Skip to content

turbonfs: remove GnuTLS dependency, non-TLS only - #320

Open
pragyagandhi wants to merge 4 commits into
mainfrom
personal/pragyagandhi/removegnutlsdep
Open

turbonfs: remove GnuTLS dependency, non-TLS only#320
pragyagandhi wants to merge 4 commits into
mainfrom
personal/pragyagandhi/removegnutlsdep

Conversation

@pragyagandhi

@pragyagandhi pragyagandhi commented Jul 20, 2026

Copy link
Copy Markdown
Collaborator

Summary

Remove the GnuTLS dependency from the turbonfs build so builds are not blocked on distros
where gnutls is not an allowed package (e.g. Azure Linux). The only supported transport is
non-TLS (xprtsec=none), and AZAUTH (AzAuthNone) is always sent as the first RPC over that
non-TLS connection.

This is the turbonfs/packaging side. The corresponding libnfs changes are in
linuxsmiths/libnfs#39.

Changes

  • turbonfs/CMakeLists.txt
    • Drop find_package(GnuTLS) and the static gnutls linking
      (libgnutls/hogweed/nettle/tasn1/idn2/gmp/p11-kit/unistring) — the binary no
      longer links gnutls.
    • Default ENABLE_INSECURE_AUTH_FOR_DEVTEST to ON.
  • turbonfs/inc/util.h: is_valid_xprtsec() accepts only none.
  • turbonfs/build.sh, package.sh, generate_package.sh: set
    INSECURE_AUTH_FOR_DEVTEST=ON for all build types (not just Debug).

Why the flag is required for all builds

libnfs now has TLS removed, so AZAUTH is always sent over the non-TLS connection. That path is
gated by ENABLE_INSECURE_AUTH_FOR_DEVTEST, and libnfs bails out (static gate) if it is
disabled. Hence turbonfs must enable it for every build type — previously it was Debug-only.

Runtime flow

sequenceDiagram
    participant C as aznfsclient (turbonfs)
    participant L as libnfs
    participant S as Blob NFS server (:2048)
    C->>L: nfs_set_auth_context(authtype=AzAuthNone) -> use_azauth=TRUE
    C->>L: nfs_mount()
    L->>S: TCP connect (non-TLS)
    L->>S: AZAUTH RPC (AzAuthNone)  (always first, over non-TLS)
    alt server has AzAuth enabled
        S-->>L: AZAUTH OK
        L->>S: MOUNT / NFS ops
        S-->>C: mounted (or MNT3ERR_NOENT if container missing)
    else server without AzAuth
        S-->>L: no response / reject
        L-->>C: "AzAuth not enabled/setup on server" diagnostic
    end
Loading

Testing

  • Full turbonfs build succeeds; aznfsclient links no gnutls
    (ldd shows only libuuid/libm/libc).
  • AzAuth-enabled account: AzAuthNone accepted, proceeds to MOUNT (server responds).
  • Non-AzAuth account: AZAUTH fails fast with a clear diagnostic.

Depends on linuxsmiths/libnfs#39 (submodule pointer bump to be done once that merges).

Remove the GnuTLS dependency from the turbonfs build so builds are not
blocked on distros where gnutls is not an allowed package (e.g. Azure
Linux). Only the non-TLS transport (xprtsec=none) is supported.

- turbonfs/CMakeLists.txt: drop find_package(GnuTLS) and the static
  gnutls library linking (libgnutls/hogweed/nettle/tasn1/idn2/gmp/
  p11-kit/unistring); the binary no longer links gnutls.
- turbonfs/inc/util.h: is_valid_xprtsec() accepts only "none".
- turbonfs/sample-turbo-config.yaml: sample share details.

Note: the corresponding libnfs submodule changes are proposed separately
in linuxsmiths/libnfs; the submodule pointer bump is intentionally not
included in this change.
Comment thread turbonfs/sample-turbo-config.yaml
Comment thread turbonfs/sample-turbo-config.yaml
Ubuntu added 3 commits August 12, 2026 06:22
TLS support (and the GnuTLS dependency) has been removed from libnfs, so
AZAUTH is always sent over the non-TLS connection. libnfs now requires
ENABLE_INSECURE_AUTH_FOR_DEVTEST to be enabled (it bails out otherwise),
so enable it for all build types instead of only Debug.

- turbonfs/build.sh, package.sh, generate_package.sh: set
  INSECURE_AUTH_FOR_DEVTEST=ON for the non-Debug (Release) builds too.
- turbonfs/CMakeLists.txt: default the option to ON.
RPC-with-TLS support (and its GnuTLS dependency) was removed and
is_valid_xprtsec() now accepts only "none", so update the docs/comments
that still advertised "tls"/"mtls" as valid values:
- sample-turbo-config.yaml: xprtsec doc.
- nfs_internal.h, aznfsc.h: xprtsec comments.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants