Re: [nfsv4] AD review of draft-ietf-nfsv4-rpc-tls

[David Noveck <[e-mail]>]

On Thu, Apr 16, 2020, 4:30 PM Magnus Westerlund <magnus.westerlund=
[e-mail]> wrote:

> Hi,
>
> I have reviewed the text proposal and have this comment.
>
> On Tue, 2020-04-14 at 11:39 -0400, Chuck Lever wrote:
> >    o  If a client uses an ephemeral source port for a TCP connection and
> >       does not present authentication material to initiate TLS host
> >       authentication, the server MUST abort the TLS handshake with a
> >       handshake_failure alert.
>
> So what is this paragraph trying to say really. Is this a mix of OS/Socket
> level
> concerns with the transport protocol level.


Unfortunately, it is. There are good reasons for it, that derive from the
history of NFS "authentication".

Becasue from my perspective, I don't
> see why it would matter if the NFS client use a single arbitrary source
> port for
> its TCP connection to the server, where it determines that it has reached
> the
> server with a requested SNI. After the TCP connection has been established
> it
> will have a specific 5-tuple. Then the client use RPC level authentication
> to
> prove to the server which user it is.


That's a reasonable perspective.  Unfortunately, it doesn't take account of
AUTH_SYS in which the authentication task is effectively delegated to the
client. In that case, knowing who the client is essential. Without that,
there is really no request authentication.

Yes, that has certain weakness in that it
> doesn't identify the client host system, however for cases where one don't
> require that.
>

I suppose one could allow use of rpcsecgss and only restrict use of
AUTH_SYS on such connections.  However, I think Chuck's statement makes
things simpler on that it requires either that the source kernel take
responsibility for the client, be allowing use of a privileged port or the
client provides
authentication material to support unprivileged clients.

NFSV4 might choose to go further to deal with the possibility of untrusted
kernels.

>
>
>
> Cheers
>
> Magnus Westerlund
>
>
> ----------------------------------------------------------------------
> Networks, Ericsson Research
> ----------------------------------------------------------------------
> Ericsson AB                 | Phone  [phone]
> Torshamnsgatan 23           | Mobile [phone]
> SE-164 80 Stockholm, Sweden | mailto: [e-mail]
> ----------------------------------------------------------------------
>
>
> _______________________________________________
> nfsv4 mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/nfsv4
>