Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     Jeff Layton <jlayton@kernel.org>
CC:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        "trondmy@hammerspace.com" <trondmy@hammerspace.com>
Subject: Re: [PATCH v2 00/15] RPC-with-TLS client side
Thread-Topic: [PATCH v2 00/15] RPC-with-TLS client side
Thread-Index: AQHYebVuZqvrXSpmmEGc/2a/uQZ/m6165IuAgAAUJ4A=
Date:   Tue, 12 Jul 2022 13:48:25 +0000
Message-ID: <F713FAF6-8910-4BA2-86C6-C5B09223AC0F@oracle.com>
References: <165452664596.1496.16204212908726904739.stgit@oracle-102.nfsv4.dev>
 <c9b6787ba9154d1f4c2bf25387a35453ad20badb.camel@kernel.org>
In-Reply-To: <c9b6787ba9154d1f4c2bf25387a35453ad20badb.camel@kernel.org>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?mdT5Sp5mx7PdBaJiJ9YRZ8RYaMKTIzV6SWtIbTn1Cen0ymf5A5GADdIQXVdr?=
 =?us-ascii?Q?mZchaYsWUdzGWVChw7+/7LcFqGZwsq42A+fLI3GiBRFVqjFKVMVAfQUfYrXb?=
 =?us-ascii?Q?dohu1zdl+MmU63lYh2vxyUkxf6efp45kUUM9FL8QxxvPmBM+NwFFCYUt2gG7?=
 =?us-ascii?Q?q8zYdvPIm20nATCGeY+boEOCHj2rg6KjauDmxutRFVB4IWaHvkJWe6a/26Pb?=
 =?us-ascii?Q?Ws9w7q/Kb3KHCSCSUfsCN0vXi98Ij7AnWCBtyXIAoQprtYeXBb9EVBCu+ymc?=
 =?us-ascii?Q?KZAQph2MicDP5FXQ3Q+nFVUZCKsHjxOCpCqib7614qrbyo1kP+Xw0xBPwEqm?=
 =?us-ascii?Q?eUuTZicOuZqAkHoNApDZNGsa07TNoR5F/WnzHmA99z2+wbALC+UkoxC1xMOi?=
 =?us-ascii?Q?pAa2tFoFNMMjEhE8a0qlzfFFKfgpbBR2mt0X31sATc0FqjDIa1d4SCBeydAD?=
 =?us-ascii?Q?8CJYXLCZEE0XK+QokjMr/YzzbtWkVOU3/8DbtRI07KkkYuLGtmK5L5yL2z8m?=
 =?us-ascii?Q?USjhao0exvMpE9jNUktEy2Q5o5pERKJkN5/akybtnMsmBob+XONgpzfkqIE/?=
 =?us-ascii?Q?2JOZAz+6gbP39KJzYoif4sIkyDci/ClDnOhgeRujmY+vhT3hfR2TTjnbQ26b?=
 =?us-ascii?Q?4BWQeMOrpcfQAnDTp9U+PzaERgP5WPCU1Us1x0ZCZ99PkuBtGalaFJyHea23?=
 =?us-ascii?Q?cDe11wf4sJE8F5wRnc7ohQ5hKCoB29f3SE1h9pgrO+hNFNre3b+vo0SOB2Fd?=
 =?us-ascii?Q?ndHBrCQu71Ay7OtxDdf8RcPy+0Joz3LbNytPDxgli5vY/UVih8WLuJzI2gIL?=
 =?us-ascii?Q?Qzg1llbJP1pQJQvtNMk+XPfhjXCRh8beFSqIM63uhMCBXXe7j9JkUDijWUkR?=
 =?us-ascii?Q?1aexY2ziG2EwcZyaqUfwEEJt1zuqkJew7oRdya9soRcn/eqBT+a3C6hbQA8e?=
 =?us-ascii?Q?Xh23pmMqxVO4b8kJfb3QFi79s+238z6geTxVDGzbP8sCvQoPCxOFSM9IYD2h?=
 =?us-ascii?Q?5qMbIQ4c9gDehAtMittKQi7CPWatKhWHaN1wjrb1pyE2PyWrKO7jiGiVQzsN?=
 =?us-ascii?Q?LV7URX6TKPdOvzVZy8FqqYzgE5mEE/X+qPTyE92BOpvBJ2h5Jq6taK7nGKqi?=
 =?us-ascii?Q?lY1fV2Wngor1VkGrqTQEDtRY4mQ2rBckksmRSw0dtSsWK92rfrMJEPUTOtG3?=
 =?us-ascii?Q?jNM0ci6UPI/yP8FnGUAB9EHiX9t1MxKfHrMiZpRZ8vYUqKPRVOpgC734jwnG?=
 =?us-ascii?Q?575bBxDPmJ9BxmqSHs+dNwWlpit7KMGBrhg1olGIijiUeipyOwOQgxyaQHCt?=
 =?us-ascii?Q?KKHukC+WaQfjrgmgRDA0a+aFaeZwWKCtDTCDNWXbwwnAIEJcZBcjWAdEy6ZF?=
 =?us-ascii?Q?NR/7N985iI7R5OzFNXPN+c8dh6+28/nwA1tKoIJyrY2niQ26caTLsCn05V99?=
 =?us-ascii?Q?uBTuOs6eUpXRpS+Sm/9POcDc9ACBeuZHiuFR3OATRSoyqMZk9s0NdwuJraDe?=
 =?us-ascii?Q?cVrQ22My/3EuqLmTx3NBf0s1zRn4BlU/GcBMYtPws5JIZj6+C4eqOez+cz8+?=
 =?us-ascii?Q?YNqvbf7gP00XRdOSq+lsA4GB2vfhKEIYstQmU2P3DrvodwRqyDmUWRujY2bF?=
 =?us-ascii?Q?xw=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <E14BD03AC743E64D8971A4E082992EA2@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5128.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: a0aa9ab9-2cc6-44b0-00cc-08da640d31c3
X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Jul 2022 13:48:25.8249
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: V0q1mc5tB25XaVmNGDDTkmttSUe+v9AMqvcoDUD2RzvMAupzOHuyHX2czDuUfgY8jUKufizYxQPEQ0bixPp/Ag==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN0PR10MB5333
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.517,18.0.883
 definitions=2022-07-12_08:2022-07-12,2022-07-12 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 mlxlogscore=999 mlxscore=0
 suspectscore=0 phishscore=0 spamscore=0 malwarescore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2206140000
 definitions=main-2207120053
X-Proofpoint-GUID: OlNTO9PEpwr-V3rXBqEhPr7oOK2EqBnZ
X-Proofpoint-ORIG-GUID: OlNTO9PEpwr-V3rXBqEhPr7oOK2EqBnZ
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> On Jul 12, 2022, at 8:36 AM, Jeff Layton <jlayton@kernel.org> wrote:
>=20
> On Mon, 2022-06-06 at 10:50 -0400, Chuck Lever wrote:
>> Now that the initial v5.19 merge window has closed, it's time for
>> another round of review for RPC-with-TLS support in the Linux NFS
>> client. This is just the RPC-specific portions. The full series is
>> available in the "topic-rpc-with-tls-upcall" branch here:
>>=20
>> https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git
>>=20
>> I've taken two or three steps towards implementing the architecture
>> Trond requested during the last review. There is now a two-stage
>> connection establishment process so that the upper level can use
>> XPRT_CONNECTED to determine when a TLS session is ready to use.
>> There are probably additional changes and simplifications that can
>> be made. Please review and provide feedback.
>>=20
>> I wanted to make more progress on client-side authentication (ie,
>> passing an x.509 cert from the client to the server) but NFSD bugs
>> have taken all my time for the past few weeks.
>>=20
>>=20
>> Changes since v1:
>> - Rebased on v5.18
>> - Re-ordered so generic fixes come first
>> - Addressed some of Trond's review comments
>>=20
>> ---
>>=20
>> Chuck Lever (15):
>>      SUNRPC: Fail faster on bad verifier
>>      SUNRPC: Widen rpc_task::tk_flags
>>      SUNRPC: Replace dprintk() call site in xs_data_ready
>>      NFS: Replace fs_context-related dprintk() call sites with tracepoin=
ts
>>      SUNRPC: Plumb an API for setting transport layer security
>>      SUNRPC: Trace the rpc_create_args
>>      SUNRPC: Refactor rpc_call_null_helper()
>>      SUNRPC: Add RPC client support for the RPC_AUTH_TLS auth flavor
>>      SUNRPC: Ignore data_ready callbacks during TLS handshakes
>>      SUNRPC: Capture cmsg metadata on client-side receive
>>      SUNRPC: Add a connect worker function for TLS
>>      SUNRPC: Add RPC-with-TLS support to xprtsock.c
>>      SUNRPC: Add RPC-with-TLS tracepoints
>>      NFS: Have struct nfs_client carry a TLS policy field
>>      NFS: Add an "xprtsec=3D" NFS mount option
>>=20
>>=20
>> fs/nfs/client.c                 |  14 ++
>> fs/nfs/fs_context.c             |  65 +++++--
>> fs/nfs/internal.h               |   2 +
>> fs/nfs/nfs3client.c             |   1 +
>> fs/nfs/nfs4client.c             |  16 +-
>> fs/nfs/nfstrace.h               |  77 ++++++++
>> fs/nfs/super.c                  |   7 +
>> include/linux/nfs_fs_sb.h       |   5 +-
>> include/linux/sunrpc/auth.h     |   1 +
>> include/linux/sunrpc/clnt.h     |  15 +-
>> include/linux/sunrpc/sched.h    |  32 ++--
>> include/linux/sunrpc/xprt.h     |   2 +
>> include/linux/sunrpc/xprtsock.h |   4 +
>> include/net/tls.h               |   2 +
>> include/trace/events/sunrpc.h   | 157 ++++++++++++++--
>> net/sunrpc/Makefile             |   2 +-
>> net/sunrpc/auth.c               |   2 +-
>> net/sunrpc/auth_tls.c           | 120 +++++++++++++
>> net/sunrpc/clnt.c               |  34 ++--
>> net/sunrpc/debugfs.c            |   2 +-
>> net/sunrpc/xprtsock.c           | 310 +++++++++++++++++++++++++++++++-
>> 21 files changed, 805 insertions(+), 65 deletions(-)
>> create mode 100644 net/sunrpc/auth_tls.c
>>=20
>> --
>> Chuck Lever
>>=20
>=20
> Chuck,
>=20
> How have you been testing this series? It looks like nfsd support is not
> fully in yet, so I was wondering if you had a 3rd party server. I'd like
> to do a little testing with this, and was wondering what I needed to
> cobble together a test rig.

Ben Coddington has an ngnix module to support RPC-with-TLS that can
front-end a stock Linux NFSD. Rick has a FreeBSD server implementation
of RPC-with-TLS. Rick's probably taken his server down, but Ben's
server is still up on the bake-a-thon VPN.


--
Chuck Lever