Received-SPF: pass (google.com: best guess record for domain of linux-nfs-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Content-Type: text/plain;
        charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Subject: Re: NFSv4 client locks up on larger writes with Kerberos enabled
From:   Chuck Lever <chuck.lever@oracle.com>
In-Reply-To: <20190925164831.GA9366@fieldses.org>
Date:   Wed, 25 Sep 2019 10:06:26 -0700
Cc:     Kevin Vasko <kvasko@gmail.com>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Content-Transfer-Encoding: 7bit
Message-Id: <57192382-86BE-4878-9AE0-B22833D56367@oracle.com>
References: <CAMd28E-pJp4=kvp62FJqGLZo-jGA2rH2OT6-hK_N=TvMiJuT2A@mail.gmail.com>
 <20190925164831.GA9366@fieldses.org>
To:     Bruce Fields <bfields@fieldses.org>
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk


> On Sep 25, 2019, at 9:48 AM, bfields@fieldses.org wrote:
> 
> On Wed, Sep 18, 2019 at 06:36:13PM -0500, Kevin Vasko wrote:
>> We have a new Dell EMC Unity 300 acting as NAS Server that is
>> presenting a NFSv4 NFS Share. Our clients are mostly Ubuntu 18.04.3
>> but issue is also present on CentOS 7.6 systems. We have been
>> struggling with this issue for over a week now and not sure how to
>> resolve it.
>> 
>> 
>> 
>> We are having trouble with NFS Clients completing their writes to the
>> Dell EMC Unity 300 NFS Server when Kerberos is enabled on the NFS
>> Share. I created the NFS Share on the U300, associated it with our
>> FreeIPA (Kerberos/LDAP server) and everything shows successful.
> 
> Troubleshooting ideas off the top of my head:
> 
> It might be worth trying some other client versions if it's not hard.
> 
> It'd be interesting to know what's happening on the network....
> Unfortunately big krb5p writes won't be fun to try to capture and
> examine.

Wireshark is supposed to have a mechanism for giving it the keys
so that captured GSS data can be decrypted. I've never gotten it
to work, but I didn't try hard. Should be appropriately documented.


> Maybe some network or rpc-level statistics would help show if
> there are an unusual number of retries or failures.


--
Chuck Lever