Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
From:   Rick Macklem <rick.macklem@gmail.com>
Date:   Sun, 2 Apr 2023 16:14:20 -0700
Message-ID: <CAM5tNy5T1-K3oH7TLeUG=F3V8u_aRhcvMEJkkaV7wj+5vqqq_w@mail.gmail.com>
Subject: sec=krb5 feature or bug??
To:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Hi,

I've been testing a Linxu 5.15 NFSv4.2 client against a
FreeBSD server to test recently added SP4_MACH_CRED
support in the FreeBSD server.

I noticed the following oddity, which I thought I'd report
in case it is considered a bug and not a feature.
I do a mount like:
# mount -t nfs -o nfsvers=4,sec=krb5 nfsv4-server:/ /mnt
#
- When looking at the packet capture during the mount,
  the ExchangeID, CreateSession and ReclaimComplete
  are done with integrity (ie. krb5i) and ExchangeID uses
  SP4_MACH_CRED.
- Then, subsequent RPCs do not use integrity, as I would
  have assumed, given the "sec=krb5" argument.
However, some subsequent RPCs in the must_allow ops
list for SP4_MACH_CRED choose to use the "machine
principal" and do krb5i.

It just seems weird that it mixes krb5 and krb5i. I had
not expected it to use SP4_MACH_CRED when
"sec=krb5" was specified.

However, it seems to work fine this way, so I can see
the argument that this is a "feature" and not a bug.

Just fyi, rick