Subject: Re: Gss Context and sequence window

From: rammarti <[email-masked]>
Date: Wed, 30 Oct 2002 12:35:01 -0800 (PST)

>X-Authentication-Warning: sunroof.eng.sun.com: majordomo set sender to 
[email-masked] using -f
>To: [email-masked]
>Cc: "William A.(Andy) Adamson" <[email-masked]>, 
[email-masked], [email-masked]
>Subject: Re: Gss Context and sequence window 
>Mime-Version: 1.0
>Date: Wed, 30 Oct 2002 15:27:34 -0500
>From: "William A.(Andy) Adamson" <[email-masked]>
>List-Archive: </var/mail/nfsv4-wg.archive/>
>List-Owner: <mailto:[email-masked]>
>List-Subscribe: <mailto:[email-masked]?body=subscribe>
>List-Unsubscribe: <mailto:[email-masked]?body=unsubscribe>
>
>> "William A.(Andy) Adamson" wrote:
>> > 
>> > Is the GSS context negotiated for a user on one mount point/communication
>> > channel supposed to be shared with all other mount points/communication
>> > channels for that user on that server? The question at issue is whether or 
not
>> > it is possible to have multiple contexts for a given user against a given
>> > server in order to avoid having a global serialization w.r.t. the sequence
>> > number.
>> > 
>> > Cheers,
>> >   Andy, Bruce, Trond
>> 
>> 
>> The client can do whatever makes sense for it. The server, especially
>> an NFSv4 server needs to be able to accept the context through all
>> exported directories. It also must accept multiple contexts from
>> the same user. This is critical for performance; most client do
>> read ahead and write behind and in the case of the Solaris client,
>> 8-9 contexts per user/mount pair get created.
>> 
>> (As an implementation aside, if you are using the MIT krb5 code,
>> you'll note that its context creation path is not re-entrant ...
>> simulataneus context creations are likely to crash. So you'll need to
>> serialize context creation or make the code re-entrant).
>> 
>> It is indeed possible and expect for a given user to have lots of
>> contexts against a given server.
>> 
>
>wow. so, my nfsv4 login client that will have 250 simultaneous users will be 
>spending a bunch of time creating contexts to a given server/mountpoint even 
>though the only difference is the sequence numbering??

If your NFSv4 client has 250 simualtaneous users,it will have to create a 
separate GSS Context for each user (with different encryption keys) and use them 
for access. So it is not just the sequence numbering that is different, the keys 
and other context parameters also will be different for each user/context.

	= Ram Marti

>-->Andy

---

From: "William A.(Andy) Adamson" <[email-masked]>
Date: Wed, 30 Oct 2002 15:42:49 -0500

>and other context parameters also will be different for each user/context.

yes, i know. the context is per user/server, and keys etc are different. i do 
question the need to create a new user/server context for each mount point 
exported by the server, as well as multiple  (8-9 per mount point for the 
solaris client) user/server context pairs per mount point! sheese. the 
user/server context has all the information for any <service,qop> the server 
chooses fro different mountpoints...

-->Andy