Re: [PATCH v2 3/3] nfs: check if gssd is running before attempting to use krb5i auth in SETCLIENTID call

[Chuck Lever <chuck.lever@oracle.com>]

On Nov 13, 2013, at 11:20 AM, Jeff Layton <jlayton@redhat.com> wrote:

> On Wed, 13 Nov 2013 11:10:52 -0500
> Chuck Lever <chuck.lever@oracle.com> wrote:
> 
>> 
>> On Nov 13, 2013, at 11:09 AM, Jeff Layton <jlayton@redhat.com> wrote:
>>> 
>>> So to clarify...today we do this when gssd isn't running and we try an
>>> AUTH_GSS mount:
>>> 
>>> - attempt SETCLIENTID with krb5i
>>> - when that fails, log a warning to ring buffer
>>> - attempt SETCLIENTID with AUTH_SYS
>>> - attempt rest of mount with krb5i
>> 
>> Hold it.  This step should not be happening.  Lease management should try krb5i by default, but why is the rest of the mount attempted with krb5i?
>> 
> 
> Sorry, I should have been more clear...the rest of the mount is
> attempted with krb5i because sec=krb5i was specified on the command
> line.
> 
> IOW, this patch just shortcuts  attempting to do the lease
> establishment with krb5i when we know that that will fail. The main
> benefit being that we don't end up logging a warning about AUTH_GSS not
> running in that case.
> 
> The warning will be logged if/when a later call attempts to use GSSAPI.

Just a thought: The usual way we have of dealing with problems like this is WARN_ONCE() (or a user space equivalent).


-- 
Chuck Lever
chuck[dot]lever[at]oracle[dot]com