On Fri, May 18, 2018 at 3:05 PM, Simo Sorce <simo@xxxxxxxxxx> wrote: > On Fri, 2018-05-18 at 14:53 -0400, Olga Kornievskaia wrote: >> Hi Chuck, >> >> I'm not convinced that "srchost=" is necessary. I believe that >> everything that is needed is suppose to be encoded in the "target=" >> option. >> >> I thought target just needed to correctly identify the domain for >> which authentication is taking place. Then I think more changes should >> be in nfs-utils to make sure that we find credentials for that >> particular domain instead of going by the gethostbyname() results. > > What do you mean by "domain" here? Realm or hostname ? > What if the multihomed service is part of multiple realms and even > serves with multiple different hostnames ? I meant the DNS domain name. Let's set a side multi-kerberos domain scenarios here as the implementation assumes a single domain right now. Otherwise we need to send down in which kerberos realm authentication is happening. I thought the problem is that nfs-utils looking for credentials quires gethostbyname() which on a multihome machine returns an answer which is insufficient accurately match among the key tab entries. I think we instead need to be parsing the domain out of the "target=<principal>@<targethost>.domain" and the look for the "nfs@<srchost>.domain" match instead of looking for "nfs@gethostbyname()" . Also kernel needs to make sure it's supplying the correct "target=" entry. > Simo. > >> >> On Fri, May 18, 2018 at 11:39 AM, Chuck Lever <chuck.lever@xxxxxxxxxx> wrote: >> > I've been experimenting with this series that modifies NFSD to >> > discover and use the correct GSS service principal when constructing >> > its NFSv4.0 callback channels. I'm interested in review of this >> > approach. There are a couple of code comments marked with XXX that >> > also need some attention. >> > >> > The rpc.gssd change mentioned in 1/4 is unremarkable and will be >> > made available once there is consensus about the kernel changes >> > in this series. No gssproxy changes are necessary. >> > >> > --- >> > >> > Chuck Lever (4): >> > sunrpc: Enable the kernel to specify the hostname part of service principals >> > sunrpc: Extract target name into svc_cred >> > nfsd: Use correct credential for NFSv4.0 callback with GSS >> > nfsd: Remove callback_cred >> > >> > >> > fs/nfsd/nfs4callback.c | 29 ++++---------- >> > fs/nfsd/nfs4state.c | 17 +++----- >> > fs/nfsd/state.h | 2 - >> > include/linux/sunrpc/svcauth.h | 3 + >> > net/sunrpc/auth_gss/auth_gss.c | 20 ++++++++-- >> > net/sunrpc/auth_gss/gss_rpc_upcall.c | 70 ++++++++++++++++++++++------------ >> > 6 files changed, 80 insertions(+), 61 deletions(-) >> > >> > -- >> > Chuck Lever >> > -- >> > To unsubscribe from this list: send the line "unsubscribe linux-nfs" in >> > the body of a message to majordomo@xxxxxxxxxxxxxxx >> > More majordomo info at http://vger.kernel.org/majordomo-info.html > > -- > Simo Sorce > Sr. Principal Software Engineer > Red Hat, Inc > -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
