Bug 1231366

Summary: NFS Authentication Performance Issue
Product: [Community] GlusterFS Reporter: Shreyas Siravara <sshreyas>
Component: nfsAssignee: Niels de Vos <ndevos>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: high Docs Contact:
Priority: unspecified    
Version: 3.7.1CC: bugs, gluster-bugs, ndevos, sshreyas
Target Milestone: ---Keywords: Patch
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: glusterfs-3.7.2 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-06-20 09:51:10 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1232165    
Bug Blocks: 1227206    
Attachments:
Description Flags
Suggested patch for bug none

Description Shreyas Siravara 2015-06-12 20:09:10 UTC 
Description of problem:
When file operations are sent to the NFS server, authorized filehandles are cached
using the exportid, mountid, gfid and host as the key to the cache. This meant that any file OR directory will always fail on the *first* fop to that filehandle since the
cache used the gfid as part of the key to the cache. However, if an export is authorized, this effectively means that ALL subdirectories and files in the export directory are authorized per the permissions of the export. This results slow times to walking a directory structure over an NFS mount.

Version-Release number of selected component (if applicable): 3.7.1


How reproducible: Turn on authentication, make a large netgroups file and walk the directory


Steps to Reproduce:
1. Make a large netgroups file, create an export and assign the netgroup to that export
2. GDB and break on is_nfs_fh_cached, and you'll see many cache misses
3. Walk the filesystem and notice slower than expected performance

Actual results: Many misses in the auth cache, resulting in slower walks of the filesystem


Expected results: More hits in the auth cache, resulting in faster walks of the filesystem.


Additional info:
Comment 1 Shreyas Siravara 2015-06-12 20:17:32 UTC 
Created attachment 1038139 [details]
Suggested patch for bug
Comment 2 Anand Avati 2015-06-16 13:13:33 UTC 
REVIEW: http://review.gluster.org/11256 (nfs: Authentication performance improvements) posted (#1) for review on release-3.7 by Niels de Vos (ndevos)
Comment 3 Anand Avati 2015-06-17 02:04:07 UTC 
COMMIT: http://review.gluster.org/11256 committed in release-3.7 by Kaleb KEITHLEY (kkeithle) 
------
commit 7d6351fa2a3ade7fa55d13f79fd576e048e44a8b
Author: Shreyas Siravara <sshreyas>
Date:   Fri Jun 12 13:11:35 2015 -0700

    nfs: Authentication performance improvements
    
    When file operations are sent to the NFS server, authorized filehandles
    are cached using the exportid, mountid, gfid and host as the key to the
    cache. This meant that any file OR directory will always fail on the
    *first* fop to that filehandle since the cache used the gfid as part of
    the key to the cache. However, if an export is authorized, this
    effectively means that ALL subdirectories and files in the export
    directory are authorized per the permissions of the export. This results
    slow times to walking a directory structure over an NFS mount.
    
    Cherry picked from commit a9f58cd6cfc29a47af868fff29ce3133b9f9efe5)
    > Change-Id: Iad811ad7255b454d1712e75a637478401d40791e
    > BUG: 1232165
    > Signed-off-by: Shreyas Siravara <sshreyas>
    > Signed-off-by: Niels de Vos <ndevos>
    > Reviewed-on: http://review.gluster.org/11245
    > Reviewed-by: jiffin tony Thottan <jthottan>
    > Reviewed-by: Kaleb KEITHLEY <kkeithle>
    > Tested-by: Gluster Build System <jenkins.com>
    
    Change-Id: Iad811ad7255b454d1712e75a637478401d40791e
    BUG: 1231366
    Signed-off-by: Shreyas Siravara <sshreyas>
    Signed-off-by: Niels de Vos <ndevos>
    Reviewed-on: http://review.gluster.org/11256
    Reviewed-by: jiffin tony Thottan <jthottan>
    Tested-by: Gluster Build System <jenkins.com>
    Reviewed-by: Kaleb KEITHLEY <kkeithle>
Comment 4 Niels de Vos 2015-06-20 09:51:10 UTC 
This bug is getting closed because a release has been made available that should address the reported issue. In case the problem is still not fixed with glusterfs-3.7.2, please reopen this bug report.

glusterfs-3.7.2 has been announced on the Gluster Packaging mailinglist [1], packages for several distributions should become available in the near future. Keep an eye on the Gluster Users mailinglist [2] and the update infrastructure for your distribution.

[1] http://www.gluster.org/pipermail/packaging/2015-June/000006.html
[2] http://thread.gmane.org/gmane.comp.file-systems.gluster.user