summaryrefslogtreecommitdiffstats
path: root/utils
Commit message (Collapse)AuthorAgeFilesLines
...
* mount.nfs: Assume v2/v3 if mount-related options are presentChuck Lever2009-11-161-0/+12
| | | | | | | | Don't try NFSv4 if any MNT protocol related options were presented by the user. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: process service= attribute in new upcallOlga Kornievskaia2009-11-163-13/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add processing of the "service=" attribute in the new gssd upcall. If "service" is specified, then the kernel is indicating that we must use machine credentials for this request. (Regardless of the uid value or the setting of root_uses_machine_creds.) If the service value is "*", then any service name can be used. Otherwise, it specifies the service name that should be used. (For now, the values of service will only be "*" or "nfs".) Restricting gssd to use "nfs" service name is needed for when the NFS server is doing a callback to the NFS client. In this case, the NFS server has to authenticate itself as "nfs" -- even if there are other service keys such as "host" or "root" in the keytab. Another case when the kernel may specify the service attribute is when gssd is being asked to create the context for a SETCLIENT_ID operation. In this case, machine credentials must be used for the authentication. However, the service name used for this case is not important. Signed-off-by: Olga Kornievskaia <aglo@citi.umich.edu> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: process target= attribute in new upcallOlga Kornievskaia2009-11-161-3/+23
| | | | | | | | | | | | | | | | | | | | | | Add processing of the "target=" attribute in the new gssd upcall. Information in this field is used to construct the gss service name of the server for which gssd will create a context . This, along with the next patch handling "service=", is needed for callback security. For Kerberos, the NFS client will use a service principal present in its keytab during authentication of the SETCLIENT_ID operation. When establishing the context for the callback, the gssd on the NFS server will attempt to authenticate the callback against the principal name used by the client. Note: An NFS client machine must have a keytab for the callback authentication to succeed. Signed-off-by: Olga Kornievskaia <aglo@citi.umich.edu> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: handle new client upcallOlga Kornievskaia2009-11-163-31/+168
| | | | | | | | | | | | | | | | | | | | Add support for handling the new client-side upcall. The kernel, beginning with 2.6.29, will attempt to use a new pipe, "gssd", which can be used for upcalls for all gss mechanisms. The new upcall is text-based with an <attribute>=<value> format. Attribute/value pairs are separated by a space, and terminated with a new-line character. The intial version has two required attributes, mech=<gss_mechanism_name> and uid=<user's_UID_number>, and two optional attributes, target=<gss_target_name> and service=<value>. Future kernels may add new attribute/value pairs. Signed-off-by: Olga Kornievskaia <aglo@citi.umich.edu> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: print full client directory being handledOlga Kornievskaia2009-11-161-2/+2
| | | | | | | | | For convenience, add the full name of the upcall pipe being processed. (Distinquishes between "normal" upcall, and a callback upcall.) Signed-off-by: Olga Kornievskaia <aglo@citi.umich.edu> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: add upcall support for callback authenticationOlga Kornievskaia2009-11-164-49/+143
| | | | | | | | | | | | | | Change the processing so that all subdirectories within the rpc_pipefs directory are treated equally. Any "clnt" directories that show up within any of them are processed. (As suggested by Bruce Fields.) Note that the callback authentication will create a new "nfs4d_cb" subdirectory. Only new kernels (2.6.29) will create this new directory. (The need for this directory will go away with NFSv4.1 where the callback can be done on the same connection as the fore-channel.) Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* gssd: refactor update_client_list()Olga Kornievskaia2009-11-162-9/+22
| | | | | | | | | Split out the processing for a pipe to a separate routine. The next patch adds a new pipe to be processed. Signed-off-by: Olga Kornievskaia <aglo@citi.umich.edu> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* This patch adds the krb5 hostbased principal, name which theOlga Kornievskaia2009-11-161-7/+87
| | | | | | | | | | | | | | nfs client used to authenticate, to the svcgssd downcall information. This information is needed for the callback authentication. When estabishing the callback, nfsd will pass the principal name in the upcall to the gssd. gssd will acquire a service ticket for the specified principal name. Signed-off-by: Olga Kornievskaia <aglo@citi.umich.edu> Signed-off-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Remove the AI_ADDRCONFIG hint flag to getaddrinfo() when it'sSteve Dickson2009-11-121-1/+1
| | | | | | | | | call by nfsd to set up the file descriptors that are sent to the kernel. The flag causes the getaddrinfo() to fail, with EAI_NONAME, when there is not a non-loopback network interface configured. Signed-off-by: Steve Dickson <steved@redhat.com>
* mount: Fix po_join() call site in nfs_try_mount_v4()Chuck Lever2009-11-031-1/+2
| | | | | | | Make sure the copied options string is freed in case po_join() fails. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* mount.nfs: Assume v2/v3 if mount-related options are presentChuck Lever2009-11-031-14/+35
| | | | | | | | Don't try NFSv4 if any MNT protocol related options were presented by the user. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* Made some aesthetic changes to the code that setsSteve Dickson2009-11-032-8/+10
| | | | | | the defaults that were a result of the code review. Signed-off-by: Steve Dickson <steved@redhat.com>
* Retry v4 mounts with a v3 mount when the versionSteve Dickson2009-11-031-2/+9
| | | | | | | | is not explicitly specified and the mount fails with ENOENT. The will help deal with Linux servers that do not automatically export a pseudo root Signed-off-by: Steve Dickson <steved@redhat.com>
* Added wrappers around the setting of default valuesSteve Dickson2009-10-272-15/+45
| | | | | | | from the config file which will be compiled out when the config file is not enabled. Signed-off-by: Steve Dickson <steved@redhat.com>
* Added the defaultproto and defaultvers variable to the mountSteve Dickson2009-10-221-4/+18
| | | | | | configuration file. Signed-off-by: Steve Dickson <steved@redhat.com>
* Use the default protocol and version values, when theySteve Dickson2009-10-222-3/+22
| | | | | | | are set in the configuration file, to start the negation with the server Signed-off-by: Steve Dickson <steved@redhat.com>
* Introducing the parsing of both 'defaultvers' and 'defaultproto'Steve Dickson2009-10-223-2/+59
| | | | | | | | | | | config variables which will be used to set the the default version and network protocol. A global variable will be set for each option with the corresponding value. The value will be used as the initial value in the server negation. Signed-off-by: Steve Dickson <steved@redhat.com>
* Make sure all protocol version options are checked in check_vers()Steve Dickson2009-10-091-3/+1
| | | | Signed-off-by: Steve Dickson <steved@redhat.com>
* Make the network transports value in the mountSteve Dickson2009-10-091-3/+4
| | | | | | | config file case sensitive, since they are in the mount command's parsing code. Signed-off-by: Steve Dickson <steved@redhat.com>
* There are a number of different mount options that can beSteve Dickson2009-10-091-0/+20
| | | | | | | | used to set the protocol version on the command line. The config file code needs to know about each option so the command line value will override the config file value. Signed-off-by: Steve Dickson <steved@redhat.com>
* mount: Support negotiation between v4, v3, and v2Chuck Lever2009-09-291-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | When negotiating between v3 and v2, mount.nfs first tries v3, then v2. Take the same approach for v4: try v4 first, then v3, then v2, in order to get the highest NFS version both the client and server support. No MNT request is needed for v4. Since we want to avoid an rpcbind query for the v4 attempt, just go straight for mount(2) without a MNT request or rpcbind negotiation first. If the server reports that v4 is not supported, try lower versions. The decisions made by the fg/bg retry loop have nothing to do with version negotation. To avoid a layering violation, mount.nfs's multi-version negotiation strategy is wholly encapsulated within nfs_try_mount(). Thus, code duplication between nfsmount_fg(), nfsmount_parent(), and nfsmount_child() is avoided. For now, negotiating version 4 is supported only on kernels that can handle the vers=4 option on type "nfs" file systems. At some point we could also allow mount.nfs to switch to an "nfs4" file system in this case. Since mi->version == 0 can now mean v2, v3, or v4, limit the versions tried for RDMA mounts. Today, only version 3 supports RDMA. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* The user's mount options and the set of versions to try should notChuck Lever2009-09-291-24/+106
| | | | | | | | | | | | | | | | | | | change over the course of mount retries. With this patch, each version-specific mount attempt is compartment- alized, and starts from the user's original mount options each time. Thus these attempts can now be safely performed in any order, depending on what the user has requested, what the server advertises, and what is up and running at any given point. Don't regress the fix in commit 23c1a452. For v2/v3 negotation, only the user's mount options are written to /etc/mtab, and not any options that were negotiated by mount.nfs. There's no way to guarantee that the server configuration will be the same at umount time as it was at mount time. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* mount.nfs: Keep server's address in nfsmount_infoChuck Lever2009-09-291-6/+7
| | | | | | | | We want to pass the server's address around. Put it in the mount context structure. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* mount.nfs: Add API to duplicate a mount option listChuck Lever2009-09-292-0/+66
| | | | | Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* idmapd: rearm event handler after error in nfsdcb()Jeff Layton2009-09-141-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A couple of years ago, Bruce committed a patch to make knfsd send unsigned uid's and gid's to idmapd, rather than signed values. Part of that earlier discussion is here: http://linux-nfs.org/pipermail/nfsv4/2007-December/007321.html While this fixed the immediate problem, it doesn't appear that anything was ever done to make idmapd continue working when it gets a bogus upcall. idmapd uses libevent for its main event handling loop. When idmapd gets an upcall from knfsd it will service the request and then rearm the event by calling event_add on the event structure again. When it hits an error though, it returns in most cases w/o rearming the event. That prevents idmapd from servicing any further requests from knfsd. I've made another change too. If an error is encountered while reading the channel file, this patch has it close and reopen the file prior to rearming the event. I've not been able to test this patch directly, but I have tested a backport of it to earlier idmapd code and verified that it did prevent idmapd from hanging when it got a badly formatted upcall from knfsd. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* mount.nfs: Support "-t nfs,vers=4" mounts in the kernelChuck Lever2009-09-144-7/+22
| | | | | | | | | | | | | | Support "vers=4" in nfs_nfs_version() Skip UMNT call for "-t nfs -o vers=4" mounts For "-t nfs -o vers=4" mounts, we want to skip v2/v3 version/transport negotiation, but be sure to append the "clientaddr" option. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com> Tested-by: Steve Dickson <steved@redhat.com>
* IPv6 support for nfsd was finished before some of the other daemonsJeff Layton2009-09-142-0/+18
| | | | | | | | | (mountd and statd in particular). That could be a problem in the future if someone were to boot a kernel that supports IPv6 serving with an older nfs-utils. For now, hardcode the IPv6 switch into the off position until the other daemons are functional. Signed-off-by: Steve Dickson <steved@redhat.com>
* Gssd blindly caches machine credentialsLukas Hejtmanek2009-08-273-41/+48
| | | | | | | | | | | | | | We have a problem with rpc.gssd which blindly caches machine credentials. E.g., if someone deletes /tmp/krb5cc_machine_REALM, rpc.gss does not create new one until the old one expires. Also, it has problems with clock skew, if time goes back and gssd thinks that machine credentials are not expired yet. The following patch tries to use cache but in case of failure, it tries it again without cache. Any comments? Signed-off-by: Lukas Hejtmanek <xhejtman@ics.muni.cz> Acked-by: Kevin Coffman <kwc@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Cleaned up some warnings in the mount config file code.Steve Dickson2009-08-271-0/+2
| | | | Signed-off-by: Steve Dickson <steved@redhat.com>
* Don't give client an empty flavor listJ. Bruce Fields2009-08-241-0/+5
| | | | | | | | | | | | | | | | | | | | In the absence of an explicit sec= option on an export, rpc.mountd is returning a zero-length flavor list to clients in the MOUNT results. The linux client doesn't seem to mind, but the Solaris client (reasonably enough) is giving up; the symptom is a "security mode does not match" error on mount. We could modify the export-parsing code to ensure the secinfo array is nonzero. But I think it's slightly simpler to handle this default case in the implementation of the MOUNT call. This is more-or-less the same thing the kernel does when mountd passes it an export without any security flavors specified. Thanks to Tom Haynes for bug report and diagnosis. Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Cleaned up parsing errors to hopeful be more preciseSteve Dickson2009-08-172-4/+5
| | | | | | | Also had mount_config_init() call xlog_open() so the program name is set on xlog() calls. Signed-off-by: Steve Dickson <steved@redhat.com>
* Now that only the Section names are case-insensitiveSteve Dickson2009-08-161-3/+6
| | | | | | | | | the mount code has to make sure the the mount options given to the kernel are in the correct case. Fixed a couple of warnings on #ifndefs Signed-off-by: Steve Dickson <steved@redhat.com>
* The example nfsmount.conf fileSteve Dickson2009-08-162-0/+121
| | | | Signed-off-by: Steve Dickson <steved@redhat.com>
* The new nfsmount.conf(5) man page and the update toSteve Dickson2009-08-163-0/+95
| | | | | | the nfs(5) man page Signed-off-by: Steve Dickson <steved@redhat.com>
* Added hooks to the mount command that allowSteve Dickson2009-08-163-1/+56
| | | | | | mount options to be set in a configuration file Signed-off-by: Steve Dickson <steved@redhat.com>
* Support routines used to read sections from the configuration fileSteve Dickson2009-08-162-0/+321
| | | | | | and parse them into comma separated mount options. Signed-off-by: Steve Dickson <steved@redhat.com>
* Move idmapd's configuration file parsing routines intoSteve Dickson2009-08-164-963/+2
| | | | | | | the shared libnfs.a library, making them available to\ other daemons and programs. Signed-off-by: Steve Dickson <steved@redhat.com>
* Augment nfs4 stats to cover new nfs41 client andBenny Halevy2009-08-161-6/+40
| | | | | | | server operations' stats. Signed-off-by: Benny Halevy <bhalevy@panasas.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs(5): Remove trailing blanksChuck Lever2009-08-161-131/+130
| | | | | | | Clean up: eliminate trailing blanks in utils/mount/nfs.man. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs(5): Add description of lookupcache mount optionChuck Lever2009-08-161-0/+96
| | | | | | | See kernel commit 7973c1f1. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* SinceJ. Bruce Fields2009-08-161-8/+6
| | | | | | | | | | | | | | | | | 2d77e3a27b7b211f303f.. "Fix bug when both crossmnt and fsid are set" Subexports automatically created by "crossmnt" get the NFSEXP_FSID flag cleared. That flag should also be cleared in the security-flavor-specific flag fields. Otherwise the kernel detects the inconsistent flags and rejects the export. The symptoms are clients hanging the first time they export a filesystem mounted under a filesystem that was exported with something like: /exports *(crossmnt,fsid=0,sec=krb5) Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Steve Dickson <steved@redhat.com>
* Add some clarification about the purpose of the program, info about theJeff Layton2009-08-141-3/+22
| | | | | | | --debug and --syslog options, and a note about how it behaves when TI-RPC support is built in. Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: add IPv6 support to nfsdJeff Layton2009-08-141-25/+89
| | | | | | | | | | | | | | Add support for handing off IPv6 sockets to the kernel for nfsd. One of the main goals here is to not change the behavior of options and not to add any new ones, so this patch attempts to do that. We also don't want to break anything in the event that someone has an rpc.nfsd program built with IPv6 capability, but the knfsd doesn't support IPv6. Ditto for the cases where IPv6 is either not compiled in or is compiled in and blacklisted. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* Allow nfssvc_setfds to properly deal with AF_INET6.Jeff Layton2009-08-141-0/+14
| | | | | | | | IPv6 sockets for knfsd can't be allowed to accept IPv4 packets. Set the correct option to prevent that from occurring on IPv6 sockets. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: convert nfssvc_setfds to use getaddrinfoJeff Layton2009-08-143-103/+212
| | | | | | | | | | | | | | | | | | | Convert nfssvc_setfds to use getaddrinfo. Change the args that it takes and fix up nfssvc function to pass in the proper args. The things that nfssvc has to do to call the new nfssvc_setfds is a little cumbersome for now, but that will eventually be cleaned up in a later patch. nfs-utils: break up the nfssvc interface Currently, the only public interface to the routines in nfssvc.c is nfssvc(). This means that we do an awful lot of work after closing stderr that could be done while it's still available. Add prototypes to the header so that more functions in nfssvc.c can be called individually, and change the nfsd program to call those routines individually. Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: move check for active knfsd to helper functionJeff Layton2009-08-011-14/+30
| | | | | | | | | nfssvc_setfds checks to see if knfsd is already running. Move this check to a helper function. Eventually the nfsd code will call this directly. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: declare a static common buffer for nfssvc.c routinesJeff Layton2009-08-011-11/+17
| | | | | | | | | | Several of the routines in nfssvc.c declare a buffer for strings. Use a shared static buffer instead to keep it off of the stack. Also, the buffer allocated in some places is *really* large. BUFSIZ is generally 8k. These routines don't need nearly that much. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: clean up NFSCTL_* macros for handling protocol bitsJeff Layton2009-08-011-0/+24
| | | | | | | | | | They are a little hard to follow currently. Clean them up and add new macros that can set these bits in addition to the ones that unset them. Also add a new macro that reports when any valid protocol bit is set. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: convert rpc.nfsd to use xlog()Jeff Layton2009-08-012-48/+66
| | | | | | | | | | | | | | | | | | ...and add --debug and --syslog options. With the switch to xlog(), it becomes trivial to add debug messages, so add an option to turn them on when requested. Also, rpc.nfsd isn't a proper daemon per-se, so it makes more sense to log errors to stderr where possible. Usually init scripts take care of redirecting stderr output to syslog anyway. For those that don't, add a --syslog option that forces all output to go to syslog instead. Note that even with this option, errors encountered during option processing will still go to stderr. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: clean up option parsing in nfsd.cJeff Layton2009-08-011-4/+4
| | | | | | | Minor formatting nits. Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-16 19:38:34 +0000