nfscl/kgssapi: Fix Kerberized NFS mounts to pNFS serversDuring recent testing related to the IETF NFSv4 Bakeathon, it wasdiscovered that Kerberized NFSv4.1/4.2 mounts to pNFS servers(sec=krb5[ip]
nfscl/kgssapi: Fix Kerberized NFS mounts to pNFS serversDuring recent testing related to the IETF NFSv4 Bakeathon, it wasdiscovered that Kerberized NFSv4.1/4.2 mounts to pNFS servers(sec=krb5[ip],pnfs mount options) was broken.The FreeBSD client was using the "service principal" forthe MDS to try and establish a rpcsec_gss credential for a DS,which is incorrect. (A "service principal" looks like"nfs@<fqdn-of-server>" and the <fqdn-of-server> for the DS is notthe same as the MDS for most pNFS servers.)To fix this, the rpcsec_gss code needs to be able to do areverse DNS lookup of the DS's IP address. A new kgssapi upcallto the gssd(8) daemon is added by this patch to do the reverse DNSalong with a new rpcsec_gss function to generate the "serviceprincipal".A separate patch to the gssd(8) will be committed, so that thispatch will fix the problem. Without the gssd(8) patch, the newupcall fails and current/incorrect behaviour remains.This bug only affects the rare case of a Kerberized (sec=krb5[ip],pnfs)mount using pNFS.This patch changes the internal KAPI between the kgssapi andnfscl modules, but since I did a version bump a few days ago,I will not do one this time.(cherry picked from commit dd7d42a1fae5a4879b62689a165238082421f343)
show more ...
sys: Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
Fix some modules to export more used symbolsand remove non-present symbols that are now reported by kmod_syms.awk.Reviewed by: emasteSponsored by: The FreeBSD FoundationMFC after: 1 weekDiffer
Fix some modules to export more used symbolsand remove non-present symbols that are now reported by kmod_syms.awk.Reviewed by: emasteSponsored by: The FreeBSD FoundationMFC after: 1 weekDifferential revision: https://reviews.freebsd.org/D32878
sys/modules: normalize .CURDIR-relative paths to SRCTOPThis simplifies make output/logicTested with: `cd sys/modules; make ALL_MODULES=` on amd64MFC after: 1 monthSponsored by: Dell EMC Isilon
Kill MFILES and find things automatically. It turned out to be onlylightly used. Find the proper .m file when we depend on *_if.[ch] inthe srcs line, with seat-belts for false positive matches. Th
Kill MFILES and find things automatically. It turned out to be onlylightly used. Find the proper .m file when we depend on *_if.[ch] inthe srcs line, with seat-belts for false positive matches. This usesmake's path mechanism. A further refinement would be to calculate thisonce, and then pass the resulting _MPATH to modules submakes.Differential Revision: https://reviews.freebsd.org/D2327
Consistently set RPCGEN_CPP when running rpcgen, so the C preprocessorset via ${CPP} is used, instead of always using hardcoded /usr/bin/cpp.MFC after: 1 week
Implement support for RPCSEC_GSS authentication to both the NFS clientand server. This replaces the RPC implementation of the NFS client andserver with the newer RPC implementation originally devel
Implement support for RPCSEC_GSS authentication to both the NFS clientand server. This replaces the RPC implementation of the NFS client andserver with the newer RPC implementation originally developed(actually ported from the userland sunrpc code) to support the NFSLock Manager. I have tested this code extensively and I believe it isstable and that performance is at least equal to the legacy RPCimplementation.The NFS code currently contains support for both the new RPCimplementation and the older legacy implementation inherited from theoriginal NFS codebase. The default is to use the new implementation -add the NFS_LEGACYRPC option to fall back to the old code. When Imerge this support back to RELENG_7, I will probably change this sothat users have to 'opt in' to get the new code.To use RPCSEC_GSS on either client or server, you must build a kernelwhich includes the KGSSAPI option and the crypto device. On theuserland side, you must build at least a new libc, mountd, mount_nfsand gssd. You must install new versions of /etc/rc.d/gssd and/etc/rc.d/nfsd and add 'gssd_enable=YES' to /etc/rc.conf.As long as gssd is running, you should be able to mount an NFSfilesystem from a server that requires RPCSEC_GSS authentication. Themount itself can happen without any kerberos credentials but allaccess to the filesystem will be denied unless the accessing user hasa valid ticket file in the standard place (/tmp/krb5cc_<uid>). Thereis currently no support for situations where the ticket file is in adifferent place, such as when the user logged in via SSH and hasdelegated credentials from that login. This restriction is alsopresent in Solaris and Linux. In theory, we could improve this infuture, possibly using Brooks Davis' implementation of variantsymlinks.Supporting RPCSEC_GSS on a server is nearly as simple. You must createservice creds for the server in the form 'nfs/<fqdn>@<REALM>' andinstall them in /etc/krb5.keytab. The standard heimdal utility ktutilmakes this fairly easy. After the service creds have been created, youcan add a '-sec=krb5' option to /etc/exports and restart both mountdand nfsd.The only other difference an administrator should notice is that nfsddoesn't fork to create service threads any more. In normal operation,there will be two nfsd processes, one in userland waiting for TCPconnections and one in the kernel handling requests. The latterprocess will create as many kthreads as required - these should bevisible via 'top -H'. The code has some support for varying the numberof service threads according to load but initially at least, nfsd usesa fixed number of threads according to the value supplied to its '-n'option.Sponsored by: Isilon SystemsMFC after: 1 month