Subject: Re: [nfsv4] New Version Notification for draft-cel-nfsv4-rpc-tls-pseudoflavors-01.txt

From: Chuck Lever III <[email-masked]>
Date: Tue, 15 Feb 2022 19:18:35 +0000

> On Jan 28, 2022, at 11:52 AM, Chuck Lever III <[email-masked]> wrote:
> 
>> 
>> On Jan 28, 2022, at 11:38 AM, David Noveck <[email-masked]> wrote:
>> 
>>> On Fri, Jan 28, 2022 at 9:57 AM Chuck Lever III <[email-masked]> wrote:
>>> 
>>> I was reminded recently that somewhere we have to mandate
>>> the use of RPC-with-TLS on the backchannel connection when
>>> an NFSv4.0 client connects using RPC-with-TLS on the forward
>>> channel. IMO that mandate belongs in nfsv4-security.
>> 
>> I will do that draft-ietf-nfsv4-security-05, either as it is done in draft-dnoveck-nfsv4-security-04 or 
>> in some other way to diding this up that Chuck and I are both comfortable with. 
>> 
>>> Also, I'd like to discuss how to divide the material in
>>> Section 5.2.1 between rpc-tls-pseudoflavors and
>>> nfsv4-security. Where do we begin?
>> 
>> I think we begin where we are in -04 with anyone, including most particularly you, proposing a different arrangement.
> 
> I can have a look at Sections 13 and 14 of -04 and
> propose some alternatives.

I'm sorry this took so long. I'm making good progress on the
Linux client RPC-with-TLS prototype, but there's one area
where I've been stuck and I haven't been able to put it down.

I looked through both documents. It seems to me that Section 5.2
of the rpc-tls-pseudoflavors document can be moved comfortably
to replace or augment Sections 13.4 and 14 of the nfsv4-security
document (I reviewed -04, Dec 2021, of this document).

And as mentioned previously:

- SETCLIENTID and friends and EXCHANGE_ID and friends need to
  have a mechanism (ie status code) for reporting missing
  transport layer security.

- The nfsv4-security document should stipulate a requirement
  for the use of transport layer security for the NFSv4.0
  callback channel.

Once the text of Section 5.2 appears in nfsv4-security, I
will remove it from Section 5 of rpc-tls-pseudoflavors and
push a new revision of that document. That might happen
concurrently with the promotion of that document to be a
WG document.

--
Chuck Lever