a9148abd9d
and server. This replaces the RPC implementation of the NFS client and server with the newer RPC implementation originally developed (actually ported from the userland sunrpc code) to support the NFS Lock Manager. I have tested this code extensively and I believe it is stable and that performance is at least equal to the legacy RPC implementation. The NFS code currently contains support for both the new RPC implementation and the older legacy implementation inherited from the original NFS codebase. The default is to use the new implementation - add the NFS_LEGACYRPC option to fall back to the old code. When I merge this support back to RELENG_7, I will probably change this so that users have to 'opt in' to get the new code. To use RPCSEC_GSS on either client or server, you must build a kernel which includes the KGSSAPI option and the crypto device. On the userland side, you must build at least a new libc, mountd, mount_nfs and gssd. You must install new versions of /etc/rc.d/gssd and /etc/rc.d/nfsd and add 'gssd_enable=YES' to /etc/rc.conf. As long as gssd is running, you should be able to mount an NFS filesystem from a server that requires RPCSEC_GSS authentication. The mount itself can happen without any kerberos credentials but all access to the filesystem will be denied unless the accessing user has a valid ticket file in the standard place (/tmp/krb5cc_<uid>). There is currently no support for situations where the ticket file is in a different place, such as when the user logged in via SSH and has delegated credentials from that login. This restriction is also present in Solaris and Linux. In theory, we could improve this in future, possibly using Brooks Davis' implementation of variant symlinks. Supporting RPCSEC_GSS on a server is nearly as simple. You must create service creds for the server in the form 'nfs/<fqdn>@<REALM>' and install them in /etc/krb5.keytab. The standard heimdal utility ktutil makes this fairly easy. After the service creds have been created, you can add a '-sec=krb5' option to /etc/exports and restart both mountd and nfsd. The only other difference an administrator should notice is that nfsd doesn't fork to create service threads any more. In normal operation, there will be two nfsd processes, one in userland waiting for TCP connections and one in the kernel handling requests. The latter process will create as many kthreads as required - these should be visible via 'top -H'. The code has some support for varying the number of service threads according to load but initially at least, nfsd uses a fixed number of threads according to the value supplied to its '-n' option. Sponsored by: Isilon Systems MFC after: 1 month |
||
---|---|---|
.. | ||
acct | ||
aio | ||
atm | ||
audit/audit_pipe_ioctl | ||
bin | ||
bpf | ||
ccd/layout | ||
doat | ||
environ | ||
ethernet/ethermulti | ||
execve | ||
fifo | ||
file | ||
fstest | ||
fsx | ||
gaithrstress | ||
geom | ||
geom_concat | ||
geom_eli | ||
geom_gate | ||
geom_gpt | ||
geom_mirror | ||
geom_nop | ||
geom_raid3 | ||
geom_shsec | ||
geom_stripe | ||
geom_uzip | ||
ia64 | ||
include/tgmath | ||
ipsec | ||
kgssapi | ||
lib | ||
mac/mac_bsdextended | ||
mlock | ||
mqueue | ||
msdosfs | ||
net80211 | ||
netatalk/simple_send | ||
netinet | ||
netinet6 | ||
netipx | ||
nfsmmap | ||
p1003_1b | ||
pipe | ||
posixsem | ||
posixshm | ||
priv | ||
pthread | ||
redzone9 | ||
rpcsec_gss | ||
security | ||
sigqueue | ||
sockets | ||
sysvmsg | ||
sysvsem | ||
sysvshm | ||
tls | ||
tmpfs | ||
ufs/uprintf | ||
usr.bin | ||
usr.sbin | ||
geom_subr.sh | ||
README | ||
TODO |
$FreeBSD$ This directory is for regression test programs. A regression test program is one that will exercise a particular bit of the system to check that we have not reintroduced an old bug. Tests should be implemented in files with a .t extension. Each .t file can contain more than one test, and can be implemented in any scripting language -- /bin/sh, Perl... The test protocol is quite simple. At its most basic, each .t file should, when run, print a line in this format: 1..m where m is the number of tests that will be run. Each test should produce a single line of output. This line should start with one of ok n not ok n to indicate whether or not the test succeeded. 'n' is the test's number. Anything after this on the line (up to the first '#' if present) is considered to be the name of the test. Naming tests is optional, but encouraged. A test may be written which is conditional, and may need to be skipped. For example, the netatalk tests require 'options NETATALK' in the kernel. A test may be skipped by printing '# skip Reason for skipping' after the test name. For example, ok 1 - netatalk # skip 'options NETATALK' not compiled in A test may be flagged as 'todo'. This indicates that you expect the test to fail (perhaps because the necessary functionality hasn't been written yet). 'todo' tests are expected to fail, so when they start working the test framework can alert you to this happy occurence. Flag these tests with a '# TODO' comment after the test name not ok 1 - infiniteloop # TODO write test for an infinite loop This is modelled on the protocol followed by the Test::Harness Perl module (and therefore much of the automated testing carried out by the Perl community). More documentation can be found at: http://search.cpan.org/~petdance/Test-Harness-2.42/lib/Test/Harness.pm To run the tests and parse their output install the devel/p5-Test-Harness port. This includes the prove(1) command which is used to run the tests and collate the output. prove geom_concat # run all the tests in geom_concat prove -r lib # run all tests in lib/, and subdirectories prove -r -v lib # as above, with verbose output prove -r # run *all* the tests Tests that are for parts of the base system should go into a directory here which is the same as their path relative to src/, for example the uuencode(1) utility resides in src/usr.bin/uuencode so its regression test resides in src/tools/regression/usr.bin/uuencode. To avoid the pre-commit check program complaining about the lack of CVS keywords in test data files, use a .in suffix for input files and a .out suffix for output files. To execute individual regression tests for binaries that you are developing, add their directory in the path before running the tests. Example: cd /usr/src/tools/regression/usr.bin (PATH=/home/user/src/experimental/jot:$PATH ; make SUBDIR=jot) Please make a subdir per other regression test, and add a brief description to this file. acct Exercise the integer to float conversion used in acct(5) geom Some tests and an out-of-kernel simulator for the GEOM code ia64 ia64 specific regression tests nfsmmap Some tests to exercise some tricky cases in NFS and mmap p1003_1b Exercise 1003.1B scheduler pipe Pipe code regression test fsx General filesystem exerciser sysvmsg SysV IPC Message Queue Regression Utility sysvsem SysV IPC Semaphore Regression Utility sysvshm SysV IPC Shared Memory Regression Utility gaithrstress General threaded getaddrinfo(3) exerciser