Hey mrchuck...
On 07/11/13 14:25, Chuck Lever wrote:
> Hi Steve-
>
> On Nov 7, 2013, at 11:09 AM, Steve Dickson <steved@xxxxxxxxxx> wrote:
>
>> This new module parameter makes the v4 client
>> use the minimal authentication flavor (AUTH_UNIX)
>> when establishing NFSV4 state and doing the
>> pseudoroot lookup
>
> The patch description doesn't say, but is this change to work
> around the 15 second GSSD upcall timeout?
Yes. A 15 second delay on every mount due to security that
nobody is requesting is just not good.. IMHO.. Also running
a security daemon for non-secure mounts just seems wrong to me.
> Have we completely given up on fixing the upcall?
Back when we were looking on to introduce gss-proxy into
the client, it was decided the upcall on the client
was not going to change. I'm just going with that!
steved.
>
>
>> Signed-off-by: Steve Dickson <steved@xxxxxxxxxx>
>> ---
>> fs/nfs/nfs4_fs.h | 1 +
>> fs/nfs/nfs4client.c | 8 ++++++--
>> fs/nfs/nfs4proc.c | 4 +++-
>> fs/nfs/super.c | 6 +++++-
>> 4 files changed, 15 insertions(+), 4 deletions(-)
>>
>> diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
>> index 28842ab..20bf925 100644
>> --- a/fs/nfs/nfs4_fs.h
>> +++ b/fs/nfs/nfs4_fs.h
>> @@ -438,6 +438,7 @@ extern bool nfs4_disable_idmapping;
>> extern unsigned short max_session_slots;
>> extern unsigned short send_implementation_id;
>> extern bool recover_lost_locks;
>> +extern bool nfs4_use_min_auth;
>>
>> #define NFS4_CLIENT_ID_UNIQ_LEN (64)
>> extern char nfs4_client_id_uniquifier[NFS4_CLIENT_ID_UNIQ_LEN];
>> diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
>> index a860ab5..ff85991 100644
>> --- a/fs/nfs/nfs4client.c
>> +++ b/fs/nfs/nfs4client.c
>> @@ -355,6 +355,7 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
>> char buf[INET6_ADDRSTRLEN + 1];
>> struct nfs_client *old;
>> int error;
>> + rpc_authflavor_t flavor = RPC_AUTH_GSS_KRB5I;
>>
>> if (clp->cl_cons_state == NFS_CS_READY) {
>> /* the client is initialised already */
>> @@ -368,8 +369,11 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
>> if (clp->cl_minorversion != 0)
>> __set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags);
>> __set_bit(NFS_CS_DISCRTRY, &clp->cl_flags);
>> - error = nfs_create_rpc_client(clp, timeparms, RPC_AUTH_GSS_KRB5I);
>> - if (error == -EINVAL)
>> +
>> + if (nfs4_use_min_auth)
>> + flavor = RPC_AUTH_UNIX;
>> + error = nfs_create_rpc_client(clp, timeparms, flavor);
>> + if (error == -EINVAL && flavor != RPC_AUTH_UNIX)
>> error = nfs_create_rpc_client(clp, timeparms, RPC_AUTH_UNIX);
>> if (error < 0)
>> goto error;
>> diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
>> index d53d678..00162cb 100644
>> --- a/fs/nfs/nfs4proc.c
>> +++ b/fs/nfs/nfs4proc.c
>> @@ -2864,7 +2864,9 @@ static int nfs4_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle,
>> int status = -EPERM;
>> size_t i;
>>
>> - for (i = 0; i < ARRAY_SIZE(flav_array); i++) {
>> + if (nfs4_use_min_auth)
>> + status = nfs4_lookup_root_sec(server, fhandle, info, RPC_AUTH_UNIX);
>> + else for (i = 0; i < ARRAY_SIZE(flav_array); i++) {
>> status = nfs4_lookup_root_sec(server, fhandle, info, flav_array[i]);
>> if (status == -NFS4ERR_WRONGSEC || status == -EACCES)
>> continue;
>> diff --git a/fs/nfs/super.c b/fs/nfs/super.c
>> index a03b9c6..42b4f9b 100644
>> --- a/fs/nfs/super.c
>> +++ b/fs/nfs/super.c
>> @@ -2791,6 +2791,7 @@ unsigned short max_session_slots = NFS4_DEF_SLOT_TABLE_SIZE;
>> unsigned short send_implementation_id = 1;
>> char nfs4_client_id_uniquifier[NFS4_CLIENT_ID_UNIQ_LEN] = "";
>> bool recover_lost_locks = false;
>> +bool nfs4_use_min_auth = false;
>>
>> EXPORT_SYMBOL_GPL(nfs_callback_set_tcpport);
>> EXPORT_SYMBOL_GPL(nfs_callback_tcpport);
>> @@ -2800,6 +2801,7 @@ EXPORT_SYMBOL_GPL(max_session_slots);
>> EXPORT_SYMBOL_GPL(send_implementation_id);
>> EXPORT_SYMBOL_GPL(nfs4_client_id_uniquifier);
>> EXPORT_SYMBOL_GPL(recover_lost_locks);
>> +EXPORT_SYMBOL_GPL(nfs4_use_min_auth);
>>
>> #define NFS_CALLBACK_MAXPORTNR (65535U)
>>
>> @@ -2842,5 +2844,7 @@ MODULE_PARM_DESC(recover_lost_locks,
>> "If the server reports that a lock might be lost, "
>> "try to recover it risking data corruption.");
>>
>> -
>> +module_param(nfs4_use_min_auth, bool, 0644);
>> +MODULE_PARM_DESC(nfs4_use_min_auth,
>> + "Use mimnal auth in SETCLIENTID operation");
>> #endif /* CONFIG_NFS_V4 */
>> --
>> 1.7.1
>>
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
>> the body of a message to majordomo@xxxxxxxxxxxxxxx
>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
> --
> Chuck Lever
> chuck[dot]lever[at]oracle[dot]com
>
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
