tree ff35a096277cf5d588557676787387b3b69c5891
parent edcc8452a05ffd2d2c8574905660c9c2572af075
author J. Bruce Fields <bfields@redhat.com> 1520542188 -0500
committer J. Bruce Fields <bfields@redhat.com> 1521491893 -0400

nfsd: don't require low ports for gss requests

In a traditional NFS deployment using auth_unix, the clients are trusted
to correctly report the credentials of their logged-in users.  The
server assumes that only root on client machines is allowed to send
requests from low-numbered ports, so it can use the originating port
number to distinguish "real" NFS clients from NFS clients run by
ordinary users, to prevent ordinary users from spoofing credentials.

The originating port number on a gss-authenticated request is less
important.  The authentication ties the request to a user, and we take
it as proof that that user authorized the request.  The low port number
check no longer adds much.

So, don't enforce low port numbers in the auth_gss case.

Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>