Mail Archives: cygwin/2024/02/25/12:20:45

Cedric Blancher via Cygwin <cygwin AT cygwin DOT com> · Sun, 25 Feb 2024 18:19:34 +0100

For your consideration - we need FEEDBACK, please!

Ced

---------- Forwarded message ---------
From: Roland Mainz <roland DOT mainz AT nrubsig DOT org>
Date: Sat, 24 Feb 2024 at 15:19
Subject: [Ms-nfs41-client-devel] ANN: NFSv4.1 filesystem client
Windows driver binaries for Windows 10/11 for testing, 2024-02-24 ...
To: <ms-nfs41-client-devel AT lists DOT sourceforge DOT net>

Hi!

----

I've created a set of test binaries for the NFSv4.1 filesystem client
driver for Windows 10/11, based on
https://github.com/kofemann/ms-nfs41-client (commit id
#5e7d973b97c4ec831b22e468e66289f555318d45, git bundle in tarball), for
testing and feedback (download URL in "Download" section below).

Please send comments, bugs, test reports, complaints etc. to the
MailMan mailing list at
https://sourceforge.net/projects/ms-nfs41-client/lists/ms-nfs41-client-devel

# 1. What is this ?
NFSv4.1 client and filesystem driver for Windows 10/11

# 2. Features:
- Full NFSv4.1 protocol support
- idmapper (mapping usernames and uid/gid values between server and
    client)
- Support for custom ports (NFSv4 defaults to TCP port 2049, this
    client can use different ports per mount)
- Support for nfs://-URL
    * Why ? nfs://-URLs are cross platform, portable and Character-Encoding
      independent descriptions of NFSv4 server resources (exports).
    - including custom ports and raw IPv6 addresses
    - nfs://-URL conversion utility (/usr/bin/nfsurlconv) to convert
        URLs, including non-ASCII/Unicode characters in mount path
- Support ssh forwarding, e.g. mounting NFSv4 filesystems via ssh
    tunnel
- Support for long paths (up to 4096 bytes), no Windows MAXPATH limit
- Unicode support
- UNC paths
    - IPv6 support in UNC paths
- IPv6 support
    - IPv6 address within '[', ']'
      (will be converted to *.ipv6-literal.net)
- Windows ACLs
- SFU/Cygwin support, including:
    - uid/gid
    - Cygwin symlinks
- Software compatibility:
    - Any NFSv4.1 server (Linux, Solaris, Illumos, FreeBSD, nfs4j,
        ...)
    - All tools from Cygwin/MinGW
    - Visual Studio
    - VMware Workstation (can use VMs hosted on NFSv4.1 filesystem)

# 3. Requirements:
- Windows 10 or Windows 11
- Cygwin 3.5.0
    - Packages:
        cygwin
        cygwin-devel
        cygrunsrv
        cygutils
        cygutils-extra
        bash
        bzip2
        coreutils
        getent
        gdb
        grep
        hostname
        less
        libiconv
        libiconv2
        pax
        pbzip2
        procps-ng
        sed
        tar
        time
        util-linux
        wget

# 4. Download:
$ mkdir -p ~/download
$ cd ~/download
$ wget 'http://www.nrubsig.org/people/gisburn/work/msnfs41client/releases/testing/msnfs41client_cygwin_binaries_20240224_11h39m_git5e7d973.tar.bz2'
$ openssl sha256
msnfs41client_cygwin_binaries_20240224_11h39m_git5e7d973.tar.bz2
SHA2-256(msnfs41client_cygwin_binaries_20240224_11h39m_git5e7d973.tar.bz2)=
b854115d86f2aad0c305c9690d9361d3c160edb05304def510363a6be85fbeca

# 5. Installation (as "Administrator"):
$ (cd / && tar -xf
~/download/msnfs41client_cygwin_binaries_20240224_11h39m_git5e7d973.tar.bz2
)
$ /sbin/msnfs41client install
<REBOOT>

# 6. Deinstallation:
$ (set -x ; cd / && tar -tf
~/download/msnfs41client_cygwin_binaries_20240224_11h39m_git5e7d973.tar.bz2
| while read i ; do [[ -f "$i" ]] && rm "$i" ; done)
<REBOOT>

# 7. Usage:

# Run the NFSv4 client daemon:
# - run this preferably as "Administrator", but this is not a requirement
# - requires separate terminal
$ /sbin/msnfs41client run_daemon

# Mount a filesystem and use it
# - requires that NFSv4 server accepts connections from a TCP port
# number > 1024, which can be archived on Linux with the "insecure"
# export option in /etc/exports, or "resvport" on Solaris/Illumos
# (see nfs(5))
$ /sbin/nfs_mount -o rw N 10.49.20.110:/net_tmpfs2
Successfully mounted '10 DOT 49 DOT 20 DOT 110 AT 2049' to drive 'N:'
$ cd /cygdrive/n/
$ ls -la
total 4
drwxrwxrwt 5 Unix_User+0      Unix_Group+0      100 Dec  7 14:17 .
dr-xr-xr-x 1 roland_mainz     Kein                0 Dec 14 13:48 ..
drwxr-xr-x 3 Unix_User+197608 Unix_Group+197121  80 Dec 12 16:24 10492030
drwxr-xr-x 3 Unix_User+197608 Unix_Group+197121  60 Dec 13 17:58 directory_t
drwxr-xr-x 3 Unix_User+197608 Unix_Group+197121  60 Dec  7 11:01 test2

# Unmount filesystem:
$ cd ~ && /sbin/nfs_mount -d N:
# OR
$ cd ~
$ net use N: /delete

# List mounted NFSv4.1 filesystems:
$ /sbin/nfs_mount

# 8. Notes:
- Idmapping (including uid/gid mapping) between NFSv4 client and
  NFSv4 server works via /lib/msnfs41client/cygwin_idmapper.ksh,
  which either uses builtin static data, or /usr/bin/getent passwd
  and /usr/bin/getent group.
  As getent uses the configured name services it should work with
  LDAP too.
  This is still work-in-progress, with the goal that both NFSv4
  client and server can use different uid/gid numeric values for
  client and server side.

- UNC paths are supported, after successful mounting /sbin/nfs_mount
  will list the paths in Cygwin UNC format.

- SIDs work, users with valid Windows accounts (see Cygwin idmapping
  above get their SIDs, unknown users with valid uid/gid values get
  Unix_User+id/Unix_Group+id SIDs, and all others are mapped
  to nobody/nogroup SIDs.

- Workflow for nfs://-URLs:
  - Create nfs://-URLs with nfsurlconv, read $ nfsurlconv --man # for usage
  - pass URL to nfs_mount.exe like this:
    $ nfs_mount -o sec=sys,rw 'L' nfs://derfwnb4966_ipv4//bigdisk #

- Cygwin symlinks are supported, but might require
  $ fsutil behavior set SymlinkEvaluation L2L:1 R2R:1 L2R:1 R2L:1 #.
  This includes symlinks to UNC paths, e.g. as Admin
  $ cmd /c 'mklink /d c:\home\rmainz
\\derfwpc5131_ipv6 AT 2049\nfs4\export\home2\rmainz' #
  and then $ cd /cygdrive/c/home/rmainz/ # should work

- performance: All binaries are build without any optimisation, so
  the filesystem is much slower than it could be.

- bad performance due to Windows Defender AntiVirus:
  Option 1:
  # disable Windows defender realtime monitoring
  # (requires Admin shell)
  powershell -Command 'Set-MpPreference -DisableRealtimeMonitoring 1'
  Option 2:
  Add "nfsd.exe", "nfsd_debug.exe", "ksh93.exe", "bash.exe",
  "git.exe" and other offending commands to the process name
  whitelist.

- performance: Use vmxnet3 in VMware to improve performance

- ACLs are supported via the normal Windows ACL tools, but on
  Linux require the nfs4_getfacl/nfs4_setfacl utilities to see the
  data.
  Example (assuming that Windows, Linux NFSv4 client and NFSv4
  server have a user "siegfried_wulsch"):
  - On Windows on a NFSv4 filesystem, :
  $ icacls myhorribledata.txt /grant "siegfried_wulsch:WD" #
  - On Linux NFSv4 clients you will then see this:
  ---- snip ----
  $ nfs4_getfacl myhorribledata.txt
  A::OWNER@:rwatTcCy
  A::siegfried_wulsch AT global DOT loc:rwatcy
  A::GROUP@:rtcy
  A::EVERYONE@:rtcy
  ---- snip ----

- nfs_mount only works when the NFSv4 server allows connections from
  ports >= 1024, as Windows does not allow the Windows NFSv4 client
  to use a "privileged port" (i.e. TCP port number < 1024)).
  By default the NFSv4 server on Solaris, Illumos, Linux
  etc. only accepts connections if the NFSv4 client uses a
  "privileged (TCP) port", i.e. a port number < 1024.
  This can be worked around by using the "insecure" export option in
  Linux /etc/exports, which allows connections from ports >= 1024,
  and for Solaris/Illumos see nfs(5), option "resvport".

# 9. Known issues:
- The kernel driver ("nfs41_driver.sys") does not yet have a
  cryptographic signature for SecureBoot - which means it will only
  work if SecureBoot is turned off (otherwise
  $ /sbin/msnfs41client install # will FAIL!)

- If nfsd_debug.exe crashes or gets killed, the only safe way
  to run it again requires a reboot

- LDAP support does not work yet

- Attribute caching is too aggressive

- Caching in the kernel does not always work. For example
  $ tail -f ... # does not not see new data.
  Workaround: Use GNU tail'S $ tail --follow=name ... #
  Working theory is that this is related to FCB caching, see
  |FCB_STATE_FILESIZECACHEING_ENABLED|, as the nfs41_driver.sys
  kernel module does not see the |stat()| syscalls. But $ tail -f ... #
  always works for a momemnt if something else opens the same file.

- Unmounting and then mounting the same filesystem causes issues
  as the name cache in nfsd*.exe is not flushed on umount, including
  leftover delegations.

- krb5p security with AES keys do not work against the linux server,
  as it does not support gss krb5 v2 tokens with rotated data.

- When recovering opens and locks outside of the server's grace
  period, client does not check whether the file has been modified
  by another client.

- If nfsd.exe is restarted while a drive is mapped, that drive needs
  to be remounted before further use.

- Does not allow renaming a file on top of an existing open file.
  Connectathon's special test op_ren has been commented out.

- Extended attributes are supported with some limitations:
  a) the server must support NFS Named Attributes,
  b) the order of listings cannot be guaranteed by NFS, and
  c) the EaSize field cannot be reported for directory queries of
  FileBothDirInformation, FileFullDirInfo, or FileIdFullDirInfo.

# 10. Notes for troubleshooting && finding bugs/debugging:
- nfsd_debug.exe has the -d option to set a level for debug
  output.
  Edit /sbin/msnfs41client to set the "-d" option.

- The "msnfs41client" script has the option "watch_kernel_debuglog"
  to get the debug output of the kernel module.

  Run as Admin: $ /sbin/msnfs41client watch_kernel_debuglog #

  Currently requires DebugView
  (https://learn.microsoft.com/en-gb/sysinternals/downloads/debugview)
  to be installed.

- Watching network traffic:
  WireShark has a command line tool called "tshark", which can be used
  to see NFSv4 traffic. As NFSv4 uses RPC you have to filter for RPC,
  and the RPC filter automatically identifies NFSv4 traffic on it's RPC
  id.
  Example for Windows:
  (for NFSv4 default TCP port "2049", replace "2049" with the
  desired port if you use a custom port ; use "ipconfig" to find the
  correct interface name, in this case "Ethernet0"):
  ---- snip ----
  $ nfsv4port=2049 ; /cygdrive/c/Program\ Files/Wireshark/tshark \
    -f "port $nfsv4port" -d "tcp.port==${nfsv4port},rpc" -i Ethernet0
  ---- snip ----

  If you are running inside a VMware VM on a Linux host it
  might require $ chmod a+rw /dev/vmnet0 # on VMware host, so that
  the VM can use "Promiscuous Mode".

----

Bye,
Roland
--
  __ .  . __
 (o.\ \/ /.o) roland DOT mainz AT nrubsig DOT org
  \__\/\/__/  MPEG specialist, C&&JAVA&&Sun&&Unix programmer
  /O /==\ O\  TEL +49 641 3992797
 (;O/ \/ \O;)

_______________________________________________
Ms-nfs41-client-devel mailing list
Ms-nfs41-client-devel AT lists DOT sourceforge DOT net
https://lists.sourceforge.net/lists/listinfo/ms-nfs41-client-devel

-- 
Cedric Blancher <cedric DOT blancher AT gmail DOT com>
[https://plus.google.com/u/0/+CedricBlancher/]
Institute Pasteur

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

X-Recipient:	archive-cygwin AT delorie DOT com
DKIM-Filter:	OpenDKIM Filter v2.11.0 sourceware.org 920EB3858297
DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1708881644;
	bh=s6QPK4F07XWtJ/JdFYmiq4ZPioyQzV6/LENKGDvG2oY=;
	h=References:In-Reply-To:Date:Subject:To:List-Id:List-Unsubscribe:
	List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:
	From;
	b=DeWBEmuYjU7ZvaMyWjGDfsP98B9rQPBxy81yIz++AlnersS4EXSbIKcursQHUDZyR
	u720pFwNbLQCcCbnnnKxIW6/kHwnUz69nFc7nGZxSkMqJZHwuZB2ratJnjYiijM4Lv
	Air4qge0/nxezVfftypgl22P5SVzST2JBktJ4dEg=
X-Original-To:	cygwin AT cygwin DOT com
Delivered-To:	cygwin AT cygwin DOT com
DMARC-Filter:	OpenDMARC Filter v1.4.2 sourceware.org 7C24C3858D32
ARC-Filter:	OpenARC Filter v1.0.0 sourceware.org 7C24C3858D32
ARC-Seal:	i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1708881619; cv=none;
	b=GutPoaC4heVik/6fWtFshg81IS9o03qobxOi31DcvDfT4E09ah7Ch71luVAS/hGKTOxwQwYS2elT1VhRnJ6aLjCaxC9ULFMGW27T88cJWjzw+vGDIyLt11IWJtHz7PxB74+kHFs+SfP7B2MZcFqVkgFVsfVid6khx97l1v7SQxs=
ARC-Message-Signature:	i=1; a=rsa-sha256; d=sourceware.org; s=key;
	t=1708881619; c=relaxed/simple;
	bh=4rnyNnJccYC5Yvn0j5EvzSfUEoYGIQwTMa+N2BEZT8o=;
	h=DKIM-Signature:MIME-Version:From:Date:Message-ID:Subject:To;
	b=ogiOZyT2ObxgaZz1lDnhgWN7oIsp4A8rZwslNEMx8ybyHIM/VOOzLYOCqN8vTEPODaw81xBxCCDwa8AIJ+xx9SHp1YNidxVl9OMYARmnVWnvt47pyHkblgj2sue/2xg+azZ2d7nB7jF6iuVdGS/R4oqieQW4XwdBPUg7QOq1zkI=
ARC-Authentication-Results:	i=1; server2.sourceware.org
X-Google-DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=1e100.net; s=20230601; t=1708881614; x=1709486414;
	h=to:subject:message-id:date:from:in-reply-to:references:mime-version
	:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
	bh=Fo0cjxNLwt3B8UVpgyngJEqUtUiOhjwRfxj9uIh2iy8=;
	b=Of+m/J0WO5x37arTADtjfy9wgBrq9nfJ1l95E6asBkN46ruBNJ5xNzoPO1WAHbAwi/
	rmrz/3Xe8CtPNeeDd+ifl8WtWvQh6/U9Oi/lON/W0IMCLBGnwarTok/iKijBXzJAGcm3
	9kKa5R7zlLIDKYSV8py2XYOJWDIMOOxTUJJKU/39ls/t3CFrC8tiX6taKtGLC77NKgOl
	AxJ5ucat1q/7SDGzKYeS6H7nUusucw/LjrEP3yJ8JxGo4+Tn0Ct0PTTpNj1D5rVrkuEA
	oDQbfWGEGT7Y0lIo/5flL+a9c23W33+ISWMN+A7cWvd5jXxwIcxdIhhKctXFAcTKu6mj
	aekA==
X-Gm-Message-State:	AOJu0Yx61CNLkgzdBYTGki/6PruFBc8E9RJfsxliezlKA6hJo5QVol/o
	2x47WyMeKjyerR59Cyd6Y3wijjclcZaiR62NfDz6Zfnf8cguEZOP9Nto5Y7IwzuQTyT+N/eST7r
	L6KhLuWBXeOoyaq5W0OpYSnSGpntNbtgw1EM=
X-Google-Smtp-Source:	AGHT+IFiAhWNWOMrtAq/yWbgYlcmHCo9/v8ZtNzVFOqXksX5LJUzBexaEMr+QQiTjCe5Yf9CSonyDKSeOu/anydgeZ0=
X-Received:	by 2002:a05:6402:2045:b0:564:2518:adfd with SMTP id
	bc5-20020a056402204500b005642518adfdmr3697354edb.10.1708881614226; Sun, 25
	Feb 2024 09:20:14 -0800 (PST)
MIME-Version:	1.0
References:	<CAKAoaQmf=XNq-bHKkcU9+K470Qrv8Jq8zzbg7PnxF63cQ2drmA AT mail DOT gmail DOT com>
In-Reply-To:	<CAKAoaQmf=XNq-bHKkcU9+K470Qrv8Jq8zzbg7PnxF63cQ2drmA@mail.gmail.com>
Date:	Sun, 25 Feb 2024 18:19:34 +0100
Message-ID:	<CALXu0UeLTz+Kr5AwUvVQfnyPuDgK3gw8uH7f7zKRZ_fEv+K6jw@mail.gmail.com>
Subject:	Fwd: [Ms-nfs41-client-devel] ANN: NFSv4.1 filesystem client Windows
	driver binaries for Windows 10/11 for testing, 2024-02-24 ...
To:	cygwin AT cygwin DOT com
X-Spam-Status:	No, score=-0.7 required=5.0 tests=BAYES_00, DKIM_SIGNED,
	DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,
	SPF_HELO_NONE, SPF_PASS, TXREP,
	T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version:	SpamAssassin 3.4.6 (2021-04-09) on
	server2.sourceware.org
X-BeenThere:	cygwin AT cygwin DOT com
X-Mailman-Version:	2.1.30
List-Id:	General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Archive:	<https://cygwin.com/pipermail/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe:	<https://cygwin.com/mailman/listinfo/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From:	Cedric Blancher via Cygwin <cygwin AT cygwin DOT com>
Reply-To:	Cedric Blancher <cedric DOT blancher AT gmail DOT com>
Sender:	"Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>

webmaster	delorie software privacy
Copyright � 2019 by DJ Delorie	Updated Jul 2019