Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: text/plain;
        charset=utf-8
Subject: Re: server-to-server copy by default
From:   Charles Hedrick <hedrick@rutgers.edu>
In-Reply-To: <20211020155421.GC597@fieldses.org>
Date:   Mon, 1 Nov 2021 14:22:37 -0400
Cc:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        dai.ngo@oracle.com,
        Olga Kornievskaia <olga.kornievskaia@gmail.com>,
        Steve Dickson <steved@redhat.com>,
        Chuck Lever <chuck.lever@oracle.com>
Content-Transfer-Encoding: quoted-printable
Message-Id: <C0088A79-6936-4764-8ADB-4D6C32054265@rutgers.edu>
References: <20211020155421.GC597@fieldses.org>
To:     "J. Bruce Fields" <bfields@fieldses.org>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?Yys1bW9wR1N6bmhXbTdoTExSdDRHV2ExQi9BdGFuUmYvTFJRd2h1RkIwaUMr?=
 =?utf-8?B?VnJ3aEtWZ1d5V1JTejczcU9qVTJuWWh1cXBVcjhPV1k1TlhHQkhPTFpQcWkv?=
 =?utf-8?B?ZjEvZ040ZlZZQk5Gc3FCYW1qenpSNDIrY0hCeE85UDVPR0YyeXFham16SmVZ?=
 =?utf-8?B?cDlDUFd2UUQ1TFdiTmQ1cFloeGlDL0RPVmdRMllSTVM5alpzc29Ed2hHODFW?=
 =?utf-8?B?RnRSMDhtZzVNUmpTeS9CRlJFcHRGelJVR0RLZlBWY3k5QXNDMmVVZmlLV3gw?=
 =?utf-8?B?WDl4NHFTcllDVE94U0tuZU9xRnh5MnhJem12d3RBalhIMW8vTWROYnB5ZWs5?=
 =?utf-8?B?WDA2QUFqR0hzbnMzZGVTOWxiZlhwR09JL2VnZ1RpbzZUbUNQbUE3VXhmcVNG?=
 =?utf-8?B?Sm1hMlRFbUlub0RoTldFRlhMVkREbXJ4WGxSNzFacFVxU0d2aGxzRGhKckRt?=
 =?utf-8?B?SlN1Q2lUcjN0bk9ubzFNNmVKUUJMQ0UrcUx6SERjWW1sNnJJUmxnNVI0Qkdx?=
 =?utf-8?B?eG1XbU93UVN1UUlENUEwZUkyQ2VSUmRjZitjaWdHZWgxempOenErTmxsbkVi?=
 =?utf-8?B?MEhpdEtrUHk2Z000Zi96M2dab0thMWRZL0NiSXBPWndNTVlSLzRGeUdBSmlk?=
 =?utf-8?B?WnNRMnl0OG81bmsrL1E4RXhLS2JUYUZQNFRWbGZwcnNrNk9QeDY1eHZMQnlM?=
 =?utf-8?B?NXdKb1dhUC9KYVA4UmtnSE1Zcnhqb3c1UC9MdG1PVzNRQjRpU2pJck1DaWxM?=
 =?utf-8?B?VjQ2STN3S1A5bm1hdU1ZMnhCVG9ORFRrckVQNUxxbWdsRG5mR2ZEUzB3bE1D?=
 =?utf-8?B?S1I3K0JBaU1ZMGE2NmhUWDJsZmVDWW1tMmU1YXhWQXlzWk80ZVBDYjArSjY0?=
 =?utf-8?B?VEJIQUdFbXZKTWFpbWNGeEllWEJvSDlwSUtZYlJ2QU5zMzZJa3h1RklpeDVa?=
 =?utf-8?B?c012aDBxSHRYcnFQZTFzaktQSDJTWFVVVU9tMnZieWg0SzREUy9DbWljS2ZY?=
 =?utf-8?B?Y1NHZ3ZtMmt6b2VLQW1qS2dwbldDdk0wY3hGL1hJa09zc0RiWUhhYjJ5TDFh?=
 =?utf-8?B?Y29nK2NtQVdVN1BhemRBMjN3RkFvbFJaMGtrOFA4S01DMElZUm54cElwVDNQ?=
 =?utf-8?B?QlNPNWNFUWdSSFBWNXFDMXpMUlFKc0g0RWs2bzVqM3VhcGI4MElTbU14NEto?=
 =?utf-8?B?UGFvWU9RZVJtb2UycThnTHlkUnJhKzVaRUw2Z1dadWN2MHpaWHd3Nmh6VlRu?=
 =?utf-8?B?dXlnc3lsZjA0aVZoVDFwNFRiRStwdDlLNFpwdmpidjQ5eTcwR0UrKytyRjdO?=
 =?utf-8?B?TG5YSGFSakE1cGpGeXExOTd2dHVEOStLbmNLTnM1OTNJNHBqbHNNRHVseEVW?=
 =?utf-8?B?YmFlMXMwdmM0bU9TUnMvcm1BZnowTmI0OENhRzRTbHBMRHRpZ1pna2lnUEJy?=
 =?utf-8?B?QVprNHVxSXRGUlpWR1VrUVlsTXFjUGNmSVJ5YXhpTmhHaTc0Nk5pVlErYy9w?=
 =?utf-8?B?L1BjTXZncmdXQzhHM1BZcW5oRkJQdW9tVkppc0tNay9BN0Rtdm5rM1FKUlVN?=
 =?utf-8?B?c0Jtak9vVC9MVnhDOFlFTXlHRC9zV2VlNUtLMm5uc1dadlhyY0huclNQaGQ3?=
 =?utf-8?B?L1RacXF5Tm5nZUk1cUdlcFdrQ29nSEQ4R3lVRDdyckRuS3k0RnJ6SEZpNFZy?=
 =?utf-8?B?aFdUalZseEEwRnlnWjBUQ1ZDUUluZnJNUUxzbXVXZndiNldhbVNRNnE2MWEz?=
 =?utf-8?B?bTdkWElNK2E3WDlSM3ltekZoQU13UnBteE9uMGk1N3p5Y0pHY01BckZiWU9a?=
 =?utf-8?B?M1R0VVVHNXhNMklMVFRlN0RQUjVHanhNenZTWklBZUN4aGY0QWQxSkRoa2ps?=
 =?utf-8?B?SE5pUnNRdnVNUmRhQk5YZ1J5VUgwZElPanIzVGdrWkYxb2V2L0JsNHBzUEVv?=
 =?utf-8?B?eTI0bXZ6ZWlDajhKWGYvc29LVDJjSFk4VnhRVExjRUo2ZVpKMDRHa1lDY0F0?=
 =?utf-8?B?OFlGanlST0NGVXpHSFdBUTZYeU9Wa3hBWVVLZlkrWmFrbUp1c0FHV0w2YldK?=
 =?utf-8?B?UVdxV3hvanJ3MnB6Sk5JNGFCYXpyWWp5Z3hqMDQwYmxYUHF1ZW5ranJiWUd0?=
 =?utf-8?B?VG5ETnk1ZXZ3R3NtY1dCVUhNUzhXNEJZaFpOZmQ0R3ZrVDg5bDRxVEdEUEU2?=
 =?utf-8?Q?QksHVu20NH8CW6SfOMZpJ/I8lm502KQ0G3DRQYVBp1k3?=
X-OriginatorOrg: rutgers.edu
X-MS-Exchange-CrossTenant-Network-Message-Id: b9bdf8a4-da25-4b5b-4dec-08d99d649567
X-MS-Exchange-CrossTenant-AuthSource: BL0PR14MB3588.namprd14.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Nov 2021 18:22:38.0881
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: b92d2b23-4d35-4470-93ff-69aca6632ffe
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: LgAjkmr6uFQJj7pXSPHDhc+G+MJ1Ht7TK+KYMBQ/XoUMzeIaFak94nGR7B8TjxSCoBm2nXIMlQulWH/T8Zu50w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR14MB3746
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org

I am in general concerned about turning on new features before basic ones w=
ork reliably. We=E2=80=99ve had enough different failures that we=E2=80=99v=
e backup up to NFS 3 for file systems with heavy use.

We first tried turning off delegation. That helped a lot. But we just ran i=
nto a two different machine hung trying to lock Chome=E2=80=99s profile. (I=
 sent a bit of information on that one previously.) We had to restart NFS o=
n the server to fix it, and that caused us to lose a bunch of VMs. (That sh=
ouldn=E2=80=99t have happened. It looks like ESX misbehaved.) If I could tu=
rn off NFS4 locking I would.

> On Oct 20, 2021, at 11:54 AM, J. Bruce Fields <bfields@fieldses.org> wrot=
e:
>=20
> knfsd has supported server-to-server copy for a couple years (since
> 5.5).  You have set a module parameter to enable it.  I'm getting asked
> when we could turn that parameter on by default.
>=20
> I've got a couple vague criteria: one just general maturity, the other a
> security question:
>=20
> 1. General maturity: the only reports I recall seeing are from testers.
> Is anyone using this?  Does it work for them?  Do they find a benefit?
> Maybe we could turn it on by default in one distro (Fedora?) and promote
> it a little and see what that turns up?
>=20
> 2. Security question: with server-to-server copy enabled, you can send
> the server a COPY call with any random address, and the server will
> mount that address, open a file, and read from it.  Is that safe?
>=20
> Normally we only mount servers that were chosen by root.  Here we'll
> mount any random server that some client told us to.  What's the worst
> that random server can do?  Do we trust our xdr decoding?  Can it DOS us
> by throwing the client's state recovery code into some loop with weird
> error returns?  Etc.
>=20
> Maybe it's fine.  I'm OK with some level of risk.  I just want to make
> sure somebody's thought this through.
>=20
> There's also interest in allowing unprivileged NFS mounts, but I don't
> think we've turned that on yet, partly for similar reasons.  This is a
> subset of that problem.
>=20
> --b.