[PATCH net-next v3 00/10] Deliver TLS session tags to upper-layer consumers (NFSD)

[Chuck Lever <cel@kernel.org>]

NFSD controls remote access to its exports today by IP address and
hostname. Neither of these are cryptographically secure. For
instance, a MitM can replace the response to a server's plaintext
DNS query. As a result, a malicious NFS client can pretend to be a
client whose hostname matches one that has access to exports it
would otherwise be denied access to.

So instead, we want access-control decisions to be based on
cryptographically-vetted objects such as TLS peer-certificates.
In-kernel x.509 parsing would duplicate work mature userspace
libraries already do, so let's make tlshd evaluate peer certificates
in user space.

The certificates are evaluated against admin-defined policy, such
as whether the certificate's Issuer matches a particular string.
tlshd then marks NFS TLS sessions with those policy matches. Admins
also provide a set of policy names on each NFSD export (allow_tags).
Computing the intersection with these per-export tags is quick and
completely separate from the details of parsing x.509 certificates.

A yet-to-be-posted patch series introduces tag set support to the
exportfs command in nfs-utils. tlshd 1.5.0, current as of this
writing, already implements TLS session tagging.

---
Changes in v3:
- Replace the sloppy cover letter.
- Avoid a double free in the stringset capacity KUnit case (sashiko).
- Add list markers to the stringset kernel-doc Return: lists (sashiko).
- Move the duplicate session-tag KUnit changes into patch 5 (sashiko).
- Link to v2: https://patch.msgid.link/20261112-tls-session-tags-v2-0-a587a50de7fc@kernel.org

Changes in v2:
- Drop v1's 1/9, sent ahead of the set per Jeff and now merged.
- Adopt the pinned hr_file/fput lifetime model.
- Adapt to the errno-valued handshake status (hp_done takes int).
- Rename "tagset" to "stringset" throughout (Hannes)
- Warn and return false when a query precedes stringset_finalize().
- Add a patch with KUnit tests for stringset.
- Split the hp_done session-tags argument into its own patch.
- Collect the session tags before taking the completion gate.
- Pass ownership of the tag set to handshake_finish_complete().
- Add handshake_session_tag_len(), shared with the NFSD parser.
- Add KUnit tests for session-tag collection.
- Check the file reference count in the completion-gate KUnit case.
- Rename the ACCEPT cap attribute MAX_TAGS to MAX_SESSION_TAGS.
- Publish the saved tags with smp_wmb() and test_bit_acquire().
- Deny a tagged export on the non-mTLS arms of check_xprtsec_policy().
- Extract nfsd_nl_parse_allow_tags() from the netlink export parser.
- Build stringset only when a consumer selects CONFIG_STRINGSET.
- Free the session tags as soon as hp_done() returns.
- Report a rejected session tag or allow-tag through the extack.
- Show allow_tags in /proc/fs/nfsd/exports.
- Record the client address and XID in nfsd_export_tags_denied.
- Link to v1: https://patch.msgid.link/20260605-tls-session-tags-v1-0-47bd1d94d552@oracle.com

---
Chuck Lever (10):
      handshake: Add tags to "done" downcall
      lib: Add a "stringset" data structure
      lib: Add KUnit tests for the stringset data structure
      handshake: Add a session-tags argument to the TLS done callback
      handshake: Pick up session tags passed during the DONE downcall
      handshake: Add a kunit test for the completion gate
      handshake: Advertise the session-tag cap to user space
      SUNRPC: Copy the TLS session tags when they are available
      NFSD: Implement export tagging
      NFSD: Add allow_tags to the netlink export interface

 Documentation/core-api/index.rst           |   1 +
 Documentation/core-api/stringset.rst       | 243 ++++++++++++++++++++++
 Documentation/netlink/specs/handshake.yaml |  19 ++
 Documentation/netlink/specs/nfsd.yaml      |  10 +
 Documentation/networking/tls-handshake.rst |  62 +++++-
 MAINTAINERS                                |   8 +
 drivers/nvme/host/tcp.c                    |   3 +-
 drivers/nvme/target/tcp.c                  |   3 +-
 fs/nfsd/Kconfig                            |   1 +
 fs/nfsd/export.c                           | 194 +++++++++++++++++-
 fs/nfsd/export.h                           |   9 +
 fs/nfsd/netlink.c                          |   4 +-
 fs/nfsd/netlink.h                          |   3 +-
 fs/nfsd/trace.h                            |  27 +++
 include/linux/stringset.h                  | 191 ++++++++++++++++++
 include/linux/sunrpc/svc_xprt.h            |   7 +-
 include/net/handshake.h                    |  50 ++++-
 include/uapi/linux/handshake.h             |   4 +
 include/uapi/linux/nfsd_netlink.h          |   1 +
 lib/Kconfig                                |  12 ++
 lib/Kconfig.debug                          |   6 +
 lib/Makefile                               |   1 +
 lib/stringset.c                            | 190 ++++++++++++++++++
 lib/tests/Makefile                         |   1 +
 lib/tests/stringset_kunit.c                | 311 +++++++++++++++++++++++++++++
 net/Kconfig                                |   1 +
 net/handshake/genl.c                       |   5 +-
 net/handshake/handshake-test.c             | 307 ++++++++++++++++++++++++++++
 net/handshake/handshake.h                  |   9 +
 net/handshake/netlink.c                    | 110 +++++++++-
 net/handshake/request.c                    |  61 +++++-
 net/handshake/tlshd.c                      |  10 +-
 net/sunrpc/Kconfig                         |   1 +
 net/sunrpc/svc_xprt.c                      |  11 +-
 net/sunrpc/svcauth_unix.c                  |  14 +-
 net/sunrpc/svcsock.c                       |  63 +++++-
 net/sunrpc/xprtsock.c                      |   4 +-
 tools/net/ynl/Makefile.deps                |   3 +-
 38 files changed, 1914 insertions(+), 46 deletions(-)
---
base-commit: d1f4b7c6b997c29de67ad7178ababac2328cb1b4
change-id: 20260512-tls-session-tags-9d0042583f44

Best regards,
--  
Chuck Lever <cel@kernel.org>