Re: [nfsv4] Agenda items for virtual interim

Chuck Lever III wrote:
>> On Oct 16, 2021, at 9:28 AM, David Noveck <davenoveck@gmail.com> wrote:
>>
>> I'd be interested in hearing from Chuck about his thoughts about addressing use of RPC-with-TLS for NFSv3 and >>how that might or might not interact with the v4 security work now going on.
>
>I haven't had a chance to read nfsv4-security yet. That is at
>the top of my to-do list.
>
>After that, I think I'd like to huddle with Rick to discuss
>how NFSv3 should work. Once we have something, we can present
>options or discuss it on the mailing list.
Well, for the implementation I did for FreeBSD, it just worked. All the changes were in the kernel
RPC layer used by all versions of NFS,
--> I suppose there is the question of crossing server mount point boundaries, where the
      requirement for RPC-with-TLS changes, but at least for FreeBSD, NFSv3 exports individual
      file systems, so there is no issue.

Having said that, I have done nothing w.r.t. the ancillary protocols (Mount, NLM, NSM). To do
Mount and NSM on FreeBSD, the userland RPC library functions would need to be modified to
support RPC-with-TLS. This wouldn't be hard to do, but  might be hard to deploy, since it means
that all RPC programs would need to link to the OpenSSL libraries, and that might not be
acceptable to the FreeBSD collective.

Not sure if support should be required for the ancillary protocols and not sure who would decide?
(Does Oracle claim NFSv3 as theirs or is it just an orphan now?;-)

>In short, I agree this is something that needs to be discussed
>at some point, but I'm not confident I'll be ready by Oct 27.
>I'd prefer to see some discussion on list about this before
>we bring it to a WG meeting.
I'll be interested in hearing what others think? Chuck, if you want to email off-list, that's fine with me,
but I'll admit the above is all I can think of right now.

rick

(Given the limited degree of interactivity available during a
virtual meeting, I'd say we should consider restricting the
agenda to slides plus a couple of executive WG decisions for
each chosen topic, at least until the virtual meeting
technology improves).

> I also want to hear from Tom T about a number of RDMA-related topics:
>       • His 'push-mode" work.
>       • Possible approaches to a secure RDMA protocol taking advantage of either TLS or Quic.

This might not be a popular opinion, but DDP/MPA over QUIC in
my opinion would be a more straightforward option than plumbing
a bespoke authentication protocol into RPC/RDMA. A transport
level approach could also help resolve the authentication issues
that came up last time we considered a pNFS/RDMA layout type.

--
Chuck Lever

_______________________________________________
nfsv4 mailing list
nfsv4@ietf.org
https://www.ietf.org/mailman/listinfo/nfsv4