Message-ID: <d5c93e97f10a8ae803efaad02559dd118e9b9b6f.camel@kernel.org>
Subject: Re: [PATCH v1 0/4] nfs-utils changes for RPC-with-TLS server
From:   Jeff Layton <jlayton@kernel.org>
To:     Chuck Lever <cel@kernel.org>, SteveD@redhat.com
Cc:     linux-nfs@vger.kernel.org
Date:   Tue, 21 Mar 2023 07:52:55 -0400
In-Reply-To: <167932279970.3437.7130911928591001093.stgit@manet.1015granger.net>
References: <167932279970.3437.7130911928591001093.stgit@manet.1015granger.net>
Content-Type: text/plain; charset="ISO-8859-15"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.46.4 (3.46.4-1.fc37) 
MIME-Version: 1.0
Precedence: bulk

On Mon, 2023-03-20 at 10:35 -0400, Chuck Lever wrote:
> Hi Steve-
>=20
> This is server-side support for RPC-with-TLS, to accompany similar
> support in the Linux NFS client. This implementation can support
> both the opportunistic use of transport layer security (it will be
> used if the client cares to) and the required use of transport
> layer security (the server requires the client to use it to access
> a particular export).
>=20
> Without any other user space componentry, this implementation will
> be able to handle clients that request the use of RPC-with-TLS. To
> support security policies that restrict access to exports based on
> the client's use of TLS, modifications to exportfs and mountd are
> needed. These can be found here:
>=20
> git://git.linux-nfs.org/projects/cel/nfs-utils.git
>=20
> They include an update to exports(5) explaining how to use the new
> "xprtsec=3D" export option.
>=20
> The kernel patches, along with the the handshake upcall, are carried
> in the topic-rpc-with-tls-upcall branch available from:
>=20
> https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git
>=20
> This was posted under separate cover.
>=20
> ---
>=20
> Chuck Lever (4):
>       libexports: Fix whitespace damage in support/nfs/exports.c
>       exports: Add an xprtsec=3D export option
>       exportfs: Push xprtsec settings to the kernel
>       exports.man: Add description of xprtsec=3D to exports(5)
>=20
>=20
>  support/export/cache.c       |  15 ++++++
>  support/include/nfs/export.h |   6 +++
>  support/include/nfslib.h     |  14 +++++
>  support/nfs/exports.c        | 100 ++++++++++++++++++++++++++++++++---
>  utils/exportfs/exportfs.c    |   1 +
>  utils/exportfs/exports.man   |  45 +++++++++++++++-
>  6 files changed, 172 insertions(+), 9 deletions(-)
>=20

Nice work, Chuck! This all looks pretty straightforward. I have a
(minor) concern about potentially blocking nfsd threads for up to 20s in
a handshake, but this seems like a good place to start.
--=20
Jeff Layton <jlayton@kernel.org>