Subject: [nfsv4] Fwd: New Version Notification for draft-dnoveck-nfsv4-security-02.txt

From: David Noveck <[email-masked]>
Date: Wed, 13 Oct 2021 09:55:18 -0400

This is the -02 draft that I will be discussing at the interim meeting on
10/27.

It does not have all I expected to have done at this point, since I had a
lot of unexpected work dealing with how acls and modes are coordinated.

I expect to produce a -03 about two weeks after the meeting and an -04
about two months after that.   I will try to incorporate the results of
working group discussion in those drafts as well as filling in some
missing pieces of the threat analysis.

There are a lot of issues where I need to change, more than editorially,
what is stated in RFCs 7530 and 8881.   As a result, as this document moves
forward, we need to make sure there is a working group consensus for these
changes.   They are summarized in Appendix B.

---------- Forwarded message ---------
From: <[email-masked]>
Date: Wed, Oct 13, 2021 at 9:29 AM
Subject: New Version Notification for draft-dnoveck-nfsv4-security-02.txt
To: David Noveck <[email-masked]>

A new version of I-D, draft-dnoveck-nfsv4-security-02.txt
has been successfully submitted by David Noveck and posted to the
IETF repository.

Name:           draft-dnoveck-nfsv4-security
Revision:       02
Title:          Security for the NFSv4 Protocols
Document date:  2021-10-13
Group:          Individual Submission
Pages:          118
URL:
https://www.ietf.org/archive/id/draft-dnoveck-nfsv4-security-02.txt
Status:
https://datatracker.ietf.org/doc/draft-dnoveck-nfsv4-security/
Html:
https://www.ietf.org/archive/id/draft-dnoveck-nfsv4-security-02.html
Htmlized:
https://datatracker.ietf.org/doc/html/draft-dnoveck-nfsv4-security
Diff:
https://www.ietf.org/rfcdiff?url2=draft-dnoveck-nfsv4-security-02

Abstract:
   This document describes the core security features of the NFSv4
   family of protocols, applying to all minor versions.  The discussion
   includes the use of security features provided by the RPC transport.

   This preliminary version of the document, is intended, in large part,
   to result in working group discussion regarding existing NFSv4
   security issues and to provide a framework for addressing these
   issues and obtaining working group consensus regarding necessary
   changes.

   When a successor document is eventually published as an RFC, it will
   supersede the description of security appearing in existing minor
   version specification documents such as RFC 7530 and RFC 8881.

The IETF Secretariat

---

From: [email-masked] (J. Bruce Fields)
Date: Fri, 15 Oct 2021 15:16:10 -0400

"Giving servers a general freedom to to not support the masks defined in
this section, creates an unacceptable level of potential
interoperability problems."

Unfortunately, we seem to be stuck with it.

"POSIX" ACLs are the only ACLs that Linux supports, it's been that way
for 20 years, and given the failure of the (significant) effort Andreas
Gruenbacher made to implement NFSv4-like on Linux, I'm not optimistic
that's going to change.

I'm not particularly happy with the ACL language here either, I totally
sympathize with the desire to clean it up, but I'm not sure how.

I'm frankly in despair over the whole ACL situation and I think that the
only really useful solutions require more than tweaking the spec
language.

--b.