On Fri, Jul 10, 2015 at 09:22:24AM -0400, Tom Talpey wrote: > and it is enabled only when the RDMA Read is active. ??? How is that done? ib_get_dma_mr is defined to return a remote usable rkey that is valid from when it it returns until the MR is destroyed. NFS creates one mr early on, it does not seem to make one per RDMA READ? For the proposed iSER patch the problem is very acute, iser makes a single PD and phys MR at boot time for each device. This means there is a single machine wide unchanging rkey that allows remote physical memory access. An attacker only has to repeatedly open QPs to iSER and guess rkey values until they find it. Add in likely non-crypto randomness for rkeys, and I bet it isn't even that hard to do. So this seems to be a catastrophic security failing. > > From there, it is a logical wish: If Steve is going to FRMR'ize iSER > >to be acceptable security wise, I'd rather see that work done on in a > >general way. Hence the API discussion. > > Well, it's important to realize that NFS already does the Right Thing. > So it isn't actually an urgent issue. There is time to discuss. It depends on what is going on with iWarp iSER. If the iWarp community thinks it should go ahead insecurely then fine, put a giant warning in dmesg and go ahead, otherwise iWarp needs to address this difference with a proper generic API, which appears, must wrapper ib_post_send. Harder job :\ I'm sorry Steve for leading you down the wrong path with these flags, I did not fully realize exactly what the iWarp difference was at the start :( Jason -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
