Subject: RE: [nfsv4] NFSv4 Global namespace: joining NFSv4 domains with a newDNS nfsv4 SRV.

From: "Everhart, Craig" <[email-masked]>
Date: Tue, 28 Feb 2006 17:52:29 -0500

So draft-everhart-nfsv4-namespace-via-dns-srv-00.txt is intended to
document an NFSv4 global namespace.

Some possible sticking points are
	- no recommendation on whether DNS SRV processing is done on NFS
client or NFS server
	- security recommendations referring to DNSSEC as part of a
chain, or the KITTEN WG's domain-based service principal names

Or is it so clear and uncontroversial as not to elicit comments?
Admittedly, lots of discussions have happened already.

		Craig

> -----Original Message-----
> From: William A.(Andy) Adamson [mailto:[email-masked]] 
> Sent: Thursday, January 19, 2006 2:25 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [nfsv4] NFSv4 Global namespace: joining NFSv4 
> domains with a newDNS nfsv4 SRV.
> 
> fs_locations referals enables an implementation of an NFSv4 
> administrative domain wide namespace.  the administrators of 
> an NFSv4 domain have the role to decide on namespace topology 
> and it's clear that they are an authority that can provide 
> appropriate fs_locations values for domain wide namespace 
> construction.
> 
> the use of fs_locations to join NFSv4 administrative domains 
> is problematic in that it requires long term agreement and 
> cooperation between domains. a server in NFSv4 domain 'A' 
> that provides a namespace junction to NFSv4 domain 'B' 
> will need to get B's fs_location info from domain B 
> adminstrators. what are the rules? who checks for circular 
> referals? if domain B is only accessable from domain A what 
> happens when domain A servers are unavailable? etc.
> 
> CITI proposes the use of a new DNS nfsv4 SRV record used to 
> construct an AFS-like namespace for NFSv4, where the first 
> level of the namespace consists of NFSv4 domain names (akin 
> to AFS Realm names) resolved by the new DNS nfsv4 SRV record.
> 
> here is an example path name;
> 
> /nfs4/NFSv4-domain/foo/bar/....
> 
> - "/nfs4" is the (local) root of the global namespace. (just 
> like /afs)
> 
> - "NFSv4-domain" is flat - one entry per NFSv4-domain 
> participating in the naemspace.  traversing from "/nfs4" into 
> "NFSv4-domain" kicks of a DNS query for the domains DNS nfsv4 
> SRV record. the record will contain the nfsv4 server
> name(s) exporting the root of the NFSv4 domain namespace.
> 
> - "foo" and all namespace under it is in "NFSv4-domain" and 
> is resolved via fs_locations.
> 
> i would like to see the DNS nfsv4 SRV record defined, and 
> added to the NFSv4.1 minor version as an official way to join 
> NFSv4 administrative domain namespaces.
> 
> -->Andy
> 
> 
> 
> _______________________________________________
> nfsv4 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/nfsv4
> 

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 28 Feb 2006 17:29:22 -0600

> 	- no recommendation on whether DNS SRV processing is done on NFS

I expect the client to do DNS SRV lookups to find the NFSv4 "root"
servers for a domain.  I expect clients to know how to cross server-side
mounts and follow referrals.

If servers wish to issue referrals to a domain's NFSv4 root, that's
fine, and for this they'd have to know how to do DNS SRV lookups.  But
really, this is something clients will want to know how to do.

> chain, or the KITTEN WG's domain-based service principal names

Right now only DNSSEC is available for normative references.  If you're
willing to wait one more IETF we could get the domain-based service
principal names I-Ds prioritized and through to Proposed-Standard.

> Or is it so clear and uncontroversial as not to elicit comments?

The first one is.  The second is not -- you must at least document the
security problem in the security considerations section.

> Admittedly, lots of discussions have happened already

Yes, but we all seem to (finally) be on the same page about the
structure of the NFSv4 global namespace (domains with root servers
discovered via DNS SRV RRs).

Nico
--