From eb7056dafdd67afaed295806608f5235c2bd876d Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Fri, 30 Oct 2026 23:02:41 +0100 Subject: [PATCH] fix(storage): keep the NFS client off the ports the platform publishes Main CI run 40976399687, socialhome#0 (swarm, tor, centos): the CLI tests of svc-net-tor (onion:25 "socks CONNECT failed with reply 0x01") and web-app-stalwart (probe_mail relay: ConnectionRefusedError on port 25) failed. dockerd on the manager had aborted the whole ingress program of the mail stack: Failed to add ingress: failed to program ingress ports: failed to bind host port 0.0.0.0:993/tcp: address already in use /proc/net/tcp named the squatter: 192.168.244.10:993 -> :2049, the node's own NFS client. The mount carries no noresvport, so the kernel drew a source port from the 665-1023 reserved window and landed on imaps. None of 25/465/993/995/4190/8095 got a DNAT rule or a docker-proxy listener while every other published port did, and stalwart still reported healthy because its healthcheck runs inside the container. 993 and 995 are the only published ports inside that window, so this is luck of the draw on any NFS-backed swarm host that runs the mail role. mount_opts now emits noresvport. insecure on the kernel-flavor export is the other half: kernel nfsd defaults to secure and answers a mount from an unprivileged source port with EACCES. It reaches the kernel flavor only; ganesha already accepts unprivileged clients. What it costs: the next deploy of every existing NFS client sees a pending opts change and remounts the shared state; a host-side job holding that path at that instant fails loudly. A plain remount may keep a running mount on its old reserved port until the next real mount. Port of f46c4d0bab from feature/store-i18n, applied identically so the later store-i18n -> main merge stays conflict-free. Co-Authored-By: Claude Opus 5.5 --- roles/svc-storage-nfs-server/vars/main.yml | 2 +- .../python/plugins/lookup/test_nfs_lookups.py | 6 +++--- tests/unit/python/utils/storage/test_nfs.py | 17 ++++++++++++++--- utils/storage/nfs.py | 2 +- 4 files changed, 19 insertions(+), 8 deletions(-) diff --git a/roles/svc-storage-nfs-server/vars/main.yml b/roles/svc-storage-nfs-server/vars/main.yml index 48b66a5f26..d3494e35a4 100644 --- a/roles/svc-storage-nfs-server/vars/main.yml +++ b/roles/svc-storage-nfs-server/vars/main.yml @@ -13,7 +13,7 @@ SVC_STORAGE_NFS_SERVER_SERVICE: Archlinux: nfs-ganesha SVC_STORAGE_NFS_SERVER_STATE_EXPORT_OPTIONS: >- - rw,sync,no_subtree_check,no_root_squash,no_all_squash + rw,sync,insecure,no_subtree_check,no_root_squash,no_all_squash SVC_STORAGE_NFS_SERVER_STATE_ALLOWED_CIDRS: - "*" diff --git a/tests/unit/python/plugins/lookup/test_nfs_lookups.py b/tests/unit/python/plugins/lookup/test_nfs_lookups.py index 835eba5152..ad70d95efa 100644 --- a/tests/unit/python/plugins/lookup/test_nfs_lookups.py +++ b/tests/unit/python/plugins/lookup/test_nfs_lookups.py @@ -35,19 +35,19 @@ class TestNfsLookups(unittest.TestCase): def test_mount_opts_github_soft(self): self.assertEqual( _run("nfs_mount_opts", BASE), - "vers=4,rw,soft,timeo=50,retrans=3", + "vers=4,rw,noresvport,soft,timeo=50,retrans=3", ) def test_mount_opts_host_hard(self): self.assertEqual( _run("nfs_mount_opts", {**BASE, "RUNTIME": "host"}), - "vers=4,rw,hard,timeo=600", + "vers=4,rw,noresvport,hard,timeo=600", ) def test_mount_opts_act_soft(self): self.assertEqual( _run("nfs_mount_opts", {**BASE, "RUNTIME": "act"}), - "vers=4,rw,soft,timeo=50,retrans=3", + "vers=4,rw,noresvport,soft,timeo=50,retrans=3", ) diff --git a/tests/unit/python/utils/storage/test_nfs.py b/tests/unit/python/utils/storage/test_nfs.py index 5ab4bd3b7c..10b7e9609f 100644 --- a/tests/unit/python/utils/storage/test_nfs.py +++ b/tests/unit/python/utils/storage/test_nfs.py @@ -22,17 +22,28 @@ class TestNfsHelpers(unittest.TestCase): def test_mount_opts_lab_runtimes_soft(self): for rt in ("dev", "act", "github"): - self.assertEqual(mount_opts(4, rt), "vers=4,rw,soft,timeo=50,retrans=3") + self.assertEqual( + mount_opts(4, rt), "vers=4,rw,noresvport,soft,timeo=50,retrans=3" + ) def test_mount_opts_prod_hard(self): - self.assertEqual(mount_opts(4, "host"), "vers=4,rw,hard,timeo=600") + self.assertEqual(mount_opts(4, "host"), "vers=4,rw,noresvport,hard,timeo=600") + + def test_mount_opts_keep_the_client_off_published_privileged_ports(self): + """A reserved source port can land on imaps/993 or pop3s/995 and then + blocks the whole ingress port set of the mail stack.""" + for version in (3, 4): + for runtime in ("dev", "act", "github", "host"): + self.assertIn("noresvport", mount_opts(version, runtime)) def test_mount_opts_v4_carries_no_v3_locking_token(self): self.assertNotIn("local_lock", mount_opts(4, "host")) self.assertNotIn("nolock", mount_opts(4, "host")) def test_mount_opts_v3_still_disables_nlm(self): - self.assertEqual(mount_opts(3, "host"), "vers=3,rw,hard,timeo=600,nolock") + self.assertEqual( + mount_opts(3, "host"), "vers=3,rw,noresvport,hard,timeo=600,nolock" + ) def test_client_src_kernel_v4_is_root(self): self.assertEqual( diff --git a/utils/storage/nfs.py b/utils/storage/nfs.py index b483e6b21b..f9537aa724 100644 --- a/utils/storage/nfs.py +++ b/utils/storage/nfs.py @@ -61,7 +61,7 @@ def mount_opts(version, runtime): else "hard,timeo=600" ) locking = "" if int(version) >= 4 else ",nolock" - return f"vers={version},rw,{reliability}{locking}" + return f"vers={version},rw,noresvport,{reliability}{locking}" def client_src(server, version, flavor, state_path_value):