freebsd-skq/tools/regression
Doug Rabson a9148abd9d Implement support for RPCSEC_GSS authentication to both the NFS client
and server. This replaces the RPC implementation of the NFS client and
server with the newer RPC implementation originally developed
(actually ported from the userland sunrpc code) to support the NFS
Lock Manager.  I have tested this code extensively and I believe it is
stable and that performance is at least equal to the legacy RPC
implementation.

The NFS code currently contains support for both the new RPC
implementation and the older legacy implementation inherited from the
original NFS codebase. The default is to use the new implementation -
add the NFS_LEGACYRPC option to fall back to the old code. When I
merge this support back to RELENG_7, I will probably change this so
that users have to 'opt in' to get the new code.

To use RPCSEC_GSS on either client or server, you must build a kernel
which includes the KGSSAPI option and the crypto device. On the
userland side, you must build at least a new libc, mountd, mount_nfs
and gssd. You must install new versions of /etc/rc.d/gssd and
/etc/rc.d/nfsd and add 'gssd_enable=YES' to /etc/rc.conf.

As long as gssd is running, you should be able to mount an NFS
filesystem from a server that requires RPCSEC_GSS authentication. The
mount itself can happen without any kerberos credentials but all
access to the filesystem will be denied unless the accessing user has
a valid ticket file in the standard place (/tmp/krb5cc_<uid>). There
is currently no support for situations where the ticket file is in a
different place, such as when the user logged in via SSH and has
delegated credentials from that login. This restriction is also
present in Solaris and Linux. In theory, we could improve this in
future, possibly using Brooks Davis' implementation of variant
symlinks.

Supporting RPCSEC_GSS on a server is nearly as simple. You must create
service creds for the server in the form 'nfs/<fqdn>@<REALM>' and
install them in /etc/krb5.keytab. The standard heimdal utility ktutil
makes this fairly easy. After the service creds have been created, you
can add a '-sec=krb5' option to /etc/exports and restart both mountd
and nfsd.

The only other difference an administrator should notice is that nfsd
doesn't fork to create service threads any more. In normal operation,
there will be two nfsd processes, one in userland waiting for TCP
connections and one in the kernel handling requests. The latter
process will create as many kthreads as required - these should be
visible via 'top -H'. The code has some support for varying the number
of service threads according to load but initially at least, nfsd uses
a fixed number of threads according to the value supplied to its '-n'
option.

Sponsored by:	Isilon Systems
MFC after:	1 month
2008-11-03 10:38:00 +00:00
..
acct
aio
atm Update README to reflect removal of netatm/harp test parts some time ago. 2008-08-31 11:41:31 +00:00
audit/audit_pipe_ioctl
bin Add a test for r182300. 2008-08-27 20:26:34 +00:00
bpf Connect a forgotten test case to Makefile. 2008-08-29 20:58:01 +00:00
ccd/layout
doat
environ Detect if the application has cleared the environ variable by setting 2008-08-02 02:34:35 +00:00
ethernet/ethermulti
execve
fifo
file
fstest
fsx
gaithrstress
geom Add sbuf_new_auto as a shortcut for the very common case of creating a 2008-08-09 11:14:05 +00:00
geom_concat
geom_eli By default backup geli metadata to a file. It is quite critical 512 bytes, 2008-08-29 18:10:18 +00:00
geom_gate
geom_gpt
geom_mirror
geom_nop
geom_raid3
geom_shsec
geom_stripe
geom_uzip
ia64
include/tgmath
ipsec
kgssapi Implement support for RPCSEC_GSS authentication to both the NFS client 2008-11-03 10:38:00 +00:00
lib #ifdef out the lock-against-self test. I'm not sure it makes sense, and 2008-10-20 17:26:30 +00:00
mac/mac_bsdextended
mlock
mqueue
msdosfs
net80211
netatalk/simple_send
netinet Update udpzerobyte to understand that passing 0 as a length to recv(2) 2008-10-07 21:01:23 +00:00
netinet6 Remove extra comment that snuck in in last commit. 2008-07-29 18:38:37 +00:00
netipx
nfsmmap
p1003_1b
pipe
posixsem Rework the lifetime management of the kernel implementation of POSIX 2008-06-27 05:39:04 +00:00
posixshm
priv
pthread
redzone9
rpcsec_gss Implement support for RPCSEC_GSS authentication to both the NFS client 2008-11-03 10:38:00 +00:00
security
sigqueue
sockets Add very simple regression test for fstat(2) on sockets: make sure it 2008-10-06 19:42:03 +00:00
sysvmsg
sysvsem
sysvshm
tls
tmpfs New regression test updates for rename, etc. 2007-08-10 10:08:43 +00:00
ufs/uprintf
usr.bin
usr.sbin
geom_subr.sh
README
TODO

$FreeBSD$

This directory is for regression test programs.

A regression test program is one that will exercise a particular bit of the
system to check that we have not reintroduced an old bug.

Tests should be implemented in files with a .t extension.  Each .t file
can contain more than one test, and can be implemented in any scripting
language -- /bin/sh, Perl...

The test protocol is quite simple.  At its most basic, each .t file should, 
when run, print a line in this format:

   1..m

where m is the number of tests that will be run.

Each test should produce a single line of output.  This line should start
with one of

   ok n
   not ok n

to indicate whether or not the test succeeded.  'n' is the test's number.
Anything after this on the line (up to the first '#' if present) is 
considered to be the name of the test.  Naming tests is optional, but 
encouraged.

A test may be written which is conditional, and may need to be skipped.
For example, the netatalk tests require 'options NETATALK' in the kernel.
A test may be skipped by printing '# skip Reason for skipping' after the
test name.  For example,

    ok 1 - netatalk # skip 'options NETATALK' not compiled in

A test may be flagged as 'todo'.  This indicates that you expect the test
to fail (perhaps because the necessary functionality hasn't been written
yet).  'todo' tests are expected to fail, so when they start working the
test framework can alert you to this happy occurence.  Flag these tests 
with a '# TODO' comment after the test name

    not ok 1 - infiniteloop # TODO write test for an infinite loop

This is modelled on the protocol followed by the Test::Harness Perl
module (and therefore much of the automated testing carried out by the 
Perl community).  More documentation can be found at:

    http://search.cpan.org/~petdance/Test-Harness-2.42/lib/Test/Harness.pm

To run the tests and parse their output install the devel/p5-Test-Harness
port.  This includes the prove(1) command which is used to run the tests
and collate the output.

    prove geom_concat		# run all the tests in geom_concat
    prove -r lib		# run all tests in lib/, and subdirectories
    prove -r -v lib		# as above, with verbose output
    prove -r			# run *all* the tests

Tests that are for parts of the base system should go into a directory here
which is the same as their path relative to src/, for example the uuencode(1)
utility resides in src/usr.bin/uuencode so its regression test resides in
src/tools/regression/usr.bin/uuencode.

To avoid the pre-commit check program complaining about the lack of
CVS keywords in test data files, use a .in suffix for input files and
a .out suffix for output files.

To execute individual regression tests for binaries that you are
developing, add their directory in the path before running the tests.
Example:
cd /usr/src/tools/regression/usr.bin
(PATH=/home/user/src/experimental/jot:$PATH ; make SUBDIR=jot)

Please make a subdir per other regression test, and add a brief description to
this file.

acct		Exercise the integer to float conversion used in acct(5)
geom		Some tests and an out-of-kernel simulator for the GEOM code
ia64		ia64 specific regression tests
nfsmmap		Some tests to exercise some tricky cases in NFS and mmap
p1003_1b	Exercise 1003.1B scheduler
pipe		Pipe code regression test
fsx		General filesystem exerciser
sysvmsg 	SysV IPC Message Queue Regression Utility
sysvsem 	SysV IPC Semaphore Regression Utility
sysvshm 	SysV IPC Shared Memory Regression Utility
gaithrstress	General threaded getaddrinfo(3) exerciser