Hi! I recently updated my test systems from EL7 to Fedora 32, and NFSv4.0 with Kerberos has stopped working. I mount with "klimt.ib" as before. The client workload stops dead when the server tries to perform its first CB_RECALL. I added some client instrumentation: kernel: NFSv4: Callback principal (nfs@xxxxxxxxxxxxxxxxxxxxxxxx) does not match acceptor (nfs@xxxxxxxx). kernel: NFS: NFSv4 callback contains invalid cred I boosted gssd verbosity, and it says: rpc.gssd[986]: doing downcall: lifetime_rec=72226 acceptor=nfs@xxxxxxxx But it knows the full hostname for the server: rpc.gssd[986]: Full hostname for 'klimt.ib' is 'klimt.ib.1015granger.net' The acceptor appears to come from the Kerberos library. Shouldn't it be canonicalized? If so, should the Kerberos library do it, or should gssd? Since this behavior appeared after an upgrade, I suspect a Kerberos library regression. But it could be config- related, since both systems were re-imaged from the ground up. Also noticing some other problems on the server (missing hostname strings in debug messages, sssd_kcm infinite loops, and gssd sending garbage to the client after the NULL request that establishes the callback context). But let's look at the client acceptor problem first. -- Chuck Lever
