The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of BSD-2-Clause.
Discussed with: pfg
MFC After: 3 days
Sponsored by: Netflix
(cherry picked from commit 4d846d260e)
If a jail is not correctly configured to run nfsd(8)
in the jail, gssd(8) cannot run.
This patch improves the failure message for this case.
(cherry picked from commit 697727110b)
This uses DES and the kernel no longer supports DES for in-kernel GSS.
Reviewed by: kp
Relnotes: yes
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D24345
Update a bunch of Makefile.depend files as
a result of adding Makefile.depend.options files
Reviewed by: bdrewery
MFC after: 1 week
Sponsored by: Juniper Networks
Differential Revision: https://reviews.freebsd.org/D22494
Leaf directories that have dependencies impacted
by options need a Makefile.depend.options file
to avoid churn in Makefile.depend
DIRDEPS for cases such as OPENSSL, TCP_WRAPPERS etc
can be set in local.dirdeps-options.mk
which can add to those set in Makefile.depend.options
See share/mk/dirdeps-options.mk
Reviewed by: bdrewery
MFC after: 1 week
Sponsored by: Juniper Networks
Differential Revision: https://reviews.freebsd.org/D22469
We've got some cases where the other end of gssd's AF_LOCAL socket gets
closed, resulting in an error (and SIGPIPE) when it tries to do I/O to it.
Closing without cleaning up means the next time nfsd starts up, it hangs,
unkillably; this allows gssd to handle that particular error.
* Limit the retry cound in gssd_syscall to 5.
The default is INT_MAX, which effectively means forever. And it's an
uninterruptable RPC call, so it will never stop.
The two changes mitigate the problem.
Reviewed by: macklem
MFC after: 2 weeks
Sponsored by: iXsystems Inc.
Differential Revision: https://reviews.freebsd.org/D19153
Mainly focus on files that use BSD 2-Clause license, however the tool I
was using misidentified many licenses so this was mostly a manual - error
prone - task.
The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.
No functional change intended.
These are no longer needed after the recent 'beforebuild: depend' changes
and hooking DIRDEPS_BUILD into a subset of FAST_DEPEND which supports
skipping 'make depend'.
Sponsored by: EMC / Isilon Storage Division
When gssd exits it leaves the kernel state set by
gssd_syscall(). nfsd sees this and waits endlessly
in an unkillable state for gssd to come back. If you
had acidentally started gssd then stopped it, then
started nfsd you'd be in a bad way until you either
restarted gssd or rebooted the system. This change
fixes that by setting the kernel state to "" when
gssd exits.
Reviewed by: rmacklem
MFC after: 1 week
Sponsored by: iXsystems
Off by default, build behaves normally.
WITH_META_MODE we get auto objdir creation, the ability to
start build from anywhere in the tree.
Still need to add real targets under targets/ to build packages.
Differential Revision: D2796
Reviewed by: brooks imp
host based (kerberos service principal) initiator credentials in
the default keytab file. This option won't actually be useful until
the corresponding kernel changes are committed.
Reviewed by: jhb
to use DES and the associated old style GSS initialization token.
This appears to be required for some non-FreeBSD servers to
get a kerberized NFS mount to work. Also, ignore some signals when daemonized,
which might fix the gssd from "disappearing" without leaving a core dump.
Given the tight timeframe for the FreeBSD9.2 release, I have
committed this while waiting for code review. I will commit
changes recommended by the review in a separate commit.
Reviewed by: dfr (pending)
MFC after: 10 days
with diagnosis of kerberized NFS mount problems. When set,
messages are sent to syslog() (or fprintf(stderr,...) if
"-d" is also specified) to indicate activity/results of
kgssapi upcalls.
Reviewed by: jhb
MFC after: 2 weeks
the ERANGE error return case. Without this fix, authentication
of users for certain system setups could fail unexpectedly.
Reported by: Elias Martenson (lokedhs@gmail.com)
Tested by: Elias Martenson (earlier version)
MFC after: 2 weeks
credential cache files with names other than /tmp/krb5cc_<uid>.
The gssd daemon does not know how to find these credential caches.
This patch implements a new option "-s" that does a search for
credential cache files, using roughly the same algorithm as the
gssd daemon for Linux uses. The gssd behaviour is only changed
if the new "-s" option is specified. It also implements two other
new options related to the "-s" option.
Reported by: Piete.Brooks at cl.cam.ac.uk, Herbert Poeckl
Tested by: Herbert Poeckl (admin at ist.tugraz.at), Illias A. Marinos
MFC after: 2 weeks
