Re: [nfsv4] https://datatracker.ietf.org/doc/draft-myklebust-nfsv4-pnfs-backend/

[Trond Myklebust <[e-mail]>]

On Thu, 2010-11-18 at 08:18 +0100, Tigran Mkrtchyan wrote:
> On 11/18/2010 02:59 AM, Trond Myklebust wrote:
> > On Wed, 2010-11-17 at 16:04 -0800, Thomas Haynes wrote:
> >   
> For multihomed client 2 it's possible that MDS and  the client acting as
> a DS  will see different IP. I think this may produce 'false negatives'
> and some requests will be denied.

I don't see how: the DS doesn't exchange client2's IP address with the
MDS.

We could perhaps pass the clientid that client2 sent as part of the
EXCHANGE_ID, but I'm not sure that would significantly enhance the
security of the system.

> BTW, PROXY_OPEN desctiprions says:
> 
>    The PROXY_OPEN function authenticates the READ request by the pNFS
>    client.  If the data filehandle is valid, and the user identified by
>    the popa_user_id is authorised to access the file, then the metadata
>    server returns the true filehandle (as returned by LOOKUP and/or
> 
>    OPEN) of the file.
> 
> 
> but XDR says:
> 
>      union PROXY_OPEN4res switch (nfsstat4 status) {
>            case NFS4_OK:
>                    /* CURRENTFH: true filehandle */
>                    stateid4        popr_proxy_stateid;
>            default:
>                    void;
>      };
> 
> 
> In other words, description promises filehandle, but XDR returns
> stateid. Did I get it wrong?

The client can/should retrieve the filehandle using a GETFH op.

Cheers
  Trond