Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <CAM5tNy5T1-K3oH7TLeUG=F3V8u_aRhcvMEJkkaV7wj+5vqqq_w@mail.gmail.com>
In-Reply-To: <CAM5tNy5T1-K3oH7TLeUG=F3V8u_aRhcvMEJkkaV7wj+5vqqq_w@mail.gmail.com>
From:   Olga Kornievskaia <aglo@umich.edu>
Date:   Mon, 3 Apr 2023 12:57:09 -0400
Message-ID: <CAN-5tyHt6dxBAO==RgDB6fBOBimE5jP6ZbY-AFDwBCbfOREUeA@mail.gmail.com>
Subject: Re: sec=krb5 feature or bug??
To:     Rick Macklem <rick.macklem@gmail.com>
Cc:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi Rick,

That's by design (rather that's what spec says? It may be rfc 8881
2.4.3 and probably somewhere else that ops that are done with machine
creds must use the same gss flavor? ). All state operations are done
with sec=3Dkrb5i (if kerberos is configured on the machine) and then
other operations are done with whatever flavor was specified on the
mount command.


On Sun, Apr 2, 2023 at 7:24=E2=80=AFPM Rick Macklem <rick.macklem@gmail.com=
> wrote:
>
> Hi,
>
> I've been testing a Linxu 5.15 NFSv4.2 client against a
> FreeBSD server to test recently added SP4_MACH_CRED
> support in the FreeBSD server.
>
> I noticed the following oddity, which I thought I'd report
> in case it is considered a bug and not a feature.
> I do a mount like:
> # mount -t nfs -o nfsvers=3D4,sec=3Dkrb5 nfsv4-server:/ /mnt
> #
> - When looking at the packet capture during the mount,
>   the ExchangeID, CreateSession and ReclaimComplete
>   are done with integrity (ie. krb5i) and ExchangeID uses
>   SP4_MACH_CRED.
> - Then, subsequent RPCs do not use integrity, as I would
>   have assumed, given the "sec=3Dkrb5" argument.
> However, some subsequent RPCs in the must_allow ops
> list for SP4_MACH_CRED choose to use the "machine
> principal" and do krb5i.
>
> It just seems weird that it mixes krb5 and krb5i. I had
> not expected it to use SP4_MACH_CRED when
> "sec=3Dkrb5" was specified.
>
> However, it seems to work fine this way, so I can see
> the argument that this is a "feature" and not a bug.
>
> Just fyi, rick