From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7A98081E51 for ; Tue, 12 Dec 2023 19:35:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="qdHoyoKn" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7C179C433C9; Tue, 12 Dec 2023 19:35:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1702409743; bh=1TYozZSHZw4HJ+3OaFPILF88Lt1Y1TXs2rTR33b7KoM=; h=From:Date:Subject:To:Cc:From; b=qdHoyoKnuQRjDoQ/ixud5UZWBv0jajQm29ipORuVUns6524kX34smeTDGognaW5W4 PSFVkd8+J9jmoT2iJI/q69UPaamtJrGbI5oSKsjbNFRALwpti+VQqGwFrMzOb6gjlV kR9ptF5wTD58w//f2IIVJ4K/lAgV1Q8I7mmIaWGWcumh9TsMuG+UwvhL+Noc6/0k7X VzuD8nG/rF/WDyls2kbfekxkyJgei3qE3LOzTeXLwY29XbOxM6mf4iwuG12XGKXpCk P4jA6XeV8XbcI24l1jo/86Ztilc7GXhBWXwY/fA99Hphkilh6PgLLTv80V4+dMQcUa PZYUNHmZrrGlw== From: Jeff Layton Date: Tue, 12 Dec 2023 14:35:38 -0500 Subject: [PATCH kdevops] ktls: allow setting up hosts with tlshd Precedence: bulk X-Mailing-List: kdevops@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20231212-ktls-v1-1-acfba0d36f75@kernel.org> X-B4-Tracking: v=1; b=H4sIAAq2eGUC/x3MQQqAIBBA0avIrBPSEqGrRIvQqYYixQkJxLsnL R98fgHGRMgwiQIJMzGFu0F1Atyx3jtK8s2gez0orbQ8n4ulMcO4eTTWWgctjQk3ev/NDKfHHCL DUusHMYpXw18AAAA= To: Luis Chamberlain Cc: Chuck Lever , kdevops@lists.linux.dev, Jeff Layton X-Mailer: b4 0.12.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=12988; i=jlayton@kernel.org; h=from:subject:message-id; bh=1TYozZSHZw4HJ+3OaFPILF88Lt1Y1TXs2rTR33b7KoM=; b=owEBbQKS/ZANAwAIAQAOaEEZVoIVAcsmYgBleLYOtADwuSpQ+USO9jY7Bo6JmyKZZmAkdp8n8 a2MGQw4M1OJAjMEAAEIAB0WIQRLwNeyRHGyoYTq9dMADmhBGVaCFQUCZXi2DgAKCRAADmhBGVaC FUNgEAC/kgMlSr4OeW3FL6Lf4e+hGvrKeH7vW8EBHUgCIwBUJ4Cixe5/Ripz3F3w9JxtrG7D04A DJze4mqFQYFguNF3dS/GKREn2+2ICynOyJbuqCxDqTwXLhLaGddw6f3rWJTZCduApUFWhVQt958 2QRj61iFnyfovia7Y8RJQY9LMPlF4fMaZ4vx+8Rmi/XsZmxOV9UIuTKN7B6bHmVrCRGtGbf5BVY BzuVKjjzwGmhnckYGPsRfYaEA0vNSBykOoogiX1neJRmz3b5dC5Rv5T74LFmc331TnI6DtoE4AD 7UVr8vmAY9xNZ1wAjerc/Pe/bJg2L3T5HP9zxBJkhqCdKOrIKEbYkruMRKS6G3/KmCmbaKL61OV SiXoeQqFGczt8tydaT+omkml3t8rgp/fKfQJb2lWF99NkGMucZTpZHTJrG/bd6bU3ZUrE3GEyEF zOWOmFqtymkh9CdHOA7GvyWN9CTF6FNL9B4YOM8V7DDIE/NTsonTmANejszXNamegeO3ApIqNlQ eyHOFo0on5wPKrbuc31NLmKD68I8ANZWfWFWZTtOldaSfawaEg/4iSZDILK0LuLtdmCwXFuarbH OYyCrumppMmN1KRMBN1k30zw6Qt7XXTB/PTQyp1x8ZGe4NbCgxFl2580LNiH0PCTslnF2VCZ2ma 9F3v4FKuOtYZe4g== X-Developer-Key: i=jlayton@kernel.org; a=openpgp; fpr=4BC0D7B24471B2A184EAF5D3000E684119568215 Add a new option to the post-install "goals" phase to configure tlshd for TLS handshake upcalls. This adds a new playbook to build a CA, generate certs for the hosts, and then configure tlshd to use them. Finally, it also adds a new NFS fstests option to test RPC over TLS (using xprtsec=mtls). Signed-off-by: Jeff Layton --- Makefile | 4 + kconfigs/Kconfig.bringup.goals | 9 ++ playbooks/ktls.yml | 4 + playbooks/roles/fstests/templates/nfs/nfs.config | 7 ++ .../roles/ktls/tasks/install-deps/debian/main.yml | 10 ++ playbooks/roles/ktls/tasks/install-deps/main.yml | 9 ++ .../roles/ktls/tasks/install-deps/redhat/main.yml | 15 +++ .../roles/ktls/tasks/install-deps/suse/main.yml | 9 ++ playbooks/roles/ktls/tasks/main.yml | 110 +++++++++++++++++++++ playbooks/roles/ktls/templates/tlshd.conf | 39 ++++++++ scripts/bringup.Makefile | 5 + scripts/ktls.Makefile | 8 ++ workflows/fstests/nfs/Kconfig | 9 +- workflows/fstests/nfs/Makefile | 3 + 14 files changed, 240 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 895a0a67c705..0f6fa024f14c 100644 --- a/Makefile +++ b/Makefile @@ -114,6 +114,10 @@ ifeq (y,$(CONFIG_WORKFLOWS)) include workflows/Makefile endif # CONFIG_WORKFLOWS +ifeq (y,$(CONFIG_KDEVOPS_SETUP_KTLS)) +include scripts/ktls.Makefile +endif # CONFIG_KDEVOPS_SETUP_KTLS + ifeq (y,$(CONFIG_KDEVOPS_SETUP_NFSD)) include scripts/nfsd.Makefile endif # CONFIG_KDEVOPS_SETUP_NFSD diff --git a/kconfigs/Kconfig.bringup.goals b/kconfigs/Kconfig.bringup.goals index 5df74d4bcb08..a2af3ffba499 100644 --- a/kconfigs/Kconfig.bringup.goals +++ b/kconfigs/Kconfig.bringup.goals @@ -56,6 +56,15 @@ config KDEVOPS_TRY_INSTALL_KDEV_TOOLS most kernel developers might prefer to have installed on target systems. +config KDEVOPS_SETUP_KTLS + bool "Configure ktls on the hosts with self-signed CA" + default n + help + Enabling this will have kdevops create a self-signed certificate + authority, and configure tlshd on the hosts to use it. This is + necessary for testing RPC over TLS, or some NVMe over fabrics + configurations. + config KDEVOPS_SETUP_NFSD bool "Set up the kernel nfs server" default n diff --git a/playbooks/ktls.yml b/playbooks/ktls.yml new file mode 100644 index 000000000000..8b7044c7ef2d --- /dev/null +++ b/playbooks/ktls.yml @@ -0,0 +1,4 @@ +--- +- hosts: all + roles: + - role: ktls diff --git a/playbooks/roles/fstests/templates/nfs/nfs.config b/playbooks/roles/fstests/templates/nfs/nfs.config index 60915f824764..e2265f3f3ee2 100644 --- a/playbooks/roles/fstests/templates/nfs/nfs.config +++ b/playbooks/roles/fstests/templates/nfs/nfs.config @@ -15,6 +15,13 @@ CANON_DEVS=yes # Test with default mount options [nfs_default] {% endif %} +{% if fstests_nfs_section_tls -%} + +# Test NFS with RPC over TLS +[nfs_tls] +TEST_FS_MOUNT_OPTS="-o xprtsec=mtls" +MOUNT_OPTIONS="-o xprtsec=mtls" +{% endif %} {% if fstests_nfs_section_v40 -%} # Test NFSv4.0 diff --git a/playbooks/roles/ktls/tasks/install-deps/debian/main.yml b/playbooks/roles/ktls/tasks/install-deps/debian/main.yml new file mode 100644 index 000000000000..704c394e0c49 --- /dev/null +++ b/playbooks/roles/ktls/tasks/install-deps/debian/main.yml @@ -0,0 +1,10 @@ +--- +- name: Install ktls dependencies + become: yes + become_method: sudo + apt: + name: + - python3-cryptography + - ktls-utils + state: present + update_cache: yes diff --git a/playbooks/roles/ktls/tasks/install-deps/main.yml b/playbooks/roles/ktls/tasks/install-deps/main.yml new file mode 100644 index 000000000000..ab343e8b05c6 --- /dev/null +++ b/playbooks/roles/ktls/tasks/install-deps/main.yml @@ -0,0 +1,9 @@ +--- +# tasks to install dependencies for pynfs +- name: oscheck distribution ospecific setup + import_tasks: tasks/install-deps/debian/main.yml + when: ansible_facts['os_family']|lower == 'debian' +- import_tasks: tasks/install-deps/suse/main.yml + when: ansible_facts['os_family']|lower == 'suse' +- import_tasks: tasks/install-deps/redhat/main.yml + when: ansible_facts['os_family']|lower == 'redhat' diff --git a/playbooks/roles/ktls/tasks/install-deps/redhat/main.yml b/playbooks/roles/ktls/tasks/install-deps/redhat/main.yml new file mode 100644 index 000000000000..0e1ab7505b3e --- /dev/null +++ b/playbooks/roles/ktls/tasks/install-deps/redhat/main.yml @@ -0,0 +1,15 @@ +--- +- name: Install ktls dependencies + become: yes + become_method: sudo + dnf: + update_cache: yes + name: "{{ packages }}" + retries: 3 + delay: 5 + register: result + until: result.rc == 0 + vars: + packages: + - python3-cryptography + - ktls-utils diff --git a/playbooks/roles/ktls/tasks/install-deps/suse/main.yml b/playbooks/roles/ktls/tasks/install-deps/suse/main.yml new file mode 100644 index 000000000000..ce5935154038 --- /dev/null +++ b/playbooks/roles/ktls/tasks/install-deps/suse/main.yml @@ -0,0 +1,9 @@ +--- +- name: Install ktls dependencies + become: yes + become_method: sudo + zypper: + state: present + name: + - python3-cryptography + - ktls-utils diff --git a/playbooks/roles/ktls/tasks/main.yml b/playbooks/roles/ktls/tasks/main.yml new file mode 100644 index 000000000000..1aa545835502 --- /dev/null +++ b/playbooks/roles/ktls/tasks/main.yml @@ -0,0 +1,110 @@ +- name: Import optional extra_args file + include_vars: "{{ item }}" + ignore_errors: yes + with_first_found: + - files: + - "../extra_vars.yml" + - "../extra_vars.yaml" + - "../extra_vars.json" + skip: true + +- name: Install dependencies + import_tasks: install-deps/main.yml + +- name: Construct the path to the CA directory + delegate_to: localhost + set_fact: + ca_dir: "{{ topdir_path }}/ca/{{ kdevops_host_prefix }}" + +- name: Create directory to hold the CA on local host + delegate_to: localhost + run_once: true + ansible.builtin.file: + path: "{{ ca_dir }}" + state: directory + +- name: Create private key for CA + delegate_to: localhost + run_once: true + community.crypto.openssl_privatekey: + path: "{{ ca_dir }}/ca-cert.key" + +- name: Create certificate signing request (CSR) for CA certificate + delegate_to: localhost + run_once: true + community.crypto.openssl_csr_pipe: + privatekey_path: "{{ ca_dir }}/ca-cert.key" + common_name: "kdevops {{ kdevops_host_prefix }} CA" + use_common_name_for_san: false # since we do not specify SANs, don't use CN as a SAN + basic_constraints: + - 'CA:TRUE' + basic_constraints_critical: true + key_usage: + - keyCertSign + key_usage_critical: true + register: ca_csr + +- name: Create self-signed CA certificate from CSR + delegate_to: localhost + run_once: true + community.crypto.x509_certificate: + path: "{{ ca_dir }}/ca-cert.pem" + csr_content: "{{ ca_csr.csr }}" + privatekey_path: "{{ ca_dir }}/ca-cert.key" + provider: selfsigned + +- name: Create private key for new TLS certificate + community.crypto.openssl_privatekey: + path: "/etc/pki/tls/private/ktls.key" + become: yes + +- name: Copy CA cert to all of the hosts + ansible.builtin.copy: + src: "{{ ca_dir }}/ca-cert.pem" + dest: "/etc/pki/tls/certs/ca-cert.pem" + owner: root + group: root + mode: 0644 + become: yes + +- name: Create certificate signing request (CSR) for new certificate + community.crypto.openssl_csr_pipe: + privatekey_path: "/etc/pki/tls/private/ktls.key" + subject_alt_name: + - "DNS:{{ ansible_host }}" + - "IP:{{ ansible_default_ipv4.address }}" + register: csr + become: yes + +- name: Sign certificate with our CA + community.crypto.x509_certificate_pipe: + csr_content: "{{ csr.csr }}" + provider: ownca + ownca_path: "{{ ca_dir }}/ca-cert.pem" + ownca_privatekey_path: "{{ ca_dir }}/ca-cert.key" + ownca_not_after: +365d # valid for one year + ownca_not_before: "-1d" # valid since yesterday + delegate_to: localhost + register: certificate + +- name: Write certificate file on host + copy: + dest: "/etc/pki/tls/certs/ktls.pem" + content: "{{ certificate.certificate }}" + become: yes + +- name: Install new /etc/tlshd.conf + ansible.builtin.copy: + src: "{{ playbook_dir }}/roles/ktls/templates/tlshd.conf" + dest: "/etc/tlshd.conf" + owner: root + group: root + mode: 0644 + become: yes + +- name: Enable and start tlshd + become: yes + ansible.builtin.systemd_service: + name: tlshd.service + enabled: true + state: reloaded diff --git a/playbooks/roles/ktls/templates/tlshd.conf b/playbooks/roles/ktls/templates/tlshd.conf new file mode 100644 index 000000000000..63ee5b59a8bd --- /dev/null +++ b/playbooks/roles/ktls/templates/tlshd.conf @@ -0,0 +1,39 @@ +# +# Copyright (c) 2022 Oracle and/or its affiliates. +# +# This file is part of ktls-utils. +# +# ktls-utils is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation; version 2. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA +# 02110-1301, USA. +# +# See tlshd.conf(5) for details. +# + +[debug] +loglevel=0 +tls=0 +nl=0 + +[authenticate] +#keyrings= ;; + +[authenticate.client] +x509.truststore=/etc/pki/tls/certs/ca-cert.pem +x509.certificate=/etc/pki/tls/certs/ktls.pem +x509.private_key=/etc/pki/tls/private/ktls.key + +[authenticate.server] +x509.truststore=/etc/pki/tls/certs/ca-cert.pem +x509.certificate=/etc/pki/tls/certs/ktls.pem +x509.private_key=/etc/pki/tls/private/ktls.key diff --git a/scripts/bringup.Makefile b/scripts/bringup.Makefile index 0051bc3d5e0d..520e2993a7b1 100644 --- a/scripts/bringup.Makefile +++ b/scripts/bringup.Makefile @@ -21,6 +21,11 @@ ifeq (y,$(CONFIG_KDEVOPS_SETUP_NFSD)) KDEVOPS_BRING_UP_DEPS += nfsd endif # KDEVOPS_SETUP_NFSD +ifeq (y,$(CONFIG_KDEVOPS_SETUP_KTLS)) +KDEVOPS_BRING_UP_DEPS += ktls +KDEVOPS_DESTROY_DEPS += ktls-destroy +endif # KDEVOPS_SETUP_KTLS + update_etc_hosts: $(Q)ansible-playbook $(ANSIBLE_VERBOSE) \ -f 30 -i hosts playbooks/update_etc_hosts.yml diff --git a/scripts/ktls.Makefile b/scripts/ktls.Makefile new file mode 100644 index 000000000000..977538041ae8 --- /dev/null +++ b/scripts/ktls.Makefile @@ -0,0 +1,8 @@ +ktls: + $(Q)ansible-playbook $(ANSIBLE_VERBOSE) --extra-vars=@./extra_vars.yaml \ + -f 30 -i hosts playbooks/ktls.yml + +ktls-destroy: + $(Q)rm -rf $(TOPDIR)/ca + +PHONY += ktls ktls-destroy diff --git a/workflows/fstests/nfs/Kconfig b/workflows/fstests/nfs/Kconfig index 7e202778d286..7e8731dc4dc1 100644 --- a/workflows/fstests/nfs/Kconfig +++ b/workflows/fstests/nfs/Kconfig @@ -54,11 +54,18 @@ config FSTESTS_NFS_SECTION_DEFAULT time of this writing, this makes the client autonegotiate an NFS version, starting with v4.2 if it's available. +config FSTESTS_NFS_SECTION_TLS + bool "Enable testing section: nfs_tls" + default n + depends on KDEVOPS_SETUP_KTLS + help + Enabling this will test with the xprtsec=tls mount option. + config FSTESTS_NFS_SECTION_V40 bool "Enable testing section: nfs_v40" default n help - Enabling this will test NFSv4.0 + Enabling this will test NFSv4.0. config FSTESTS_NFS_SECTION_V3 bool "Enable testing section: nfs_v3" diff --git a/workflows/fstests/nfs/Makefile b/workflows/fstests/nfs/Makefile index 7a057532be67..0e5245920ee9 100644 --- a/workflows/fstests/nfs/Makefile +++ b/workflows/fstests/nfs/Makefile @@ -9,6 +9,9 @@ FSTESTS_ARGS += fstests_nfs_server_host='$(FSTESTS_NFS_SERVER_HOST)' ifeq (y,$(CONFIG_FSTESTS_NFS_SECTION_DEFAULT)) FSTESTS_ARGS += fstests_nfs_section_default=True endif +ifeq (y,$(CONFIG_FSTESTS_NFS_SECTION_TLS)) +FSTESTS_ARGS += fstests_nfs_section_tls=True +endif ifeq (y,$(CONFIG_FSTESTS_NFS_SECTION_V40)) FSTESTS_ARGS += fstests_nfs_section_v40=True endif --- base-commit: 2f7d9b13a7ac734e2fb40ed68e45150af9d727ef change-id: 20231212-ktls-5534fde5777c Best regards, -- Jeff Layton