diff options
| author | Trond Myklebust <trond.myklebust@hammerspace.com> | 2025-10-18 20:10:36 -0400 |
|---|---|---|
| committer | Anna Schumaker <anna.schumaker@oracle.com> | 2025-11-10 10:32:28 -0500 |
| commit | fb2cba0854a7f315c8100a807a6959b99d72479e (patch) | |
| tree | 53ea216e619e7781724c2a3181750a698e12e973 /fs/nfs/client.c | |
| parent | 8ab523ce78d4ca13add6b4ecbacff0f84c274603 (diff) | |
NFS: Check the TLS certificate fields in nfs_match_client()
If the TLS security policy is of type RPC_XPRTSEC_TLS_X509, then the
cert_serial and privkey_serial fields need to match as well since they
define the client's identity, as presented to the server.
Fixes: 90c9550a8d65 ("NFS: support the kernel keyring for TLS")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Diffstat (limited to 'fs/nfs/client.c')
| -rw-r--r-- | fs/nfs/client.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/fs/nfs/client.c b/fs/nfs/client.c index 4e3dcc157a83..54699299d5b1 100644 --- a/fs/nfs/client.c +++ b/fs/nfs/client.c @@ -338,6 +338,14 @@ again: /* Match the xprt security policy */ if (clp->cl_xprtsec.policy != data->xprtsec.policy) continue; + if (clp->cl_xprtsec.policy == RPC_XPRTSEC_TLS_X509) { + if (clp->cl_xprtsec.cert_serial != + data->xprtsec.cert_serial) + continue; + if (clp->cl_xprtsec.privkey_serial != + data->xprtsec.privkey_serial) + continue; + } refcount_inc(&clp->cl_count); return clp; |