| 4602d45e | 25-Apr-2026 |
Gleb Smirnoff <glebius@FreeBSD.org> |
kgss: de-virtualize kgss_gssd_handle
The RPC client is more of a class rather than an instance. RPCs from different VNETs are served by the same client. This makes the kgss layer fully transparent
kgss: de-virtualize kgss_gssd_handle
The RPC client is more of a class rather than an instance. RPCs from different VNETs are served by the same client. This makes the kgss layer fully transparent to VIMAGE and not even required to be aware of it.
It is responsibility of the rpcsec_gss module to have curvnet set on the calling thread when doing RPC calls via kgssapi.
This change should enable proper operation of an NFS server with gssd(8) in a VIMAGE jail.
PR: 294501 Reviewed by: rmacklem Differential Revision: https://reviews.freebsd.org/D56562
show more ...
|
| 2bd2f267 | 25-Apr-2026 |
Gleb Smirnoff <glebius@FreeBSD.org> |
kgss: remove unnecessary CURVNET_SET() and kgss_gssd_handle checks
These RPC methods correctly acquire the kgss_gssd_handle later with call to kgss_gssd_client().
Reviewed by: rmacklem Differentia
kgss: remove unnecessary CURVNET_SET() and kgss_gssd_handle checks
These RPC methods correctly acquire the kgss_gssd_handle later with call to kgss_gssd_client().
Reviewed by: rmacklem Differential Revision: https://reviews.freebsd.org/D56561
show more ...
|
| 2fa185f9 | 09-May-2025 |
Mark Johnston <markj@FreeBSD.org> |
crypto: Remove uses of CRYPTO_F_DONE
Previously OCF set CRYPTO_F_DONE prior to invoking the completion callback, even if the request failed. This isn't particularly useful and leads to bugs when con
crypto: Remove uses of CRYPTO_F_DONE
Previously OCF set CRYPTO_F_DONE prior to invoking the completion callback, even if the request failed. This isn't particularly useful and leads to bugs when consumers retry a failed request, since OCF also asserts that CRYPTO_F_DONE is clear in crypto_dispatch(). (Really, OCF should retry requests that fail with EAGAIN, but that's a larger change.)
For now, just stop setting CRYPTO_F_DONE to simplify consumers (and fix those which fail to clear the flag before retrying a request).
PR: 286321 Reviewed by: jhb Differential Revision: https://reviews.freebsd.org/D50104
show more ...
|
| dd7d42a1 | 23-Oct-2023 |
Rick Macklem <rmacklem@FreeBSD.org> |
nfscl/kgssapi: Fix Kerberized NFS mounts to pNFS servers
During recent testing related to the IETF NFSv4 Bakeathon, it was discovered that Kerberized NFSv4.1/4.2 mounts to pNFS servers (sec=krb5[ip]
nfscl/kgssapi: Fix Kerberized NFS mounts to pNFS servers
During recent testing related to the IETF NFSv4 Bakeathon, it was discovered that Kerberized NFSv4.1/4.2 mounts to pNFS servers (sec=krb5[ip],pnfs mount options) was broken. The FreeBSD client was using the "service principal" for the MDS to try and establish a rpcsec_gss credential for a DS, which is incorrect. (A "service principal" looks like "nfs@<fqdn-of-server>" and the <fqdn-of-server> for the DS is not the same as the MDS for most pNFS servers.)
To fix this, the rpcsec_gss code needs to be able to do a reverse DNS lookup of the DS's IP address. A new kgssapi upcall to the gssd(8) daemon is added by this patch to do the reverse DNS along with a new rpcsec_gss function to generate the "service principal".
A separate patch to the gssd(8) will be committed, so that this patch will fix the problem. Without the gssd(8) patch, the new upcall fails and current/incorrect behaviour remains.
This bug only affects the rare case of a Kerberized (sec=krb5[ip],pnfs) mount using pNFS.
This patch changes the internal KAPI between the kgssapi and nfscl modules, but since I did a version bump a few days ago, I will not do one this time.
MFC after: 1 month
show more ...
|