Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     Steve Dickson <steved@redhat.com>
CC:     Jeff Layton <jlayton@kernel.org>, Chuck Lever <cel@kernel.org>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Subject: Re: [PATCH v1 0/4] nfs-utils changes for RPC-with-TLS server
Thread-Topic: [PATCH v1 0/4] nfs-utils changes for RPC-with-TLS server
Thread-Index: AQHZWzlAXSqCgHySYk+ZhP0eJ9zOUa8FIOaAgAOKbACAAAErgIABm90AgAAVC4A=
Date:   Fri, 24 Mar 2023 19:50:46 +0000
Message-ID: <A6DA5D88-5DA8-4F19-B07C-52B32F41A962@oracle.com>
References: <167932279970.3437.7130911928591001093.stgit@manet.1015granger.net>
 <d5c93e97f10a8ae803efaad02559dd118e9b9b6f.camel@kernel.org>
 <da936d7d-a864-a2ff-64a4-a295653a6aa7@redhat.com>
 <7AC1BDBB-B6E3-49A8-A468-C045F0218495@oracle.com>
 <89a49550-d7f2-22df-5f6d-b9b8c66604de@redhat.com>
In-Reply-To: <89a49550-d7f2-22df-5f6d-b9b8c66604de@redhat.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?KToqD05WgRr1wgB7Rln92Nbz6l7IEWPETu+lrcCZ54M41l8xV9ZNEOjZMzQU?=
 =?us-ascii?Q?rR0vG5wX+qv4TuymsvAPmBkGN+6Qf2xhElbYmzID0zh/U4AscNI/iGoidoje?=
 =?us-ascii?Q?ygRgfk9Dv763/ga1u+wF4xpgdmHBBIuAvd/zyYoFrWxYfz3B058bdWvTHC92?=
 =?us-ascii?Q?/3k0/bceyBz+YhiYdn0bhtWBH9t5/rKNouT5VnnD09UU8dG+R++Vvy29SLld?=
 =?us-ascii?Q?cenY+o3Vyqes3LRB43KcOqjrtZa5mHJTplzSJ+fVXOSbHwk9fK82RkEuK0nV?=
 =?us-ascii?Q?mwBnVSiVUjYDaD2ecgU37+veJup4frcQ8OSa6NrtjNpD9WEnwalgVNiQXhpB?=
 =?us-ascii?Q?SlKrzZyjRhaVvVhvZRQA6JTCa4uDA7H87fnmIhBdbOgG2YMIbSHZCo71Hqp8?=
 =?us-ascii?Q?pXv4gII2PmZc2C9i7AYeRZxXCgwXjiK0ivzD8yF0IyhRXD/JSHhCK++EnV4S?=
 =?us-ascii?Q?x4hBb34kiH9Zp98y40ogJ8IOgXb7V1zplx/hvuxMfoPQMU85haX4Wl8Ywse/?=
 =?us-ascii?Q?WMevKNla7T0MihBs/ZRIKjtFdqftxW72ro04V+6iyI6iuDCtuk0GHSCfftbs?=
 =?us-ascii?Q?cFhQaSCyS4tTUIsVqCueeVsYNS5wU5HaG/Y8ZXHIEcWQ26TredwZrkI+Tqie?=
 =?us-ascii?Q?zRNclC0KIJt4vmxgV/Vcc+9mvFrOXcMfsOJFpgcU/Sazhx0SnHLB5lIM9Eh0?=
 =?us-ascii?Q?ouBQZTzHRYmZ0HztexlweeJFn9i6rbMb0KsQFFsC2RyS8qQuAeU+SMtdujYU?=
 =?us-ascii?Q?g/EvgIdkT6rPHqRBU48ZopLvyHBXHltcAmZ+bJ2Z4OIn3Sh+3celnQUEJbEW?=
 =?us-ascii?Q?wXq/VGHonEB8084q9UI+rNYOElEyRpQPtdmdBUVn6Siu/9oyq+GYMKpgG6qM?=
 =?us-ascii?Q?osjNPii6UX6KF7AXTLJJNluTh1sHepsBJuID8kKVFIDueKqVSigmJ4ncFfoj?=
 =?us-ascii?Q?Vj/DEElUrJMhRMMOdJO7af1ntCEItnk9Haxd5jbXLPEl4guN4vzIvf35JMO4?=
 =?us-ascii?Q?vRckzrPTQIQzeQKoDTYnObC2cwpP7HCxLBtUidX7zX3vvwxPcxNhOe3Sq7Iw?=
 =?us-ascii?Q?r+m6Cnmh/BqfzHHz9NF9Fq2FoPbgElKmQSsbrKbJDhXMpasY5f2ohRzpibTK?=
 =?us-ascii?Q?04GirTqY3D3WcNDLNZL5+y44xpmd71qNbYywSCZdoQY/5YJ+vk9fOztsPu5G?=
 =?us-ascii?Q?PlVhl1wbv+7gnWV4E1odP7Z9lItSrnWnXBzSVfoUYTWLGVV4jxUM+dpzXCJp?=
 =?us-ascii?Q?91PZL8medbWoiI+wuY/WLZD3Fbhf0YHcu/ASndoRmDpvabciS/l59pSwZTs0?=
 =?us-ascii?Q?/LBqNc3B/R2dgsZdd1IqhakUHEUHwi7gYBbVyjxIoGs8LVgpYKA9Oz9HJ5BM?=
 =?us-ascii?Q?1ixQBQ9PTpdhFJgeYtrL2kSjt6pDem1cNrwTFJh+UhEa7UaY8r4Ygn8VWkV1?=
 =?us-ascii?Q?aNTfBBCsOEnh7EBZirtveXF9H9uRoFtxTII1C+mGo/M03XMNLBcbqdpOwJe/?=
 =?us-ascii?Q?5UoPBXs2ORRDopMir3Kh3dKEwQufGPV4I7IEF3n5OsSx84GgLnoLvW2I3YFV?=
 =?us-ascii?Q?Vivyq8/8EO7CMKw3PBLM1vJxpgo46UyhK5LfR5a5ak3694VYU7tbiOjZQ+9E?=
 =?us-ascii?Q?8w=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <C14E6EF9859C6049BD4B8ED20B1FB608@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 6wz6AcVPtdjif1Ow3op78KIlER2DQw/E5T3KL03ZdhYJWA+/MX3It0Dl4Qgf/wvKbzN+KGA9J9o9t5LwxInY3Bz7zU8mF/Kta4tQkyU6WR6D0wabOLdAI61oj5jffwQ2fb31PHaYD0OYoWNkh7ktCZRJr0VHw+q8i7I+P5ixXewVCU23Djw/Sspk1aA+BowfrqQQv0OJ9LrW2ZotKNNHMPwnr1C49bzQ4/yUX85m7HKbSUu9+L6EOLqqVvpxvfZZnKPfxvsPAAmRYBSG0WIJtCN4BW43rb3O+JGF7JBslXLAXZXdMKzfff/iCJyI0Bq27QuHG5MxIam4nMjXo+9FRRGqj24GDscYQ7tvx2XhHz0eWFGyFxTHG8SHTRahsJXBqRkBKSxzslhgiFZqlDFlR+YHx3gWJzkJGsN9P95FrfS7PJ9AZnce+v3x5n8njWfCySx+DNjKw1zQl27mmsZi7A2U0u6IUIwKLm4Nte2E5rFowssJlBGc8XH6PUOTxQzB+3tOnqjU86MFysVV245T1bsx1AKONssh1khzG/EMMidHQ83Z84aZPxtbrMPHqSsOQIROh6xiFEPqN5g41nrMhmUgiNGA7+XTyr8xflq0TRVQDPn2WvMjbo6maJ7zbxX7fxtiR/mKdVq+DWXuiOSOYvepXojTXZcy7g3VQA88aFxfP/7aMILoBIY4sY5a+m+jv4TiBajlR221bK3vKaiQM2ozTnyJ6KaR3qi1bv9Rb99zsq5HTTA7ccTijg6Ghl0UqZCNfZy8s6mq4tg/xNM7tjdJGFLHouRESlEUHI8yXGldOhi4QcKeOh9p15XqeGaz
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5128.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b48bcc74-0d21-4cc7-16a8-08db2ca10f55
X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Mar 2023 19:50:46.1491
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 12R85Fc26DuQwHSxFhy6/xvaA95WOnI4vMyUWY+hryf6AssQkCLfxpTQXSduJzkIBdmcN5KGu82IZ62PSBI5HQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB4294
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-03-24_11,2023-03-24_01,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=946 malwarescore=0
 adultscore=0 spamscore=0 suspectscore=0 bulkscore=0 mlxscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2303200000 definitions=main-2303240153
X-Proofpoint-ORIG-GUID: cgja078dQ2LT9S4umGiKyfiOq-pquWbB
X-Proofpoint-GUID: cgja078dQ2LT9S4umGiKyfiOq-pquWbB
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
        DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H2,
        SPF_HELO_NONE,SPF_NONE autolearn=unavailable autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> On Mar 24, 2023, at 2:35 PM, Steve Dickson <steved@redhat.com> wrote:
>=20
>=20
>=20
> On 3/23/23 2:01 PM, Chuck Lever III wrote:
>>> On Mar 23, 2023, at 1:57 PM, Steve Dickson <steved@redhat.com> wrote:
>>>=20
>>>=20
>>>=20
>>> On 3/21/23 7:52 AM, Jeff Layton wrote:
>>>> On Mon, 2023-03-20 at 10:35 -0400, Chuck Lever wrote:
>>>>> Hi Steve-
>>>>>=20
>>>>> This is server-side support for RPC-with-TLS, to accompany similar
>>>>> support in the Linux NFS client. This implementation can support
>>>>> both the opportunistic use of transport layer security (it will be
>>>>> used if the client cares to) and the required use of transport
>>>>> layer security (the server requires the client to use it to access
>>>>> a particular export).
>>>>>=20
>>>>> Without any other user space componentry, this implementation will
>>>>> be able to handle clients that request the use of RPC-with-TLS. To
>>>>> support security policies that restrict access to exports based on
>>>>> the client's use of TLS, modifications to exportfs and mountd are
>>>>> needed. These can be found here:
>>>>>=20
>>>>> git://git.linux-nfs.org/projects/cel/nfs-utils.git
>>>>>=20
>>>>> They include an update to exports(5) explaining how to use the new
>>>>> "xprtsec=3D" export option.
>>>>>=20
>>>>> The kernel patches, along with the the handshake upcall, are carried
>>>>> in the topic-rpc-with-tls-upcall branch available from:
>>>>>=20
>>>>> https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git
>>>>>=20
>>>>> This was posted under separate cover.
>>>>>=20
>>>>> ---
>>>>>=20
>>>>> Chuck Lever (4):
>>>>>       libexports: Fix whitespace damage in support/nfs/exports.c
>>>>>       exports: Add an xprtsec=3D export option
>>>>>       exportfs: Push xprtsec settings to the kernel
>>>>>       exports.man: Add description of xprtsec=3D to exports(5)
>>>>>=20
>>>>>=20
>>>>>  support/export/cache.c       |  15 ++++++
>>>>>  support/include/nfs/export.h |   6 +++
>>>>>  support/include/nfslib.h     |  14 +++++
>>>>>  support/nfs/exports.c        | 100 ++++++++++++++++++++++++++++++++-=
--
>>>>>  utils/exportfs/exportfs.c    |   1 +
>>>>>  utils/exportfs/exports.man   |  45 +++++++++++++++-
>>>>>  6 files changed, 172 insertions(+), 9 deletions(-)
>>>>>=20
>>>> Nice work, Chuck! This all looks pretty straightforward. I have a
>>>> (minor) concern about potentially blocking nfsd threads for up to 20s =
in
>>>> a handshake, but this seems like a good place to start.
>>> Yes! But Will here be a V2 with the suggested changes?
>> I've done the suggested updates in my private tree already, so I can pos=
t a refresh soon.
> Fair enough.
>>> It would be good to get a new release with these patches
>>> in before the upcoming Bakeathon.
>> The concept and operation of xprtsec=3D is pretty new... would there be =
a problem if all this were to change significantly after community review?
> Not a problem at all! I was just thinking about get the patches into
> Fedora rawhide to get some testing...

To test, rawhide would need to have a ktls-utils package. Jeff and I
have discussed this ... he's volunteered to pull it in when netdev
has finally blessed the kernel/netlink pieces of this stack.

--
Chuck Lever