Received-SPF: pass (google.com: domain of linux-nfs+bounces-3571-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Precedence: bulk
MIME-Version: 1.0
References: <CAN-5tyHghLR_eSoPq_z18_XvdySKNrWpPKjuAd2c97KKqYGjFg@mail.gmail.com>
 <6E31172E-8991-43E2-A9E0-88FEAEDDA00B@oracle.com>
In-Reply-To: <6E31172E-8991-43E2-A9E0-88FEAEDDA00B@oracle.com>
From: Olga Kornievskaia <aglo@umich.edu>
Date: Wed, 5 Jun 2024 12:30:55 -0400
Message-ID: <CAN-5tyFVWm_p4tT1VYfmVxktsycn4K_v_KH_BKyzJ80-1rnmZA@mail.gmail.com>
Subject: Re: NFS with TLS on 4.0
To: Chuck Lever III <chuck.lever@oracle.com>
Cc: Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, Jun 5, 2024 at 11:37=E2=80=AFAM Chuck Lever III <chuck.lever@oracle=
.com> wrote:
>
> Howdy -
>
> > On Jun 5, 2024, at 10:34=E2=80=AFAM, Olga Kornievskaia <aglo@umich.edu>=
 wrote:
> >
> > Hi Chuck,
> >
> > I noticed an interesting behaviour by the linux server. If I were to
> > mount the linux server with vers=3D4.0,sec=3Dsys,xprtsec=3Dtls, acquire=
 a
> > delegation, and trigger a CB_RECALL, then it is done with gss
> > integrity. Why is that? I thought callback is supposed to be done with
> > the same security flavor as the forechannel.
>
> The CB_RECALL is using the same flavor and principal as was used
> for the SETCLIENTID. That is all that the NFSv4.0 spec requires.

Thanks. For some reason I thought "do state operations with krb5i was
4.1 thing and not 4.0". But I can see now that this started with the
client doing SETCLIENTID using krb5i (even though mount was sec=3Dsys).

> Remember that xprtsec=3D does not specify a security flavor.
>
>
> > But then also callback isn't done over TLS. Should the callback be
> > done over TLS (and it's a future implementation to do for
> > client/server)?
>
> The NFSv4.0 backchannel could be done over TLS, sure.
>
>
> > Or is this a spec restriction/limitation?
>
> The NFSv4.0 spec doesn't know about TLS, so it doesn't take
> a position about requiring it.
>
> Unless there's an interoperability concern, IMO standards action
> isn't necessary. We can definitely say, though, that a prudent
> NFSv4.0 server implementation would choose to try TLS if the
> forward channel used it, and a prudent NFSv4.0 client would
> require the use of TLS on the backchannel in that case.
>
> The Linux implementation does not do that yet -- TLS would
> protect both directions of operation for NFSv4.1 and above,
> but for NFSv4.0, it doesn't.

Thank you for the clarification. Not sure it is worth the effort
(given we've been discussing deprecating 4.0 anyway) but it answers my
question if it's a question of implementation or spec.

>
>
> --
> Chuck Lever
>
>