pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS

The default setting for the transport security policy must be
RPC_XPRTSEC_NONE, when using a TCP or RDMA connection without TLS.
Conversely, when using TLS, the security policy needs to be set.

Fixes: 6c0a8c5fcf71 ("NFS: Have struct nfs_client carry a TLS policy field")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>

diff --git a/fs/nfs/nfs3client.c b/fs/nfs/nfs3client.c
index 0d7310c1ee0c0c317740588e4910cd7316502ca2..5d97c1d38bb62df7017d541e44102b33755ef52b 100644 (file)
--- a/fs/nfs/nfs3client.c
+++ b/fs/nfs/nfs3client.c
@@ -2,6 +2,7 @@
 #include <linux/nfs_fs.h>
 #include <linux/nfs_mount.h>
 #include <linux/sunrpc/addr.h>
+#include <net/handshake.h>
 #include "internal.h"
 #include "nfs3_fs.h"
 #include "netns.h"
@@ -98,7 +99,11 @@ struct nfs_client *nfs3_set_ds_client(struct nfs_server *mds_srv,
                .net = mds_clp->cl_net,
                .timeparms = &ds_timeout,
                .cred = mds_srv->cred,
-               .xprtsec = mds_clp->cl_xprtsec,
+               .xprtsec = {
+                       .policy = RPC_XPRTSEC_NONE,
+                       .cert_serial = TLS_NO_CERT,
+                       .privkey_serial = TLS_NO_PRIVKEY,
+               },
                .connect_timeout = connect_timeout,
                .reconnect_timeout = connect_timeout,
        };
@@ -111,9 +116,14 @@ struct nfs_client *nfs3_set_ds_client(struct nfs_server *mds_srv,
        cl_init.hostname = buf;
 
        switch (ds_proto) {
+       case XPRT_TRANSPORT_TCP_TLS:
+               if (mds_clp->cl_xprtsec.policy != RPC_XPRTSEC_NONE)
+                       cl_init.xprtsec = mds_clp->cl_xprtsec;
+               else
+                       ds_proto = XPRT_TRANSPORT_TCP;
+               fallthrough;
        case XPRT_TRANSPORT_RDMA:
        case XPRT_TRANSPORT_TCP:
-       case XPRT_TRANSPORT_TCP_TLS:
                if (mds_clp->cl_nconnect > 1)
                        cl_init.nconnect = mds_clp->cl_nconnect;
        }

diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 5998d6bd8a4f4edf4c79d52d685c52861d33dba5..3a4baed993c96f10a1ecd06ffd38a7befabbbe78 100644 (file)
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -11,6 +11,7 @@
 #include <linux/sunrpc/xprt.h>
 #include <linux/sunrpc/bc_xprt.h>
 #include <linux/sunrpc/rpc_pipe_fs.h>
+#include <net/handshake.h>
 #include "internal.h"
 #include "callback.h"
 #include "delegation.h"
@@ -983,7 +984,11 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv,
                .net = mds_clp->cl_net,
                .timeparms = &ds_timeout,
                .cred = mds_srv->cred,
-               .xprtsec = mds_srv->nfs_client->cl_xprtsec,
+               .xprtsec = {
+                       .policy = RPC_XPRTSEC_NONE,
+                       .cert_serial = TLS_NO_CERT,
+                       .privkey_serial = TLS_NO_PRIVKEY,
+               },
        };
        char buf[INET6_ADDRSTRLEN + 1];
 
@@ -992,9 +997,14 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv,
        cl_init.hostname = buf;
 
        switch (ds_proto) {
+       case XPRT_TRANSPORT_TCP_TLS:
+               if (mds_srv->nfs_client->cl_xprtsec.policy != RPC_XPRTSEC_NONE)
+                       cl_init.xprtsec = mds_srv->nfs_client->cl_xprtsec;
+               else
+                       ds_proto = XPRT_TRANSPORT_TCP;
+               fallthrough;
        case XPRT_TRANSPORT_RDMA:
        case XPRT_TRANSPORT_TCP:
-       case XPRT_TRANSPORT_TCP_TLS:
                if (mds_clp->cl_nconnect > 1) {
                        cl_init.nconnect = mds_clp->cl_nconnect;
                        cl_init.max_connect = NFS_MAX_TRANSPORTS;