Received: by 2002:a25:8b91:0:0:0:0:0 with SMTP id j17csp13794848ybl; Sun, 29 Dec 2019 21:06:08 -0800 (PST) X-Google-Smtp-Source: APXvYqyf2icg6s8dSL40y3JOZ6eyF4DLF6HUeINA2VJ7sfQxjNM+++3dbY5nxSCJ6Fb73TbJcXge X-Received: by 2002:a05:6830:3050:: with SMTP id p16mr27382691otr.301.1577682368481; Sun, 29 Dec 2019 21:06:08 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1577682368; cv=none; d=google.com; s=arc-20160816; b=l7HOHxxA0h3vTj82/i1WHh+wRdIXHhA5i2qF2ZITi/pto0uO88MjipPhUly71a/lb/ st9jehVDWG4jzTC2aKAI7/T9uQgel2TZNE0F1Tw7QAiGH24JV+Xo+Ylp04Dw6KNdKYuw sIAsL5zkKEvwSmXpntblWu2Gvrac7xhEbNdyyPsD0/qNM+r3uQ1MNKgSPYyIvWBfs/eu NU7OPknpAh8qDnLXtWAFYwJ1O4P2tI7kSYzcmCXSd8/CJqIvW8Y01Us5X81L8n/KirQq GiMitehn7xlEUpxBU7d5Vb1uIrUPwR8pKd/P3c1nD7nzVkmgkJFxp3bm/BMR9CysZLwG POHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=dv0gPEJpw1DwGP6Ytsqpfok/vsNxEo1QlHlYHyDkSVE=; b=S35gQj9dXOQyS2K+44XgYXALaG7jTHnQzyWqfJ546c8ZQHKwDgDixqFOMaNq8ILVI3 VAmvG7+/QgTCsfBZSFKXLodpnvqpF7pZJ1sgxC8nJXFjnDZuM0naCbLYszYRvPSqN5U7 Q8EJSVV/J7qgoIbDL2RwJzNivCOxRANv/u53YO4zp9abdL48rJ0g3E6Ie8V4JGLaXHLZ /jq9RLKYIPkcJ/ihJYBpRW8ObIbMJ2VGkGbYE8mWqpwAp8oT8DVke/TQSbk2QUmGOzqG QhtoXNwixhr9GQ5CeJmTJzraDY5LUVwuHqQhHgwJUKAIBhtK9CqxXLo2XRA/V5g5Jxt7 st0A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=a4NIpEw5; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id d22si20917872otf.256.2019.12.29.21.05.56; Sun, 29 Dec 2019 21:06:08 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=a4NIpEw5; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727194AbfL3FFI (ORCPT + 99 others); Mon, 30 Dec 2019 00:05:08 -0500 Received: from mail-pj1-f66.google.com ([209.85.216.66]:38729 "EHLO mail-pj1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726775AbfL3FFH (ORCPT ); Mon, 30 Dec 2019 00:05:07 -0500 Received: by mail-pj1-f66.google.com with SMTP id l35so7613478pje.3; Sun, 29 Dec 2019 21:05:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=dv0gPEJpw1DwGP6Ytsqpfok/vsNxEo1QlHlYHyDkSVE=; b=a4NIpEw5OUkiOZHEJ2p94OEkLOazuVzl39soh04GBzQn5THlohfN7fkk45af3qNk1E GaqMGmZSqpcPrkOx568+/BdoxnELySHHMjqyu/W0ADc0UtsA/UrGQfna62ZmRaQii1Ml g6IvebMp2ypmJpDIlyN4w6uXsFpxFO+Bq8f/BV3Pzrr1Afwt1iOCRm9G8eGDNlzKTTc7 yRabqQA2YqswNFs1TAVcVizHlF5yzz9NtigY9ciVjV+wK+o6LkmBRvKTGslDZX/RaWCe /02p3gJVf7Wtf+/Ub7eBEjbbMawyjeoopDaLBJvOmJ6EG/WUdLkWWrM6YJdB/KVK0GHw 480A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=dv0gPEJpw1DwGP6Ytsqpfok/vsNxEo1QlHlYHyDkSVE=; b=jeVhHufzP8rgRwKupZdDnAPOa7Wb6/2LMy+gEODuS/4Ge69ZX/Pr66QLngjLLUTSVA sDD2GtftyjEoK3LXH0SXO6OMf90IsKscYALguYb3vIa58+x32HenpflCLUqJA1/pwIEw 8oRgSMA1TpjaahHud06JpS8fkMLfI+w7hD6M1fCqStQq/6iXkIjetA1nCyqIT0lPI1lR jPpX7b3qj2faC8qKnelrhRsTKWsBdoDgLtdEkm8v1VxFnKaausiGoq+dTVgbBMq+NvzV IUTd6EB1L3IMs0++0p+mwtAvNnJ/sn8RWpTizcE8zE24C6HowwDCt4uFLj+WRgVxSVj+ xarg== X-Gm-Message-State: APjAAAVKaNXtyfGGzExO67Lcswn0J34I4Z+fenySDNfpnAbXtWqxhHPT Xme1KYMJ5GP/XiGyThCT0WM= X-Received: by 2002:a17:902:d694:: with SMTP id v20mr26699724ply.127.1577682305975; Sun, 29 Dec 2019 21:05:05 -0800 (PST) Received: from localhost.localdomain ([2804:14d:72b1:8920:da15:c0bd:33c1:e2ad]) by smtp.gmail.com with ESMTPSA id r2sm45054727pgv.16.2019.12.29.21.05.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 29 Dec 2019 21:05:05 -0800 (PST) From: "Daniel W. S. Almeida" X-Google-Original-From: Daniel W. S. Almeida To: corbet@lwn.net, mchehab+samsung@kernel.org Cc: "Daniel W. S. Almeida" , linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, skhan@linuxfoundation.org, linux-kernel-mentees@lists.linuxfoundation.org Subject: [PATCH 3/5] Documentation: nfs: rpc-server-gss: convert to ReST Date: Mon, 30 Dec 2019 02:04:45 -0300 Message-Id: X-Mailer: git-send-email 2.24.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: "Daniel W. S. Almeida" Convert rpc-server-gss.txt to ReST. Content remains mostly unchanged. Signed-off-by: Daniel W. S. Almeida --- Documentation/filesystems/nfs/index.rst | 1 + ...{rpc-server-gss.txt => rpc-server-gss.rst} | 19 +++++++++++-------- 2 files changed, 12 insertions(+), 8 deletions(-) rename Documentation/filesystems/nfs/{rpc-server-gss.txt => rpc-server-gss.rst} (92%) diff --git a/Documentation/filesystems/nfs/index.rst b/Documentation/filesystems/nfs/index.rst index 52f4956e7770..9d5365cbe2c3 100644 --- a/Documentation/filesystems/nfs/index.rst +++ b/Documentation/filesystems/nfs/index.rst @@ -8,3 +8,4 @@ NFS pnfs rpc-cache + rpc-server-gss diff --git a/Documentation/filesystems/nfs/rpc-server-gss.txt b/Documentation/filesystems/nfs/rpc-server-gss.rst similarity index 92% rename from Documentation/filesystems/nfs/rpc-server-gss.txt rename to Documentation/filesystems/nfs/rpc-server-gss.rst index 310bbbaf9080..812754576845 100644 --- a/Documentation/filesystems/nfs/rpc-server-gss.txt +++ b/Documentation/filesystems/nfs/rpc-server-gss.rst @@ -1,4 +1,4 @@ - +========================================= rpcsec_gss support for kernel RPC servers ========================================= @@ -9,14 +9,17 @@ NFSv4.1 and higher don't require the client to act as a server for the purposes of authentication.) RPCGSS is specified in a few IETF documents: + - RFC2203 v1: http://tools.ietf.org/rfc/rfc2203.txt - RFC5403 v2: http://tools.ietf.org/rfc/rfc5403.txt + and there is a 3rd version being proposed: + - http://tools.ietf.org/id/draft-williams-rpcsecgssv3.txt (At draft n. 02 at the time of writing) Background ----------- +========== The RPCGSS Authentication method describes a way to perform GSSAPI Authentication for NFS. Although GSSAPI is itself completely mechanism @@ -29,6 +32,7 @@ depends on GSSAPI extensions that are KRB5 specific. GSSAPI is a complex library, and implementing it completely in kernel is unwarranted. However GSSAPI operations are fundementally separable in 2 parts: + - initial context establishment - integrity/privacy protection (signing and encrypting of individual packets) @@ -41,7 +45,7 @@ kernel, but leave the initial context establishment to userspace. We need upcalls to request userspace to perform context establishment. NFS Server Legacy Upcall Mechanism ----------------------------------- +================================== The classic upcall mechanism uses a custom text based upcall mechanism to talk to a custom daemon called rpc.svcgssd that is provide by the @@ -62,21 +66,20 @@ groups) due to limitation on the size of the buffer that can be send back to the kernel (4KiB). NFS Server New RPC Upcall Mechanism ------------------------------------ +=================================== The newer upcall mechanism uses RPC over a unix socket to a daemon called gss-proxy, implemented by a userspace program called Gssproxy. -The gss_proxy RPC protocol is currently documented here: - - https://fedorahosted.org/gss-proxy/wiki/ProtocolDocumentation +The gss_proxy RPC protocol is currently documented `here +`_. This upcall mechanism uses the kernel rpc client and connects to the gssproxy userspace program over a regular unix socket. The gssproxy protocol does not suffer from the size limitations of the legacy protocol. Negotiating Upcall Mechanisms ------------------------------ +============================= To provide backward compatibility, the kernel defaults to using the legacy mechanism. To switch to the new mechanism, gss-proxy must bind -- 2.24.1