Re: [nfsv4] I-D Action: draft-ietf-nfsv4-rpc-tls-06.txt

Chuck Lever <chuck.lever@oracle.com> Sat, 15 February 2020 16:03 UTC

Return-Path: <chuck.lever@oracle.com>
X-Original-To: nfsv4@ietfa.amsl.com
Delivered-To: nfsv4@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C2281200E9 for <nfsv4@ietfa.amsl.com>; Sat, 15 Feb 2020 08:03:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.301
X-Spam-Level:
X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xmPGf8c-dglx for <nfsv4@ietfa.amsl.com>; Sat, 15 Feb 2020 08:03:04 -0800 (PST)
Received: from aserp2120.oracle.com (aserp2120.oracle.com [141.146.126.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF7781200E3 for <nfsv4@ietf.org>; Sat, 15 Feb 2020 08:03:04 -0800 (PST)
Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 01FG2qJI101236; Sat, 15 Feb 2020 16:02:52 GMT
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=content-type : mime-version : subject : from : in-reply-to : date : cc : content-transfer-encoding : message-id : references : to; s=corp-2020-01-29; bh=QFCy34eCaU6NNnjx2YGkLZO6GKCJ49l0GGLJtdF6080=; b=yG8Tm+IoRRzsT+5aCn9rYoYQRAoXEek3LSuEyrUUFJoZpUi0aS4D0B3XP8tCmyCmS/W9 LTYsPhVN7YN9Fs6ZUO0e9Y7juc16pBDwcj/yRDJekF8XtcM2/EiPzIThVVLCIpCU5heG op7Xa1iyCj/KD8V2BXo21hnXjCZmitGwh2377fm/Z5yc5GwP/pRIUkzcWDxF+9tTSG7g KqWVeIgZ8rDuUUc97EpZus7CxzIwzPJK2cUAMhuAUk0XBz6hC25xKczTcibmnnX2m3x4 AlyTS/KxpNHpWvLDfX6WV+OnVCy5OrvG1QHF0lq/iWJsKBbVW+rUtPpocLP54v0ISui2 OA==
Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by aserp2120.oracle.com with ESMTP id 2y68kqhv0s-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 15 Feb 2020 16:02:52 +0000
Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 01FG1WFk034940; Sat, 15 Feb 2020 16:02:52 GMT
Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by aserp3020.oracle.com with ESMTP id 2y68f6nu93-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 15 Feb 2020 16:02:51 +0000
Received: from abhmp0006.oracle.com (abhmp0006.oracle.com [141.146.116.12]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id 01FG2jTa016453; Sat, 15 Feb 2020 16:02:45 GMT
Received: from anon-dhcp-153.1015granger.net (/68.61.232.219) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Sat, 15 Feb 2020 08:02:45 -0800
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
From: Chuck Lever <chuck.lever@oracle.com>
In-Reply-To: <1596201389.6225924.1581770847254.JavaMail.zimbra@desy.de>
Date: Sat, 15 Feb 2020 11:02:43 -0500
Cc: NFSv4 <nfsv4@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <255FD5F9-7256-4C1F-B562-C078C73857B5@oracle.com>
References: <158074451013.28494.10714680016688772019@ietfa.amsl.com> <4F4B842E-86BB-46BF-92F4-B81ECDDCCD05@oracle.com> <1596201389.6225924.1581770847254.JavaMail.zimbra@desy.de>
To: "Mkrtchyan, Tigran" <tigran.mkrtchyan@desy.de>
X-Mailer: Apple Mail (2.3445.104.11)
X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9531 signatures=668685
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 bulkscore=0 suspectscore=0 malwarescore=0 adultscore=0 mlxlogscore=999 phishscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2001150001 definitions=main-2002150140
X-Proofpoint-Virus-Version: vendor=nai engine=6000 definitions=9531 signatures=668685
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 spamscore=0 lowpriorityscore=0 mlxlogscore=999 malwarescore=0 priorityscore=1501 clxscore=1011 mlxscore=0 suspectscore=0 impostorscore=0 bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2001150001 definitions=main-2002150140
Archived-At: <https://mailarchive.ietf.org/arch/msg/nfsv4/JBk1tIeDm0VIHsCxvNMi-G6_73w>
Subject: Re: [nfsv4] I-D Action: draft-ietf-nfsv4-rpc-tls-06.txt
X-BeenThere: nfsv4@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NFSv4 Working Group <nfsv4.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/nfsv4>, <mailto:nfsv4-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/nfsv4/>
List-Post: <mailto:nfsv4@ietf.org>
List-Help: <mailto:nfsv4-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/nfsv4>, <mailto:nfsv4-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 15 Feb 2020 16:03:07 -0000

Hi Tigran-

Opened https://github.com/chucklever/i-d-rpc-tls/issues/8 to track
this.

> On Feb 15, 2020, at 7:47 AM, Mkrtchyan, Tigran <tigran.mkrtchyan@desy.de> wrote:
> 
> Hi Chuck,
> 
> Yesterday we were fixing in our (not nfs related) code a TLS bug. 
> The issue was that we were redirecting clients to another endpoint
> by an IP address. As a result, the client side server certificate
> validation was failing, as subject alternative name didn't match
> endpoint client was connecting to - subject and and alternative
> name were dns names.
> 
> This situation is very similar to what we will ger with pNFS, where
> data servers are offered as combination of netid and uaddr.

I'm thinking fs_locations too, but agreed.


> Though
> there is no direct connection between your spec and pNFS over TLS,
> you probably should have a paragraph describing TLS and certificate
> handling when server address presented as netid+uaddr.

I was wondering if this should be in a later NFS-related document,
but both netid and uaddr are RPC-layer data types.

Would you propose some text to get us started? Describe how you
addressed the bug, for example. What do you think are the
interoperability concerns?


> Regards,
>   Tigran.
> 
> 
> ----- Original Message -----
>> From: "Chuck Lever" <chuck.lever@oracle.com>
>> To: "NFSv4" <nfsv4@ietf.org>
>> Sent: Monday, February 3, 2020 4:44:11 PM
>> Subject: Re: [nfsv4] I-D Action: draft-ietf-nfsv4-rpc-tls-06.txt
> 
>>> On Feb 3, 2020, at 10:41 AM, internet-drafts@ietf.org wrote:
>>> 
>>> 
>>> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>>> This draft is a work item of the Network File System Version 4 WG of the IETF.
>>> 
>>>       Title           : Towards Remote Procedure Call Encryption By Default
>>>       Authors         : Trond Myklebust
>>>                         Charles Lever
>>> 	Filename        : draft-ietf-nfsv4-rpc-tls-06.txt
>>> 	Pages           : 21
>>> 	Date            : 2020-02-03
>>> 
>>> Abstract:
>>>  This document describes a mechanism that, through the use of
>>>  opportunistic Transport Layer Security (TLS), enables encryption of
>>>  in-transit Remote Procedure Call (RPC) transactions while
>>>  interoperating with ONC RPC implementations that do not support this
>>>  mechanism.  This document updates RFC 5531.
>>> 
>>> 
>>> The IETF datatracker status page for this draft is:
>>> https://datatracker.ietf.org/doc/draft-ietf-nfsv4-rpc-tls/
>>> 
>>> There are also htmlized versions available at:
>>> https://tools.ietf.org/html/draft-ietf-nfsv4-rpc-tls-06
>>> https://datatracker.ietf.org/doc/html/draft-ietf-nfsv4-rpc-tls-06
>>> 
>>> A diff from the previous version is available at:
>>> https://www.ietf.org/rfcdiff?url2=draft-ietf-nfsv4-rpc-tls-06
>>> 
>>> 
>>> Please note that it may take a couple of minutes from the time of submission
>>> until the htmlized version and diff are available at tools.ietf.org.
>>> 
>>> Internet-Drafts are also available by anonymous FTP at:
>>> ftp://ftp.ietf.org/internet-drafts/
>> 
>> I heard no objection to the changes proposed last week.
>> This revision addresses recent comments from Rick Macklem.
>> 
>> 
>> --
>> Chuck Lever
>> 
>> 
>> 
>> _______________________________________________
>> nfsv4 mailing list
>> nfsv4@ietf.org
>> https://www.ietf.org/mailman/listinfo/nfsv4

--
Chuck Lever