Description of problem: Targeted for 6.4 kernel release is a feature that adds implementation of RFC 9289 which is securing RPC traffic with TLS. There will be kernel patches that span SUNRPC, NFS, and NET kernel components as well as a user land deamon piece that does the TLS handshake. Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
There has been a lot of progress on this upstream. There are now a working prototype NFS client and server patches that use a netlink-based mechanism to hand off TLS negotiation to userland. Hannes Reinecke also has some prototype patches for nvme over tls that use the same upcall. There are still some details to be worked out, but this seems like the way forward so far. We're (tentatively) hoping that some of these patches will make their way into v6.4 upstream, but it's still too early to know. Relevant patch postings so far: https://lore.kernel.org/kernel-tls-handshake/167726551328.5428.13732817493891677975.stgit@91.116.238.104.host.secureserver.net/T/#t https://lore.kernel.org/kernel-tls-handshake/167932094748.3131.11264549266195745851.stgit@manet.1015granger.net/T/#t https://lore.kernel.org/kernel-tls-handshake/c90f39ed-1bcc-7a8f-fd2d-ee4663e94bb4@suse.de/T/#t There are also NFS client patches, but they haven't been reposted lately. At this point, I'm going to go ahead set the ITR for RHEL9.4. Hopefully by later this summer we should be ready to backport something for this.
(In reply to Jeff Layton from comment #2) ... > At this point, I'm going to go ahead set the ITR for RHEL9.4. Please note that we'll start to use Jira (instead of Bugzilla) to process the RHEL update. Thus this is a candidate to be migrated to Jira.
*** Bug 2230453 has been marked as a duplicate of this bug. ***
I've started an initial backport of this, based on Chris Leech's backport of the nvmeof work. The current plan is to target 9.4.
Draft backport is here. It'll probably need several iterations before it's ready for inclusion: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/2909