From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-00069f02.pphosted.com (mx0b-00069f02.pphosted.com [205.220.177.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 346CA63575 for ; Tue, 12 Dec 2023 19:44:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oracle.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oracle.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="oi3WonR+"; dkim=pass (1024-bit key) header.d=oracle.onmicrosoft.com header.i=@oracle.onmicrosoft.com header.b="hRqNBaaj" Received: from pps.filterd (m0333520.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 3BCDinWF010403; Tue, 12 Dec 2023 19:44:03 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=date : from : to : cc : subject : message-id : references : content-type : in-reply-to : mime-version; s=corp-2023-11-20; bh=10O9wP5wpQjsAKSQVKmRjuMyRMxg0BC1AYrPLm2dmHk=; b=oi3WonR+y7duBQvLdtFHwJBiIR3EUE8bxtca8LJlelTt7MjYca/Y8mV2wUtdBUwKlgpa +eUTViobPz8aJqBZUBcDIeScS1kxICbfXb5t2UjLxdgy0qTZslhDykyWskiCrzL7L9aO kPMKP/qJlf0dphQNBIQe0XLXQeaROzPXDo1cTwSWOer2ad6LqxAxylkNGLODxPe/aJVM easwCSUuH3REkt7uT66dci7my/deU0o4LzyQcRvrJAgXp2Q+feBuA6mcHwwiJhWBoL1j +LQyB2Jk2sa85Qzzic5wtLN5URIYYJ4oeJ1QiwIefjxAsZ06dsPlCm+qB2FrLfhrgR9B fQ== Received: from iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com (iadpaimrmta03.appoci.oracle.com [130.35.103.27]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3uvg9d6khf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 12 Dec 2023 19:44:02 +0000 Received: from pps.filterd (iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1]) by iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com (8.17.1.19/8.17.1.19) with ESMTP id 3BCIFgZq013005; Tue, 12 Dec 2023 19:44:02 GMT Received: from nam12-dm6-obe.outbound.protection.outlook.com (mail-dm6nam12lp2169.outbound.protection.outlook.com [104.47.59.169]) by iadpaimrmta03.imrmtpd1.prodappiadaev1.oraclevcn.com (PPS) with ESMTPS id 3uvepdbu9w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 12 Dec 2023 19:44:02 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=nommYh/dZvQ+3D5nV+nOxmaIEaQVjL4arrVEjryfBuATaitnHS0k+vLAuXTx9L7hU4tYDBZQhfwoDacyvZ0ZzMuOpg7pyQP3bgf1nPjWU48aHrCIPUWjKvpr6375xe3IA5QHtATDO6MyhRVcEvehi4TKRcCydd+jErBilAxUT5WYpAYOZR410+/jvX2clWuZvDDUV3uKFkvRpev3+W1Xp2qm5eGql33Fms9p/w+/3eXkF3BShrxDDBPOSt42qt14NfKY2MAGefiJmDeFiIXC7/+2atTXza6OL0mgBWeZt8HhyPiljrmq/M1DpnsqI8GliMCSSaUFp5Qxi+fp4Vzubw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=10O9wP5wpQjsAKSQVKmRjuMyRMxg0BC1AYrPLm2dmHk=; b=e7ngdlMrE6vtJANMjpPdlCqezAJYwZktQ4Gh3T9NeBQzKpGmbdNGeLhsW86HfDca9RRcPBmlWzM9oyzltzYdgnJ1YYeGAagRqqjuZC7dFDtdg8BoDOq4Op21SBY27a3YparAJPWRwrXNMgrMS+MyOKCZIxN2V8Gg8COCxgZ6cHuCojKieGwwRIdZV5j+yxf2XxZGZB4MgvcA0tEPk8hp+y/kj2YTAqK/oNq9sHtSXtlvx+bHIKAf6sGS4tIpYOUDHd1YHJ8uiyFOYMoQZ1l2gd6x38ghZUYc0h3hxnqsZ5DedE5nS8RWieJdwjIZXjPmIpW34Zs2VmBNDnn5yVsEDw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=10O9wP5wpQjsAKSQVKmRjuMyRMxg0BC1AYrPLm2dmHk=; b=hRqNBaajPbCgphIM8+/37T90pwdLId5NBiuQY8CmbHQzn2jmBBa2/gdApkwrGFTgsZ2fIgPHuhwEY9g3/6Ma/gDrAkDxuyv7aDj4HLUYWDRVgwRE5q/NMFGxtTYXmNYsWfc5hfAws/ou02LcKEMCoNK6Iq2Q93GLg6rIt+Lipe8= Received: from BN0PR10MB5128.namprd10.prod.outlook.com (2603:10b6:408:117::24) by BLAPR10MB5282.namprd10.prod.outlook.com (2603:10b6:208:30e::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7091.26; Tue, 12 Dec 2023 19:44:00 +0000 Received: from BN0PR10MB5128.namprd10.prod.outlook.com ([fe80::360b:b3c0:c5a9:3b3c]) by BN0PR10MB5128.namprd10.prod.outlook.com ([fe80::360b:b3c0:c5a9:3b3c%4]) with mapi id 15.20.7091.022; Tue, 12 Dec 2023 19:44:00 +0000 Date: Tue, 12 Dec 2023 14:43:57 -0500 From: Chuck Lever To: Jeff Layton Cc: Luis Chamberlain , kdevops@lists.linux.dev Subject: Re: [PATCH kdevops] ktls: allow setting up hosts with tlshd Message-ID: References: <20231212-ktls-v1-1-acfba0d36f75@kernel.org> Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20231212-ktls-v1-1-acfba0d36f75@kernel.org> X-ClientProxiedBy: CH2PR14CA0038.namprd14.prod.outlook.com (2603:10b6:610:56::18) To BN0PR10MB5128.namprd10.prod.outlook.com (2603:10b6:408:117::24) Precedence: bulk X-Mailing-List: kdevops@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN0PR10MB5128:EE_|BLAPR10MB5282:EE_ X-MS-Office365-Filtering-Correlation-Id: f2c65224-0a33-4a29-cc88-08dbfb4aafc4 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 52DyOq2963M2PetMqpeTpVjZ3sXnO1vSINGxsCbb/efCwOdYAP+LcfbMfSpaiAcF1jfEwUfz9vilwYwj8rbgZWe/vkwmi8lEBC1GMZY8X2S4Wr3Rp26izu/IXMXKHe9NUH3wSZiKW8Tg/c98EJ2mv0ibfr04a/aA2hcLLBZH1TU/Wjfr8wXina8baakmC7wDz/P+iDJ11EIGJ36qHJxy19K4z9ni3Lpqx/cuGyerNsMd9algmcVweopp2YrexQ3EHK0sxoe6LEkvdGzVlPPUw9AFZumTalhRF5OjCCopa/Q7q0kM/SF2VB8UcpLsjnR5Q5Rqder/XbdipLh5N7yj3B7kR6iasZt5ImoavUfnd/xyzLm1xrIlM8C2Yujl/qor0llOV1wH9TVqUm7lSxjnzs5WTv0xGy+RWM1mqq8Zis1/+lWm9uOJNE+7iS2Y6KR2vxCuMsjD2zTJUqYClfugaF93JLKUaAQ0+gNrA23AIGqgFP6jlKu57lBnuJpRZU6yD4RIT2X2zjYkW3WvW5UKnOeXrb7P2zKh9w+gOM8VD1k6LPEYZ6tiTB5QD4lVPXdV0954Cq8VSOJiuMPi1OjmOeeQS4fiMQWBn39cDMBbE94UaTYgMI+2+bSSyJ0nqlxu X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN0PR10MB5128.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(136003)(396003)(366004)(346002)(376002)(39860400002)(230922051799003)(451199024)(186009)(1800799012)(64100799003)(5660300002)(38100700002)(30864003)(2906002)(41300700001)(86362001)(478600001)(316002)(6916009)(6486002)(66476007)(66556008)(66946007)(26005)(6666004)(6506007)(9686003)(6512007)(4326008)(8676002)(8936002)(83380400001)(44832011)(17423001)(2004002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?wOh850ZpmGQh0AP1rRc69h9Mq04V74BEyyNWumb4eTsxNr27tVa1OG4NPUXS?= =?us-ascii?Q?3GT2XiJQjgnYbiivDAW2avPizavBiUmdUhVgguZ4+dVqnmEFX0tflx+goO7/?= =?us-ascii?Q?SeVIhsEX1Zcy6ezN8yOWv9bH1Tf2S+VJj4ee4llPhY2Ma6yRORqwXpr3U6O4?= =?us-ascii?Q?htLnwp7w1epJIuLQtPZvguAuc3KMem/PVMFCg1Amq5Z7QbPGK8D/krn3t2tw?= =?us-ascii?Q?IDXPdS26wdkPjR9XWxUZRQ7lRB8Xz1j4Wd+0W/+NYZlK0QIebiymjCiBPr0a?= =?us-ascii?Q?ZvkENIMsp7JZZRdDED8/eKpwOUihofeeYPr/oon6cNlVz68ryhFBexh+nrHp?= =?us-ascii?Q?MkuJvSkgR4h8w+K8Ca/+3nvhWJjbJXtyxtGW5UtCF/U4h9pC77G7wFrnwizW?= =?us-ascii?Q?NdoNM3/Qe0valz1CxD9MwOfLdAklB8aYThl9DVH5f0mZFvPss+/GN41lB7FC?= =?us-ascii?Q?dr0WGgC6aAIy773+MFxR070yAT/69+G6Sx/VG+4nPuVzxX3R0tV+x/aX3EFq?= =?us-ascii?Q?YIf+H2bcplW9XghL69HQYMXtnJcR/EEwKb+Ky2hNX3Q8nIMyu23tF6HOA6Rj?= =?us-ascii?Q?SUoFAExOMAK43eiKpiGQms4fKYomXRlbSLh7WlszpFeu6Iak3tx2QYMNN/tX?= =?us-ascii?Q?qr1kT0h0yaM07+rC7IhTSthbLLCF7pgAsQf8Y1PYQFZ4oRh5QaCmDEuDvX1y?= =?us-ascii?Q?gyEOAxtmPQAKTIyykPtYbMRPwvAViyatmLjNLcocLQydUPIWURSaV/Xbq0NF?= =?us-ascii?Q?H1/eFofH5rRNLGaPoAkzqA+M7DMJfNCSAZhGl/cKrXujFekqqiuFaqqcGCFO?= =?us-ascii?Q?cxdmuvwhW6IakCbos1PUSZgOL4wduJfmx7fcn5th9gpI3MuJ2b60rQhgJ+De?= =?us-ascii?Q?btsGOpOWzwyT1x/xryEX1kDv9qDXVYZ82MJD/OHRYvHRs3KsMqCvSPLoCmdB?= =?us-ascii?Q?3jj1jGl9+e9q0zRUFwH6zl29TdKmV3jqH9v0EYj4AM+X5yHHaIG4+zTgpSxs?= =?us-ascii?Q?hs6yPE9oWLQbAJzrLrZhni2GrUe1IemvAohZ8KVILMm8WA53vnSw1Ox0usQ9?= =?us-ascii?Q?dB44Snl79ztWcgbcCOuWMtnLEmB5ei/iEi3oJbCu+kCnPanzmo8FKnf/eGq+?= =?us-ascii?Q?2rwNg3cVDyGEpEqPZjNOhr3HFuqBoQvkCm7B3cZDCBpdO2zemGc8suO3ku3y?= =?us-ascii?Q?HcvdXc5iR15HGYJjWo/JbCLPXPKhhTxgUe3Uempc9GBM9VlfIQzzdptMNK5e?= =?us-ascii?Q?GGM6eyXPRoUM+Yxu3yp0iZ3BtVmAq1bHEez0DlZctswuNLka3g7jgbkFJenw?= =?us-ascii?Q?eSLuskwEOIbOIRJmVmsOczFx9A4M1v61Z0gIpGueNNp5WwRMd34rj8FrzXV2?= =?us-ascii?Q?G7kaU7laUo5Ujk7tduIo7+mtxln4Z4FUoMYxT3qjFTtxjq+IIuAdvJgg+bgl?= =?us-ascii?Q?yO+J8wpbJfj+BTQRx5BgS3KcSVAf2itDB9TijpMGsgvmjchuFugk9vNg0uW2?= =?us-ascii?Q?y4HtnB639DEgwmTeoMAv3GnsKGRE+KikrzOoxStwAbgpprJN66PokbiC7zyj?= =?us-ascii?Q?KREN2NxOitg05W0rcT0V9sxdmvkjEtH79MIY7yyPV9l2tnzJaK3Mx2FqmQl5?= =?us-ascii?Q?rQ=3D=3D?= X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 56qH6KLiU3RSN9Wt7XXlXJeB89jfwjs697loRFs5GP+CMWUTX7ylBuZzONC5p2xbNplw+qurlcBBknO39SuAqB4SCfMdrulrsMJ8DTmOzDVx1fYc5zXOUswYl54GGN65LdCDIEMa34eWJai+9mAm0QXGnHCJxf0D7rov79D6xHx8JolYNQNDd3uLiYP1qsWJtmK+DwIiOE7xIalj3tg3OrCq6uNeX0GhsRXGTFi7IX+4Gj+wmfsb4B3hFvfBftkN9eUBONkpa3NeDvHP+reGA5wk1lcD4A2ARYHRqzLbwb5bPsV2jUUZrMHEms8cQuIi8bPGGpJgEohOzqd6kVdGivz3DRcHWd0vgTMKSLTPOnAmUxvkPCBJULoq6bFFZhF45c/yppMl9fE/YlbvVV1VtBvc4xCdi47DBlkOtpyEY4EZxHskhwXEBpE7B9E4uXO7jrjqF0XkFJPipGvHteyrCH2Kn2ILsimmZ55fA3R1Da8w3TfvUwsEkD7SSiK9Q34FlczaoX35PXH9y/K1BdjHGu6jHZgsrq9g36QX6P74gJp32oyodzmqMhrW03XBca8wPljGZQaUUAc68GpahEcGYQ9SoD8n7yUF+qMCuf7FnKY= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: f2c65224-0a33-4a29-cc88-08dbfb4aafc4 X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5128.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Dec 2023 19:43:59.9396 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: pS0KxX0ZL34oPen2dOjMpeuuwS6jSqmIH6ZKBcyGetKn1/yHsQWRqbEcOWL8pJCo2bIgX0HElsgk4myKiTw8rg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLAPR10MB5282 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.997,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2023-12-12_12,2023-12-12_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 mlxscore=0 suspectscore=0 phishscore=0 adultscore=0 mlxlogscore=999 bulkscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000 definitions=main-2312120151 X-Proofpoint-GUID: X_Hm2yPH9irXYi3OV8bbi7jbQ_G-VMW3 X-Proofpoint-ORIG-GUID: X_Hm2yPH9irXYi3OV8bbi7jbQ_G-VMW3 On Tue, Dec 12, 2023 at 02:35:38PM -0500, Jeff Layton wrote: > Add a new option to the post-install "goals" phase to configure tlshd > for TLS handshake upcalls. This adds a new playbook to build a CA, > generate certs for the hosts, and then configure tlshd to use them. > > Finally, it also adds a new NFS fstests option to test RPC over TLS > (using xprtsec=mtls). > > Signed-off-by: Jeff Layton > --- > Makefile | 4 + > kconfigs/Kconfig.bringup.goals | 9 ++ > playbooks/ktls.yml | 4 + > playbooks/roles/fstests/templates/nfs/nfs.config | 7 ++ > .../roles/ktls/tasks/install-deps/debian/main.yml | 10 ++ > playbooks/roles/ktls/tasks/install-deps/main.yml | 9 ++ > .../roles/ktls/tasks/install-deps/redhat/main.yml | 15 +++ > .../roles/ktls/tasks/install-deps/suse/main.yml | 9 ++ > playbooks/roles/ktls/tasks/main.yml | 110 +++++++++++++++++++++ > playbooks/roles/ktls/templates/tlshd.conf | 39 ++++++++ > scripts/bringup.Makefile | 5 + > scripts/ktls.Makefile | 8 ++ > workflows/fstests/nfs/Kconfig | 9 +- > workflows/fstests/nfs/Makefile | 3 + > 14 files changed, 240 insertions(+), 1 deletion(-) > > diff --git a/Makefile b/Makefile > index 895a0a67c705..0f6fa024f14c 100644 > --- a/Makefile > +++ b/Makefile > @@ -114,6 +114,10 @@ ifeq (y,$(CONFIG_WORKFLOWS)) > include workflows/Makefile > endif # CONFIG_WORKFLOWS > > +ifeq (y,$(CONFIG_KDEVOPS_SETUP_KTLS)) > +include scripts/ktls.Makefile > +endif # CONFIG_KDEVOPS_SETUP_KTLS > + > ifeq (y,$(CONFIG_KDEVOPS_SETUP_NFSD)) > include scripts/nfsd.Makefile > endif # CONFIG_KDEVOPS_SETUP_NFSD > diff --git a/kconfigs/Kconfig.bringup.goals b/kconfigs/Kconfig.bringup.goals > index 5df74d4bcb08..a2af3ffba499 100644 > --- a/kconfigs/Kconfig.bringup.goals > +++ b/kconfigs/Kconfig.bringup.goals > @@ -56,6 +56,15 @@ config KDEVOPS_TRY_INSTALL_KDEV_TOOLS > most kernel developers might prefer to have installed on target > systems. > > +config KDEVOPS_SETUP_KTLS > + bool "Configure ktls on the hosts with self-signed CA" > + default n > + help > + Enabling this will have kdevops create a self-signed certificate > + authority, and configure tlshd on the hosts to use it. This is > + necessary for testing RPC over TLS, or some NVMe over fabrics > + configurations. > + > config KDEVOPS_SETUP_NFSD > bool "Set up the kernel nfs server" > default n > diff --git a/playbooks/ktls.yml b/playbooks/ktls.yml > new file mode 100644 > index 000000000000..8b7044c7ef2d > --- /dev/null > +++ b/playbooks/ktls.yml > @@ -0,0 +1,4 @@ > +--- > +- hosts: all > + roles: > + - role: ktls > diff --git a/playbooks/roles/fstests/templates/nfs/nfs.config b/playbooks/roles/fstests/templates/nfs/nfs.config > index 60915f824764..e2265f3f3ee2 100644 > --- a/playbooks/roles/fstests/templates/nfs/nfs.config > +++ b/playbooks/roles/fstests/templates/nfs/nfs.config > @@ -15,6 +15,13 @@ CANON_DEVS=yes > # Test with default mount options > [nfs_default] > {% endif %} > +{% if fstests_nfs_section_tls -%} > + > +# Test NFS with RPC over TLS > +[nfs_tls] > +TEST_FS_MOUNT_OPTS="-o xprtsec=mtls" > +MOUNT_OPTIONS="-o xprtsec=mtls" > +{% endif %} > {% if fstests_nfs_section_v40 -%} > > # Test NFSv4.0 > diff --git a/playbooks/roles/ktls/tasks/install-deps/debian/main.yml b/playbooks/roles/ktls/tasks/install-deps/debian/main.yml > new file mode 100644 > index 000000000000..704c394e0c49 > --- /dev/null > +++ b/playbooks/roles/ktls/tasks/install-deps/debian/main.yml > @@ -0,0 +1,10 @@ > +--- > +- name: Install ktls dependencies > + become: yes > + become_method: sudo > + apt: > + name: > + - python3-cryptography > + - ktls-utils > + state: present > + update_cache: yes > diff --git a/playbooks/roles/ktls/tasks/install-deps/main.yml b/playbooks/roles/ktls/tasks/install-deps/main.yml > new file mode 100644 > index 000000000000..ab343e8b05c6 > --- /dev/null > +++ b/playbooks/roles/ktls/tasks/install-deps/main.yml > @@ -0,0 +1,9 @@ > +--- > +# tasks to install dependencies for pynfs > +- name: oscheck distribution ospecific setup > + import_tasks: tasks/install-deps/debian/main.yml Since this is a new set of install-deps, how about using include_tasks: instead? > + when: ansible_facts['os_family']|lower == 'debian' > +- import_tasks: tasks/install-deps/suse/main.yml > + when: ansible_facts['os_family']|lower == 'suse' > +- import_tasks: tasks/install-deps/redhat/main.yml > + when: ansible_facts['os_family']|lower == 'redhat' > diff --git a/playbooks/roles/ktls/tasks/install-deps/redhat/main.yml b/playbooks/roles/ktls/tasks/install-deps/redhat/main.yml > new file mode 100644 > index 000000000000..0e1ab7505b3e > --- /dev/null > +++ b/playbooks/roles/ktls/tasks/install-deps/redhat/main.yml > @@ -0,0 +1,15 @@ > +--- > +- name: Install ktls dependencies > + become: yes > + become_method: sudo > + dnf: > + update_cache: yes > + name: "{{ packages }}" > + retries: 3 > + delay: 5 > + register: result > + until: result.rc == 0 > + vars: > + packages: > + - python3-cryptography > + - ktls-utils > diff --git a/playbooks/roles/ktls/tasks/install-deps/suse/main.yml b/playbooks/roles/ktls/tasks/install-deps/suse/main.yml > new file mode 100644 > index 000000000000..ce5935154038 > --- /dev/null > +++ b/playbooks/roles/ktls/tasks/install-deps/suse/main.yml > @@ -0,0 +1,9 @@ > +--- > +- name: Install ktls dependencies > + become: yes > + become_method: sudo > + zypper: > + state: present > + name: > + - python3-cryptography > + - ktls-utils > diff --git a/playbooks/roles/ktls/tasks/main.yml b/playbooks/roles/ktls/tasks/main.yml > new file mode 100644 > index 000000000000..1aa545835502 > --- /dev/null > +++ b/playbooks/roles/ktls/tasks/main.yml > @@ -0,0 +1,110 @@ > +- name: Import optional extra_args file > + include_vars: "{{ item }}" > + ignore_errors: yes > + with_first_found: > + - files: > + - "../extra_vars.yml" > + - "../extra_vars.yaml" > + - "../extra_vars.json" > + skip: true > + > +- name: Install dependencies > + import_tasks: install-deps/main.yml > + > +- name: Construct the path to the CA directory > + delegate_to: localhost > + set_fact: > + ca_dir: "{{ topdir_path }}/ca/{{ kdevops_host_prefix }}" > + > +- name: Create directory to hold the CA on local host > + delegate_to: localhost > + run_once: true > + ansible.builtin.file: > + path: "{{ ca_dir }}" > + state: directory > + > +- name: Create private key for CA > + delegate_to: localhost > + run_once: true > + community.crypto.openssl_privatekey: > + path: "{{ ca_dir }}/ca-cert.key" > + > +- name: Create certificate signing request (CSR) for CA certificate > + delegate_to: localhost > + run_once: true > + community.crypto.openssl_csr_pipe: > + privatekey_path: "{{ ca_dir }}/ca-cert.key" > + common_name: "kdevops {{ kdevops_host_prefix }} CA" > + use_common_name_for_san: false # since we do not specify SANs, don't use CN as a SAN > + basic_constraints: > + - 'CA:TRUE' > + basic_constraints_critical: true > + key_usage: > + - keyCertSign > + key_usage_critical: true > + register: ca_csr > + > +- name: Create self-signed CA certificate from CSR > + delegate_to: localhost > + run_once: true > + community.crypto.x509_certificate: > + path: "{{ ca_dir }}/ca-cert.pem" > + csr_content: "{{ ca_csr.csr }}" > + privatekey_path: "{{ ca_dir }}/ca-cert.key" > + provider: selfsigned > + > +- name: Create private key for new TLS certificate > + community.crypto.openssl_privatekey: > + path: "/etc/pki/tls/private/ktls.key" > + become: yes > + > +- name: Copy CA cert to all of the hosts > + ansible.builtin.copy: > + src: "{{ ca_dir }}/ca-cert.pem" > + dest: "/etc/pki/tls/certs/ca-cert.pem" > + owner: root > + group: root > + mode: 0644 > + become: yes > + > +- name: Create certificate signing request (CSR) for new certificate > + community.crypto.openssl_csr_pipe: > + privatekey_path: "/etc/pki/tls/private/ktls.key" > + subject_alt_name: > + - "DNS:{{ ansible_host }}" > + - "IP:{{ ansible_default_ipv4.address }}" > + register: csr > + become: yes > + > +- name: Sign certificate with our CA > + community.crypto.x509_certificate_pipe: > + csr_content: "{{ csr.csr }}" > + provider: ownca > + ownca_path: "{{ ca_dir }}/ca-cert.pem" > + ownca_privatekey_path: "{{ ca_dir }}/ca-cert.key" > + ownca_not_after: +365d # valid for one year > + ownca_not_before: "-1d" # valid since yesterday > + delegate_to: localhost > + register: certificate > + > +- name: Write certificate file on host > + copy: > + dest: "/etc/pki/tls/certs/ktls.pem" > + content: "{{ certificate.certificate }}" > + become: yes > + > +- name: Install new /etc/tlshd.conf > + ansible.builtin.copy: > + src: "{{ playbook_dir }}/roles/ktls/templates/tlshd.conf" > + dest: "/etc/tlshd.conf" > + owner: root > + group: root > + mode: 0644 > + become: yes > + > +- name: Enable and start tlshd > + become: yes > + ansible.builtin.systemd_service: > + name: tlshd.service > + enabled: true > + state: reloaded > diff --git a/playbooks/roles/ktls/templates/tlshd.conf b/playbooks/roles/ktls/templates/tlshd.conf > new file mode 100644 > index 000000000000..63ee5b59a8bd > --- /dev/null > +++ b/playbooks/roles/ktls/templates/tlshd.conf > @@ -0,0 +1,39 @@ > +# > +# Copyright (c) 2022 Oracle and/or its affiliates. > +# > +# This file is part of ktls-utils. > +# > +# ktls-utils is free software; you can redistribute it and/or > +# modify it under the terms of the GNU General Public License as > +# published by the Free Software Foundation; version 2. > +# > +# This program is distributed in the hope that it will be useful, > +# but WITHOUT ANY WARRANTY; without even the implied warranty of > +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU > +# General Public License for more details. > +# > +# You should have received a copy of the GNU General Public License > +# along with this program; if not, write to the Free Software > +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA > +# 02110-1301, USA. > +# > +# See tlshd.conf(5) for details. > +# > + > +[debug] > +loglevel=0 > +tls=0 > +nl=0 > + > +[authenticate] > +#keyrings= ;; > + > +[authenticate.client] > +x509.truststore=/etc/pki/tls/certs/ca-cert.pem > +x509.certificate=/etc/pki/tls/certs/ktls.pem > +x509.private_key=/etc/pki/tls/private/ktls.key > + > +[authenticate.server] > +x509.truststore=/etc/pki/tls/certs/ca-cert.pem > +x509.certificate=/etc/pki/tls/certs/ktls.pem > +x509.private_key=/etc/pki/tls/private/ktls.key > diff --git a/scripts/bringup.Makefile b/scripts/bringup.Makefile > index 0051bc3d5e0d..520e2993a7b1 100644 > --- a/scripts/bringup.Makefile > +++ b/scripts/bringup.Makefile > @@ -21,6 +21,11 @@ ifeq (y,$(CONFIG_KDEVOPS_SETUP_NFSD)) > KDEVOPS_BRING_UP_DEPS += nfsd > endif # KDEVOPS_SETUP_NFSD > > +ifeq (y,$(CONFIG_KDEVOPS_SETUP_KTLS)) > +KDEVOPS_BRING_UP_DEPS += ktls > +KDEVOPS_DESTROY_DEPS += ktls-destroy > +endif # KDEVOPS_SETUP_KTLS > + > update_etc_hosts: > $(Q)ansible-playbook $(ANSIBLE_VERBOSE) \ > -f 30 -i hosts playbooks/update_etc_hosts.yml > diff --git a/scripts/ktls.Makefile b/scripts/ktls.Makefile > new file mode 100644 > index 000000000000..977538041ae8 > --- /dev/null > +++ b/scripts/ktls.Makefile > @@ -0,0 +1,8 @@ > +ktls: > + $(Q)ansible-playbook $(ANSIBLE_VERBOSE) --extra-vars=@./extra_vars.yaml \ > + -f 30 -i hosts playbooks/ktls.yml > + > +ktls-destroy: > + $(Q)rm -rf $(TOPDIR)/ca > + > +PHONY += ktls ktls-destroy > diff --git a/workflows/fstests/nfs/Kconfig b/workflows/fstests/nfs/Kconfig > index 7e202778d286..7e8731dc4dc1 100644 > --- a/workflows/fstests/nfs/Kconfig > +++ b/workflows/fstests/nfs/Kconfig > @@ -54,11 +54,18 @@ config FSTESTS_NFS_SECTION_DEFAULT > time of this writing, this makes the client autonegotiate an NFS > version, starting with v4.2 if it's available. > > +config FSTESTS_NFS_SECTION_TLS > + bool "Enable testing section: nfs_tls" > + default n > + depends on KDEVOPS_SETUP_KTLS > + help > + Enabling this will test with the xprtsec=tls mount option. > + > config FSTESTS_NFS_SECTION_V40 > bool "Enable testing section: nfs_v40" > default n > help > - Enabling this will test NFSv4.0 > + Enabling this will test NFSv4.0. > > config FSTESTS_NFS_SECTION_V3 > bool "Enable testing section: nfs_v3" > diff --git a/workflows/fstests/nfs/Makefile b/workflows/fstests/nfs/Makefile > index 7a057532be67..0e5245920ee9 100644 > --- a/workflows/fstests/nfs/Makefile > +++ b/workflows/fstests/nfs/Makefile > @@ -9,6 +9,9 @@ FSTESTS_ARGS += fstests_nfs_server_host='$(FSTESTS_NFS_SERVER_HOST)' > ifeq (y,$(CONFIG_FSTESTS_NFS_SECTION_DEFAULT)) > FSTESTS_ARGS += fstests_nfs_section_default=True > endif > +ifeq (y,$(CONFIG_FSTESTS_NFS_SECTION_TLS)) > +FSTESTS_ARGS += fstests_nfs_section_tls=True > +endif > ifeq (y,$(CONFIG_FSTESTS_NFS_SECTION_V40)) > FSTESTS_ARGS += fstests_nfs_section_v40=True > endif > > --- > base-commit: 2f7d9b13a7ac734e2fb40ed68e45150af9d727ef > change-id: 20231212-ktls-5534fde5777c > > Best regards, > -- > Jeff Layton > -- Chuck Lever