Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: nfs4.1 and nconnect - is this supported?
To:     Rick Macklem <rmacklem@uoguelph.ca>,
        linux-nfs <linux-nfs@vger.kernel.org>
References: <9d726e22-8c47-41ac-727b-3a27a9919fc6@vastdata.com>
 <YQXPR0101MB09687CF25C779E1E6ECEFF5ADD129@YQXPR0101MB0968.CANPRD01.PROD.OUTLOOK.COM>
From:   guy keren <guy@vastdata.com>
Message-ID: <9e025239-bff4-3fbe-a167-342e58475b35@vastdata.com>
Date:   Thu, 15 Jul 2021 23:25:26 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.10.0
MIME-Version: 1.0
In-Reply-To: <YQXPR0101MB09687CF25C779E1E6ECEFF5ADD129@YQXPR0101MB0968.CANPRD01.PROD.OUTLOOK.COM>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-GB
Precedence: bulk

On 7/15/21 5:43 PM, Rick Macklem wrote:
> guy keren <guy@vastdata.com> wrote:
>> hi,
>>
>> i wonder if the linux client's nfs nconnect feature was designed to
>> support NFS4.1 (or higher) versions? according to our experimentation,
>> the linux client seems to just alternate messages between the multiple
>> RPC/TCP connections, and does not seem to adhere to the NFS 4.1 protocol
>> requirement, that when using multiple connections, the client needs to
>> use BIND_CONN_TO_SESSION when trying to user a 2nd connection with the
>> same NFS4.1 session.
>>
>> was this done on purpose? or is this configuration not supported by
>> linux client's 'nconnect'? or am i missing something?
> Yep, you're missing something.
>
> Snippet from RFC 5661 pg. 43:
>     If the client specifies no state
>     protection (Section 18.35) when the session is created, then when
>     SEQUENCE is transmitted on a different connection, the connection is
>     automatically associated with the fore channel of the session
>     specified in the SEQUENCE operation.
>
> As such, BIND_CONN_TO_SESSION is only required to associate the
> backchannel to the connection.
>
> rick

thanks for pointing this out, rick - i forgot about this feature.


does it mean that 'nconnect' cannot work with MACHCRED or SSV client 
authentication then?

will it work with kerberos (which does authenticate the client machine 
normally, as far as i know)?


thanks,

--guy