turbonfs: remove GnuTLS dependency, non-TLS only - #320
Open
pragyagandhi wants to merge 4 commits into
Open
Conversation
Remove the GnuTLS dependency from the turbonfs build so builds are not blocked on distros where gnutls is not an allowed package (e.g. Azure Linux). Only the non-TLS transport (xprtsec=none) is supported. - turbonfs/CMakeLists.txt: drop find_package(GnuTLS) and the static gnutls library linking (libgnutls/hogweed/nettle/tasn1/idn2/gmp/ p11-kit/unistring); the binary no longer links gnutls. - turbonfs/inc/util.h: is_valid_xprtsec() accepts only "none". - turbonfs/sample-turbo-config.yaml: sample share details. Note: the corresponding libnfs submodule changes are proposed separately in linuxsmiths/libnfs; the submodule pointer bump is intentionally not included in this change.
palashvij-msft
approved these changes
Jul 28, 2026
added 3 commits
August 12, 2026 06:22
TLS support (and the GnuTLS dependency) has been removed from libnfs, so AZAUTH is always sent over the non-TLS connection. libnfs now requires ENABLE_INSECURE_AUTH_FOR_DEVTEST to be enabled (it bails out otherwise), so enable it for all build types instead of only Debug. - turbonfs/build.sh, package.sh, generate_package.sh: set INSECURE_AUTH_FOR_DEVTEST=ON for the non-Debug (Release) builds too. - turbonfs/CMakeLists.txt: default the option to ON.
RPC-with-TLS support (and its GnuTLS dependency) was removed and is_valid_xprtsec() now accepts only "none", so update the docs/comments that still advertised "tls"/"mtls" as valid values: - sample-turbo-config.yaml: xprtsec doc. - nfs_internal.h, aznfsc.h: xprtsec comments.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remove the GnuTLS dependency from the turbonfs build so builds are not blocked on distros
where gnutls is not an allowed package (e.g. Azure Linux). The only supported transport is
non-TLS (
xprtsec=none), and AZAUTH (AzAuthNone) is always sent as the first RPC over thatnon-TLS connection.
This is the turbonfs/packaging side. The corresponding libnfs changes are in
linuxsmiths/libnfs#39.
Changes
find_package(GnuTLS)and the static gnutls linking(
libgnutls/hogweed/nettle/tasn1/idn2/gmp/p11-kit/unistring) — the binary nolonger links gnutls.
ENABLE_INSECURE_AUTH_FOR_DEVTESTto ON.is_valid_xprtsec()accepts onlynone.INSECURE_AUTH_FOR_DEVTEST=ONfor all build types (not just Debug).Why the flag is required for all builds
libnfs now has TLS removed, so AZAUTH is always sent over the non-TLS connection. That path is
gated by
ENABLE_INSECURE_AUTH_FOR_DEVTEST, and libnfs bails out (static gate) if it isdisabled. Hence turbonfs must enable it for every build type — previously it was Debug-only.
Runtime flow
sequenceDiagram participant C as aznfsclient (turbonfs) participant L as libnfs participant S as Blob NFS server (:2048) C->>L: nfs_set_auth_context(authtype=AzAuthNone) -> use_azauth=TRUE C->>L: nfs_mount() L->>S: TCP connect (non-TLS) L->>S: AZAUTH RPC (AzAuthNone) (always first, over non-TLS) alt server has AzAuth enabled S-->>L: AZAUTH OK L->>S: MOUNT / NFS ops S-->>C: mounted (or MNT3ERR_NOENT if container missing) else server without AzAuth S-->>L: no response / reject L-->>C: "AzAuth not enabled/setup on server" diagnostic endTesting
aznfsclientlinks no gnutls(
lddshows only libuuid/libm/libc).