Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     Steve Dickson <steved@redhat.com>
CC:     Chuck Lever <cel@kernel.org>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        Rick Macklem <rick.macklem@gmail.com>,
        "kernel-tls-handshake@lists.linux.dev" 
        <kernel-tls-handshake@lists.linux.dev>
Subject: Re: [PATCH v2 0/4] nfs-utils changes for RPC-with-TLS
Thread-Topic: [PATCH v2 0/4] nfs-utils changes for RPC-with-TLS
Thread-Index: AQHZYkfyXVf2UZl2IkChqQGwU7OVd68c9gaAgAABSYA=
Date:   Wed, 5 Apr 2023 16:45:00 +0000
Message-ID: <AC76C4AB-F5DE-40B2-8A0D-4BADC7EFD918@oracle.com>
References: <168009806320.2522.10415374334827613451.stgit@manet.1015granger.net>
 <1c59beaf-63b6-ee39-b339-339a0c7e72b9@redhat.com>
In-Reply-To: <1c59beaf-63b6-ee39-b339-339a0c7e72b9@redhat.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?zKZbNpCLSHnxzTgTc3tRr0gNSCBD7VplqHRABo51ihZiDcHsrIQBTPdtw+ZN?=
 =?us-ascii?Q?i5fa7x4HBuVYmUJ50N7T8jTpaCxdnLAUiAlsk+ASVFZZxoP4Ih8WJIezhLBZ?=
 =?us-ascii?Q?jUmDc4hHt0bj/QNA1PFkxMXAUu0TTWPstYeK98nuF2uk4YS7n31oORsYPTJt?=
 =?us-ascii?Q?PZBKTKKZeKv2OOZjaglAXkk8nA4H5WMRuxM/O0QO/AHe/4jNz6NY5qlbPM8i?=
 =?us-ascii?Q?WmJPuW6uBaYBZ2NpuMs8NOOXNZAXAdjtRBiz5KzhPKZGQ5FUyJylwAsZztJt?=
 =?us-ascii?Q?VMLJMygT35rXtRlv/M/ElDM8vo5nYeBLC1rnSskou+pwZeE6Vfv3PZWeTsHx?=
 =?us-ascii?Q?VEvyoblAZa271bwd/H59u7i7hzO72cgQgkMlntrLsSkm3afpKF/eUrIgmUKo?=
 =?us-ascii?Q?yDxwXJi60CcbDlXljzlZ0kCjXKam6tMJUXJu4o+8H9PzU/ypV7cmm4KXMmDb?=
 =?us-ascii?Q?CMAnIPLeaPY1EUmS+0Z+h9YuFBUXAInotXY3lKwc73LY2ecZ0T8CPgCpr//J?=
 =?us-ascii?Q?F816vKVAK1Qv7CAtz7N0no57YH5++cCyrP3vgtSy3KRCbaRNguZwIOQNw5Io?=
 =?us-ascii?Q?EAnreRx6vzJ9XNjKWGpUmFdx5h7rCJCek7MsltCzstTSkLISBr9XR4V4XzhQ?=
 =?us-ascii?Q?rLQ6n66L8aBhh1NHjKVu7moPFaFhh1gdXGR3Pgd0ZCwABHPyEEYbgllB9CNC?=
 =?us-ascii?Q?IAfR0WuXC+F0QYlwBYP9Qe5+4aKwtEcILIY6ZfjFBvQPg59yF/9WEcqp0gKF?=
 =?us-ascii?Q?ZLBqwT72DjftVhHWQdHUAzDfWfNeWajI+UyMdYtVucr1TZP6etl8Wzgg7zzb?=
 =?us-ascii?Q?aWiNZ1pmjHHCSxySrR7y791M7pKQyclzBDwzbFXbu6vMvxSbr4jTiV+jJEdS?=
 =?us-ascii?Q?LEbvB7W4LPJuxZ2oKD5lY7nsgyMjifPjKGL/RLnXToI2QQLHbrddSslDATyc?=
 =?us-ascii?Q?41sptECRw+YwB/vV63heYcjLlIBWvP8qc+oZVErau+76ZQVjST1DWC6vs4MS?=
 =?us-ascii?Q?Juy66W6XOa1sVHepts1QasBFqWnMa0qDI9onnueZaIBNyxNnTYByEMje1r0r?=
 =?us-ascii?Q?QEAowKyRNQsB55GOx9cYqtfRjHviOV8M1bGFTBTO6KNc7sRlNGA/4uPMM/cX?=
 =?us-ascii?Q?SyCo3tNf2TjeVCHBGfdYKWMu+I2Ot0sd++jkiQbChBjytTSgTiFKPW5AMB5T?=
 =?us-ascii?Q?8hX8mFzkCrmrLVv1cQ6y7RnJG3+6zu1xn8aFCwGF+SkXlWDD7F/g/saI5MPb?=
 =?us-ascii?Q?h+ttg3LK5IpNQOULM/WKQi5hYUTgsmi/1QUg7gbThM1MaDT6vPfbuR3oUUqy?=
 =?us-ascii?Q?Y21sDUAHsT6litQPSZjDFeNRt1pypE91dwnw6ivBWKtB51SnKc0g6bhkKeCy?=
 =?us-ascii?Q?RdEMjXtI4JljMzNnWIGC4oezX0VbT+XCT2FoU+bSX5eIVxXk/HhZvAbYIEoO?=
 =?us-ascii?Q?9L0D/wqEh5rEvOz99NpXJxvaPL1vYizpv2AYTZAXhQYXtbKU5XsT7BrO4XT5?=
 =?us-ascii?Q?MUL8gEZQitS0YkRk5jp6dlqiMgutlnvfi9BSDIHDOm+4wEjT7n+mw6lxtYVF?=
 =?us-ascii?Q?HSmJ2T82OmIIh1A2XiS50ywq5MM2YmYdok52syABEBbSlMXJL3sBw09eXO2j?=
 =?us-ascii?Q?Xw=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <739A24F57E7F7A4DAC3123B492F9ABA4@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: bUNAHosRoRo0QSo614a2RKzfk6Ju8zy7Q8aufOfTb6uQFRpm13B2ArRigTkJ4jXddCAD78IUZqTtqCqnoGEcEaCwkKWv6yOq5e65hxe9MgaVHzgtu/L2lGxdas6UCojNY2lwv+Utx3/+YxJvBEIg5O2yKZ/qzLTzm9J5uUNy85Q5wLEXl6r46Z2rhfHu4gOaRM7RWN08pfQBW3/xu0tipuTR5zjqXpMjXw8lmHPbRHUNCa+Hi8rJKwdm//y7we+SXds3tltbgZ7GmKed1oxktA4MQcwQcq7jMynKqEiARlbNQ82ekUlPgqWE9cTk5nkPlNAq2dC+awOz9h60kyxOvUfwy5+H/fJ7Y390t0SlBW79i4FgzkVCPSsGwYW+SceoSlRdQkdOO7ogvEzPzTIwP72G4AqU7uLwW4lCgzyPB3wNKskgl/Fha6w2kia2LHTOgOM0zvKkuJW0+oKqKu7zK6WUCAIucz52ejeAO7hwonjOGDSJXu+dEfhq0fkSi3dRZ3yaJOFvq09ad2+qPrhBrfDuhOwPiAx3CqO2NtfhsEy9W/7g318K6MUMpSS5pRIWQtY1086TV6XxAnY2KVA+HjZazxBQXtoaLY36l01xUzzhn5mYTf0stG4EsYpuPkFqMlqDXHh8sEEuJ8rlQA+5CRkChcQA8pcweI5jUBGuWfbVAGBQv28bVBSQXXDeijFc+UQlEN/YdiFe/EgAz5PfWNtCe93Czo5XAjT3YQGzR6E1KP0Shoe/Rc1nCJD4XvaZtBtNfJXfjtkPsJXqDvcSoaobOhT94ZQ47OtHvmVCfJVDow84xzQSp5LTngsUG8BVeHEQNLIgtB5cTjcCuZD9aNGzC1nOsWWrVfY6lisEtOc4MCyyBVyXnYj36FeNIccu
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5128.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d76ddf7e-7ca4-433a-2d11-08db35f51910
X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Apr 2023 16:45:00.6804
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: m53iJ4hdKDNCypqU4qIEMbwHhf5js1f0mwn1TSdQeprn4L2lDahzpOawMGpOlNA3JZWUa2CZlgkcftiAcOr+fw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR10MB6656
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-04-05_11,2023-04-05_01,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 adultscore=0
 phishscore=0 bulkscore=0 mlxscore=0 malwarescore=0 mlxlogscore=902
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2303200000 definitions=main-2304050151
X-Proofpoint-GUID: HTjfON9dTByMp76ASBq3mNk2VdEfvGoJ
X-Proofpoint-ORIG-GUID: HTjfON9dTByMp76ASBq3mNk2VdEfvGoJ
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
        DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H2,
        SPF_HELO_NONE,SPF_NONE autolearn=unavailable autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> On Apr 5, 2023, at 12:40 PM, Steve Dickson <steved@redhat.com> wrote:
>=20
> Hey Chuck,
>=20
> On 3/29/23 10:08 AM, Chuck Lever wrote:
>> Hi Steve-
>> This is client- and server-side nfs-utils support for RPC-with-TLS.
>> The client side support at this point is only a man page update
>> since the kernel handles mount option processing itself.
>> The server implementation can support both the opportunistic use of
>> transport layer security (it will be used if the client cares to),
>> and the required use of transport layer security (the server
>> requires the client to use it to access a particular export).
>> Without any other user space componentry, this implementation is
>> able to handle clients that request the use of RPC-with-TLS. To
>> support security policies that restrict access to exports based on
>> the client's use of TLS, modifications to exportfs and mountd are
>> needed. These are contained in this post, and can also be found
>> here:
>> git://git.linux-nfs.org/projects/cel/nfs-utils.git
>> The kernel patches, along with the handshake upcall, are carried in
>> the topic-rpc-with-tls-upcall branch available from:
>> https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux.git
>=20
> Just wondering if these patch should wait until the kernel
> patches reach mainline (aka rawhide)?

The kernel changes do not require these, they add more
features. Thus I don't think it's harmful to let them
wait for the kernel patches.

For testing, Jeff has set up a Fedora COPR with these,
the ktls-utils package, and an updated kernel.

What could be checked now is whether these nfs-utils
changes will break something on pre-TLS kernels.


> steved.
>=20
>> Soon I hope to compose a new man page in Section 7 that will provide
>> an overview and quick set-up guidance for NFS's use of RPC-with-TLS.
>> Changes since v1:
>> - Addressed Jeff's review comments
>> - Updated nfs.man as well
>> ---
>> Chuck Lever (4):
>>       libexports: Fix whitespace damage in support/nfs/exports.c
>>       exports: Add an xprtsec=3D export option
>>       exports(5): Describe the xprtsec=3D export option
>>       nfs(5): Document the new "xprtsec=3D" mount option
>>  support/export/cache.c       |  15 ++++++
>>  support/include/nfs/export.h |  14 +++++
>>  support/include/nfslib.h     |  14 +++++
>>  support/nfs/exports.c        | 100 ++++++++++++++++++++++++++++++++---
>>  utils/exportfs/exportfs.c    |   1 +
>>  utils/exportfs/exports.man   |  51 +++++++++++++++++-
>>  utils/mount/nfs.man          |  34 +++++++++++-
>>  7 files changed, 219 insertions(+), 10 deletions(-)
>> --
>> Chuck Lever


--
Chuck Lever