Re: [PATCH 3/4] pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS

[Chuck Lever <chuck.lever@oracle.com>]

On 10/18/25 8:10 PM, Trond Myklebust wrote:
> From: Trond Myklebust <trond.myklebust@hammerspace.com>
> 
> The default setting for the transport security policy must be
> RPC_XPRTSEC_NONE, when using a TCP or RDMA connection without TLS.
> Conversely, when using TLS, the security policy needs to be set.

That matches my understanding.

Reviewed-by: Chuck Lever <chuck.lever@oracle.com>


> 
> Fixes: 6c0a8c5fcf71 ("NFS: Have struct nfs_client carry a TLS policy field")
> Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
> ---
>  fs/nfs/nfs3client.c | 14 ++++++++++++--
>  fs/nfs/nfs4client.c | 14 ++++++++++++--
>  2 files changed, 24 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/nfs/nfs3client.c b/fs/nfs/nfs3client.c
> index 0d7310c1ee0c..5d97c1d38bb6 100644
> --- a/fs/nfs/nfs3client.c
> +++ b/fs/nfs/nfs3client.c
> @@ -2,6 +2,7 @@
>  #include <linux/nfs_fs.h>
>  #include <linux/nfs_mount.h>
>  #include <linux/sunrpc/addr.h>
> +#include <net/handshake.h>
>  #include "internal.h"
>  #include "nfs3_fs.h"
>  #include "netns.h"
> @@ -98,7 +99,11 @@ struct nfs_client *nfs3_set_ds_client(struct nfs_server *mds_srv,
>  		.net = mds_clp->cl_net,
>  		.timeparms = &ds_timeout,
>  		.cred = mds_srv->cred,
> -		.xprtsec = mds_clp->cl_xprtsec,
> +		.xprtsec = {
> +			.policy = RPC_XPRTSEC_NONE,
> +			.cert_serial = TLS_NO_CERT,
> +			.privkey_serial = TLS_NO_PRIVKEY,
> +		},
>  		.connect_timeout = connect_timeout,
>  		.reconnect_timeout = connect_timeout,
>  	};
> @@ -111,9 +116,14 @@ struct nfs_client *nfs3_set_ds_client(struct nfs_server *mds_srv,
>  	cl_init.hostname = buf;
>  
>  	switch (ds_proto) {
> +	case XPRT_TRANSPORT_TCP_TLS:
> +		if (mds_clp->cl_xprtsec.policy != RPC_XPRTSEC_NONE)
> +			cl_init.xprtsec = mds_clp->cl_xprtsec;
> +		else
> +			ds_proto = XPRT_TRANSPORT_TCP;
> +		fallthrough;
>  	case XPRT_TRANSPORT_RDMA:
>  	case XPRT_TRANSPORT_TCP:
> -	case XPRT_TRANSPORT_TCP_TLS:
>  		if (mds_clp->cl_nconnect > 1)
>  			cl_init.nconnect = mds_clp->cl_nconnect;
>  	}
> diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
> index 6fddf43d729c..bb4c41ad7134 100644
> --- a/fs/nfs/nfs4client.c
> +++ b/fs/nfs/nfs4client.c
> @@ -11,6 +11,7 @@
>  #include <linux/sunrpc/xprt.h>
>  #include <linux/sunrpc/bc_xprt.h>
>  #include <linux/sunrpc/rpc_pipe_fs.h>
> +#include <net/handshake.h>
>  #include "internal.h"
>  #include "callback.h"
>  #include "delegation.h"
> @@ -982,7 +983,11 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv,
>  		.net = mds_clp->cl_net,
>  		.timeparms = &ds_timeout,
>  		.cred = mds_srv->cred,
> -		.xprtsec = mds_srv->nfs_client->cl_xprtsec,
> +		.xprtsec = {
> +			.policy = RPC_XPRTSEC_NONE,
> +			.cert_serial = TLS_NO_CERT,
> +			.privkey_serial = TLS_NO_PRIVKEY,
> +		},
>  	};
>  	char buf[INET6_ADDRSTRLEN + 1];
>  
> @@ -991,9 +996,14 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv,
>  	cl_init.hostname = buf;
>  
>  	switch (ds_proto) {
> +	case XPRT_TRANSPORT_TCP_TLS:
> +		if (mds_srv->nfs_client->cl_xprtsec.policy != RPC_XPRTSEC_NONE)
> +			cl_init.xprtsec = mds_srv->nfs_client->cl_xprtsec;
> +		else
> +			ds_proto = XPRT_TRANSPORT_TCP;
> +		fallthrough;
>  	case XPRT_TRANSPORT_RDMA:
>  	case XPRT_TRANSPORT_TCP:
> -	case XPRT_TRANSPORT_TCP_TLS:
>  		if (mds_clp->cl_nconnect > 1) {
>  			cl_init.nconnect = mds_clp->cl_nconnect;
>  			cl_init.max_connect = NFS_MAX_TRANSPORTS;


-- 
Chuck Lever