upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-04 17:05:14 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
opnsense-src/lib/libc/sys
History
Doug Rabson a9148abd9d Implement support for RPCSEC_GSS authentication to both the NFS client 
and server. This replaces the RPC implementation of the NFS client and
server with the newer RPC implementation originally developed
(actually ported from the userland sunrpc code) to support the NFS
Lock Manager.  I have tested this code extensively and I believe it is
stable and that performance is at least equal to the legacy RPC
implementation.

The NFS code currently contains support for both the new RPC
implementation and the older legacy implementation inherited from the
original NFS codebase. The default is to use the new implementation -
add the NFS_LEGACYRPC option to fall back to the old code. When I
merge this support back to RELENG_7, I will probably change this so
that users have to 'opt in' to get the new code.

To use RPCSEC_GSS on either client or server, you must build a kernel
which includes the KGSSAPI option and the crypto device. On the
userland side, you must build at least a new libc, mountd, mount_nfs
and gssd. You must install new versions of /etc/rc.d/gssd and
/etc/rc.d/nfsd and add 'gssd_enable=YES' to /etc/rc.conf.

As long as gssd is running, you should be able to mount an NFS
filesystem from a server that requires RPCSEC_GSS authentication. The
mount itself can happen without any kerberos credentials but all
access to the filesystem will be denied unless the accessing user has
a valid ticket file in the standard place (/tmp/krb5cc_<uid>). There
is currently no support for situations where the ticket file is in a
different place, such as when the user logged in via SSH and has
delegated credentials from that login. This restriction is also
present in Solaris and Linux. In theory, we could improve this in
future, possibly using Brooks Davis' implementation of variant
symlinks.

Supporting RPCSEC_GSS on a server is nearly as simple. You must create
service creds for the server in the form 'nfs/<fqdn>@<REALM>' and
install them in /etc/krb5.keytab. The standard heimdal utility ktutil
makes this fairly easy. After the service creds have been created, you
can add a '-sec=krb5' option to /etc/exports and restart both mountd
and nfsd.

The only other difference an administrator should notice is that nfsd
doesn't fork to create service threads any more. In normal operation,
there will be two nfsd processes, one in userland waiting for TCP
connections and one in the kernel handling requests. The latter
process will create as many kthreads as required - these should be
visible via 'top -H'. The code has some support for varying the number
of service threads according to load but initially at least, nfsd uses
a fixed number of threads according to the value supplied to its '-n'
option.

Sponsored by:	Isilon Systems
MFC after:	1 month
2008-11-03 10:38:00 +00:00
..
__error.c Remove 3rd clause, renumber, ok per email 2007-01-12 07:31:30 +00:00
_exit.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
abort2.2 Fix markup, language, function prototype, and example code. 2006-09-30 10:24:00 +00:00
accept.2 Add Xr to getsockname(2) 2008-06-20 14:47:06 +00:00
access.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
acct.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
adjtime.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
aio_cancel.2 style(9) cleanup 2008-04-03 02:41:54 +00:00
aio_error.2 Fix typo 2006-09-26 09:47:46 +00:00
aio_read.2 Sort .Xr by section number. 2005-12-13 13:43:35 +00:00
aio_return.2 Reword previous delta a little bit. 2006-10-07 10:49:20 +00:00
aio_suspend.2 style(9) cleanup 2008-04-03 02:41:54 +00:00
aio_waitcomplete.2
aio_write.2 Sort .Xr by section number. 2005-12-13 13:43:35 +00:00
bind.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
brk.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
chdir.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
chflags.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
chmod.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
chown.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
chroot.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
clock_gettime.2 Add missing words. 2008-02-25 13:03:18 +00:00
close.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
connect.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
cpuset.2 Support for CPU sets is going to appear in 7.1 before 8.0. 2008-09-29 15:44:48 +00:00
cpuset_getaffinity.2 Support for CPU sets is going to appear in 7.1 before 8.0. 2008-09-29 15:44:48 +00:00
dup.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
execve.2 When calculating arguments to the interpreter for the shebang script 2008-08-26 10:53:32 +00:00
extattr_get_file.2 Update this manual page to describe the extattr_list_file() and the 2008-01-29 18:15:38 +00:00
fcntl.2 Add the new kernel-mode NFS Lock Manager. To use it instead of the 2008-03-26 15:23:12 +00:00
fcntl.c Call the fcntl compatiblity wrapper from the thread library fcntl wrappers 2008-05-30 14:47:42 +00:00
fhopen.2 Use 'manual page' instead of 'man page' for consistency. 2005-06-30 13:18:15 +00:00
flock.2 Xref flopen.3 which references this manual page. 2008-01-22 15:56:48 +00:00
fork.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
fsync.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
ftruncate.c Change the C wrappers for mmap/lseek/pread/pwrite/truncate/ftruncate to 2007-07-04 23:27:38 +00:00
getdirentries.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
getdtablesize.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
getfh.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
getfsstat.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
getgid.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
getgroups.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
getitimer.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
getlogin.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
getpeername.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
getpgrp.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
getpid.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
getpriority.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
getrlimit.2 Integrate the new MPSAFE TTY layer to the FreeBSD operating system. 2008-08-20 08:31:58 +00:00
getrusage.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
getsid.2
getsockname.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
getsockopt.2 Bring missing getsockopt(2) options: SO_LABEL SO_PEERLABEL SO_LISTENQLIMIT 2008-06-12 22:58:35 +00:00
gettimeofday.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
getuid.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
intro.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
ioctl.2 Take a sentence into the present by removing a reference to FreeBSD 3.0. 2007-07-14 19:23:29 +00:00
issetugid.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
jail.2 Add EAGAIN to the ERRORS list, as found in kern_jail.c. 2008-08-03 21:56:58 +00:00
kenv.2 Use 'manual page' instead of 'man page' for consistency. 2005-06-30 13:18:15 +00:00
kill.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
kldfind.2
kldfirstmod.2
kldload.2 Document that kldload(2) can also return EEXIST. 2003-06-03 12:29:34 +00:00
kldnext.2 Markup fixes. 2006-09-17 21:27:35 +00:00
kldstat.2 Add a BUGS section to note that mount/chroot changes since 2007-10-22 21:49:39 +00:00
kldsym.2
kldunload.2 Fix bugs in previous revision (missing comma, misspelled syscall name). 2008-03-13 10:33:24 +00:00
kqueue.2 We've been able to support EVFILT_VNODE filtering on non-UFS 2007-09-07 13:10:09 +00:00
kse.2 New sentence -> new line. While here, fix apostrophe abuse. 2007-02-14 07:38:39 +00:00
ktrace.2 remove whitespace bug (8 spaces into one tab) 2008-08-02 13:49:12 +00:00
link.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
lio_listio.2 Add missing word "returns." 2006-10-07 05:13:32 +00:00
listen.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
lseek.2 Bump date. 2007-04-05 21:17:52 +00:00
lseek.c Change the C wrappers for mmap/lseek/pread/pwrite/truncate/ftruncate to 2007-07-04 23:27:38 +00:00
madvise.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
Makefile.inc Integrate the new MPSAFE TTY layer to the FreeBSD operating system. 2008-08-20 08:31:58 +00:00
mincore.2 Add support to mincore for detecting whether a page is part of a 2008-03-28 04:29:27 +00:00
minherit.2 Bump manpage date, missed during the last change. 2007-10-30 15:28:43 +00:00
mkdir.2 - Forgot to bump a date after last change 2008-06-30 08:46:09 +00:00
mkfifo.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
mknod.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
mlock.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
mlockall.2 Fixed markup. 2004-07-03 23:14:34 +00:00
mmap.2 Finish what revision 1.40 started. Revision 1.40 removed a false statement 2008-10-24 14:40:13 +00:00
mmap.c Change the C wrappers for mmap/lseek/pread/pwrite/truncate/ftruncate to 2007-07-04 23:27:38 +00:00
modfind.2
modnext.2 Expand *n't contractions. 2005-02-13 22:25:33 +00:00
modstat.2 Update the definition of modspecific structure 2008-07-15 10:06:37 +00:00
mount.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
mprotect.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
mq_close.2 Use the easily-greppable copyright notice template from 2008-02-29 17:48:25 +00:00
mq_getattr.2 Use the easily-greppable copyright notice template from 2008-02-29 17:48:25 +00:00
mq_notify.2 Use the easily-greppable copyright notice template from 2008-02-29 17:48:25 +00:00
mq_open.2 Use the easily-greppable copyright notice template from 2008-02-29 17:48:25 +00:00
mq_receive.2 Use the easily-greppable copyright notice template from 2008-02-29 17:48:25 +00:00
mq_send.2 Use the easily-greppable copyright notice template from 2008-02-29 17:48:25 +00:00
mq_setattr.2 Use the easily-greppable copyright notice template from 2008-02-29 17:48:25 +00:00
msync.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
munmap.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
nanosleep.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
nfssvc.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
ntp_adjtime.2 Use better manuals for these ntp system calls. These were replaced by 2007-09-15 14:33:55 +00:00
open.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
pathconf.2 Bump date. 2007-04-05 21:17:52 +00:00
pipe.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
poll.2 Sort sections. 2005-01-20 09:17:07 +00:00
posix_openpt.2 Integrate the new MPSAFE TTY layer to the FreeBSD operating system. 2008-08-20 08:31:58 +00:00
pread.c Change the C wrappers for mmap/lseek/pread/pwrite/truncate/ftruncate to 2007-07-04 23:27:38 +00:00
profil.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
ptrace.2 Belatedly bump Dd for my recent changes. 2007-04-11 20:31:06 +00:00
pwrite.c Change the C wrappers for mmap/lseek/pread/pwrite/truncate/ftruncate to 2007-07-04 23:27:38 +00:00
quotactl.2 Docment the acceptable values for the id parameter. 2007-02-01 02:31:02 +00:00
read.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
readlink.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
reboot.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
recv.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
rename.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
revoke.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
rfork.2 Document RFTHREAD 2007-05-14 13:58:54 +00:00
rmdir.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
rtprio.2 Sort sections. 2005-01-20 09:17:07 +00:00
sched_get_priority_max.2 Mechanically kill hard sentence breaks. 2004-07-02 23:52:20 +00:00
sched_setparam.2 Sort SEE ALSO references (in dictionary order, ignoring case). 2004-07-04 20:55:50 +00:00
sched_setscheduler.2 Mechanically kill hard sentence breaks. 2004-07-02 23:52:20 +00:00
sched_yield.2 Mechanically kill hard sentence breaks. 2004-07-02 23:52:20 +00:00
sctp_generic_recvmsg.2 Correct minor typos in SCTP man pages. 2008-04-28 16:57:56 +00:00
sctp_generic_sendmsg.2 Remove extraneous empty lines, to fix mdoc warnings. 2007-10-30 15:36:40 +00:00
sctp_peeloff.2 Correct minor typos in SCTP man pages. 2008-04-28 16:57:56 +00:00
select.2 Add note about other systems. 2007-12-19 03:33:13 +00:00
semctl.2 Eliminate macro calls inside literal displays. 2005-01-15 12:28:01 +00:00
semget.2 Expand contractions. 2005-02-15 09:27:00 +00:00
semop.2 Eliminate macro calls inside literal displays. 2005-01-15 12:28:01 +00:00
send.2 Remove the MSG_PEEK flag from the documentation of the send(2) syscall - 2007-04-27 10:28:30 +00:00
sendfile.2 Give sendfile(2) a SF_SYNC flag which makes it wait until all mbufs 2008-02-03 15:54:41 +00:00
setfib.2 Add prototype defination for setfib(2) to sys/socket.h. 2008-08-08 22:40:04 +00:00
setgroups.2 Make it clearer that privilege is needed to reduce as well as 2008-06-16 14:50:21 +00:00
setpgid.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
setregid.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
setresuid.2
setreuid.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
setsid.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
setuid.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
shm_open.2 Add a new file descriptor type for IPC shared memory objects and use it to 2008-01-08 21:58:16 +00:00
shmat.2 Mechanically kill hard sentence breaks. 2004-07-02 23:52:20 +00:00
shmctl.2 Expand contractions. 2005-02-13 23:45:54 +00:00
shmget.2 Mechanically kill hard sentence breaks. 2004-07-02 23:52:20 +00:00
shutdown.2 Fix license. Clause 4 is still required (UCB materiel). 2007-03-07 13:38:11 +00:00
sigaction.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
sigaltstack.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
sigpending.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
sigprocmask.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
sigqueue.2 Markup fixes. 2006-09-17 21:27:35 +00:00
sigreturn.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
sigstack.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
sigsuspend.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
sigwait.2 -mdoc sweep. 2005-11-17 13:00:00 +00:00
sigwaitinfo.2 Sort .Xr by section number. 2005-12-13 13:43:35 +00:00
socket.2 Add EPERM to the ERRORS section. 2008-08-04 22:22:17 +00:00
socketpair.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
stack_protector.c Expose __stack_chk_fail_local() so -fstack-protector-all works. 2007-06-05 08:24:34 +00:00
stat.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
statfs.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
swapon.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
Symbol.map Implement support for RPCSEC_GSS authentication to both the NFS client 2008-11-03 10:38:00 +00:00
symlink.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
sync.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
sysarch.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
syscall.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
timer_create.2 Fix library names. 2007-06-18 01:50:03 +00:00
timer_delete.2 Fix library names. 2007-06-18 01:50:03 +00:00
timer_settime.2 Fix library names. 2007-06-18 01:50:03 +00:00
truncate.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
truncate.c Change the C wrappers for mmap/lseek/pread/pwrite/truncate/ftruncate to 2007-07-04 23:27:38 +00:00
umask.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
undelete.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
unlink.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
utimes.2 Man pages for the openat(2), fexecve(2) and related syscalls. 2008-04-16 13:03:12 +00:00
utrace.2 Fixed markup. 2004-07-03 23:14:34 +00:00
uuidgen.2 Fix all the spelling mistakes I could find in the man pages for words 2005-07-31 03:30:48 +00:00
vfork.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00
wait.2 Implement WNOWAIT flag for wait4(2). It specifies that process whose status 2008-08-26 12:37:16 +00:00
write.2 Per Regents of the University of Calfornia letter, remove advertising 2007-01-09 00:28:16 +00:00