Update mountd and nfsd rc.d scripts to use the "-R" option added by r375026

[rmacklem]

Summary

r376026 added a new "-R" option to mountd, which tells it to
not support the Mount protocol (not used by NFSv4) and not
register with rpcbind.
Rpcbind is considered a security issue by some sites now.

This patch adds a new yes/no variable called nfsv4_server_only.
When that is set, make vfs.nfsd.server_min_vers=4 and set "=R"
for mountd.
Setting vfs.nfsd.server_min_vers=4 tells nfsd to not register with rpcbind.

Test Plan

Tested both nfsv4_server_only set to "NO" and "YES".
When set to "YES" everything seemed to work without
rpcbind running.

[0mp]

Seems fine in general, but I've not tested it.

etc/rc.d/mountd

27 ↗

(On Diff #78728)

I was wondering if required_modules=nfsd would work instead but required_modules is processed after precmd...

[rmacklem]

Well, if you are comfortable clicking "reviewed", I've added
you as a Reviewer.

[0mp]

etc/rc.d/mountd

23 ↗

(On Diff #78728)

I wonder if this line is needed. rc_flags seems to be set to ${name}_flags by default.

Test program:

. /etc/rc.subr

name=test
rcvar=test_enable

test_enable=yes

test_flags="1 2 3"

start_precmd="precmd"
command=/bin/echo

precmd() {
    echo rc_flags: "$rc_flags"

}

run_rc_command "$1"

Results;

rc_flags: 1 2 3
Starting test.
1 2 3

48 ↗

(On Diff #78728)

We are overriding rc_flags here. That's probably bad, isn't it?

[rmacklem]

Deleted the assignment of rc_flags as suggested.
I had assumed that nfs_server_enable would be YES
whenever nfsv4_server_only is YES, but that was not correct.

This version handles the case where nfsv4_server_only is YES
and nfs_server_enable is NO.
It also prints out a message when weak_mountd_authentication
and nfsv4_server_only are both YES, noting that
weak_mountd_authentication is being ignored.

[rmacklem]

Marked inline comments as done and added an inline comment.

etc/rc.d/mountd

53 ↗

(On Diff #78792)

Yes, good point. I had assumed that nfs_server_enable would be YES
whenever nfsv4_server_only is YES, but that assumption is not correct.
This version checks for this case and also prints out a message if
both nfsv4_server_only and weak_mountd_authentication are YES.
(weak_mountd_authentication is meaningless if mountd isn't doing
the Mount protocol.)

[0mp]

etc/rc.d/mountd

26 ↗

(On Diff #78792)

Och, BTW, don't we want to exit here if we fail to load? I am not sure if that's already the case.

53 ↗

(On Diff #78792)

Hmm, wait. I might be mistaken, but I think you've addressed a different bug :D

Shouldn't we have rc_flags="${rc_flags} -n" here to preserve flags set by the user?

(But then, this is not part of this revision, so I guess we can address it next time)

[rmacklem]

Add checks for load_kld failing to both mountd and nfsd.
To be honest, nfsd has never had the check and, since
both /usr/sbin/mountd and /usr/sbin/nfsd do check for
nfsd.ko being loaded, checking in the rc.d script isn't
critical, I think?

[0mp]

In D26938#605434, @rmacklem wrote:

Add checks for load_kld failing to both mountd and nfsd.
To be honest, nfsd has never had the check and, since
both /usr/sbin/mountd and /usr/sbin/nfsd do check for
nfsd.ko being loaded, checking in the rc.d script isn't
critical, I think?

True, I didn't know about it. It's probably better to fail as soon as possible anyway.

I think I've got no further comments regarding this revision :)

BTW, we should probably mention in the commit message why we add tlsclntd tlsservd.

[rmacklem]

Oops, change specific to NFS over TLS slipped into last version.

[rmacklem]

Updated to remove change that is specific to NFS over TLS that
slipped into previous revision.