]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
NFSv4.1/pnfs: fix NFS with TLS in pnfs
authorOlga Kornievskaia <kolga@netapp.com>
Tue, 20 Feb 2024 23:25:34 +0000 (18:25 -0500)
committerSasha Levin <sashal@kernel.org>
Tue, 26 Mar 2024 22:20:03 +0000 (18:20 -0400)
commitcda2f3d1754a36467cf6bd282df03180d54716c3
tree0ecd07ad4a0fc11a563ac693bb8c57de0cc37d5a
parent7f029d2438a0c99cf7e643882969a3dfe873bb53
NFSv4.1/pnfs: fix NFS with TLS in pnfs

[ Upstream commit a35518cae4b325632840bc8c3aa9ad9bac430038 ]

Currently, even though xprtsec=tls is specified and used for operations
to MDS, any operations that go to DS travel over unencrypted connection.
Or additionally, if more than 1 DS can serve the data, then trunked
connections are also done unencrypted.

IN GETDEVINCEINFO, we get an entry for the DS which carries a protocol
type (which is TCP), then nfs4_set_ds_client() gets called with TCP
instead of TCP with TLS.

Currently, each trunked connection is created and uses clp->cl_hostname
value which if TLS is used would get passed up in the handshake upcall,
but instead we need to pass in the appropriate trunked address value.

Fixes: c8407f2e560c ("NFS: Add an "xprtsec=" NFS mount option")
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/nfs/pnfs_nfs.c