nfs-utils: nfs-fh-verify signed filehandles

We've had a lot of folks configure signed filehandles, and then wonder "Is this thing actually working?". Given the various filehandle lengths and types, it can be pretty difficult to know if the kernel is actually correctly signing its filehandles. Claude and I wrote this tool that allows anyone to verify the correct functioning of filehandle signing given the original key and a list of filehandles.

Beyond that, this tool shows a way to monitor the configured state of signed filehandles in a distributed installation.

Benjamin Coddington (1):
nfs-fh-verify: add tool to validate kNFSD filehandle signatures

 configure.ac                          |   7 +
 tools/Makefile.am                     |   4 +
 tools/nfs-fh-verify/Makefile.am       |  10 +
 tools/nfs-fh-verify/main.c            | 337 ++++++++++++++++++++++++++
 tools/nfs-fh-verify/nfs-fh-verify.man | 171 +++++++++++++
 5 files changed, 529 insertions(+)
 create mode 100644 tools/nfs-fh-verify/Makefile.am
 create mode 100644 tools/nfs-fh-verify/main.c
 create mode 100644 tools/nfs-fh-verify/nfs-fh-verify.man

base-commit: a806c9d65662ecf5d40c00d60a514e13ada8d76e

2.53.0

knfsd optionally signs filehandles with an 8-byte SipHash-2-4 MAC for exports marked with the sign_fh option (see fs/nfsd/nfsfh.c, kernel commit 2a83ffc55750). When triaging captures or filehandle issues it is useful to confirm offline that a given filehandle's MAC verifies under the same key the running server was configured with.

Add a small standalone utility, nfs-fh-verify, that:

- reads filehandles in ASCII hex from stdin (one per line, tolerant of

    "0x" prefixes, ':' or whitespace separators, '#' comments, and
    mixed case);
  - derives the 128-bit SipHash key from a key file using the existing
    hash_fh_key_file() helper, matching what nfsdctl pushes to the
    kernel via NFSD_A_SERVER_FH_KEY;
  - recomputes the trailing 8-byte MAC over fh[0..n-8] and reports
    OK, BAD, or MALFORMED for each filehandle;

- exits 0 if every parsed filehandle verified, 1 on any BAD/MALFORMED, or 2 on setup error.

The SipHash-2-4 implementation is embedded as a small reference port of the kernel's lib/siphash.c, validated at startup against two published Aumasson/Bernstein test vectors so that an incorrect build refuses to emit verdicts rather than silently mis-reporting.

Wired in behind --disable-nfs-fh-verify (default on), mirroring the existing nfsrahead pattern.

---
 configure.ac                          |   7 +
 tools/Makefile.am                     |   4 +
 tools/nfs-fh-verify/Makefile.am       |  10 +
 tools/nfs-fh-verify/main.c            | 337 ++++++++++++++++++++++++++
 tools/nfs-fh-verify/nfs-fh-verify.man | 171 +++++++++++++
 5 files changed, 529 insertions(+)
 create mode 100644 tools/nfs-fh-verify/Makefile.am
 create mode 100644 tools/nfs-fh-verify/main.c
 create mode 100644 tools/nfs-fh-verify/nfs-fh-verify.man

index 8ca06fd62b47..1fc8f8cb9552 100644
@@ -247,6 +247,12 @@ AC_ARG_ENABLE(nfsrahead,
 		PKG_CHECK_MODULES([LIBMOUNT], [mount])
 	fi
 
+AC_ARG_ENABLE(nfs-fh-verify,
+	[AS_HELP_STRING([--disable-nfs-fh-verify],[disable nfs-fh-verify command @<:@default=no@:>@])],
+	enable_nfs_fh_verify=$enableval,
+	enable_nfs_fh_verify="yes")
+	AM_CONDITIONAL(CONFIG_NFS_FH_VERIFY, [test "$enable_nfs_fh_verify" = "yes" ])
+
 AC_ARG_ENABLE(nfsdcltrack,
 	[AS_HELP_STRING([--enable-nfsdcltrack],[enable NFSv4 clientid tracking programs @<:@default=no@:>@])],
 	enable_nfsdcltrack=$enableval,

@@ -753,6 +759,7 @@ AC_CONFIG_FILES([
 	tools/mountstats/Makefile
 	tools/nfs-iostat/Makefile
 	tools/nfsrahead/Makefile
+	tools/nfs-fh-verify/Makefile
 	tools/rpcctl/Makefile
 	tools/nfsdclnts/Makefile
 	tools/nfsconf/Makefile

index 48fd0cdf1f83..4478b3cfd664 100644
@@ -16,6 +16,10 @@ if CONFIG_NFSRAHEAD
 OPTDIRS += nfsrahead
 endif
 
+if CONFIG_NFS_FH_VERIFY
+OPTDIRS += nfs-fh-verify
+endif
+
 SUBDIRS = locktest rpcdebug nlmtest mountstats nfs-iostat rpcctl nfsdclnts $(OPTDIRS)
 
 MAINTAINERCLEANFILES = Makefile.in

new file mode 100644
index 000000000000..6403d9b9cab7
@@ -0,0 +1,10 @@
+## Process this file with automake to produce Makefile.in
+
+sbin_PROGRAMS = nfs-fh-verify
+nfs_fh_verify_SOURCES = main.c
+nfs_fh_verify_LDADD = ../../support/nfs/libnfs.la
+
+man8_MANS = nfs-fh-verify.man
+EXTRA_DIST = $(man8_MANS)
+
+MAINTAINERCLEANFILES = Makefile.in

2.53.0

Do you know if wireshark might be able to handle this verification instead? It might be quite useful to see a "FH Verified" on every RPC in a network capture.

Chuck Lever

Great idea - I'm sure it would be able to do so. If we ever change the way we hash the fh-key-file in nfs-utils, we'd have a wireshark drift problem. But, its unlikely we'd change it in nfs-utils and trash everyone's existing filehandles.

We'd have to build an interface to point it at the fh-key-file of course - would that constant reconfiguration in wireshark make it less useful than this utility?

I have a slight preference for this tool in the near-term because it immediately solves my problem rather than having to wait for distros to downstream wireshark work.

Ben

Committed... (tag: nfs-utils-3-1-2.rc1

steved.