headers
Neil Brown | 1 May 2008 01:29
X-Face
Picon
Gravatar

Re: reconnect_path() breaks NFS server causing occasional EACCES

On Tuesday April 29, bfields@... wrote:
> 
> Just to make sure I understand--you're not claiming that there's an
> actual threat of corrupting the on-disk filesystem or in-core data
> structures, right? 

Correct.  I'm not claiming that.

NeilBrown
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@...
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Permalink | Reply | 0 comments |
headers
mike | 1 May 2008 07:36
Picon
Gravatar

[NFS] Back to basics - still having NFS issues

I've switched up my setup now, thinking this would "mature" it more.
Everything is gigabit ethernet.

Server:
FreeBSD 7.0, quad-core xeon 3220, 2GB RAM, 4x750 hardware RAID10
Adaptec 3405 (so ~ 1.5TB usable)

42 processes:  1 running, 41 sleeping
CPU states:  0.0% user,  0.0% nice,  0.5% system,  0.0% interrupt, 99.5% idle
Mem: 15M Active, 1581M Inact, 325M Wired, 48M Cache, 214M Buf, 9232K Free
Swap: 2048M Total, 20K Used, 2048M Free

/etc/rc.conf:
nfs_server_flags="-u -t -n 16"

/etc/exports:
/home -maproot=root -network 10.13.5.0 -mask 255.255.255.0

Clients (3 moderate usage, 2 minimal usage):
Linux 2.6.24-16-server, quad-core xeon 3220, 4GB RAM, single SATA2
250G disk (barely used)

/etc/fstab:
raid01:/home    /home           nfs
rsize=8192,rsize=8192,tcp,rw,acregmin=30

I stuck with the 8k since it seems like FreeBSD (from what I read)
recommended it. It seems damn near rock solid but one machine
consistently flakes out (and is identical in every way - hardware,
fstab, nfs-common parameters, etc) to two other nodes that don't show
(Continue reading)

Permalink | Reply | 0 comments |
headers
Janne Karhunen | 1 May 2008 14:57
Picon

Re: [patch] fix statd -n

On Tue, Apr 29, 2008 at 12:16 PM, J. Bruce Fields <bfields@...> wrote:

>  > Do we really have to add so many lines of the code just to fix "statd
>  > -n"

Which is why I offered the small patch initially; it was
mentioned that intrusiveness does not matter if it
can be kept in userspace.

> >  ? Maybe we should go back to the basics by understanding the
>  > requirement of this command ? So why do we need it (i.e. what kind of
>  > bad things we'll see if we don't fix this) ? Some short description
>  > would help.
>
>  I recall two reasons for -n given in this thread; I think one was just
>  security (maybe you don't want statd listening on some ports, for
>  whatever reason.  The other was a code comment quoted here:

That being one..

>         http://marc.info/?l=linux-nfs&m=120854237320424&w=2
>
>
>         "This is required to support clients that ignore the mon_name in
>         the statd protocol but use the source address from the request
>         packet."

This another, and the third the fact that this way mon_name
stays the same on server failover to node that has different
name. It identifies the server instance..
(Continue reading)

Permalink | Reply | 26 comments |
headers
Janne Karhunen | 1 May 2008 15:28
Picon

Re: [patch] fix statd -n

Hi,

So effectively, it makes me sleep better. With it:
- I can rely on clients identifying the server correctly,
- I'm not exposing out anything that is not needed,
- Can tell by the address what this traffic is,
- Can be sure that packets are sent out via right interface

It might be even better if it would exit if -n is used when
no such interface is actually available. As I did it, it still
gambles here just as before.

--

-- 
// Janne

On Thu, May 1, 2008 at 8:57 AM, Janne Karhunen
<janne.karhunen@...> wrote:
> On Tue, Apr 29, 2008 at 12:16 PM, J. Bruce Fields <bfields@...> wrote:
>
>  >  > Do we really have to add so many lines of the code just to fix "statd
>  >  > -n"
>
>  Which is why I offered the small patch initially; it was
>  mentioned that intrusiveness does not matter if it
>  can be kept in userspace.
>
>
>
>  > >  ? Maybe we should go back to the basics by understanding the
>  >  > requirement of this command ? So why do we need it (i.e. what kind of
(Continue reading)

Permalink | Reply | 25 comments |
headers
Kevin Coffman | 1 May 2008 15:34
Picon
Favicon

[PATCH 0/4] nfs-utils gssd

Hi Steve,
These have all been sent before, with various levels of formality,
but haven't made it into git yet.

1) adds code to gssd to read a possible alternate port number
from the info file.

2) adds the "other" DES encryption types to the default list that
can currently be negotiated.

3) adds a utility function to retrieve the current logging
verbosity.  (Used by the fourth patch to determine whether
it should print certain error messages.)

4) allows the administrator to specify multiple directories
where gssd can look for credentials caches.

--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@...
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Permalink | Reply | 5 comments |
headers
Kevin Coffman | 1 May 2008 15:35
Picon
Favicon

[PATCH 1/4] gssd: read port number from info file if supplied

From: Olga Kornievskaia <aglo@...>

Check the info file information to see if a port number is supplied.
If so, use it rather than the standard port number.

Signed-off-by: Olga Kornievskaia <aglo@...>
Signed-off-by: Kevin Coffman <kwc@...>
---

 utils/gssd/gssd.h      |    1 +
 utils/gssd/gssd_proc.c |   14 ++++++++++++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/utils/gssd/gssd.h b/utils/gssd/gssd.h
index e17edde..6f14c34 100644
--- a/utils/gssd/gssd.h
+++ b/utils/gssd/gssd.h
 <at>  <at>  -80,6 +80,7  <at>  <at>  struct clnt_info {
 	int			krb5_poll_index;
 	int			spkm3_fd;
 	int			spkm3_poll_index;
+	int			port;
 };

 void init_client_list(void);
diff --git a/utils/gssd/gssd_proc.c b/utils/gssd/gssd_proc.c
index 6860cc8..bac7295 100644
--- a/utils/gssd/gssd_proc.c
+++ b/utils/gssd/gssd_proc.c
 <at>  <at>  -102,7 +102,7  <at>  <at>  int pollsize;  /* the size of pollaray (in pollfd's) */
(Continue reading)

Permalink | Reply | 0 comments |
headers
Kevin Coffman | 1 May 2008 15:35
Picon
Favicon

[PATCH 3/4] gssd: add a function to retrieve the current verbosity level

Add a new function to retrieve the current verbosity level
so that some messages that would otherwise always print may
be silenced.

Signed-off-by: Kevin Coffman <kwc@...>
---

 utils/gssd/err_util.c |    5 +++++
 utils/gssd/err_util.h |    1 +
 2 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/utils/gssd/err_util.c b/utils/gssd/err_util.c
index 5644db6..2583e06 100644
--- a/utils/gssd/err_util.c
+++ b/utils/gssd/err_util.c
 <at>  <at>  -60,3 +60,8  <at>  <at>  void printerr(int priority, char *format, ...)
 		xlog_backend(L_ERROR, format, args);
 	va_end(args);
 }
+
+int get_verbosity(void)
+{
+	return verbosity;
+}
diff --git a/utils/gssd/err_util.h b/utils/gssd/err_util.h
index 5e5af48..c4df32d 100644
--- a/utils/gssd/err_util.h
+++ b/utils/gssd/err_util.h
 <at>  <at>  -33,5 +33,6  <at>  <at>
(Continue reading)

Permalink | Reply | 0 comments |
headers
Kevin Coffman | 1 May 2008 15:35
Picon
Favicon

[PATCH 2/4] gssd: add other des encryption types to default list

Add the other two DES encryption types to the default list of
Kerberos encryption types that may be negotiated.

Signed-off-by: Kevin Coffman <kwc@...>
---

 utils/gssd/krb5_util.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c
index 3cf27ca..0589cd8 100644
--- a/utils/gssd/krb5_util.c
+++ b/utils/gssd/krb5_util.c
 <at>  <at>  -277,7 +277,9  <at>  <at>  limit_krb5_enctypes(struct rpc_gss_sec *sec, uid_t uid)
 	u_int maj_stat, min_stat;
 	gss_cred_id_t credh;
 	gss_OID_set_desc  desired_mechs;
-	krb5_enctype enctypes[] = { ENCTYPE_DES_CBC_CRC };
+	krb5_enctype enctypes[] = { ENCTYPE_DES_CBC_CRC,
+				    ENCTYPE_DES_CBC_MD5,
+				    ENCTYPE_DES_CBC_MD4 };
 	int num_enctypes = sizeof(enctypes) / sizeof(enctypes[0]);

 	/* We only care about getting a krb5 cred */

--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@...
More majordomo info at  http://vger.kernel.org/majordomo-info.html
(Continue reading)

Permalink | Reply | 0 comments |
headers
Kevin Coffman | 1 May 2008 15:35
Picon
Favicon

[PATCH 4/4] gssd: search multiple directories for Kerberos credentials

From: Vince Busam <vbusam@...>

Kerberos credentials may be stored in multiple places.  Make it
possible to search several directories for valid credentials when
making NFS requests.

Original patch from Vince Busam <vbusam@...>, modified by
Kevin Coffman <kwc@...>.

Signed-off-by: Vince Busam <vbusam@...>
Signed-off-by: Kevin Coffman <kwc@...>
---

 utils/gssd/gssd.c      |   10 ++++++++++
 utils/gssd/gssd.h      |    3 ++-
 utils/gssd/gssd.man    |    6 +++++-
 utils/gssd/gssd_proc.c |   11 ++++++++---
 utils/gssd/krb5_util.c |   30 ++++++++++++++++--------------
 utils/gssd/krb5_util.h |    3 ++-
 6 files changed, 43 insertions(+), 20 deletions(-)

diff --git a/utils/gssd/gssd.c b/utils/gssd/gssd.c
index bbcad20..e8612a5 100644
--- a/utils/gssd/gssd.c
+++ b/utils/gssd/gssd.c
 <at>  <at>  -57,6 +57,7  <at>  <at>  char pipefs_dir[PATH_MAX] = GSSD_PIPEFS_DIR;
 char pipefs_nfsdir[PATH_MAX] = GSSD_PIPEFS_DIR;
 char keytabfile[PATH_MAX] = GSSD_DEFAULT_KEYTAB_FILE;
 char ccachedir[PATH_MAX] = GSSD_DEFAULT_CRED_DIR;
+char *ccachesearch[GSSD_MAX_CCACHE_SEARCH + 1];
(Continue reading)

Permalink | Reply | 0 comments |
headers
Wendy Cheng | 1 May 2008 15:50
Picon

Re: [patch] fix statd -n

Janne Karhunen wrote:
> Hi,
>
> So effectively, it makes me sleep better. With it:
> - I can rely on clients identifying the server correctly,
> - I'm not exposing out anything that is not needed,
> - Can tell by the address what this traffic is,
> - Can be sure that packets are sent out via right interface
>
> It might be even better if it would exit if -n is used when
> no such interface is actually available. As I did it, it still
> gambles here just as before.
>
>
>   
Yep, understood. Linux NFS server failover was one of my painful 
projects (actually it was "the" one - so much work and so little result).

But the flow you proposed confuses me. Reading the code right now (to 
refresh my memory).. Will get back to the list soon.

-- Wendy
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@...
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Permalink | Reply | 1 comment |

Gmane