github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nfsv4/pnfs: use the MDS authflavor for data server connections

Browse Source 
When a pNFS client connects to an NFSv4.1 data server, the EXCHANGE_ID
is always attempted with RPCSEC_GSS krb5i first, even if the auth flavor
with the MDS is AUTH_SYS. On a host that runs rpc.gssd but has no usable
machine credential, every first contact with a data server therefore
upcalls to rpc.gssd before falling back to AUTH_SYS.

As nfs4_discover_server_trunking is serialized by nfs_clid_init_mutex
such an extra upcall creates a backlog of DS connections when many files
accessed in parallel.

Pass the authflavor of the MDS lease to nfs4_alloc_client() and skip
the krb5i attempt if the MDS already ended up with AUTH_SYS. Nothing
changes for the MDS itself, or for data servers of an MDS whose lease
was established with krb5i.

Fixes: 4edaa30888 ("NFS: Use "krb5i" to establish NFSv4 state whenever possible")
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
This commit is contained in:
Tigran Mkrtchyan 2026-10-09 17:58:02 +02:00 committed by Anna Schumaker
parent 9ee534a759
commit 4b27670ea2
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
fs/nfs/internal.h
View File

@ -86,6 +86,7 @@ struct nfs_client_initdata {
struct xprtsec_parms xprtsec;
unsigned long connect_timeout;
unsigned long reconnect_timeout;
rpc_authflavor_t authflavor; /* Auth flavor to use for DS connection */
};
/*

7
fs/nfs/nfs4client.c
View File

@ -230,8 +230,12 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
/*
* Set up the connection to the server before we add add to the
* global list.
*
* Prefer krb5i unless the caller already knows AUTH_UNIX is required.
*/
err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_GSS_KRB5I);
err = -EINVAL;
if (cl_init->authflavor != RPC_AUTH_UNIX)
err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_GSS_KRB5I);
if (err == -EINVAL)
err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_UNIX);
if (err < 0)
@ -816,6 +820,7 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv,
.cert_serial = TLS_NO_CERT,
.privkey_serial = TLS_NO_PRIVKEY,
},
.authflavor = mds_clp->cl_rpcclient->cl_auth->au_flavor,
};
char buf[INET6_ADDRSTRLEN + 1];