Commit Graph

29 Commits

Author SHA1 Message Date
Doug Rabson
23c107627d Fix standalone module build by generating opt_kgssapi.h.
Submitted by:	n_hibma
2008-11-25 16:11:41 +00:00
Dag-Erling Smørgrav
19aa71e559 Unbreak NFS.
Pointy hat to:	dfr
2008-11-06 10:53:35 +00:00
Doug Rabson
a9148abd9d Implement support for RPCSEC_GSS authentication to both the NFS client
and server. This replaces the RPC implementation of the NFS client and
server with the newer RPC implementation originally developed
(actually ported from the userland sunrpc code) to support the NFS
Lock Manager.  I have tested this code extensively and I believe it is
stable and that performance is at least equal to the legacy RPC
implementation.

The NFS code currently contains support for both the new RPC
implementation and the older legacy implementation inherited from the
original NFS codebase. The default is to use the new implementation -
add the NFS_LEGACYRPC option to fall back to the old code. When I
merge this support back to RELENG_7, I will probably change this so
that users have to 'opt in' to get the new code.

To use RPCSEC_GSS on either client or server, you must build a kernel
which includes the KGSSAPI option and the crypto device. On the
userland side, you must build at least a new libc, mountd, mount_nfs
and gssd. You must install new versions of /etc/rc.d/gssd and
/etc/rc.d/nfsd and add 'gssd_enable=YES' to /etc/rc.conf.

As long as gssd is running, you should be able to mount an NFS
filesystem from a server that requires RPCSEC_GSS authentication. The
mount itself can happen without any kerberos credentials but all
access to the filesystem will be denied unless the accessing user has
a valid ticket file in the standard place (/tmp/krb5cc_<uid>). There
is currently no support for situations where the ticket file is in a
different place, such as when the user logged in via SSH and has
delegated credentials from that login. This restriction is also
present in Solaris and Linux. In theory, we could improve this in
future, possibly using Brooks Davis' implementation of variant
symlinks.

Supporting RPCSEC_GSS on a server is nearly as simple. You must create
service creds for the server in the form 'nfs/<fqdn>@<REALM>' and
install them in /etc/krb5.keytab. The standard heimdal utility ktutil
makes this fairly easy. After the service creds have been created, you
can add a '-sec=krb5' option to /etc/exports and restart both mountd
and nfsd.

The only other difference an administrator should notice is that nfsd
doesn't fork to create service threads any more. In normal operation,
there will be two nfsd processes, one in userland waiting for TCP
connections and one in the kernel handling requests. The latter
process will create as many kthreads as required - these should be
visible via 'top -H'. The code has some support for varying the number
of service threads according to load but initially at least, nfsd uses
a fixed number of threads according to the value supplied to its '-n'
option.

Sponsored by:	Isilon Systems
MFC after:	1 month
2008-11-03 10:38:00 +00:00
Yaroslav Tykhiy
822923447e Let modules use the kernel's opt_*.h files if built along with
the kernel by wrapping all targets for fake opt_*.h files in
.if defined(KERNBUILDDIR).  Thus, such fake files won't be
created at all if modules are built with the kernel.

Some modules undergo cleanup like removing unused or unneeded
options or .h files, without which they wouldn't build this way
or the other.

Reviewed by:	ru
Tested by:	no binary changes in modules built alone
Tested on:	i386 sparc64 amd64
2005-10-14 23:30:17 +00:00
Robert Watson
e5e820fd1f Permit MAC policies to instrument the access control decisions for
system accounting configuration and for nfsd server thread attach.
Policies might use this to protect the integrity or confidentiality
of accounting data, limit the ability to turn on or off accounting,
as well as to prevent inappropriately labeled threads from becoming nfs
server threads.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories
2002-11-04 15:13:36 +00:00
Alfred Perlstein
09ce4f7aaf Add IPv6 support.
Submitted by: Jean-Luc Richier <Jean-Luc.Richier@imag.fr>
2002-07-15 19:40:23 +00:00
Ruslan Ermilov
17d6c63672 Drop <bsd.man.mk> support from <bsd.kmod.mk>.
Not objected to by:	-current
2002-01-11 15:49:02 +00:00
Peter Wemm
eb25edbda3 Cleanup and split of nfs client and server code.
This builds on the top of several repo-copies.
2001-09-18 23:32:09 +00:00
Alfred Perlstein
4e2e455f2e NFS module now requires nfs_lock.c 2001-04-18 08:33:52 +00:00
Peter Wemm
205a48f7f3 Zap some bad examples:
opt_foo.h:
	touch opt_foo.h
.. is unnecessary - kmod.mk does this for us.
2001-02-04 08:23:14 +00:00
David E. O'Brien
c68159a6d8 Use a consistent style and one much closer to the rest of /usr/src 2001-01-06 14:00:42 +00:00
Peter Wemm
64db83a8ab Use .include <bsd.kmod.mk> to get to ../../*/conf/kmod.mk instead of
encoding the relative path.
2000-05-27 01:14:33 +00:00
Peter Wemm
56ca39961b Pull in sys/conf/kmod.mk, rather than /usr/share/mk/bsd.kmod.mk.
This means that the kernel can be totally self contained now and is not
dependent on the last buildworld to update /usr/share/mk.  This might
also make it easier to build 5.x kernels on 4.0 boxes etc, assuming
gensetdefs and config(8) are updated.
2000-05-04 12:08:52 +00:00
Peter Wemm
b41da0980c Remove a whole bunch of "CFLAGS+= -DFSNAME" cruft. It hasn't been
needed for ages, but keeps getting cut/pasted into new Makefiles.
(Once apon a time it was used to activate mount arguments in
 <sys/mount.h>, but that was killed with extreme prejudice long ago)
1999-12-12 20:34:11 +00:00
Peter Wemm
a5aa0913bd Bring these more into line with other modules that have .h files generated
on the fly.
1999-12-12 16:47:33 +00:00
Bruce Evans
6f940b3847 Removed special rules for building and cleaning device interface files
and empty options files.  The rules are now generated automatically in
bsd.kmod.mk.  Cleaned up related things ($S and ${CLEANFILES}).
1999-11-28 18:53:47 +00:00
Brian Feldman
fa470df9db Unbreak this build. 1999-11-02 04:16:17 +00:00
Peter Wemm
c3aac50f28 $Id$ -> $FreeBSD$ 1999-08-28 01:08:13 +00:00
Peter Wemm
a654d07295 Sample initial set of kld-ified modules. Not all have been completely
converted yet.  These are more of a starting point.  This is NOT connected
to the parent Makefile.

OK'ed by jkh (who is ever so patiently waiting)
1998-10-16 04:30:52 +00:00
Bruce Evans
90665a1b48 Finished previous fix - don't forget to add one dummy options header
to CLEANFILES.

Fixed lots of style bugs.
1998-07-07 02:27:09 +00:00
Søren Schmidt
22ae800eb6 Fix the N'th occurance of missed bits due to opt_???? mucking.
Doesn't anybody TEST code before committing....

This is the N+1'th time these laste couble of days...
1998-07-02 14:09:44 +00:00
John-Mark Gurney
ae3efda3a4 add new opt_nfs.h to cleanfiles... 1998-06-30 11:29:01 +00:00
John-Mark Gurney
56786ee91b fix buildworld hopefully be3fore anyone complains...
NFS_*TIMO should possibly be converted to sysctl vars (jkh's suggestion),
but in some cases it looks like nfs keeps a copy of the value in a struct

hash sizes are already ifdef'd KERNEL, so there aren't userland inpact
from them...
1998-06-30 11:19:22 +00:00
Eivind Eklund
ccf5ba7483 Back out opt_diagnostic.h changes. 1998-02-06 23:54:27 +00:00
Eivind Eklund
8e734a64e3 Make the LKMs handle DIAGNOSTIC as a new-style option. 1998-02-04 21:56:39 +00:00
Eivind Eklund
9e1d8a7b92 Minor fixups after INET option change. 1998-01-09 01:01:21 +00:00
Peter Wemm
4a0f765fbf Revert $FreeBSD$ back to $Id$ 1997-02-22 12:49:29 +00:00
Jordan K. Hubbard
1130b656e5 Make the long-awaited change from $Id$ to $FreeBSD$
This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.

Boy, I'm glad we're not using sup anymore.  This update would have been
insane otherwise.
1997-01-14 07:20:47 +00:00
Garrett Wollman
42477d75d0 Create NFS LKM. 1994-09-22 22:12:59 +00:00