f-denkena/rclone
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

serve nfs: advertise AUTH_UNIX so the *BSD NFS clients can mount

Browse Source 
The mount served fine on Linux and macOS but *BSD kernel NFS clients
refused it with "Authentication error". The MOUNT reply only ever
offered AUTH_NULL, and the OpenBSD/FreeBSD/NetBSD clients won't mount a
server unless AUTH_UNIX is among the offered flavors.

Add AUTH_UNIX to the advertised list. The server still doesn't inspect
the credential (there's no per-user access control here) so the AUTH_UNIX
cred the client then sends is read as an opaque blob and ignored, exactly
as the AUTH_NULL one was. No behaviour change for existing Linux/macOS
clients, and OpenBSD now mounts and reads files over the share.

Verified on a real OpenBSD 7.9 arm64 VM: registered rclone's server in
portmap and ran "mount_nfs -T localhost:/ /mnt"; the mount now succeeds
(MOUNT and GetAttr RPCs go through) and files read back correctly through
the mount, where before it stopped at the auth stage.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Socialpranker
2026-07-30 19:54:16 +01:00
committed by Nick Craig-Wood
co-authored by Claude Opus 4.8
parent b78a43d05f
commit 9d41369d77
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/serve/nfs/handler.go
+7 -1
View File
@@ -64,7 +64,13 @@ func NewHandler(ctx context.Context, vfs *vfs.VFS, opt *Options) (handler nfs.Ha
// looked up and must be a plain directory (not a regular file, symlink or
// other special node).
func (h *Handler) Mount(ctx context.Context, conn net.Conn, req nfs.MountRequest) (status nfs.MountStatus, hndl billy.Filesystem, auths []nfs.AuthFlavor) {
auths = []nfs.AuthFlavor{nfs.AuthFlavorNull}
// Advertise both AUTH_NULL and AUTH_UNIX. The server doesn't inspect the
// credential either way (there is no per-user access control here), but the
// *BSD kernel NFS clients refuse to mount a server that only offers
// AUTH_NULL and require AUTH_UNIX to be on offer, so listing it lets them
// mount. The AUTH_UNIX credential they then send is read as an opaque blob
// and ignored, exactly as the AUTH_NULL one was.
auths = []nfs.AuthFlavor{nfs.AuthFlavorNull, nfs.AuthFlavorUnix}
cleaned := path.Clean("/" + string(req.Dirpath))
if cleaned == "/" {
return nfs.MountStatusOk, h.billyFS, auths