Subject: [nfsv4] issue from the June 2009 bake-a-thon ... retry with different principal

From: "Mike Eisler" <[email-masked]>
Date: Sat, 20 Jun 2009 11:49:37 -0700

A question came up about what to do if the client retries a request
(i.e. same session ID, slot ID and sequence ID) and the rretry uses
a different principal than the original. If the original was something like:

  { PUTFH, READ }

and the READ operation's results were cached, we don't want to allow
the retry to read data the new principal might not have access to.

Leaving aside this point,

  if the client was using SP4_SSV or SP4_MACH_CRED state
  protection, this is unlikely to happen, and even if
  it did, the client might have cached the reply on its end any way,

nonetheless, I propose this change to the NFS4ERR_SEQ_FALSE_RETRY
error description:

        The requester sent a Sequence operation with a
        slot ID and sequence ID that are in the reply cache, but
        the replier has detected that the retried request
        is not the same as the original request, including a retry
        that has different operations or different arguments in the
        operations from the original, and a retry that uses a
        different principal in the RPC request's credential field.

-- 
Mike Eisler, Senior Technical Director, NetApp, 719 599 9026,
http://blogs.netapp.com/eislers_nfs_blog/

---

From: "William A. (Andy) Adamson" <[email-masked]>
Date: Mon, 22 Jun 2009 18:05:03 -0400

>        different principal in the RPC request's credential field.

Does this mean that a retry from the same user who happened to switch
authentication methods in between the original and retried RPC (e.g.
was using AUTH_SYS and then obtained Kerberos Credentials), the retry
should fail?

Perhaps it should say something like this -
"and a retry that uses a principal in the RPC request's credential
field that translates to a different user."

-->Andy
> _______________________________________________
> nfsv4 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nfsv4
>

---

From: "Noveck, Dave" <[email-masked]>
Date: Tue, 23 Jun 2009 14:16:44 -0400

How about a case in uid 0 was first used to read using kerberos and then
a switch to AUTH_SYS was done?  In many cases, the first request would
be treated by the server as done by root and the second by nobody.  So
how about adding:

    In the latter case, translations of particularly 
    privileged user values to other users due to the lack of
    appropriately secure credentials, as configured on the
    server, are to be applied before determining whether 
    the users are the same or different.

-----Original Message-----
From: William A. (Andy) Adamson [mailto:[email-masked]] 
Sent: Monday, June 22, 2009 6:05 PM
To: Mike Eisler
Cc: [email-masked]
Subject: Re: [nfsv4] issue from the June 2009 bake-a-thon ... retry
withdifferent principal

-->Andy