From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A32D2303C93 for ; Sat, 6 Jun 2026 14:43:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780757023; cv=none; b=Q2Qaekpp7xS6+G06P3htnKlnyxPmvLhNspTJVsBWKIOLoE3+v4ppZyGgezDJcW8id4wY+pM6MpF+8zgL0rd04ElfCgaAorHoORPclAKRTApHb+m1F0/cGTC+oaeF6OkHXB8TLTbLHAtxNh7e/v3YQvsy6u1F3hhp6G0J48/AcbE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780757023; c=relaxed/simple; bh=a+OdDYPpATQec036hI/xaSLFO74hocIsV5vnu7E04iI=; h=MIME-Version:Date:From:To:Cc:Message-Id:In-Reply-To:References: Subject:Content-Type; b=Dy8YgZQONvGzsCK+FKy/pXsuCzhUmhuiVFsggzlv1zAhxYpmiQu6aV3tObOB3X4z9er9stg2JTQFxcW8qjcOpthtMVREJ41JNd3rZ8bXYsD09nC1utInEdRZf4DU7vijcv2kFj1yY11Kz7+7XjwRDTnQnFdPwxpxOSvmwdQKs2g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ZFce0516; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ZFce0516" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 294E21F00899; Sat, 6 Jun 2026 14:43:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780757022; bh=j9/rxncOVJQdf3WrC5LokDwMbFsp3+6id0NaDbR7R/o=; h=Date:From:To:Cc:In-Reply-To:References:Subject; b=ZFce0516pHo023GI/7ho3O0vr1reNsrXtyYjewMtEl14Nq+40s2lAII37Yj9LMsqx aEKOCc9N2hhfz1KIftZkmsp+0hTPY7X5S4e1pjIgzaXyrufml3xz758+12L3B0h6qP ETYGs/QySPdfldEj8q8qEC/BAW360mefiV913CwenXAPACPYCaPIq+fgxe9fs2jcHb Tj0YKn/194IwkaVe5VuG+lL7snuA8jRvMQ1g5SCWdwsHEf2wuu9em9m6tb9IFHB8r7 rHC4RdKgoXruYufCJRDFt/jePaItFcvmcOfkDQmiuKrqkqVhkRNnEq4m/KnahcUGum ck9KNJiqMsbcg== Received: from phl-compute-10.internal (phl-compute-10.internal [10.202.2.50]) by mailfauth.phl.internal (Postfix) with ESMTP id 27FD6F40080; Sat, 6 Jun 2026 10:43:40 -0400 (EDT) Received: from phl-imap-15 ([10.202.2.104]) by phl-compute-10.internal (MEProxy); Sat, 06 Jun 2026 10:43:40 -0400 X-ME-Sender: X-ME-Proxy-Cause: dmFkZTEUeB0sMSCB1BLAAfntTLokbcu3We/mJtkfQ3Bhx0+gg34v+F1FZmEmD6OrAdv0jY L0ZhnvdXsLckDDVeoCkmavi3Qiu4cRgLVny27TXjhaePcLZ7Qwi6awa0lqlf23y9NIctya zKY2gguliLTdmYNqKG5iLkZjE7U4YqBfvCzgM/OMm8CG2VOJfUleRmiXKjQxAmX4IowXkb AD8YFZoDcbSHrMQYvt6OIQj5eHxauxVdmFmC/dhLchIZ1EeStLZ1QUtdeKPOAmOLRZDH72 RvyAAzplNZXzsH24wz4IoHiR4vg8OCdGU3d+ENB4BQk6SBE6ojkulwZiWEdKPkYAR8IxCe VWbTYJjVZYVoi/sBg7yPVKXIajigS+oKlphTRa6HpxbIj94r0ADWOx2w95japhq5SCvGL+ 1/FpbJyRS/oDNJcUvPhQZgnvKRqq2kAhbVA+vgFLWeBSTpRr1vFASZ3g4M0Rur001XT03w 9RmGSpbaYuszI5N+38BqCYHTjjF32p8mKmNl257juV1S7ikiFj846jGd9RxWbJukq2YxQ8 rv1kyUfg87QwX0LFyvGJSIeF+RLPT01/TSkNywdokuo5wdJ2id+YSZWS2Hlq+6J/G2sQJ0 2nTP6NFUga4foclm8d4I9ABOXW7/h0Gd7zkWFx67x0Qx4GGwDPqTLrf1cZ/w X-ME-Proxy: Feedback-ID: ifa6e4810:Fastmail Received: by mailuser.phl.internal (Postfix, from userid 501) id E0E11780070; Sat, 6 Jun 2026 10:43:39 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ThreadId: Awlu_ohcY-4Z Date: Sat, 06 Jun 2026 07:43:17 -0700 From: "Chuck Lever" To: "Jeff Layton" , "Donald Hunter" , "Jakub Kicinski" , "David S. Miller" , "Eric Dumazet" , "Paolo Abeni" , "Simon Horman" , "Jonathan Corbet" , "Shuah Khan" , "Andrew Morton" , "John Fastabend" , "Sabrina Dubroca" , "Keith Busch" , "Jens Axboe" , "Christoph Hellwig" , "Sagi Grimberg" , "Chaitanya Kulkarni" , NeilBrown , "Olga Kornievskaia" , "Dai Ngo" , "Tom Talpey" , "Trond Myklebust" , "Anna Schumaker" Cc: kernel-tls-handshake@lists.linux.dev, netdev@vger.kernel.org, linux-nvme@lists.infradead.org, linux-nfs@vger.kernel.org, "Chuck Lever" Message-Id: In-Reply-To: References: <20260605-tls-session-tags-v1-0-47bd1d94d552@oracle.com> Subject: Re: [PATCH 0/9] Deliver TLS session tags to upper-layer consumers (NFSD) Content-Type: text/plain Content-Transfer-Encoding: 7bit On Sat, Jun 6, 2026, at 6:26 AM, Jeff Layton wrote: > On Fri, 2026-06-05 at 13:34 -0400, Chuck Lever wrote: >> NFSD and similar upper-layer services want access-control decisions >> based on TLS peer-certificate characteristics, but in-kernel x.509 >> parsing would duplicate work mature userspace libraries already do. >> This series gives tlshd a way to evaluate certificates against >> admin-defined policy and report matching policies back to the kernel >> as opaque string tags. The handshake layer plumbs the tags through to >> the upper-layer consumer's completion callback; intersection against >> per-resource tag sets stays the consumer's problem. >> >> Four architectural choices shape the series, only one of which is >> visible in any single patch. >> >> The tagging vocabulary is opaque to the kernel. tlshd decides what >> each tag means; the handshake layer and its consumers only test >> membership. This keeps x.509 out of the kernel and lets policy evolve >> at userspace speed. Any future attribute the kernel wants to gate on >> must be expressed as a tag rather than as a new netlink field per >> attribute. >> >> DONE gains a privilege check (patch 1) as a prerequisite, not as >> cleanup. Without it, an unprivileged process guessing a sockfd could >> submit a forged DONE and effectively grant or deny tag membership >> for a real handshake. Once tags carry authorization weight, that >> pre-existing gap becomes load-bearing. The fix predates tags in >> principle and carries a Fixes: tag, but it sits at the head of this >> series so the rest of the work has a trustworthy foundation. >> >> HANDSHAKE_MAX_SESSIONTAGS is advertised on every ACCEPT reply as >> HANDSHAKE_A_ACCEPT_MAX_TAGS (patch 6), so tlshd can size its >> DONE-side tag list against the kernel's runtime limit rather than >> guessing from header constants. If a daemon overruns anyway, the >> DONE handler truncates and logs one pr_warn_once rather than >> returning -E2BIG: tearing down a handshake the operator almost >> certainly wants to keep is a worse outcome than dropping a few >> tags. The truncation path is defense-in-depth for a buggy or >> stale agent, not the primary signal. >> >> The tagset helper (patch 3) is split out as a generic library so >> NFSD export tagging (patches 8 and 9) can use it without further >> churn in net/handshake/. >> >> --- >> Chuck Lever (9): >> handshake: Require admin permission for DONE command >> handshake: Add tags to "done" downcall >> lib: Add a "tagset" data structure >> handshake: Pick up session tags passed during the DONE downcall >> handshake: Add a kunit test for the completion gate >> handshake: advertise the session-tag cap to user space >> SUNRPC: Copy the TLS session tags when they are available >> NFSD: Implement export tagging >> NFSD: Add allow_tags to the netlink export interface >> >> Documentation/core-api/index.rst | 1 + >> Documentation/core-api/tagset.rst | 225 +++++++++++++++++++++++++++++ >> Documentation/netlink/specs/handshake.yaml | 16 ++ >> Documentation/netlink/specs/nfsd.yaml | 10 ++ >> Documentation/networking/tls-handshake.rst | 63 +++++++- >> drivers/nvme/host/tcp.c | 3 +- >> drivers/nvme/target/tcp.c | 3 +- >> fs/nfsd/export.c | 141 +++++++++++++++++- >> fs/nfsd/export.h | 11 ++ >> fs/nfsd/netlink.c | 4 +- >> fs/nfsd/netlink.h | 3 +- >> fs/nfsd/trace.h | 19 +++ >> include/linux/sunrpc/svc_xprt.h | 2 + >> include/linux/tagset.h | 187 ++++++++++++++++++++++++ >> include/net/handshake.h | 30 +++- >> include/uapi/linux/handshake.h | 4 + >> include/uapi/linux/nfsd_netlink.h | 1 + >> lib/Makefile | 1 + >> lib/tagset.c | 174 ++++++++++++++++++++++ >> net/handshake/genl.c | 7 +- >> net/handshake/handshake-test.c | 72 +++++++++ >> net/handshake/handshake.h | 6 + >> net/handshake/netlink.c | 109 +++++++++++++- >> net/handshake/request.c | 68 ++++++++- >> net/handshake/tlshd.c | 10 +- >> net/sunrpc/svc_xprt.c | 11 +- >> net/sunrpc/svcauth_unix.c | 12 ++ >> net/sunrpc/svcsock.c | 38 ++++- >> net/sunrpc/xprtsock.c | 5 +- >> 29 files changed, 1205 insertions(+), 31 deletions(-) >> --- >> base-commit: 4d4d6605de5f91a40335729b6a7cc15e83b280f3 >> change-id: 20260512-tls-session-tags-9d0042583f44 >> >> Best regards, >> -- >> Chuck Lever > > I was wanting to review this, but I can't seem to get it to apply > cleanly to any known tree. What tree is this based on? commit 4d4d6605de5f91a40335729b6a7cc15e83b280f3 (cel/nfsd-testing) Author: Chuck Lever AuthorDate: Thu Sep 5 15:25:37 2024 -0400 Commit: Chuck Lever CommitDate: Thu May 28 11:34:51 2026 -0400 That's some old shit. I will rebase it before posting it again. -- Chuck Lever