From: Steve Dickson <steved@redhat.com>
To: Benjamin Coddington <bcodding@hammerspace.com>
Cc: linux-nfs@vger.kernel.org, Chuck Lever <chuck.lever@oracle.com>,
NeilBrown <neil@brown.name>, Jeff Layton <jlayton@kernel.org>
Subject: Re: [PATCH v7 0/2] nfs-utils: signed filehandle support
Date: Sun, 29 Mar 2026 16:52:18 -0400 [thread overview]
Message-ID: <3d888a3d-fa6e-41c0-9b28-6dbb878a0a77@redhat.com> (raw)
In-Reply-To: <cover.1772638460.git.bcodding@hammerspace.com>
On 3/4/26 10:40 AM, Benjamin Coddington wrote:
> Here are two patches allowing userspace to set a secret key for kNFSD to
> sign filehandles, and also set the option to sign filehandles for an
> export.
>
> The secret key passed to the server is the first 128 bits of a sha1 hash of
> the contents of a file configured via the nfs.conf server section
> "fh_key_file". Exports that have the option "sign_fh" set will cause the
> server to use this key to append an 8-byte siphash of the filehandle onto
> each filehandle.
>
> This version of the userspace patches correspond with the v7 of the kernel
> changes which have been posted here:
> https://lore.kernel.org/linux-nfs/cover.1772022373.git.bcodding@hammerspace.com
> and are currently queued up for potentical inclusion to linux kernel v7.1.
>
> Changes on v5:
> - add -k,--fh-key_file= argument to "nfsdctl threads" command (Jeff Layton)
> - fail if "nfsdctl threads -k" unsuported by kernel (Jeff Layton)
>
> Changes on v6:
> - fix a premature exit from fh-key-file hashing routine
>
> Changes on v7:
> - fix another corner-case for hasing fh-key-file, simplify.
>
> Benjamin Coddington (2):
> exportfs: Add support for export option sign_fh
> nfsdctl/rpc.nfsd: Add support for passing encrypted filehandle key
>
> nfs.conf | 1 +
> support/include/nfs/export.h | 2 +-
> support/include/nfslib.h | 2 ++
> support/nfs/Makefile.am | 4 +--
> support/nfs/exports.c | 4 +++
> support/nfs/fh_key_file.c | 63 ++++++++++++++++++++++++++++++++++++
> systemd/nfs.conf.man | 1 +
> utils/exportfs/exportfs.c | 2 ++
> utils/exportfs/exports.man | 9 ++++++
> utils/nfsd/nfssvc.h | 1 +
> utils/nfsdctl/nfsd_netlink.h | 1 +
> utils/nfsdctl/nfsdctl.8 | 8 ++++-
> utils/nfsdctl/nfsdctl.c | 57 ++++++++++++++++++++++++++++----
> 13 files changed, 145 insertions(+), 10 deletions(-)
> create mode 100644 support/nfs/fh_key_file.c
>
>
> base-commit: 4706bac0345f67c50b73fd8da1c2629ed15ff79d
Committed... (tag: nfs-utils-2-9-1-rc2)
steved.
prev parent reply other threads:[~2026-03-29 20:52 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-04 15:40 [PATCH v7 0/2] nfs-utils: signed filehandle support Benjamin Coddington
2026-03-04 15:40 ` [PATCH v7 1/2] exportfs: Add support for export option sign_fh Benjamin Coddington
2026-03-04 15:40 ` [PATCH v7 2/2] nfsdctl/rpc.nfsd: Add support for passing encrypted filehandle key Benjamin Coddington
2026-03-29 20:52 ` Steve Dickson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3d888a3d-fa6e-41c0-9b28-6dbb878a0a77@redhat.com \
--to=steved@redhat.com \
--cc=bcodding@hammerspace.com \
--cc=chuck.lever@oracle.com \
--cc=jlayton@kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=neil@brown.name \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).