nfs: authenticated deep mounting
Subsystems (2)
PATCH 1/1 nfs: authenticated deep mounting
Allow mount to do authenticated mounts below the root of the exported tree. The wording in RFC 2623, sec 2.3.2. allows fsinfo with UNIX authentication on the root of the export. Mounts are not always done on the root of the exported tree. Especially autoumounts often mount below the root of the exported tree.
Some server implementations (justly) require full authentication for the so-called deep mounts. The old code used AUTH_SYS only. This caused deep mounts to fail on systems requiring stronger authentication..
The client should try both authentication types and use the first one that succeeds.
This method was already partially implemented. This patch completes the implementation for NFS2 and NFS3.
This patch was developed to allow Debian systems to automount home directories on Solaris servers with krb5 authentication.
Tested on kernel 2.6.24-etchnhalf.1
---
fs/nfs/nfs3proc.c +17 -2
@@ -684,7 +684,7 @@ nfs3_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle, }static int -nfs3_proc_fsinfo (struct nfs_server *server,struct nfs_fh *fhandle, +do_proc_fsinfo (struct rpc_clnt *client,struct nfs_fh *fhandle,struct nfs_fsinfo *info) {struct rpc_message msg = {
@@ -696,11 +696,26 @@ nfs3_proc_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle,dprintk ("NFS call fsinfo\n" );nfs_fattr_init (info->fattr); - status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + status =rpc_call_sync (client, &msg,0 );dprintk ("NFS reply fsinfo: %d\n" , status);return status; } +/* +* Bare-bones access to fsinfo: this is for nfs_get_root/nfs_get_sb via nfs_create_server +*/ +static int +nfs3_proc_fsinfo (struct nfs_server *server,struct nfs_fh *fhandle, +struct nfs_fsinfo *info) +{ +int status; + + status =do_proc_fsinfo (server->client, fhandle, info); +if (status && server->nfs_client->cl_rpcclient != server->client) + status =do_proc_fsinfo (server->nfs_client->cl_rpcclient, fhandle, info); +return status; +} +static int nfs3_proc_pathconf (struct nfs_server *server,struct nfs_fh *fhandle,struct nfs_pathconf *info)
fs/nfs/proc.c +10 -2
@@ -65,14 +65,22 @@ nfs_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,dprintk ("%s: call getattr\n" , __FUNCTION__);nfs_fattr_init (fattr); - status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + status =rpc_call_sync (server->client, &msg,0 ); +/* Retry with default authentication if different */ +if (status && server->nfs_client->cl_rpcclient != server->client) { + status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + }dprintk ("%s: reply getattr: %d\n" , __FUNCTION__, status);if (status)return status;dprintk ("%s: call statfs\n" , __FUNCTION__); msg.rpc_proc = &nfs_procedures[NFSPROC_STATFS ]; msg.rpc_resp = &fsinfo; - status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + status =rpc_call_sync (server->client, &msg,0 ); +/* Retry with default authentication if different */ +if (status && server->nfs_client->cl_rpcclient != server->client) { + status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + }dprintk ("%s: reply statfs: %d\n" , __FUNCTION__, status);if (status)return status;
A message that is not in the archive (sent off-list or not yet received): 48AA9122.90805-vHs5IaWfoDhmR6Xm/[email protected]
PATCH 1/1 nfs: authenticated deep mounting
From: EG Keizer <keie-vHs5IaWfoDhmR6Xm/[email protected]>
Allow mount to do authenticated mounts below the root of the exported tree. The wording in RFC 2623, sec 2.3.2. allows fsinfo with UNIX authentication on the root of the export. Mounts are not always done on the root of the exported tree. Especially autoumounts often mount below the root of the exported tree.
Some server implementations (justly) require full authentication for the so-called deep mounts. The old code used AUTH_SYS only. This caused deep mounts to fail on systems requiring stronger authentication..
The client should try both authentication types and use the first one that succeeds.
This method was already partially implemented. This patch completes the implementation for NFS2 and NFS3.
This patch was developed to allow Debian systems to automount home directories on Solaris servers with krb5 authentication.
Tested on kernel 2.6.24-etchnhalf.1
--- fs/nfs/nfs3proc.c | 20 ++++++++++++++++++-- fs/nfs/proc.c | 10 ++++++++-- 2 files changed, 26 insertions(+), 4 deletions(-)
Quoted 1 line · EG Keizer
Allow mount to do authenticated mounts below the root of the exported tree.
Thanks. For some reason, if I look at your mail in a text editor I see an extra space at the beginning of each line. Which prevents patch from applying it. Anyway, with that fixed up, and some other trivial changes, the below is what I get. Makes sense to me; Trond?
--b.
fs/nfs/nfs3proc.c +18 -2
@@ -699,7 +699,7 @@ nfs3_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle, }static int -nfs3_proc_fsinfo (struct nfs_server *server,struct nfs_fh *fhandle, +do_proc_fsinfo (struct rpc_clnt *client,struct nfs_fh *fhandle,struct nfs_fsinfo *info) {struct rpc_message msg = {
@@ -711,11 +711,27 @@ nfs3_proc_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle,dprintk ("NFS call fsinfo\n" );nfs_fattr_init (info->fattr); - status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + status =rpc_call_sync (client, &msg,0 );dprintk ("NFS reply fsinfo: %d\n" , status);return status; } +/* +* Bare-bones access to fsinfo: this is for nfs_get_root/nfs_get_sb via +* nfs_create_server +*/ +static int +nfs3_proc_fsinfo (struct nfs_server *server,struct nfs_fh *fhandle, +struct nfs_fsinfo *info) +{ +int status; + + status =do_proc_fsinfo (server->client, fhandle, info); +if (status && server->nfs_client->cl_rpcclient != server->client) + status =do_proc_fsinfo (server->nfs_client->cl_rpcclient, fhandle, info); +return status; +} +static int nfs3_proc_pathconf (struct nfs_server *server,struct nfs_fh *fhandle,struct nfs_pathconf *info)
fs/nfs/proc.c +8 -2
@@ -65,14 +65,20 @@ nfs_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,dprintk ("%s: call getattr\n" , __func__);nfs_fattr_init (fattr); - status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + status =rpc_call_sync (server->client, &msg,0 ); +/* Retry with default authentication if different */ +if (status && server->nfs_client->cl_rpcclient != server->client) + status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 );dprintk ("%s: reply getattr: %d\n" , __func__, status);if (status)return status;dprintk ("%s: call statfs\n" , __func__); msg.rpc_proc = &nfs_procedures[NFSPROC_STATFS ]; msg.rpc_resp = &fsinfo; - status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + status =rpc_call_sync (server->client, &msg,0 ); +/* Retry with default authentication if different */ +if (status && server->nfs_client->cl_rpcclient != server->client) + status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 );dprintk ("%s: reply statfs: %d\n" , __func__, status);if (status)return status;
Signature · 1 line
1.5.5.rc1
Quoted 27 lines · J. Bruce Fields
From: EG Keizer <keie-vHs5IaWfoDhmR6Xm/[email protected]>
Allow mount to do authenticated mounts below the root of the exported tree. The wording in RFC 2623, sec 2.3.2. allows fsinfo with UNIX authentication on the root of the export. Mounts are not always done on the root of the exported tree. Especially autoumounts often mount below the root of the exported tree.
Some server implementations (justly) require full authentication for the so-called deep mounts. The old code usedAUTH_SYSonly. This caused deep mounts to fail on systems requiring stronger authentication..
The client should try both authentication types and use the first one that succeeds.
This method was already partially implemented. This patch completes the implementation for NFS2 and NFS3.
This patch was developed to allow Debian systems to automount home directories on Solaris servers with krb5 authentication.Tested on kernel 2.6.24-etchnhalf.1
Signed-off-by E.G. Keizer <keie-vHs5IaWfoDhmR6Xm/[email protected]>Signed-off-by J. Bruce Fields <[email protected]>--- fs/nfs/nfs3proc.c | 20 ++++++++++++++++++-- fs/nfs/proc.c | 10 ++++++++-- 2 files changed, 26 insertions(+), 4 deletions(-)On Tue, Aug 19, 2008 at 11:23:46AM +0200, EG Keizer wrote:
Quoted 8 lines
Quoted 1 line
Allow mount to do authenticated mounts below the root of the exported tree.
Thanks. For some reason, if I look at your mail in a text editor I see an extra space at the beginning of each line. Which prevents patch from applying it. Anyway, with that fixed up, and some other trivial changes, the below is what I get. Makes sense to me; Trond?
--b.
OK. This one applies correctly...
Quoted 72 lines
fs/nfs/nfs3proc.c +18
-2@@ -699,7 +699,7 @@ nfs3_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle, }static int -nfs3_proc_fsinfo (struct nfs_server *server,struct nfs_fh *fhandle, +do_proc_fsinfo (struct rpc_clnt *client,struct nfs_fh *fhandle,struct nfs_fsinfo *info) {struct rpc_message msg = {@@ -711,11 +711,27 @@ nfs3_proc_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle,dprintk ("NFS call fsinfo\n" );nfs_fattr_init (info->fattr); - status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + status =rpc_call_sync (client, &msg,0 );dprintk ("NFS reply fsinfo: %d\n" , status);return status; } +/* +* Bare-bones access to fsinfo: this is for nfs_get_root/nfs_get_sb via +* nfs_create_server +*/ +static int +nfs3_proc_fsinfo (struct nfs_server *server,struct nfs_fh *fhandle, +struct nfs_fsinfo *info) +{ +int status; + + status =do_proc_fsinfo (server->client, fhandle, info); +if (status && server->nfs_client->cl_rpcclient != server->client) + status =do_proc_fsinfo (server->nfs_client->cl_rpcclient, fhandle, info); +return status; +} +static int nfs3_proc_pathconf (struct nfs_server *server,struct nfs_fh *fhandle,struct nfs_pathconf *info)fs/nfs/proc.c +8
-2@@ -65,14 +65,20 @@ nfs_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,dprintk ("%s: call getattr\n" , __func__);nfs_fattr_init (fattr); - status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + status =rpc_call_sync (server->client, &msg,0 ); +/* Retry with default authentication if different */ +if (status && server->nfs_client->cl_rpcclient != server->client) + status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 );dprintk ("%s: reply getattr: %d\n" , __func__, status);if (status)return status;dprintk ("%s: call statfs\n" , __func__); msg.rpc_proc = &nfs_procedures[NFSPROC_STATFS ]; msg.rpc_resp = &fsinfo; - status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + status =rpc_call_sync (server->client, &msg,0 ); +/* Retry with default authentication if different */ +if (status && server->nfs_client->cl_rpcclient != server->client) + status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 );dprintk ("%s: reply statfs: %d\n" , __func__, status);if (status)return status;Signature · 1 line
1.5.5.rc1
Signature · 6 lines
Trond Myklebust Linux NFS client maintainer NetApp [email protected] www.netapp.com
Quoted 15 lines · EG Keizer
Allow mount to do authenticated mounts below the root of the exported tree. The wording in RFC 2623, sec 2.3.2. allows fsinfo with UNIX authentication on the root of the export. Mounts are not always done on the root of the exported tree. Especially autoumounts often mount below the root of the exported tree.
Some server implementations (justly) require full authentication for the so-called deep mounts. The old code usedAUTH_SYSonly. This caused deep mounts to fail on systems requiring stronger authentication..
The client should try both authentication types and use the first one that succeeds.
This method was already partially implemented. This patch completes the implementation for NFS2 and NFS3.
This patch was developed to allow Debian systems to automount home directories on Solaris servers with krb5 authentication.
Quoted 3 lines
Tested on kernel 2.6.24-etchnhalf.1
Signed-off-by E.G. Keizer <keie-vHs5IaWfoDhmR6Xm/[email protected]>
I'd like to apply this patch, but it won't apply to 2.6.27-rc7...
Cheers
Trond
Quoted 76 lines
---
fs/nfs/nfs3proc.c +17
-2@@ -684,7 +684,7 @@ nfs3_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle, }static int -nfs3_proc_fsinfo (struct nfs_server *server,struct nfs_fh *fhandle, +do_proc_fsinfo (struct rpc_clnt *client,struct nfs_fh *fhandle,struct nfs_fsinfo *info) {struct rpc_message msg = {@@ -696,11 +696,26 @@ nfs3_proc_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle,dprintk ("NFS call fsinfo\n" );nfs_fattr_init (info->fattr); - status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + status =rpc_call_sync (client, &msg,0 );dprintk ("NFS reply fsinfo: %d\n" , status);return status; } +/* +* Bare-bones access to fsinfo: this is for nfs_get_root/nfs_get_sb via nfs_create_server +*/ +static int +nfs3_proc_fsinfo (struct nfs_server *server,struct nfs_fh *fhandle, +struct nfs_fsinfo *info) +{ +int status; + + status =do_proc_fsinfo (server->client, fhandle, info); +if (status && server->nfs_client->cl_rpcclient != server->client) + status =do_proc_fsinfo (server->nfs_client->cl_rpcclient, fhandle, info); +return status; +} +static int nfs3_proc_pathconf (struct nfs_server *server,struct nfs_fh *fhandle,struct nfs_pathconf *info)fs/nfs/proc.c +10
-3@@ -65,14 +65,22 @@ nfs_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,dprintk ("%s: call getattr\n" , __FUNCTION__);nfs_fattr_init (fattr); - status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + status =rpc_call_sync (server->client, &msg,0 ); +/* Retry with default authentication if different */ +if (status && server->nfs_client->cl_rpcclient != server->client) { + status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + }dprintk ("%s: reply getattr: %d\n" , __FUNCTION__, status);if (status)return status;dprintk ("%s: call statfs\n" , __FUNCTION__); msg.rpc_proc = &nfs_procedures[NFSPROC_STATFS ]; msg.rpc_resp = &fsinfo; - status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + status =rpc_call_sync (server->client, &msg,0 ); +/* Retry with default authentication if different */ +if (status && server->nfs_client->cl_rpcclient != server->client) { + status =rpc_call_sync (server->nfs_client->cl_rpcclient, &msg,0 ); + }dprintk ("%s: reply statfs: %d\n" , __FUNCTION__, status);if (status)return status; --To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html