Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <a009cbf3-cb83-b7c8-aa86-2eee06962b68@oracle.com>
Date:   Wed, 20 Oct 2021 22:00:41 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0)
 Gecko/20100101 Thunderbird/91.2.0
Subject: Re: server-to-server copy by default
Content-Language: en-US
To:     Bruce Fields <bfields@fieldses.org>
Cc:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        Steve Dickson <steved@redhat.com>,
        Olga Kornievskaia <olga.kornievskaia@gmail.com>,
        Chuck Lever <chuck.lever@oracle.com>
References: <20211020155421.GC597@fieldses.org>
 <18E32DF5-3F1D-4C23-8C2F-A7963103CF8C@oracle.com>
 <CAN-5tyEL4L2GH=-MDGS4qNTcCLRPFCQzfDQjFAVbG7wMKvHxOg@mail.gmail.com>
 <8b1eb564-974d-00b6-397a-d92f301df7d8@oracle.com>
 <20211020202907.GF597@fieldses.org>
From:   dai.ngo@oracle.com
In-Reply-To: <20211020202907.GF597@fieldses.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?QWJUM00reHNDRUhmcjVrWElFR0l2bTJyS0s3eHVkSGR3YVc3OUxzQUtlMC9O?=
 =?utf-8?B?OS9xYjVaRzI4d2Zmd0QrMFA5YldZVmEyb2ZKZkhVdzNVbDh0a2hHcUVBZjNO?=
 =?utf-8?B?N3hJTjBFZVFhT2hNYlEycGFRQjhkVGYzZGlwRkIvNkIvYjFXb29QeHlsMzF3?=
 =?utf-8?B?TzdVVVprTnRRU1ZWUGtFZVdBbUlSS3Y5N1AvUnpWN1BrMVB0M3dRYVVqYmFn?=
 =?utf-8?B?cnBGazF0Mk1MUWxqS2JGcko1Ujh1R0NoNjNzd3BEYVNtaHBwb3lLWGhjZmtD?=
 =?utf-8?B?T2l1TGJyRFF0L1NDOS9yNjhCMmtRcUd6YktVako0a3B3UzU4Z1RlM1IyaEx6?=
 =?utf-8?B?dVFjUW1LWHpPQnRMMFZoR3laellQVVBwK2tyRWV4c0laNDFib2JkalduNnpF?=
 =?utf-8?B?c1dxV2NuMndvVjhyWkFPY1hITktDM2JXcU1lY3Z2dlVqWk5QOTI1cjJVUGtl?=
 =?utf-8?B?eVhmeXV3UGNxUlduT3liaVJXUWQyZDdYYkFMS3F5dFVMVVMrWTczSU0raWsr?=
 =?utf-8?B?ZGtLeUpRZTYzakVYUm1wTk9hOFp1TnBWOERDYzMzY2cxREphVWZHczNHSWlG?=
 =?utf-8?B?ZUlFSEpESC9kVlFzVzhMT1BXREZ2Nm04T29tRkFKOEhKeXhkWXUwdytCbmNH?=
 =?utf-8?B?NjlWU0VhK1BDb2toZXNVcE5BMHpXK0FaM2NXTnhIZm9Iei96Y3dVb3lzN08r?=
 =?utf-8?B?ZysvQzIrU3d0VlN5M2FWNC9VRzE4b0dpV2FUYkNMZ2s4UVkydHRRSXV2VEJm?=
 =?utf-8?B?NlgzRGZRanU5NWRQYithMUtxdGt0TXVwSUVUVDc5dm5qOWc0VjQ5NzNxU3ZP?=
 =?utf-8?B?QmhsZWFLSmg4WFpPMHdUMGdyblg5SmRReUJxcmRSR0t3SXB2engyandUd1RC?=
 =?utf-8?B?Q3F3YVpwQkRxMGgvYkluYmVvY21tS1RoczM1anFRaW4wM2JVU1dLTXNTTTlQ?=
 =?utf-8?B?Smc4NmJVZjlkS1BxcjY5amx5UmlhMVQ5MkFTbWVCY01xNFoyM2JRaURaTVJH?=
 =?utf-8?B?bVJtQmdFdDdWcHdHR0w1Mmp4VWxha3NqOUNnclJnV0Y1cFJpdE1reHAzR05k?=
 =?utf-8?B?ODFlaE5waFBTdmYzTlRwaFcyRDdZRFAwcnEwcWx6L3E3Ym40YUF0aU1wbEhC?=
 =?utf-8?B?RDhETUlObEhScXg3Y2k2eFBuTDQzQmxGMWw5WGF5WkJKODdienRMSm1tSWt4?=
 =?utf-8?B?ZlBxOE9QWVJlUklUc094Ukh1Q2JmTTRUWGZKVmVib0pTdWdBalZlTU1va1pX?=
 =?utf-8?B?VE5nSlczZVNUa3dRQTFIRnJPd3V2ajM5LzVHb2hFMk5VemJVbDd1QjhqSkNT?=
 =?utf-8?B?MTRLVmljblViZ0dOZlNPOGtOSFJuSXNIQVBtVW9zM1BHMlVJb28zVzVtbUlD?=
 =?utf-8?B?OXZ6bHk0eWtqWnlyR1doTXBwQjlOR21Nc1JMMG5DcWNsOU9EQVFlSnE3OHdu?=
 =?utf-8?B?WG1GQ2IybFlXY3p1ZkRxVHZoRVpiM1lwbDZSRFlLMFpRSjkyalFDMERzWXcv?=
 =?utf-8?B?Zkk3QVpxL21ZczdIYWI1MHYxK2JXNU5pcXVZVWNEemhUVW00cHZuS2NkMmVM?=
 =?utf-8?B?alJsZmxwN043bG9jaEkybXJ6c2pKeVZQaWtnNTNXZk84SU5mWUljL3JzK3M3?=
 =?utf-8?B?MDJ4MVBRSjlYaHpWdldLNE9vemFzRVZ2S252VldDNmVJeHJpOG9Sc3RiTldq?=
 =?utf-8?B?TExGNXlxK2N6d3NhUTVPeUx3R3J6RndGR3VObXJrcU1vSHoxRFBZbEpkVHRN?=
 =?utf-8?Q?DCL7UA739y59Jgy2JPaIoNXfSQKbFe1ldNJDDri?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: db23fa8d-3dc1-4b48-46ba-08d9944fbd34
X-MS-Exchange-CrossTenant-AuthSource: BY5PR10MB4257.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Oct 2021 05:00:44.8527
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: dai.ngo@oracle.com
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR10MB3954
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10143 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 spamscore=0 adultscore=0
 malwarescore=0 phishscore=0 bulkscore=0 mlxlogscore=999 suspectscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109230001
 definitions=main-2110210021
X-Proofpoint-GUID: Xa_ggJMgxjvfR_ni7jyxkZkalN5gTCj7
X-Proofpoint-ORIG-GUID: Xa_ggJMgxjvfR_ni7jyxkZkalN5gTCj7
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org

On 10/20/21 1:29 PM, Bruce Fields wrote:

> On Wed, Oct 20, 2021 at 12:03:46PM -0700, dai.ngo@oracle.com wrote:
>> On 10/20/21 9:33 AM, Olga Kornievskaia wrote:
>>> On Wed, Oct 20, 2021 at 12:00 PM Chuck Lever III <chuck.lever@oracle.com> wrote:
>>>>> 2. Security question: with server-to-server copy enabled, you can send
>>>>> the server a COPY call with any random address, and the server will
>>>>> mount that address, open a file, and read from it.  Is that safe?
>> The client already has write access to the share on the destination
>> server, it can write any data to the destination file.
> Agreed.  Please look back at what I said; I'm not thinking about attacks
> on the source server, I'm thinking about attacks on the destination (the
> one that receives the COPY).

Sorry for missing you point. If I understand correctly, your concern is
that a malicious client can direct the destination server to mount a
malicious source server that can generate DOS attack to the destination
server.

The attack can come from the replies of the source server or requests
from the source server to the destination server via the back channel.
One of possible attack in the reply is BAD_STATEID which was handled
by the client code as mentioned by Olga.

Here is the list of NFS requests made from the destination to the
source server:

         EXCHANGE_ID
         CREATE_SESSION
         RECLAIM_COMLETE
         SEQUENCE
         PUTROOTFH
         PUTHF
         GETFH
         GETATTR
         READ/READ_PLUS
         DESTROY_SESSION
         DESTROY_CLIENTID

Do you think we should review all replies from these requests to make
sure error replies do not cause problems for the destination server?

same for the back channel ops:

         OP_CB_GETATTR
         OP_CB_RECALL
         OP_CB_LAYOUTRECALL
         OP_CB_NOTIFY
         OP_CB_PUSH_DELEG
         OP_CB_RECALL_ANY
         OP_CB_RECALLABLE_OBJ_AVAIL
         OP_CB_RECALL_SLOT
         OP_CB_SEQUENCE
         OP_CB_WANTS_CANCELLED
         OP_CB_NOTIFY_LOCK
         OP_CB_NOTIFY_DEVICEID
         OP_CB_OFFLOAD

-Dai

> --b.