[PATCH v8 01/14] SUNRPC: Reject an AUTH_TLS probe inside a TLS session

[Chuck Lever <cel@kernel.org>]

svcauth_tls_accept() accepts an AUTH_TLS probe on a connection that
already carries a TLS session. It sets XPT_HANDSHAKE, and
svc_tcp_handshake() then clears XPT_TLS_SESSION and calls
tls_server_hello_x509(). The first handshake_req stays hashed until
the socket is destroyed, so the second request fails with -EBUSY and
svc_tcp_handshake() leaves the connection open. The kTLS ULP is
still installed, but XPT_TLS_SESSION is clear, so every later test
of that flag treats the connection as cleartext.

RFC 9289 Section 4.1 requires the server to reject a probe sent
within an existing TLS session with AUTH_BADCRED. Deny the call
there, before the handshake is started.

Fixes: 74aaf96feaca ("SUNRPC: Teach server to recognize RPC_AUTH_TLS")
Signed-off-by: Chuck Lever <cel@kernel.org>
---
 net/sunrpc/svcauth_unix.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index ad8a73653e42..fee7e20e2e9b 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -1144,6 +1144,12 @@ svcauth_tls_accept(struct svc_rqst *rqstp)
 		return SVC_DENIED;
 	}
 
+	/* RFC 9289 Section 4.1: a probe inside a TLS session is rejected */
+	if (test_bit(XPT_TLS_SESSION, &xprt->xpt_flags)) {
+		rqstp->rq_auth_stat = rpc_autherr_badcred;
+		return SVC_DENIED;
+	}
+
 	/* Signal that mapping to nobody uid/gid is required */
 	cred->cr_uid = INVALID_UID;
 	cred->cr_gid = INVALID_GID;

-- 
2.56.0