News for hackers. Stuff that matters.

A comment on FreeBSD gets pNFS support. Parent comment

Re:FreeBSD gets pNFS support by toast0 on Tuesday June 12, 2018 @09:06PM (#17299450)
NFS tends to be living in the kernel, which sounds like a terrible place for TLS. That said, IPSec lives in the kernel to some extent, you could layer NFS on top of ipsec....
[ Parent | on HN ]
Re:FreeBSD gets pNFS support by justincormack on Wednesday June 13, 2018 @02:13AM (#17300677)
Linux and FreeBSD have both got kernel TLS support (not sure if freebsd got merged yet but Netflix have used it fir a while)
[ Parent | on HN ]
Re:FreeBSD gets pNFS support by loeg on Wednesday June 13, 2018 @04:02AM (#17301189)
Netflix's TLS support is an extremely limited hack that suits their performance needs. It does not support initial session negotiation or rekeying. They do the former in userspace before handing off a symmetric key to the kernel, and drop connections in the latter case, relying on the client to reconnect. There's no chance it will be merged to FreeBSD; it's not a general solution.

As long as we're talking about TLS and IPSec, though, I'd point to Wireguard as maybe something viable for kernel use.

[ Parent | on HN ]
Re:FreeBSD gets pNFS support by justincormack on Friday June 22, 2018 @11:53AM (#17374948)
The Linux kernel TLS support does the same.
[ Parent | on HN ]
Re:FreeBSD gets pNFS support by gnufx on Wednesday June 13, 2018 @04:57PM (#17306873)
For what it's worth, NFS-Ganesha is a serious userland server.
[ Parent | on HN ]