proposal and have this comment. 
> > > 
> > > On Tue, 2020-04-14 at 11:39 -0400, Chuck Lever wrote:
> > > >  o  If a client uses an ephemeral source port for a TCP connection and
> > > >     does not present authentication material to initiate TLS host
> > > >     authentication, the server MUST abort the TLS handshake with a
> > > >     handshake_failure alert.
> > > 
> > > So what is this paragraph trying to say really. Is this a mix of OS/Socket
> > > level
> > > concerns with the transport protocol level.
> > 
> > NFS server implementations have traditionally required clients to use a
> > privileged source port when using weak authentication like AUTH_SYS.
> > When a client uses a flavor like krb5 that provides strong host
> > authentication, the privileged source port requirement is waived.
> > 
> > This bullet simply states that the server does not have to require a
> > privileged source port when using TLS, just like with krb5/i/p. So
> > a client using AUTH_SYS with TLS would be permitted to use an ephemeral
> > source port, which is a much less rare resource than a privileged source
> > port.
> > 
> > We could leave this statement for a subsequent NFS-specific document
> > but there are some non-NFS user space RPC implementations that have
> > the same requirement.
> > 
> > Or, I could move this bullet to the Security Considerations section.
> 
> The mind wandered last night, and I realized that the privileged port
> requirement applies in the connectionless case as well. I will move
> this text somewhere that is appropriate for both transport types.

I think it is fine to include. Howver, I was missing context for this. So I
think if you provide slightly more context to the statement it will avoid
confusion from the future reviewers. 
 
Cheers

Magnus Westerlund 


----------------------------------------------------------------------
Networks, Ericsson Research
----------------------------------------------------------------------
Ericsson AB                 | Phone  [phone]
Torshamnsgatan 23           | Mobile [phone]
SE-164 80 Stockholm, Sweden | mailto: [e-mail]
----------------------------------------------------------------------