OpenZFS (sharenfs export generation): When an NFS share is exported to IPv6 addresses via sharenfs, OpenZFS silently

Impact

When an NFS share is exported to IPv6 addresses via sharenfs, OpenZFS silently fails to parse the address and exports the dataset to everyone instead. The operator sees a restriction in the config that does not exist on the wire, so any host on the network mounts the dataset.

Who can reach it

Any host that can reach the NFS server, on any ZFS dataset whose sharenfs restriction was written with IPv6 addresses.

What to do

Upgrade OpenZFS past 2.0.3 and re-export the datasets, then verify the actual export list with exportfs -v rather than trusting the sharenfs property. Prefer expressing restrictions in /etc/exports directly, and audit any dataset that was shared with an IPv6 restriction.

References