Subject: [nfsv4] openssl s_client patch for RPC starttls

From: "Benjamin Coddington" <[email-masked]>
Date: Wed, 13 Oct 2021 16:15:22 -0400

I often inspect TLS certificates and session parameters using openssl's
s_client app, so I've hacked up a patch that allows the s_client app to 
use
"-starttls rpc" for servers that have a working implementation.  I 
thought
I'd share it here as it might be useful:

https://github.com/bcodding/openssl/commit/4759096e12e8ff9e60bb340677d43d5e4ec0a740

It would be nice to know if it works to display certificates and 
parameters
against a freebsd server or other implementations.  I was able to test 
this
against Tigran's dcache-nfs-lab server that is still up on the VPN.

I'll eventually send a pull request to the openssl project once we have 
a
solid RFC.

Ben

---

From: "Benjamin Coddington" <[email-masked]>
Date: Thu, 14 Oct 2021 06:53:15 -0400

On 13 Oct 2021, at 16:15, Benjamin Coddington wrote:

> s_client app, so I've hacked up a patch that allows the s_client app 
> to use

Rick pointed out that I had the request wired up incorrectly.  This 
version
of the patch has the correction in it:

https://github.com/bcodding/openssl/commit/9bf2c4d66eac

Thanks Rick!
Ben

---

From: Rick Macklem <[email-masked]>
Date: Fri, 15 Oct 2021 00:05:45 +0000

>On 13 Oct 2021, at 16:15, Benjamin Coddington wrote:
[stuff snipped]
> https://github.com/bcodding/openssl/commit/9bf2c4d66eac
You are welcome. And thanks Ben for supporting the Bat VPN. It
comes in handy. (Just email if/when you want to do more testing.)
Btw, it might be nice to add a few things to the Bat VPN doc.
- Needs GNU make (gmake) and bash.
- Registration can be done from any system using local.hostname.
- Although the VPN is IP6 only, you can use IP4 to access the VPN
  concentratot, so you only need an IP4 Internet connection.

Have fun with it, ricl

Ben

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/nfsv4

---

From: "Benjamin Coddington" <[email-masked]>
Date: Fri, 15 Oct 2021 09:35:54 -0400

>   concentratot, so you only need an IP4 Internet connection.

I've added your suggestions to the documentation.  Thanks again for the
quick test.

Ben