From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0854063BE1 for ; Tue, 12 Dec 2023 20:12:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="cf71/Y2h" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0858DC433C8; Tue, 12 Dec 2023 20:12:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1702411945; bh=dRtGvnp18I5UIesEqijLycmlBVENhs2GUq6WmByFmJk=; h=Subject:From:To:Cc:Date:In-Reply-To:References:From; b=cf71/Y2hQ2D/Sh4wt0P+eBINx+NTHQLqFermHmplp5ewEVBnQ7J3eoIEKZyQxrw5I HuEFNMfRMPskhpP3kp4a6jJcJTlUi4hrWe0Wz1zr6zoCL2zGdFrMkFYcsZlASwuwNJ qRg3svSgibjUkUf2x4cLF09Qk9UE0luqTdLtCYq2LB4DfIvMFG3xp+DRhbpUiHI4by GLdBSrHmk6a5IF7ihPKbHiGgxp/IPnC6C/x0ZxL9txjZxfCN5JLip8cJ/kPwtmuPF/ W5NTDIqBG/PqNx8iyj1/UgCOVMu2LqpenX5563N7QGH09J9Wo3wf4puSMV/QCbkd9+ aFfN2Bphn59ww== Message-ID: <539aa05a30423b58b868c088a326cff2bc912743.camel@kernel.org> Subject: Re: [PATCH kdevops] ktls: allow setting up hosts with tlshd From: Jeff Layton To: Chuck Lever Cc: Luis Chamberlain , kdevops@lists.linux.dev Date: Tue, 12 Dec 2023 15:12:23 -0500 In-Reply-To: References: <20231212-ktls-v1-1-acfba0d36f75@kernel.org> Autocrypt: addr=jlayton@kernel.org; prefer-encrypt=mutual; keydata=mQINBE6V0TwBEADXhJg7s8wFDwBMEvn0qyhAnzFLTOCHooMZyx7XO7dAiIhDSi7G1NPxwn8jdFUQMCR/GlpozMFlSFiZXiObE7sef9rTtM68ukUyZM4pJ9l0KjQNgDJ6Fr342Htkjxu/kFV1WvegyjnSsFt7EGoDjdKqr1TS9syJYFjagYtvWk/UfHlW09X+jOh4vYtfX7iYSx/NfqV3W1D7EDi0PqVT2h6v8i8YqsATFPwO4nuiTmL6I40ZofxVd+9wdRI4Db8yUNA4ZSP2nqLcLtFjClYRBoJvRWvsv4lm0OX6MYPtv76hka8lW4mnRmZqqx3UtfHX/hF/zH24Gj7A6sYKYLCU3YrI2Ogiu7/ksKcl7goQjpvtVYrOOI5VGLHge0awt7bhMCTM9KAfPc+xL/ZxAMVWd3NCk5SamL2cE99UWgtvNOIYU8m6EjTLhsj8snVluJH0/RcxEeFbnSaswVChNSGa7mXJrTR22lRL6ZPjdMgS2Km90haWPRc8Wolcz07Y2se0xpGVLEQcDEsvv5IMmeMe1/qLZ6NaVkNuL3WOXvxaVT9USW1+/SGipO2IpKJjeDZfehlB/kpfF24+RrK+seQfCBYyUE8QJpvTZyfUHNYldXlrjO6n5MdOempLqWpfOmcGkwnyNRBR46g/jf8KnPRwXs509yAqDB6sELZH+yWr9LQZEwARAQABtCVKZWZmIExheXRvbiA8amxheXRvbkBwb29jaGllcmVkcy5uZXQ+iQI7BBMBAgAlAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAUCTpXWPAIZAQAKCRAADmhBGVaCFc65D/4gBLNMHopQYgG/9RIM3kgFCCQV0pLv0hcg1cjr+bPI5f1PzJoOVi9s0wBDHwp8+vtHgYhM54yt43uI7Htij0RHFL5eFqoVT4TSfAg2qlvNemJEOY0e4daljjmZM7UtmpGs9NN0r9r50W82eb5Kw5bc/ r0kmR/arUS2st+ecRsCnwAOj6HiURwIgfDMHGPtSkoPpu3DDp/cjcYUg3HaOJuTjtGHFH963B+f+hyQ2BrQZBBE76ErgTDJ2Db9Ey0kw7VEZ4I2nnVUY9B5dE2pJFVO5HJBMp30fUGKvwaKqYCU2iAKxdmJXRIONb7dSde8LqZahuunPDMZyMA5+mkQl7kpIpR6kVDIiqmxzRuPeiMP7O2FCUlS2DnJnRVrHmCljLkZWf7ZUA22wJpepBligemtSRSbqCyZ3B48zJ8g5B8xLEntPo/NknSJaYRvfEQqGxgk5kkNWMIMDkfQOlDSXZvoxqU9wFH/9jTv1/6p8dHeGM0BsbBLMqQaqnWiVt5mG92E1zkOW69LnoozE6Le+12DsNW7RjiR5K+27MObjXEYIW7FIvNN/TQ6U1EOsdxwB8o//Yfc3p2QqPr5uS93SDDan5ehH59BnHpguTc27XiQQZ9EGiieCUx6Zh2ze3X2UW9YNzE15uKwkkuEIj60NvQRmEDfweYfOfPVOueC+iFifbQgSmVmZiBMYXl0b24gPGpsYXl0b25AcmVkaGF0LmNvbT6JAjgEEwECACIFAk6V0q0CGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEAAOaEEZVoIViKUQALpvsacTMWWOd7SlPFzIYy2/fjvKlfB/Xs4YdNcf9qLqF+lk2RBUHdR/dGwZpvw/OLmnZ8TryDo2zXVJNWEEUFNc7wQpl3i78r6UU/GUY/RQmOgPhs3epQC3PMJj4xFx+VuVcf/MXgDDdBUHaCTT793hyBeDbQuciARDJAW24Q1RCmjcwWIV/pgrlFa4lAXsmhoac8UPc82Ijrs6ivlTweFf16VBc4nSLX5FB3ls7S5noRhm5/Zsd4PGPgIHgCZcPgkAnU1S/A/rSqf3FLpU+CbVBDvlVAnOq9gfNF+QiTlOHdZVIe4gEYAU3CUjbleywQqV02BKxPVM0C5/oVjMVx 3bri75n1TkBYGmqAXy9usCkHIsG5CBHmphv9MHmqMZQVsxvCzfnI5IO1+7MoloeeW/lxuyd0pU88dZsV/riHw87i2GJUJtVlMl5IGBNFpqoNUoqmvRfEMeXhy/kUX4Xc03I1coZIgmwLmCSXwx9MaCPFzV/dOOrju2xjO+2sYyB5BNtxRqUEyXglpujFZqJxxau7E0eXoYgoY9gtFGsspzFkVNntamVXEWVVgzJJr/EWW0y+jNd54MfPRqH+eCGuqlnNLktSAVz1MvVRY1dxUltSlDZT7P2bUoMorIPu8p7ZCg9dyX1+9T6Muc5dHxf/BBP/ir+3e8JTFQBFOiLNdFtB9KZWZmIExheXRvbiA8amxheXRvbkBzYW1iYS5vcmc+iQI4BBMBAgAiBQJOldK9AhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAADmhBGVaCFWgWD/0ZRi4hN9FK2BdQs9RwNnFZUr7JidAWfCrs37XrA/56olQl3ojn0fQtrP4DbTmCuh0SfMijB24psy1GnkPepnaQ6VRf7Dxg/Y8muZELSOtsv2CKt3/02J1BBitrkkqmHyni5fLLYYg6fub0T/8Kwo1qGPdu1hx2BQRERYtQ/S5d/T0cACdlzi6w8rs5f09hU9Tu4qV1JLKmBTgUWKN969HPRkxiojLQziHVyM/weR5Reu6FZVNuVBGqBD+sfk/c98VJHjsQhYJijcsmgMb1NohAzwrBKcSGKOWJToGEO/1RkIN8tqGnYNp2G+aR685D0chgTl1WzPRM6mFG1+n2b2RR95DxumKVpwBwdLPoCkI24JkeDJ7lXSe3uFWISstFGt0HL8EewP8RuGC8s5h7Ct91HMNQTbjgA+Vi1foWUVXpEintAKgoywaIDlJfTZIl6Ew8ETN/7DLy8bXYgq0XzhaKg3CnOUuGQV5/nl4OAX/3jocT5Cz/OtAiNYj5mLPeL5z2ZszjoCAH6caqsF2oLyA nLqRgDgR+wTQT6gMhr2IRsl+cp8gPHBwQ4uZMb+X00c/Amm9VfviT+BI7B66cnC7Zv6Gvmtu2rEjWDGWPqUgccB7hdMKnKDthkA227/82tYoFiFMb/NwtgGrn5n2vwJyKN6SEoygGrNt0SI84y6hEVbQlSmVmZiBMYXl0b24gPGpsYXl0b25AcHJpbWFyeWRhdGEuY29tPokCOQQTAQIAIwUCU4xmKQIbAwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEAAOaEEZVoIV1H0P/j4OUTwFd7BBbpoSp695qb6HqCzWMuExsp8nZjruymMaeZbGr3OWMNEXRI1FWNHMtcMHWLP/RaDqCJil28proO+PQ/yPhsr2QqJcW4nr91tBrv/MqItuAXLYlsgXqp4BxLP67bzRJ1Bd2x0bWXurpEXY//VBOLnODqThGEcL7jouwjmnRh9FTKZfBDpFRaEfDFOXIfAkMKBa/c9TQwRpx2DPsl3eFWVCNuNGKeGsirLqCxUg5kWTxEorROppz9oU4HPicL6rRH22Ce6nOAON2vHvhkUuO3GbffhrcsPD4DaYup4ic+DxWm+DaSSRJ+e1yJvwi6NmQ9P9UAuLG93S2MdNNbosZ9P8k2mTOVKMc+GooI9Ve/vH8unwitwo7ORMVXhJeU6Q0X7zf3SjwDq2lBhn1DSuTsn2DbsNTiDvqrAaCvbsTsw+SZRwF85eG67eAwouYk+dnKmp1q57LDKMyzysij2oDKbcBlwB/TeX16p8+LxECv51asjS9TInnipssssUDrHIvoTTXWcz7Y5wIngxDFwT8rPY3EggzLGfK5Zx2Q5S/N0FfmADmKknG/D8qGIcJE574D956tiUDKN4I+/g125ORR1v7bP+OIaayAvq17RP+qcAqkxc0x8iCYVCYDouDyNvWPGRhbLUO7mlBpjW9jK9e2fvZY9iw3QzIPGKtClKZWZmIExheXRvbiA8amVmZi5sYXl0 b25AcHJpbWFyeWRhdGEuY29tPokCOQQTAQIAIwUCU4xmUAIbAwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEAAOaEEZVoIVzJoQALFCS6n/FHQS+hIzHIb56JbokhK0AFqoLVzLKzrnaeXhE5isWcVg0eoV2oTScIwUSUapy94if69tnUo4Q7YNt8/6yFM6hwZAxFjOXR0ciGE3Q+Z1zi49Ox51yjGMQGxlakV9ep4sV/d5a50M+LFTmYSAFp6HY23JN9PkjVJC4PUv5DYRbOZ6Y1+TfXKBAewMVqtwT1Y+LPlfmI8dbbbuUX/kKZ5ddhV2736fgyfpslvJKYl0YifUOVy4D1G/oSycyHkJG78OvX4JKcf2kKzVvg7/Rnv+AueCfFQ6nGwPn0P91I7TEOC4XfZ6a1K3uTp4fPPs1Wn75X7K8lzJP/p8lme40uqwAyBjk+IA5VGd+CVRiyJTpGZwA0jwSYLyXboX+Dqm9pSYzmC9+/AE7lIgpWj+3iNisp1SWtHc4pdtQ5EU2SEz8yKvDbD0lNDbv4ljI7eflPsvN6vOrxz24mCliEco5DwhpaaSnzWnbAPXhQDWb/lUgs/JNk8dtwmvWnqCwRqElMLVisAbJmC0BhZ/Ab4sph3EaiZfdXKhiQqSGdK4La3OTJOJYZphPdGgnkvDV9Pl1QZ0ijXQrVIy3zd6VCNaKYq7BAKidn5g/2Q8oio9Tf4XfdZ9dtwcB+bwDJFgvvDYaZ5bI3ln4V3EyW5i2NfXazz/GA/I/ZtbsigCFc8ftCBKZWZmIExheXRvbiA8amxheXRvbkBrZXJuZWwub3JnPokCOAQTAQIAIgUCWe8u6AIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQAA5oQRlWghUuCg/+Lb/xGxZD2Q1oJVAE37uW308UpVSD2tAMJUvFTdDbfe3zKlPDTuVsyNsALBGclPLagJ5ZTP+Vp2irAN9uwBuac BOTtmOdz4ZN2tdvNgozzuxp4CHBDVzAslUi2idy+xpsp47DWPxYFIRP3M8QG/aNW052LaPc0cedYxp8+9eiVUNpxF4SiU4i9JDfX/sn9XcfoVZIxMpCRE750zvJvcCUz9HojsrMQ1NFc7MFT1z3MOW2/RlzPcog7xvR5ENPH19ojRDCHqumUHRry+RF0lH00clzX/W8OrQJZtoBPXv9ahka/Vp7kEulcBJr1cH5Wz/WprhsIM7U9pse1f1gYy9YbXtWctUz8uvDR7shsQxAhX3qO7DilMtuGo1v97I/Kx4gXQ52syh/w6EBny71CZrOgD6kJwPVVAaM1LRC28muq91WCFhs/nzHozpbzcheyGtMUI2Ao4K6mnY+3zIuXPygZMFr9KXE6fF7HzKxKuZMJOaEZCiDOq0anx6FmOzs5E6Jqdpo/mtI8beK+BE7Va6ni7YrQlnT0i3vaTVMTiCThbqsB20VrbMjlhpf8lfK1XVNbRq/R7GZ9zHESlsa35ha60yd/j3pu5hT2xyy8krV8vGhHvnJ1XRMJBAB/UYb6FyC7S+mQZIQXVeAA+smfTT0tDrisj1U5x6ZB9b3nBg65ke5Ag0ETpXRPAEQAJkVmzCmF+IEenf9a2nZRXMluJohnfl2wCMmw5qNzyk0f+mYuTwTCpw7BE2H0yXk4ZfAuA+xdj14K0A1Dj52j/fKRuDqoNAhQe0b6ipo85Sz98G+XnmQOMeFVp5G1Z7r/QP/nus3mXvtFsu9lLSjMA0cam2NLDt7vx3l9kUYlQBhyIE7/DkKg+3fdqRg7qJoMHNcODtQY+n3hMyaVpplJ/l0DdQDbRSZi5AzDM3DWZEShhuP6/E2LN4O3xWnZukEiz688d1ppl7vBZO9wBql6Ft9Og74diZrTN6lXGGjEWRvO55h6ijMsLCLNDRAVehPhZvSlPldtUuvhZLAjdWpwmzbRIwgoQcO51aWeKthpcpj8feDdKdlVjvJO9fgFD5kqZ QiErRVPpB7VzA/pYV5Mdy7GMbPjmO0IpoL0tVZ8JvUzUZXB3ErS/dJflvboAAQeLpLCkQjqZiQ/DCmgJCrBJst9Xc7YsKKS379Tc3GU33HNSpaOxs2NwfzoesyjKU+P35czvXWTtj7KVVSj3SgzzFk+gLx8y2Nvt9iESdZ1Ustv8tipDsGcvIZ43MQwqU9YbLg8k4V9ch+Mo8SE+C0jyZYDCE2ZGf3OztvtSYMsTnF6/luzVyej1AFVYjKHORzNoTwdHUeC+9/07GO0bMYTPXYvJ/vxBFm3oniXyhgb5FtABEBAAGJAh8EGAECAAkFAk6V0TwCGwwACgkQAA5oQRlWghXhZRAAyycZ2DDyXh2bMYvI8uHgCbeXfL3QCvcw2XoZTH2l2umPiTzrCsDJhgwZfG9BDyOHaYhPasd5qgrUBtjjUiNKjVM+Cx1DnieR0dZWafnqGv682avPblfi70XXr2juRE/fSZoZkyZhm+nsLuIcXTnzY4D572JGrpRMTpNpGmitBdh1l/9O7Fb64uLOtA5Qj5jcHHOjL0DZpjmFWYKlSAHmURHrE8M0qRryQXvlhoQxlJR4nvQrjOPMsqWD5F9mcRyowOzr8amasLv43w92rD2nHoBK6rbFE/qC7AAjABEsZq8+TQmueN0maIXUQu7TBzejsEbV0i29z+kkrjU2NmK5pcxgAtehVxpZJ14LqmN6E0suTtzjNT1eMoqOPrMSx+6vOCIuvJ/MVYnQgHhjtPPnU86mebTY5Loy9YfJAC2EVpxtcCbx2KiwErTndEyWL+GL53LuScUD7tW8vYbGIp4RlnUgPLbqpgssq2gwYO9m75FGuKuB2+2bCGajqalid5nzeq9v7cYLLRgArJfOIBWZrHy2m0C+pFu9DSuV6SNr2dvMQUv1V58h0FaSOxHVQnJdnoHn13g/CKKvyg2EMrMt/EfcXgvDwQbnG9we4xJiWOIOcsvrWcB6C6lWBDA+In7w7SXnnok kZWuOsJdJQdmwlWC5L5ln9xgfr/4mOY38B0U= Content-Type: text/plain; charset="ISO-8859-15" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.50.2 (3.50.2-1.fc39) Precedence: bulk X-Mailing-List: kdevops@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Tue, 2023-12-12 at 14:43 -0500, Chuck Lever wrote: > On Tue, Dec 12, 2023 at 02:35:38PM -0500, Jeff Layton wrote: > > Add a new option to the post-install "goals" phase to configure tlshd > > for TLS handshake upcalls. This adds a new playbook to build a CA, > > generate certs for the hosts, and then configure tlshd to use them. > >=20 > > Finally, it also adds a new NFS fstests option to test RPC over TLS > > (using xprtsec=3Dmtls). > >=20 > > Signed-off-by: Jeff Layton > > --- > > Makefile | 4 + > > kconfigs/Kconfig.bringup.goals | 9 ++ > > playbooks/ktls.yml | 4 + > > playbooks/roles/fstests/templates/nfs/nfs.config | 7 ++ > > .../roles/ktls/tasks/install-deps/debian/main.yml | 10 ++ > > playbooks/roles/ktls/tasks/install-deps/main.yml | 9 ++ > > .../roles/ktls/tasks/install-deps/redhat/main.yml | 15 +++ > > .../roles/ktls/tasks/install-deps/suse/main.yml | 9 ++ > > playbooks/roles/ktls/tasks/main.yml | 110 +++++++++++++= ++++++++ > > playbooks/roles/ktls/templates/tlshd.conf | 39 ++++++++ > > scripts/bringup.Makefile | 5 + > > scripts/ktls.Makefile | 8 ++ > > workflows/fstests/nfs/Kconfig | 9 +- > > workflows/fstests/nfs/Makefile | 3 + > > 14 files changed, 240 insertions(+), 1 deletion(-) > >=20 > > diff --git a/Makefile b/Makefile > > index 895a0a67c705..0f6fa024f14c 100644 > > --- a/Makefile > > +++ b/Makefile > > @@ -114,6 +114,10 @@ ifeq (y,$(CONFIG_WORKFLOWS)) > > include workflows/Makefile > > endif # CONFIG_WORKFLOWS > > =20 > > +ifeq (y,$(CONFIG_KDEVOPS_SETUP_KTLS)) > > +include scripts/ktls.Makefile > > +endif # CONFIG_KDEVOPS_SETUP_KTLS > > + > > ifeq (y,$(CONFIG_KDEVOPS_SETUP_NFSD)) > > include scripts/nfsd.Makefile > > endif # CONFIG_KDEVOPS_SETUP_NFSD > > diff --git a/kconfigs/Kconfig.bringup.goals b/kconfigs/Kconfig.bringup.= goals > > index 5df74d4bcb08..a2af3ffba499 100644 > > --- a/kconfigs/Kconfig.bringup.goals > > +++ b/kconfigs/Kconfig.bringup.goals > > @@ -56,6 +56,15 @@ config KDEVOPS_TRY_INSTALL_KDEV_TOOLS > > most kernel developers might prefer to have installed on target > > systems. > > =20 > > +config KDEVOPS_SETUP_KTLS > > + bool "Configure ktls on the hosts with self-signed CA" > > + default n > > + help > > + Enabling this will have kdevops create a self-signed certificate > > + authority, and configure tlshd on the hosts to use it. This is > > + necessary for testing RPC over TLS, or some NVMe over fabrics > > + configurations. > > + > > config KDEVOPS_SETUP_NFSD > > bool "Set up the kernel nfs server" > > default n > > diff --git a/playbooks/ktls.yml b/playbooks/ktls.yml > > new file mode 100644 > > index 000000000000..8b7044c7ef2d > > --- /dev/null > > +++ b/playbooks/ktls.yml > > @@ -0,0 +1,4 @@ > > +--- > > +- hosts: all > > + roles: > > + - role: ktls > > diff --git a/playbooks/roles/fstests/templates/nfs/nfs.config b/playboo= ks/roles/fstests/templates/nfs/nfs.config > > index 60915f824764..e2265f3f3ee2 100644 > > --- a/playbooks/roles/fstests/templates/nfs/nfs.config > > +++ b/playbooks/roles/fstests/templates/nfs/nfs.config > > @@ -15,6 +15,13 @@ CANON_DEVS=3Dyes > > # Test with default mount options > > [nfs_default] > > {% endif %} > > +{% if fstests_nfs_section_tls -%} > > + > > +# Test NFS with RPC over TLS > > +[nfs_tls] > > +TEST_FS_MOUNT_OPTS=3D"-o xprtsec=3Dmtls" > > +MOUNT_OPTIONS=3D"-o xprtsec=3Dmtls" > > +{% endif %} > > {% if fstests_nfs_section_v40 -%} > > =20 > > # Test NFSv4.0 > > diff --git a/playbooks/roles/ktls/tasks/install-deps/debian/main.yml b/= playbooks/roles/ktls/tasks/install-deps/debian/main.yml > > new file mode 100644 > > index 000000000000..704c394e0c49 > > --- /dev/null > > +++ b/playbooks/roles/ktls/tasks/install-deps/debian/main.yml > > @@ -0,0 +1,10 @@ > > +--- > > +- name: Install ktls dependencies > > + become: yes > > + become_method: sudo > > + apt: > > + name: > > + - python3-cryptography > > + - ktls-utils > > + state: present > > + update_cache: yes > > diff --git a/playbooks/roles/ktls/tasks/install-deps/main.yml b/playboo= ks/roles/ktls/tasks/install-deps/main.yml > > new file mode 100644 > > index 000000000000..ab343e8b05c6 > > --- /dev/null > > +++ b/playbooks/roles/ktls/tasks/install-deps/main.yml > > @@ -0,0 +1,9 @@ > > +--- > > +# tasks to install dependencies for pynfs > > +- name: oscheck distribution ospecific setup > > + import_tasks: tasks/install-deps/debian/main.yml >=20 > Since this is a new set of install-deps, how about using > include_tasks: instead? >=20 >=20 Thanks! That seems to work just as well. I've incorporated that change in tree for now. > > + when: ansible_facts['os_family']|lower =3D=3D 'debian' > > +- import_tasks: tasks/install-deps/suse/main.yml > > + when: ansible_facts['os_family']|lower =3D=3D 'suse' > > +- import_tasks: tasks/install-deps/redhat/main.yml > > + when: ansible_facts['os_family']|lower =3D=3D 'redhat' > > diff --git a/playbooks/roles/ktls/tasks/install-deps/redhat/main.yml b/= playbooks/roles/ktls/tasks/install-deps/redhat/main.yml > > new file mode 100644 > > index 000000000000..0e1ab7505b3e > > --- /dev/null > > +++ b/playbooks/roles/ktls/tasks/install-deps/redhat/main.yml > > @@ -0,0 +1,15 @@ > > +--- > > +- name: Install ktls dependencies > > + become: yes > > + become_method: sudo > > + dnf: > > + update_cache: yes > > + name: "{{ packages }}" > > + retries: 3 > > + delay: 5 > > + register: result > > + until: result.rc =3D=3D 0 > > + vars: > > + packages: > > + - python3-cryptography > > + - ktls-utils > > diff --git a/playbooks/roles/ktls/tasks/install-deps/suse/main.yml b/pl= aybooks/roles/ktls/tasks/install-deps/suse/main.yml > > new file mode 100644 > > index 000000000000..ce5935154038 > > --- /dev/null > > +++ b/playbooks/roles/ktls/tasks/install-deps/suse/main.yml > > @@ -0,0 +1,9 @@ > > +--- > > +- name: Install ktls dependencies > > + become: yes > > + become_method: sudo > > + zypper: > > + state: present > > + name: > > + - python3-cryptography > > + - ktls-utils > > diff --git a/playbooks/roles/ktls/tasks/main.yml b/playbooks/roles/ktls= /tasks/main.yml > > new file mode 100644 > > index 000000000000..1aa545835502 > > --- /dev/null > > +++ b/playbooks/roles/ktls/tasks/main.yml > > @@ -0,0 +1,110 @@ > > +- name: Import optional extra_args file > > + include_vars: "{{ item }}" > > + ignore_errors: yes > > + with_first_found: > > + - files: > > + - "../extra_vars.yml" > > + - "../extra_vars.yaml" > > + - "../extra_vars.json" > > + skip: true > > + > > +- name: Install dependencies > > + import_tasks: install-deps/main.yml > > + > > +- name: Construct the path to the CA directory > > + delegate_to: localhost > > + set_fact: > > + ca_dir: "{{ topdir_path }}/ca/{{ kdevops_host_prefix }}" > > + > > +- name: Create directory to hold the CA on local host > > + delegate_to: localhost > > + run_once: true > > + ansible.builtin.file: > > + path: "{{ ca_dir }}" > > + state: directory > > + > > +- name: Create private key for CA > > + delegate_to: localhost > > + run_once: true > > + community.crypto.openssl_privatekey: > > + path: "{{ ca_dir }}/ca-cert.key" > > + > > +- name: Create certificate signing request (CSR) for CA certificate > > + delegate_to: localhost > > + run_once: true > > + community.crypto.openssl_csr_pipe: > > + privatekey_path: "{{ ca_dir }}/ca-cert.key" > > + common_name: "kdevops {{ kdevops_host_prefix }} CA" > > + use_common_name_for_san: false # since we do not specify SANs, do= n't use CN as a SAN > > + basic_constraints: > > + - 'CA:TRUE' > > + basic_constraints_critical: true > > + key_usage: > > + - keyCertSign > > + key_usage_critical: true > > + register: ca_csr > > + > > +- name: Create self-signed CA certificate from CSR > > + delegate_to: localhost > > + run_once: true > > + community.crypto.x509_certificate: > > + path: "{{ ca_dir }}/ca-cert.pem" > > + csr_content: "{{ ca_csr.csr }}" > > + privatekey_path: "{{ ca_dir }}/ca-cert.key" > > + provider: selfsigned > > + > > +- name: Create private key for new TLS certificate > > + community.crypto.openssl_privatekey: > > + path: "/etc/pki/tls/private/ktls.key" > > + become: yes > > + > > +- name: Copy CA cert to all of the hosts > > + ansible.builtin.copy: > > + src: "{{ ca_dir }}/ca-cert.pem" > > + dest: "/etc/pki/tls/certs/ca-cert.pem" > > + owner: root > > + group: root > > + mode: 0644 > > + become: yes > > + > > +- name: Create certificate signing request (CSR) for new certificate > > + community.crypto.openssl_csr_pipe: > > + privatekey_path: "/etc/pki/tls/private/ktls.key" > > + subject_alt_name: > > + - "DNS:{{ ansible_host }}" > > + - "IP:{{ ansible_default_ipv4.address }}" > > + register: csr > > + become: yes > > + > > +- name: Sign certificate with our CA > > + community.crypto.x509_certificate_pipe: > > + csr_content: "{{ csr.csr }}" > > + provider: ownca > > + ownca_path: "{{ ca_dir }}/ca-cert.pem" > > + ownca_privatekey_path: "{{ ca_dir }}/ca-cert.key" > > + ownca_not_after: +365d # valid for one year > > + ownca_not_before: "-1d" # valid since yesterday > > + delegate_to: localhost > > + register: certificate > > + > > +- name: Write certificate file on host > > + copy: > > + dest: "/etc/pki/tls/certs/ktls.pem" > > + content: "{{ certificate.certificate }}" > > + become: yes > > + > > +- name: Install new /etc/tlshd.conf > > + ansible.builtin.copy: > > + src: "{{ playbook_dir }}/roles/ktls/templates/tlshd.conf" > > + dest: "/etc/tlshd.conf" > > + owner: root > > + group: root > > + mode: 0644 > > + become: yes > > + > > +- name: Enable and start tlshd > > + become: yes > > + ansible.builtin.systemd_service: > > + name: tlshd.service > > + enabled: true > > + state: reloaded > > diff --git a/playbooks/roles/ktls/templates/tlshd.conf b/playbooks/role= s/ktls/templates/tlshd.conf > > new file mode 100644 > > index 000000000000..63ee5b59a8bd > > --- /dev/null > > +++ b/playbooks/roles/ktls/templates/tlshd.conf > > @@ -0,0 +1,39 @@ > > +# > > +# Copyright (c) 2022 Oracle and/or its affiliates. > > +# > > +# This file is part of ktls-utils. > > +# > > +# ktls-utils is free software; you can redistribute it and/or > > +# modify it under the terms of the GNU General Public License as > > +# published by the Free Software Foundation; version 2. > > +# > > +# This program is distributed in the hope that it will be useful, > > +# but WITHOUT ANY WARRANTY; without even the implied warranty of > > +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU > > +# General Public License for more details. > > +# > > +# You should have received a copy of the GNU General Public License > > +# along with this program; if not, write to the Free Software > > +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA > > +# 02110-1301, USA. > > +# > > +# See tlshd.conf(5) for details. > > +# > > + > > +[debug] > > +loglevel=3D0 > > +tls=3D0 > > +nl=3D0 > > + > > +[authenticate] > > +#keyrings=3D ;; > > + > > +[authenticate.client] > > +x509.truststore=3D/etc/pki/tls/certs/ca-cert.pem > > +x509.certificate=3D/etc/pki/tls/certs/ktls.pem > > +x509.private_key=3D/etc/pki/tls/private/ktls.key > > + > > +[authenticate.server] > > +x509.truststore=3D/etc/pki/tls/certs/ca-cert.pem > > +x509.certificate=3D/etc/pki/tls/certs/ktls.pem > > +x509.private_key=3D/etc/pki/tls/private/ktls.key > > diff --git a/scripts/bringup.Makefile b/scripts/bringup.Makefile > > index 0051bc3d5e0d..520e2993a7b1 100644 > > --- a/scripts/bringup.Makefile > > +++ b/scripts/bringup.Makefile > > @@ -21,6 +21,11 @@ ifeq (y,$(CONFIG_KDEVOPS_SETUP_NFSD)) > > KDEVOPS_BRING_UP_DEPS +=3D nfsd > > endif # KDEVOPS_SETUP_NFSD > > =20 > > +ifeq (y,$(CONFIG_KDEVOPS_SETUP_KTLS)) > > +KDEVOPS_BRING_UP_DEPS +=3D ktls > > +KDEVOPS_DESTROY_DEPS +=3D ktls-destroy > > +endif # KDEVOPS_SETUP_KTLS > > + > > update_etc_hosts: > > $(Q)ansible-playbook $(ANSIBLE_VERBOSE) \ > > -f 30 -i hosts playbooks/update_etc_hosts.yml > > diff --git a/scripts/ktls.Makefile b/scripts/ktls.Makefile > > new file mode 100644 > > index 000000000000..977538041ae8 > > --- /dev/null > > +++ b/scripts/ktls.Makefile > > @@ -0,0 +1,8 @@ > > +ktls: > > + $(Q)ansible-playbook $(ANSIBLE_VERBOSE) --extra-vars=3D@./extra_vars.= yaml \ > > + -f 30 -i hosts playbooks/ktls.yml > > + > > +ktls-destroy: > > + $(Q)rm -rf $(TOPDIR)/ca > > + > > +PHONY +=3D ktls ktls-destroy > > diff --git a/workflows/fstests/nfs/Kconfig b/workflows/fstests/nfs/Kcon= fig > > index 7e202778d286..7e8731dc4dc1 100644 > > --- a/workflows/fstests/nfs/Kconfig > > +++ b/workflows/fstests/nfs/Kconfig > > @@ -54,11 +54,18 @@ config FSTESTS_NFS_SECTION_DEFAULT > > time of this writing, this makes the client autonegotiate an NFS > > version, starting with v4.2 if it's available. > > =20 > > +config FSTESTS_NFS_SECTION_TLS > > + bool "Enable testing section: nfs_tls" > > + default n > > + depends on KDEVOPS_SETUP_KTLS > > + help > > + Enabling this will test with the xprtsec=3Dtls mount option. > > + > > config FSTESTS_NFS_SECTION_V40 > > bool "Enable testing section: nfs_v40" > > default n > > help > > - Enabling this will test NFSv4.0 > > + Enabling this will test NFSv4.0. > > =20 > > config FSTESTS_NFS_SECTION_V3 > > bool "Enable testing section: nfs_v3" > > diff --git a/workflows/fstests/nfs/Makefile b/workflows/fstests/nfs/Mak= efile > > index 7a057532be67..0e5245920ee9 100644 > > --- a/workflows/fstests/nfs/Makefile > > +++ b/workflows/fstests/nfs/Makefile > > @@ -9,6 +9,9 @@ FSTESTS_ARGS +=3D fstests_nfs_server_host=3D'$(FSTESTS_= NFS_SERVER_HOST)' > > ifeq (y,$(CONFIG_FSTESTS_NFS_SECTION_DEFAULT)) > > FSTESTS_ARGS +=3D fstests_nfs_section_default=3DTrue > > endif > > +ifeq (y,$(CONFIG_FSTESTS_NFS_SECTION_TLS)) > > +FSTESTS_ARGS +=3D fstests_nfs_section_tls=3DTrue > > +endif > > ifeq (y,$(CONFIG_FSTESTS_NFS_SECTION_V40)) > > FSTESTS_ARGS +=3D fstests_nfs_section_v40=3DTrue > > endif > >=20 > > --- > > base-commit: 2f7d9b13a7ac734e2fb40ed68e45150af9d727ef > > change-id: 20231212-ktls-5534fde5777c > >=20 > > Best regards, > > --=20 > > Jeff Layton > >=20 >=20 --=20 Jeff Layton