Bug 2178799

Summary:	Feature request: support for NFS with TLS
Product:	Red Hat Enterprise Linux 9	Reporter:	Olga Kornieskaia <kolga>
Component:	kernel	Assignee:	Jeff Layton <jlayton>
kernel sub component:	NFS	QA Contact:	JianHong Yin <jiyin>
Status:	ASSIGNED ---	Docs Contact:
Severity:	unspecified
Priority:	unspecified	CC:	bcodding, jlayton, plambri, rahsingh, tbecker, xzhou, yieli, yoyang
Version:	9.4	Keywords:	FutureFeature, Triaged
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Story
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Olga Kornieskaia 2023-03-15 18:29:05 UTC

Description of problem:

Targeted for 6.4 kernel release is a feature that adds implementation of RFC 9289 which is securing RPC traffic with TLS.

There will be kernel patches that span SUNRPC, NFS, and NET kernel components as well as a user land deamon piece that does the TLS handshake.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 2 Jeff Layton 2023-03-22 11:47:20 UTC

There has been a lot of progress on this upstream. There are now a working prototype NFS client and server patches that use a netlink-based mechanism to hand off TLS negotiation to userland. Hannes Reinecke also has some prototype patches for nvme over tls that use the same upcall. There are still some details to be worked out, but this seems like the way forward so far. We're (tentatively) hoping that some of these patches will make their way into v6.4 upstream, but it's still too early to know. Relevant patch postings so far:

https://lore.kernel.org/kernel-tls-handshake/167726551328.5428.13732817493891677975.stgit@91.116.238.104.host.secureserver.net/T/#t
https://lore.kernel.org/kernel-tls-handshake/167932094748.3131.11264549266195745851.stgit@manet.1015granger.net/T/#t
https://lore.kernel.org/kernel-tls-handshake/c90f39ed-1bcc-7a8f-fd2d-ee4663e94bb4@suse.de/T/#t

There are also NFS client patches, but they haven't been reposted lately. At this point, I'm going to go ahead set the ITR for RHEL9.4. Hopefully by later this summer we should be ready to backport something for this.

Comment 3 Yongcheng Yang 2023-03-23 05:39:13 UTC

(In reply to Jeff Layton from comment #2)
...
> At this point, I'm going to go ahead set the ITR for RHEL9.4.

Please note that we'll start to use Jira (instead of Bugzilla) to process the RHEL update. Thus this is a candidate to be migrated to Jira.

Comment 4 Jeff Layton 2023-08-09 13:30:02 UTC

*** Bug 2230453 has been marked as a duplicate of this bug. ***

Comment 5 Jeff Layton 2023-08-09 13:32:45 UTC

I've started an initial backport of this, based on Chris Leech's backport of the nvmeof work. The current plan is to target 9.4.

Comment 6 Jeff Layton 2023-08-09 13:38:41 UTC

Draft backport is here. It'll probably need several iterations before it's ready for inclusion:

    https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/2909