[PATCH v7 0/2] nfs-utils: signed filehandle support

[Benjamin Coddington <bcodding@hammerspace.com>]

Here are two patches allowing userspace to set a secret key for kNFSD to
sign filehandles, and also set the option to sign filehandles for an
export.

The secret key passed to the server is the first 128 bits of a sha1 hash of
the contents of a file configured via the nfs.conf server section
"fh_key_file".  Exports that have the option "sign_fh" set will cause the
server to use this key to append an 8-byte siphash of the filehandle onto
each filehandle.

This version of the userspace patches correspond with the v7 of the kernel
changes which have been posted here:
https://lore.kernel.org/linux-nfs/cover.1772022373.git.bcodding@hammerspace.com
and are currently queued up for potentical inclusion to linux kernel v7.1.

Changes on v5:
	- add -k,--fh-key_file= argument to "nfsdctl threads" command (Jeff Layton)
	- fail if "nfsdctl threads -k" unsuported by kernel (Jeff Layton)

Changes on v6:
	- fix a premature exit from fh-key-file hashing routine

Changes on v7:
	- fix another corner-case for hasing fh-key-file, simplify.

Benjamin Coddington (2):
  exportfs: Add support for export option sign_fh
  nfsdctl/rpc.nfsd: Add support for passing encrypted filehandle key

 nfs.conf                     |  1 +
 support/include/nfs/export.h |  2 +-
 support/include/nfslib.h     |  2 ++
 support/nfs/Makefile.am      |  4 +--
 support/nfs/exports.c        |  4 +++
 support/nfs/fh_key_file.c    | 63 ++++++++++++++++++++++++++++++++++++
 systemd/nfs.conf.man         |  1 +
 utils/exportfs/exportfs.c    |  2 ++
 utils/exportfs/exports.man   |  9 ++++++
 utils/nfsd/nfssvc.h          |  1 +
 utils/nfsdctl/nfsd_netlink.h |  1 +
 utils/nfsdctl/nfsdctl.8      |  8 ++++-
 utils/nfsdctl/nfsdctl.c      | 57 ++++++++++++++++++++++++++++----
 13 files changed, 145 insertions(+), 10 deletions(-)
 create mode 100644 support/nfs/fh_key_file.c


base-commit: 4706bac0345f67c50b73fd8da1c2629ed15ff79d
-- 
2.53.0