[PATCH] nfs: don't attempt auth methods that require upcall unless we know that gssd is running

[PATCH] nfs: don't attempt auth methods that require upcall unless we know that gssd is running

[Jeff Layton]

Currently, if the server lists krb5 as an allowed auth method, but gssd isn't
running, you'll get the infamous "AUTH_GSS upcall failed" message, even if
you didn't request sec=krb5.

This is because nfs4_find_root_sec() establishes a default list of auth
methods to try when the admin didn't supply one, and that list contains
AUTH_GSS methods first. Skip those methods if gssd isn't running since
they won't succeed anyway.

Cc: Weston Andros Adamson <dros@netapp.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
---
 fs/nfs/nfs4proc.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 15052b8..468a581 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2900,6 +2900,13 @@ static int nfs4_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle,
 	} else {
 		/* no flavors specified by user, try default list */
 		for (i = 0; i < ARRAY_SIZE(flav_array); i++) {
+			/*
+			 * Don't attempt to upcall with the default list
+			 * unless we know that gssd is running.
+			 */
+			if (!gssd_running(server->nfs_client->cl_net))
+				continue;
+
 			status = nfs4_lookup_root_sec(server, fhandle, info,
 						      flav_array[i]);
 			if (status == -NFS4ERR_WRONGSEC || status == -EACCES)
-- 
1.8.5.3

Re: [PATCH] nfs: don't attempt auth methods that require upcall unless we know that gssd is running

[Jeff Layton]

On Fri, 24 Jan 2014 07:09:28 -0500
Jeff Layton <jlayton@redhat.com> wrote:

> Currently, if the server lists krb5 as an allowed auth method, but gssd isn't
> running, you'll get the infamous "AUTH_GSS upcall failed" message, even if
> you didn't request sec=krb5.
> 
> This is because nfs4_find_root_sec() establishes a default list of auth
> methods to try when the admin didn't supply one, and that list contains
> AUTH_GSS methods first. Skip those methods if gssd isn't running since
> they won't succeed anyway.
> 
> Cc: Weston Andros Adamson <dros@netapp.com>
> Signed-off-by: Jeff Layton <jlayton@redhat.com>
> ---
>  fs/nfs/nfs4proc.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
> index 15052b8..468a581 100644
> --- a/fs/nfs/nfs4proc.c
> +++ b/fs/nfs/nfs4proc.c
> @@ -2900,6 +2900,13 @@ static int nfs4_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle,
>  	} else {
>  		/* no flavors specified by user, try default list */
>  		for (i = 0; i < ARRAY_SIZE(flav_array); i++) {
> +			/*
> +			 * Don't attempt to upcall with the default list
> +			 * unless we know that gssd is running.
> +			 */
> +			if (!gssd_running(server->nfs_client->cl_net))
> +				continue;
> +
>  			status = nfs4_lookup_root_sec(server, fhandle, info,
>  						      flav_array[i]);
>  			if (status == -NFS4ERR_WRONGSEC || status == -EACCES)

Eep! Wrong patch. I'll resend. Sorry for the noise...

-- 
Jeff Layton <jlayton@redhat.com>