RPC-with-TLS DANE prototype - #162
Open
chucklever wants to merge 3 commits into
Open
Conversation
RFC 9289 mentions DANE but specifies none of it: no TLSA owner name for RPC services, no certificate usage, and no word that a TLSA lookup means nothing unless DNSSEC validated it. NFS with TLS therefore still needs a CA bundle on every client. A TLSA RRset in a signed zone replaces that. Add a module that resolves _<port>._tcp.<name> through libunbound and matches the peer certificate with dane_verify_crt_raw(). libgnutls-dane's dane_query_tlsa() hides its resolver and fixes its trust anchor path at build time, so it cannot point at a test zone. An evaluation ends in one of five outcomes. A validated, usable RRset pins the security floor. A validated denial or a provably unsigned span leaves PKIX in charge. A bogus or failed lookup fails the handshake and never becomes the unsigned case. This round enables DANE-EE only. Policy is per handshake. One tlshd serves the NFS client, NFSD callbacks, and NVMe/TCP, so a daemon-global setting would apply one subsystem's DANE posture to every handshake. The config file supplies a default for consumers that name none. A config file naming a policy this build cannot honor is refused before it replaces the running one, fatally at startup. The legacy /etc/tlshd.conf yields to /etc/tlshd/config only when it is absent, never on a parse failure. RFC 9289 also requires a log of security mode selection, which tlshd emits only when debugging is enabled. Log policy, outcome, and authentication result for every DANE handshake. The netlink handler now keeps the peer port and notes whether getnameinfo() synthesized the peer name, since a PTR-derived name must not select a TLSA base domain. Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
The DANE step cannot run from the certificate verification callback. RFC 7671 makes the selected TLSA base domain the SNI value, and both client paths set SNI before the ClientHello goes out. A lookup from the callback arrives too late to change it. Evaluate DANE first, set SNI from the result, then start the handshake. The callback consumes what the evaluation left behind and performs no DNS of its own. The client-anonymous path used gnutls_session_set_verify_cert(), which bypasses a custom callback. Convert it to the callback the mutual path uses; DANE applies whether or not the client presents a certificate. The QUIC path evaluates too, so a policy requiring DANE is not bypassed. An unauthenticated QUIC handshake and a resumed session run no verify callback, so mark those cases and the audit reports auth=unauth or auth=resumed rather than an authentication failure. With the last gnutls_session_set_verify_cert() caller gone, no handshake records a verification status in the session. gnutls_session_get_verify_cert_status() then returns (unsigned)-1, which tlshd_log_cert_verification_error() logs as every failure reason at once. Report the status word from the verify callbacks instead and remove the reporter from handshake.c. Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Record what the three new [authenticate] settings do, which packages the build needs, and where tlshd looks for a DNSSEC trust anchor when the config file names none. Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a prototype implementation of DANE-based server authentication. To use, add appropriate DNS records identifying RPC servers that are known to support RPC-with-TLS, and then configure RPC-with-TLS clients to enable this feature.
A nascent "RPC-with-TLS using DANE" personal draft is available here: https://chucklever.github.io/i-d-rpc-tls-dane/draft-cel-nfsv4-rpc-tls-dane.html