Re: [nfsv4] AD review of draft-ietf-nfsv4-rpc-tls

[Rick Macklem <[e-mail]>]

Chuck Lever wrote:
[stuff snipped]
>Then I started thinking about TCP.
>
>Since we have implementations that use the same connection to transport
>multiple RPC programs, we have to make a different statement. What should
>that statement be?
>
>I wondered again about whether it makes sense to permit or encourage
>multiple TLS sessions on the same connection.
>
>If you wanted to, how would you establish a second TLS session? Because
>of the "no clear-text RPCs after a TLS session has been established"
>stipulation, the client would have to perform a bunch of AUTH_TLS probes
>_before_ sending any ClientHello messages.
>
>(And in any event we probably want rpc-tls to discuss what should happen
>if there is traffic on the connection between the AUTH_TLS probe and
>the ClientHello message).
I think that multiple AUTH_TLS probes before sending ClientHello
is both difficult to implement and confusing.

The AUTH_TLS probe serves two purposes well.
1 - It establishes whether or not RPC-over-TLS is supported by the server.
2 - If supported, it triggers a TLS handshake for the first session.

If you do want multiple TLS sessions on the same TCP connection (I'll assume TLS
allows this?), then I think a separate kind of AUTH_TLS Null RPC which is done
within a TLS session would be a more appropriate way to establish it.
(This one could have a non-NULL credential to differentiate it from the initial one.)

>But it's likely that multiple TLS sessions makes sense only when there
>are multiple certificates on the client side. So this is very likely
>out of scope for rpc-tls. Then do we explicitly forbid the use of
>multiple TLS sessions per connection for this iteration of RPC-on-TLS?
Yes, I would agree with this.

However, I do not see why multiple RPC programs cannot be allowed on
the same TCP connection using the same TLS session and I don't see that
the RPC program number used for the AUTH_TLS probe need imply
"only this program for this session".
Of course, this typically does not happen, since same TCP connection
implies same server port# and FreeBSD does not do this at this time.
So, as such, I really do not care whether or not a "only one RPC program
per TCP connection" restriction exists.

rick


--
Chuck Lever



_______________________________________________
nfsv4 mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/nfsv4