Received-SPF: pass (google.com: domain of linux-nfs+bounces-1449-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
Precedence: bulk
MIME-Version: 1.0
References: <CAAvCNcBMY1mrgEgy4APSiFXDP5u=64YXNjiHHjh8RscPsB3row@mail.gmail.com>
 <b25436fa457256f0f409fbc33f60c13e8ab6af12.camel@kernel.org> <96A320F4-AFC1-4DD9-8D5D-784F13DE94D4@redhat.com>
In-Reply-To: <96A320F4-AFC1-4DD9-8D5D-784F13DE94D4@redhat.com>
From: Dan Shelton <dan.f.shelton@gmail.com>
Date: Fri, 26 Jan 2024 02:05:23 +0100
Message-ID: <CAAvCNcBjuTLwsLb7nQxaS_O8PVLGPxk=6y2Wj8rp3se0+YxvPQ@mail.gmail.com>
Subject: Re: Implement NFSv4 TLS support with /usr/bin/openssl s_client?
To: Benjamin Coddington <bcodding@redhat.com>
Cc: Jeff Layton <jlayton@kernel.org>, Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"

On Thu, 25 Jan 2024 at 22:11, Benjamin Coddington <bcodding@redhat.com> wrote:
>
> On 25 Jan 2024, at 15:37, Jeff Layton wrote:
>
> > On Thu, 2024-01-25 at 03:21 +0100, Dan Shelton wrote:
> >> Hello!
> >>
> >> Is it possible for a NFSv4 client to implement TLS support via
> >> /usr/bin/openssl s_client?
> >>
> >> /usr/bin/openssl s_client would do the connection, and a normal
> >> libtirpc client would connect to the other side of s_client.
> >>
> >> Does that work?
> >>
> >> Dan
> >
> > Doubtful. RPC over TLS requires some cleartext setup before TLS is
> > negotiated. At one time Ben Coddington had a proxy based on nginx that
> > could handle the TLS negotiation, but I think that might have been based
> > on an earlier draft of the spec. It would probably need some work to be
> > brought up to the state of the RFC.
>
> Yeah, its' a little bit rotted.  Wasn't super fresh to begin with, but it
> did help bootstrap some implementation.
>
> You could also modify openssl to be aware of the clear text, something like:
> https://github.com/bcodding/openssl/commit/9bf2c4d66eacccd3530fb2f3a0a6c87d5878348c
>
> .. but I think you're definitely in "what are you really trying to do?" territory.

For example legacy NFSv4 client add-on? You cannot expect that
everyone can or will update to the latest and greatest version, so
either you have clients without TLS, which is a security risk, or have
a way to retrofit them.

Dan
-- 
Dan Shelton - Cluster Specialist Win/Lin/Bsd