Commit Graph

119 Commits

Author SHA1 Message Date
Doug Rabson
a9148abd9d Implement support for RPCSEC_GSS authentication to both the NFS client
and server. This replaces the RPC implementation of the NFS client and
server with the newer RPC implementation originally developed
(actually ported from the userland sunrpc code) to support the NFS
Lock Manager.  I have tested this code extensively and I believe it is
stable and that performance is at least equal to the legacy RPC
implementation.

The NFS code currently contains support for both the new RPC
implementation and the older legacy implementation inherited from the
original NFS codebase. The default is to use the new implementation -
add the NFS_LEGACYRPC option to fall back to the old code. When I
merge this support back to RELENG_7, I will probably change this so
that users have to 'opt in' to get the new code.

To use RPCSEC_GSS on either client or server, you must build a kernel
which includes the KGSSAPI option and the crypto device. On the
userland side, you must build at least a new libc, mountd, mount_nfs
and gssd. You must install new versions of /etc/rc.d/gssd and
/etc/rc.d/nfsd and add 'gssd_enable=YES' to /etc/rc.conf.

As long as gssd is running, you should be able to mount an NFS
filesystem from a server that requires RPCSEC_GSS authentication. The
mount itself can happen without any kerberos credentials but all
access to the filesystem will be denied unless the accessing user has
a valid ticket file in the standard place (/tmp/krb5cc_<uid>). There
is currently no support for situations where the ticket file is in a
different place, such as when the user logged in via SSH and has
delegated credentials from that login. This restriction is also
present in Solaris and Linux. In theory, we could improve this in
future, possibly using Brooks Davis' implementation of variant
symlinks.

Supporting RPCSEC_GSS on a server is nearly as simple. You must create
service creds for the server in the form 'nfs/<fqdn>@<REALM>' and
install them in /etc/krb5.keytab. The standard heimdal utility ktutil
makes this fairly easy. After the service creds have been created, you
can add a '-sec=krb5' option to /etc/exports and restart both mountd
and nfsd.

The only other difference an administrator should notice is that nfsd
doesn't fork to create service threads any more. In normal operation,
there will be two nfsd processes, one in userland waiting for TCP
connections and one in the kernel handling requests. The latter
process will create as many kthreads as required - these should be
visible via 'top -H'. The code has some support for varying the number
of service threads according to load but initially at least, nfsd uses
a fixed number of threads according to the value supplied to its '-n'
option.

Sponsored by:	Isilon Systems
MFC after:	1 month
2008-11-03 10:38:00 +00:00
Craig Rodrigues
049307ba00 Use the version of the kernel returned by getosreldate()
to determine whether to call the fallback_mount() backwards
compatibility function or not.

Reviewed by:	dfr
2008-09-19 11:59:10 +00:00
Craig Rodrigues
4b5bc28358 Instead of building up a "struct nfs_args" to pass to the kernel
via nmount(), build up an iovec where each iovec member is an NFS mount
option, and pass the iovec down to the kernel via nmount().  These options
are then parsed in the kernel.
This should make it easier to add new NFS mount options in future.

Many, many thanks to Doug Rabson for taking my initial patches,
and cleaning them up.  In addition, Doug added a fallback_mount()
function so that the newer mount_nfs program will work against older
kernels, to facilitate upgrading/downgrading scenarios.
Doug also re-wrote the mount_nfs.8 man page.

Reviewed by:	dfr
2008-09-13 20:22:46 +00:00
Kris Kennaway
bf005f321e Fix -o mntudp after the conversion to default TCP mounts
Submitted by:	danfe
MFC after:	1 week
2008-07-10 17:53:10 +00:00
Yaroslav Tykhiy
c6446de05d Undo the damage I did in sys/kern/vfs_mount.c #1.274 and
sbin/mount_nfs/mount_nfs.c #1.76.  Let the dragons sleep.

Requested by:	rodrigc, des
PR:		kern/120319 (welcome the bug back)
2008-02-18 20:58:57 +00:00
Yaroslav Tykhiy
bd20049d27 Add a work-around to make it possible again to remount
NFS root r/w.

The real solution would be to bring the whole nmount(2)
framework, including FS drivers and userland tools, into
a consistent state at last; but things should work in the
meantime, too.

Reported by:	kris
2008-02-18 10:24:47 +00:00
Yaroslav Tykhiy
a83655a35f Back out rev. 1.74 because the kernel isn't ready yet
to see NFS specific string options.
2008-02-18 00:23:28 +00:00
Yaroslav Tykhiy
fb2ae60938 Don't forget to prepare string options for nmount(2).
Otherwise things won't work as intended, e.g., it'll
be impossible to upgrade NFS root mount to read-write.

Reported by:	kris
2008-02-18 00:05:50 +00:00
Ceri Davies
3efe0d9d2a Add the -4 option to the synopsis. 2008-02-12 09:24:11 +00:00
Ceri Davies
4a2b331aa6 Bump .Dd for r1.48. 2008-02-12 09:20:27 +00:00
Kris Kennaway
2427fa1998 Switch the default NFS mount mode from UDP to TCP. UDP mounts are a
historical relic, and are no longer appropriate for either LAN or WAN
mounting.  At modern (gigabit and 10 gigabit) LAN speeds packet loss
from socket buffer fill events is common, and sequence numbers wrap
quickly enough that data corruption is possible.  TCP solves both of
these problems without imposing significant overhead.

MFC after:     1 month
2008-02-11 23:23:21 +00:00
Thomas Quinot
3bbd554a99 Add "fg" option as antonym to "bg"; add "hard" option as antonym to "soft".
This is for better compatibility with other environments (Linux, Solaris,
HP-UX, AIX and Tru64 support these options).

PR:		bin/109924
MFC after:	1 week
2007-03-05 14:47:54 +00:00
Craig Rodrigues
0d27250907 Link mount_nfs -> mount_nfs4, and mount_nfs.8 -> mount_nfs4.8.
Suggested by:	rees
2007-01-23 09:14:33 +00:00
Craig Rodrigues
0c269d1f05 Merge mount_nfs4.c and mount_nfs.c into one program.
If argv[0] == "mount_nfs4", then default to mounting NFSv4,
otherwise if argv[0] == "mount_nfs", default to the old mount_nfs behavior.

- Add a -4 option.
- Add the University of Michigan copyright from mount_nfs4.c, for the
  code merged from mount_nfs4.c.

Reviewed by:	rees
2007-01-23 07:17:10 +00:00
Craig Rodrigues
a6b2640236 Pass a string buffer named "errmsg" to nmount().
This will allow the NFS mount code to return a string error message
in addition to returning an error integer value.

Reviewed by:    mohans
MFC after:      1 month
2006-11-29 00:46:30 +00:00
Craig Rodrigues
412ffff0a0 Deduce the "fstype" parameter to pass to nmount() by looking at
the "_nfs" part of argv[0].  This should facilitate unifying mount_nfs
and mount_nfs4 into one binary.

MFC after:	1 month
Reviewed by:	mohans
2006-11-29 00:41:44 +00:00
Craig Rodrigues
852bc770e3 Increase WARNS to 3. 2006-11-21 02:01:33 +00:00
Craig Rodrigues
b535b298b1 Fix last element of nc_protos[] array to appease GCC. 2006-11-21 02:00:48 +00:00
Craig Rodrigues
c5aa1dc845 Convert mount_nfs from old mount(2) API to new nmount(2) API.
Reviewed by:	mohans
2006-11-21 01:53:18 +00:00
Tom Rhodes
d24dde7544 Properly separate sentences by adding a semi-colon.
Hinted by:	bmah
2006-10-07 23:12:19 +00:00
Warner Losh
33924ad466 Minor style(9) and KNF elimination as I prepare to fix a bug. 2006-03-20 21:28:46 +00:00
Tom Rhodes
5646f2e5f3 Kill the BUGS section, and remove a similar line noted under -T. As far
as I know, Sun's NFS support works with TCP just fine.  This is even
hinted at in the PR.

PR:		71782
2005-12-25 10:36:30 +00:00
Xin LI
46b7a14ba4 Use MOPT_END in favor of MOPT_NULL, which better describes the purporse
of the macro.
2005-06-10 09:51:43 +00:00
Xin LI
73ac45052f Add a handy macro to represent null mount option, MOPT_NULL, and make
use of the macro in sbin/mount*'s, by replacing:

	mopts[] = {
	    MOPT_STDOPTS,
	    { NULL }
	}

With:
	mopts[] = {
	    MOPT_STDOPTS,
	    MOPT_NULL
	}

This change will help to reduce the situation that we don't explicitly
initialize "struct mntopt"'s.  It should not contribute to any
functional/logical changes as far as I can tell.
2005-06-01 09:39:36 +00:00
Ruslan Ermilov
8d646af581 Sync program's usage() with manpage's SYNOPSIS. 2005-02-10 09:19:34 +00:00
Ruslan Ermilov
9806e23132 Mechanically kill hard sentence breaks. 2004-07-02 21:45:06 +00:00
Mark Murray
4c723140a4 Remove advertising clause from University of California Regent's license,
per letter dated July 22, 1999.

Approved by: core, imp
2004-04-09 19:58:40 +00:00
Johan Karlsson
604d24db95 style.Makefile(5):
Use WARNS?= instead of WARNS=.
2004-02-23 20:25:27 +00:00
Ruslan Ermilov
8236257c6f mdoc(7): There cannot be a subsection inside a list.
Reported by:	naddy
2003-09-10 08:24:33 +00:00
Ruslan Ermilov
a7475cf45a mdoc(7) markup overhaul. 2003-05-17 22:53:44 +00:00
Tom Rhodes
bd3fc74891 Remove -p from getopt args.
PR:		37221
Submitted by:	Joshua Goodall <joshua@roughtrade.net>
Reviewed by:	rwatson
Approved by:	re (jhb)
2003-05-12 19:48:47 +00:00
Tom Rhodes
dd31c8607f Remove remnants of the -p option. While I'm here, remove wording about
-P which could be interpreted as 'this option must be specified'.

PR:		37221 && 51886
Discussed with:	bmah
Approved by:	re (blanket)
2003-05-11 00:38:58 +00:00
David E. O'Brien
c69284ca08 Use __FBSDID() to quiet GCC 3.3 warnings. 2003-05-03 18:41:59 +00:00
Matthew N. Dodd
302f15f9e8 Add mount options 'noinet4' and 'noinet6' which prevent using those
address families.

This is useful for preventing NFS mounts from using IPv6 on hosts
that have both A and AAAA records for the same name.
2003-03-25 01:25:30 +00:00
Matthew N. Dodd
c04affffc1 - Silence warnings (casting, implicit decl., unused var.).
- WARNS=2
2003-03-25 00:16:41 +00:00
Matthew Dillon
091e0b14d5 Update mount_nfs documentation to reference new sysctl for -c default. 2003-01-27 20:12:32 +00:00
Maxime Henrion
fb624dbc80 Removed a debugging printf() left here in peter's
last commit.

Spotted by:	kris
2002-09-14 15:14:29 +00:00
Peter Wemm
4db5660477 Bandaid for mount_nfs segfaulting with the more obscure mount options
in /etc/fstab.  This isn't a real fix though and I'm still not sure
why it started failing.  mount(8) breaks up the nfs args into seperate
repeated '-o option=value' arguments.  But, the altflags variable that
we use to track things is incrementally built up each time we see the
next option and shows us the cumulative set of flags, not just the
flag that we are currently looking at.  As a result, the strstr hack
for looking up flags in a giant -o opt=val,opt=val, etc string was failing
and causing a segfault.  I do not know what changed recently that caused
this to suddenly break, but the code has been rather bogus for some time.
2002-09-06 19:59:29 +00:00
Ian Dowse
fd0b613a7b Unbreak the -c option by not using connect(2) for mount_nfs's
communication with the remote NFS server if this flag is specified.

PR:		bin/42003
Submitted by:	Jean-Luc Richier <Jean-Luc.Richier@imag.fr>
2002-08-26 13:08:23 +00:00
Tom Rhodes
ce66ddb763 s/filesystem/file system/g as discussed on -developers 2002-08-21 18:11:48 +00:00
Semen Ustimenko
7ed000f774 Fix -o ac(reg|dir)(min|max) options. The appropriate flags weren't
translated from ALTF_* to NFSMNT_* thus these options weren't accepted
by kernel.

PR:		bin/30334
MFC after:	1 week
2002-08-06 20:26:30 +00:00
Maxime Henrion
526ba6d32b Now that the kernel is able to load modules itself,
remove all the code which was trying to do so.
This code was nasty in several ways, it was hiding
the kernel bug where the kernel was unable to properly
load a module, and it was quitting if it wasn't able
to load the module.  The consequence is that an ABI
breakage of the vfsconf API would have broken *every*
mount utility.
2002-08-03 16:03:21 +00:00
Matthew Dillon
3d8f797ac1 Convert old style (type foo *)0 casts to NULLs
PR:		kern/40360
Requested by:	Hiten PAndya via direct email
2002-07-11 17:54:58 +00:00
Philippe Charnier
e1205e80e5 The .Nm utility 2002-07-06 19:34:18 +00:00
Tom Rhodes
3468b317cb more file system > filesystem 2002-05-16 04:10:46 +00:00
Warner Losh
854299908c o __P removed
o main prototype removed
2002-03-21 13:14:21 +00:00
David E. O'Brien
3d438ad61f Remove 'register' keyword.
It does not help modern compilers, and some may take some hit from it.
(I also found several functions that listed *every* of its 10 local vars with
 "register" -- just how many free registers do people think machines have?)
2002-03-20 17:55:10 +00:00
David E. O'Brien
2d68bf45bf Default to WARNS=2.
Binary builds that cannot handle this must explicitly set WARNS=0.

Reviewed by:	mike
2001-12-04 02:19:58 +00:00
Alfred Perlstein
3fd0605ef0 note that 'nolockd' can't be used when updating mount flags 2001-11-12 02:43:56 +00:00
Alfred Perlstein
13190d8754 Allow users to use the 'nolockd' or -L options with mount_nfs in order
to avoid the need for rpc.lockd to perform client locks.  Using
this option a user can revert back to using local locks for NFS mounts
like we did before we had rpc.lockd.
2001-11-12 02:33:52 +00:00