Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     Trond Myklebust <trondmy@hammerspace.com>
CC:     "linux-cifs@vger.kernel.org" <linux-cifs@vger.kernel.org>,
        "linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>,
        "linux-nvme@lists.infradead.org" <linux-nvme@lists.infradead.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "simo@redhat.com" <simo@redhat.com>,
        "ak@tempesta-tech.com" <ak@tempesta-tech.com>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        "borisp@nvidia.com" <borisp@nvidia.com>
Subject: Re: [PATCH RFC 00/15] Prototype implementation of RPC-with-TLS
Thread-Topic: [PATCH RFC 00/15] Prototype implementation of RPC-with-TLS
Thread-Index: AQHYU0SpuI21otIlHEi6aMaWB1g+e6z2lWsAgADRRwCAAC7JgIAAAZCA
Date:   Tue, 19 Apr 2022 18:53:43 +0000
Message-ID: <E7B440A0-FD0A-4F67-8238-CAE9A6882F10@oracle.com>
References: <165030062272.5246.16956092606399079004.stgit@oracle-102.nfsv4.dev>
 <962bbdf09f6f446f26ea9b418ddfec60a23aed8d.camel@hammerspace.com>
 <06AB6768-AA74-43AF-9B9A-D6580EA0AE86@oracle.com>
 <8597368113bcc38e605e9bbd11916a0ac8b7852d.camel@hammerspace.com>
In-Reply-To: <8597368113bcc38e605e9bbd11916a0ac8b7852d.camel@hammerspace.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?RFfS7K8E8cvc4XwEFLTXucq4CO3cvRcpVVBJY5G7f/6WcAjIWTbHiI4BpM32?=
 =?us-ascii?Q?acnLrBJC4owYKZAOJImahdSE1NtSwkQdq7IUR2kClWunphYdJhi3LnHdhn4+?=
 =?us-ascii?Q?D8ErMynjFI2k7kvXkTgivxrA5dAPYPcXBMoa2QCEgjE7smH3ZGxO1sSl1Xu8?=
 =?us-ascii?Q?Z3ra4MeJueUs8mRu6dg1bAlh3UY6YJUB6/f+Ig0V4a0Tw/NHfnmyc3mZlKvR?=
 =?us-ascii?Q?hcBZx4+wZVe5jYSGIuBN5UrKZIbPCfndWR/q9mNR0hP2UjIS/O/vERHXaZe+?=
 =?us-ascii?Q?RR6PPERTV7y6fKi41NmYgtFls+sV1Jby4HFvGiZCC8ahd9N9wH1aj925DJWa?=
 =?us-ascii?Q?sG/Xr2DO4nNkJNZTAx/u5el/NKuMK4E4YgZ2RfvnN0o3DjrvYXIKTM11uBtd?=
 =?us-ascii?Q?F95bRrQVEHXJJ52NC/z2Gi8wa/Wuf39evBMTRGyndgahkXpCSd8/QHefr6Yw?=
 =?us-ascii?Q?XWPBKiJvwn/lhyIYglRCPrcvpRufv3u2iruNZ8TMLbSM6I8f3AgaNE45dzxC?=
 =?us-ascii?Q?YqYPydcbdJ3ElaqTFcUdvjZLKUe50b5l3TCFXi12qJkpg7fP7etGswmHsTem?=
 =?us-ascii?Q?2hzVUBFSLi1PAghpAW0eeJ4s2YaLQhuqGrv+TT9fDCbIMPNHEjCgZXODGg0p?=
 =?us-ascii?Q?MmHiQMeiwJNctY79Wow+cUTYMxQwK3vXbXHoBbyXEvlq+DX/TjfDti1DxNul?=
 =?us-ascii?Q?YPq951d+LHyNErgEdGP4UW11VxZc4dMbXeFjqhi0/is/4GKJyCE5bZZLnEJb?=
 =?us-ascii?Q?fVU/rZlM42MAtB4E1vAx+DGcZa+3Ombze5zf9X4xJUYOZm144vUqbzhOgP13?=
 =?us-ascii?Q?Ffij8vl1px3nJLzK5IvrIiup0Hx1XfOZY3zaf1cIIGlUc9t6ydh4Tsc0nPe+?=
 =?us-ascii?Q?pIpHIpH50oKciqniNTmITRK62KAwqQuDXu8jggmRvadAQ4SGtSe13uxNeqDa?=
 =?us-ascii?Q?c2DBkwBB9zdXQtY1oQzBBUeHaTjsww9prnyKe9FcFYgrJzsN6vu/qLYuT1R6?=
 =?us-ascii?Q?fMTeeDTdouLUSAyFj4CXbDoBXT4Rxd3r8XO5CD8oYwKbggQSV46mm0rdP7BI?=
 =?us-ascii?Q?OTvhPCuv53PANt8g/8fySaIjJaT6nOPwvaQPFJ2Nj8j1zBikfU8m6SlZNoMl?=
 =?us-ascii?Q?nVfHWNMOVui2BwwL3SVgrgno3tdQsseV6FHz7hHVMVurnq/e9L+bdhy2wlHz?=
 =?us-ascii?Q?qISh97rgqnYc0eeDSduScBS+V6qutV9jLILqDsHYl/12sji8GGYuwEV0Niiy?=
 =?us-ascii?Q?sLCekhejLVW0aWO5BiD/BVARnZiIT13pGy5L8AHae0Xxpv4SG13HYbcX9e2c?=
 =?us-ascii?Q?g036sKp4E0BNO6WrzHoF6fAJQ4U012sT6Z7VOgciqIf7YFT0kd4itQ3/31Nw?=
 =?us-ascii?Q?HgDptKavUX7mbZuCu8LiY6Qnju20a2AJPzJKR36Ih3q8v4SrOs1jcbkqI8Gi?=
 =?us-ascii?Q?d210e8O7R2wqYAGqQPPMoQSeM+03I8nDSbgBYLUTH7E1qSr76M4DIgDyBIhM?=
 =?us-ascii?Q?boCm6kC35JA3h/z45+xdN4TXhXI9m3A9nv3L38xx5gDsNFhsc3sAawwXVvyy?=
 =?us-ascii?Q?zUUbJsbXpVjyU4HJvpDt1xmUf4f+mzE2hXrYvmXou1xXVIdxI/LOFgh7qjDX?=
 =?us-ascii?Q?fLNxoJ952FQteWqYRsxTXKKEJv5pzgC45zDOhxlpR4yycLEY93ajzOVtqeYv?=
 =?us-ascii?Q?VveZ+vq4i5rGFtFVC9pErjgPHdBfJ+XAsLxVcpnBA9pFG9Zy3ibaKkn/kLbK?=
 =?us-ascii?Q?wXarAYa4lQ9mVn67fbC3A7x+XX2t5U8=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <085117D7ADA568458E01E26535F64A7C@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5128.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c328ff99-aa62-49cb-1f71-08da2235ed3c
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Apr 2022 18:53:43.4160
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 9vJrBAKXMqLed+fIV8A12OWsVtHtRMUlYJBMT+IO42Rtz7qMnVUJ7SQKfjXgpSAA3+Y96jcbk4znjjr+0I2K0Q==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB4374
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.486,18.0.858
 definitions=2022-04-19_06:2022-04-15,2022-04-19 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 bulkscore=0 suspectscore=0
 malwarescore=0 mlxlogscore=999 adultscore=0 mlxscore=0 spamscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000
 definitions=main-2204190107
X-Proofpoint-GUID: YHWoQPy4dNxes-dH5An2QZM3DTc8kGFh
X-Proofpoint-ORIG-GUID: YHWoQPy4dNxes-dH5An2QZM3DTc8kGFh
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> On Apr 19, 2022, at 2:48 PM, Trond Myklebust <trondmy@hammerspace.com> wr=
ote:
>=20
> On Tue, 2022-04-19 at 16:00 +0000, Chuck Lever III wrote:
>> Hi Trond-
>>=20
>> Thanks for the early review!
>>=20
>>=20
>>> On Apr 18, 2022, at 11:31 PM, Trond Myklebust
>>> <trondmy@hammerspace.com> wrote:
>>>=20
>>> On Mon, 2022-04-18 at 12:51 -0400, Chuck Lever wrote:
>>>> This series implements RPC-with-TLS in the Linux kernel:
>>>>=20
>>>> https://datatracker.ietf.org/doc/draft-ietf-nfsv4-rpc-tls/
>>>>=20
>>>> This prototype is based on the previously posted mechanism for
>>>> providing a TLS handshake facility to in-kernel TLS consumers.
>>>>=20
>>>> For the purpose of demonstration, the Linux NFS client is
>>>> modified
>>>> to add a new mount option: xprtsec =3D [ none|auto|tls ] . Updates
>>>> to the nfs(5) man page are being developed separately.
>>>>=20
>>>=20
>>> I'm fine with having a userspace level 'auto' option if that's a
>>> requirement for someone, however I see no reason why we would need
>>> to
>>> implement that in the kernel.
>>>=20
>>> Let's just have a robust mechanism for immediately returning an
>>> error
>>> if the user supplies a 'tls' option on the client that the server
>>> doesn't support, and let the negotiation policy be worked out in
>>> userspace by the 'mount.nfs' utility. Otherwise we'll rathole into
>>> another twisty maze of policy decisions that generate kernel level
>>> CVEs
>>> instead of a set of more gentle fixes.
>>=20
>> Noted.
>>=20
>> However, one of Rick's preferences is that "auto" not use
>> transport-layer security unless the server requires it via
>> a SECINFO/MNT pseudoflavor, which only the kernel would be
>> privy to. I'll have to think about whether we want to make
>> that happen.
>=20
> That sounds like a terrible protocol hack. TLS is not an authentication
> flavour but a transport level protection.

Fair enough. We've been discussing this on nfsv4@ietf.org, and
it's certainly not written in stone yet.

I invite you to join the conversation and share your concerns
(and possibly any alternative solutions you might have).


> That said, I don't see how this invalidates my argument. When told to
> use TLS, the kernel client can still return a mount time error if the
> server fails to advertise support through this pseudoflavour and leave
> it up to userspace to decide how to deal with that.

Sure. I'm just saying I haven't thought it through yet. I don't
think it will be a problem to move more (or all) of the transport
security policy to mount.nfs.


--
Chuck Lever