| 2fa185f9 | 09-May-2025 |
Mark Johnston <markj@FreeBSD.org> |
crypto: Remove uses of CRYPTO_F_DONE
Previously OCF set CRYPTO_F_DONE prior to invoking the completion
callback, even if the request failed. This isn't particularly useful
and leads to bugs when con
crypto: Remove uses of CRYPTO_F_DONE
Previously OCF set CRYPTO_F_DONE prior to invoking the completion
callback, even if the request failed. This isn't particularly useful
and leads to bugs when consumers retry a failed request, since OCF also
asserts that CRYPTO_F_DONE is clear in crypto_dispatch(). (Really, OCF
should retry requests that fail with EAGAIN, but that's a larger
change.)
For now, just stop setting CRYPTO_F_DONE to simplify consumers (and fix
those which fail to clear the flag before retrying a request).
PR: 286321
Reviewed by: jhb
Differential Revision: https://reviews.freebsd.org/D50104
show more ...
|
| dd7d42a1 | 23-Oct-2023 |
Rick Macklem <rmacklem@FreeBSD.org> |
nfscl/kgssapi: Fix Kerberized NFS mounts to pNFS servers
During recent testing related to the IETF NFSv4 Bakeathon, it was
discovered that Kerberized NFSv4.1/4.2 mounts to pNFS servers
(sec=krb5[ip]
nfscl/kgssapi: Fix Kerberized NFS mounts to pNFS servers
During recent testing related to the IETF NFSv4 Bakeathon, it was
discovered that Kerberized NFSv4.1/4.2 mounts to pNFS servers
(sec=krb5[ip],pnfs mount options) was broken.
The FreeBSD client was using the "service principal" for
the MDS to try and establish a rpcsec_gss credential for a DS,
which is incorrect. (A "service principal" looks like
"nfs@<fqdn-of-server>" and the <fqdn-of-server> for the DS is not
the same as the MDS for most pNFS servers.)
To fix this, the rpcsec_gss code needs to be able to do a
reverse DNS lookup of the DS's IP address. A new kgssapi upcall
to the gssd(8) daemon is added by this patch to do the reverse DNS
along with a new rpcsec_gss function to generate the "service
principal".
A separate patch to the gssd(8) will be committed, so that this
patch will fix the problem. Without the gssd(8) patch, the new
upcall fails and current/incorrect behaviour remains.
This bug only affects the rare case of a Kerberized (sec=krb5[ip],pnfs)
mount using pNFS.
This patch changes the internal KAPI between the kgssapi and
nfscl modules, but since I did a version bump a few days ago,
I will not do one this time.
MFC after: 1 month
show more ...
|