Merge lp:~stgraber/ubuntu/saucy/nfs-utils/debian-merge into lp:debian/nfs-utils

[Stéphane Graber]

Merge for nfs-utils, confirmed to build properly on amd64.

Unmerged revisions

72. By Stéphane Graber on 2013-05-24

Merge from Debian

71. By Steve Langasek on 2012-10-10

restore bug reference

70. By Stéphane Graber on 2012-09-28

[ Steve Langasek ]
* Adjust upstart jobs to treat TYPE=nfs and TYPE=nfs4 mounts identically,
  since TYPE=nfs4 is considered deprecated.
* Fix various boot-time race conditions between mountall and nfs-utils by
  moving handling of the 'mounting' events to separate gssd-mounting and
  idmapd-mounting jobs. Requires mountall 2.41 or better to avoid deadlock
  on boot. LP: #643289, LP: #611397.
* Fix the stop conditions: never stop on 'runlevel [06]' since that gives
  the system no time to cleanly unmount nfs mounts; instead, stop only on
  the unmounted-remote-filesystems event.
* Newer versions of gssd don't talk to portmap, so don't make the upstart
  job depend on it.
* Add an instance to statd-mounting, and change it to just wait for statd
  instead of trying to trigger it potentially out of order. This also means
  we don't need to try to force portmap to start from statd.

[ Matthew L. Dailey ]
* Add "-e" (ticket expiry is error) option to rpc.gssd to prevent hangs due
  to EKEYEXPIRED error from kernel on ticket expiry. LP: #794112

69. By Steve Langasek on 2012-09-11

document bug closure

68. By Steve Langasek on 2012-09-09

document bug closures

67. By Steve Langasek on 2012-09-09

Since the -mounting jobs no longer try to start gssd/statd, anything that would
make these services exit without respawning must also cause our -mounting job
to exit.

66. By Steve Langasek on 2012-09-09

Add an instance to statd-mounting, and change it to just wait for statd
instead of trying to trigger it potentially out of order. This also means
we don't need to try to force portmap to start from statd.

65. By Steve Langasek on 2012-09-09

Newer versions of gssd don't talk to portmap, so don't make the upstart
job depend on it.

64. By Steve Langasek on 2012-09-09

Put the mountall dep on the right package

63. By Steve Langasek on 2012-09-09

Fix the stop conditions: never stop on 'runlevel [06]' since that gives
the system no time to cleanly unmount nfs mounts; instead, stop only on
the unmounted-remote-filesystems event.

=== added directory '.pc/19-iscsiadm-path.patch'
=== removed directory '.pc/19-iscsiadm-path.patch'
=== added directory '.pc/19-iscsiadm-path.patch/utils'
=== removed directory '.pc/19-iscsiadm-path.patch/utils'
=== added directory '.pc/19-iscsiadm-path.patch/utils/osd_login'
=== removed directory '.pc/19-iscsiadm-path.patch/utils/osd_login'
=== added file '.pc/19-iscsiadm-path.patch/utils/osd_login/osd_login'
--- .pc/19-iscsiadm-path.patch/utils/osd_login/osd_login	1970-01-01 00:00:00 +0000
+++ .pc/19-iscsiadm-path.patch/utils/osd_login/osd_login	2013-05-24 21:14:25 +0000
@@ -0,0 +1,118 @@
+#!/bin/bash
+#
+# osd_login : This script is part of the autologin feature
+#             mandated by the pnfs-objects standard.
+# It is called from objlayoutdriver.ko in the kernel.
+
+# Copyright (C) 2012, Sachin Bhamare <[e-mail]>
+# Copyright (C) 2012, Boaz Harrosh <[e-mail]>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+# MA 02110-1301 USA
+
+umask 022
+
+PATH="/sbin:/usr/sbin:/bin:/usr/bin"
+
+iscsiadm=/sbin/iscsiadm
+
+PARENT_PID=$BASHPID
+WATCHDOG_TIMEOUT=15
+
+protocol=""
+portal=""
+uri=""
+osdname=""
+systemid=""
+
+usage()
+{
+	echo "Usage: $0 -u <URI> -o <OSDNAME> -s <SYSTEMID>"
+	echo "Options:"
+	echo  "-u		target uri e.g. iscsi://<ip>:<port>"
+	echo  "-o		osdname of the target OSD"
+	echo  "-s		systemid of the target OSD"
+}
+
+parse_cmdline()
+{
+	argc=$#
+	if [ $# -lt 3 ]; then
+		usage
+		exit 1
+	fi
+
+	# parse the input arguments
+	while getopts "u:o:s:" options; do
+	    case $options in
+		u ) uri=$OPTARG;;
+		o ) osdname=$OPTARG;;
+		s ) systemid=$OPTARG;;
+		\? ) usage
+			exit 1;;
+		* )  usage
+			exit 1;;
+	    esac
+	done
+
+	echo "-u : $uri"
+	echo "-o : $osdname"
+	echo "-s : $systemid"
+
+	protocol=`echo $uri | awk -F ':' '{print $1}'`
+	portal=`echo $uri | awk -F '//' '{print $2}'`
+}
+
+watchdog()
+{
+	timeout=$1
+	portal=$2
+
+	sleep $timeout
+	if kill -9 $PARENT_PID; then
+	    echo "watchdog : Timed out (>$timeout seconds) while login into $portal" | logger -t "osd_login"
+	fi
+	echo "watchdog: exiting .."
+	exit 2
+}
+
+login_iscsi_osd()
+{
+	echo "login into: $1"
+	if ! $iscsiadm -m discovery -o nonpersistent -t sendtargets -p $1 --login; then
+		echo "$iscsiadm -m discovery -t sendtargets -p $1 --login returned error $? !"
+		sleep 1;
+	fi
+}
+
+echo "============= osd_login ========="
+echo "progname : $0"
+parse_cmdline "$@"
+echo "protocol: $protocol"
+echo "portal: $portal"
+
+watchdog $WATCHDOG_TIMEOUT $portal &
+watchdog_pid=$!
+
+case $protocol in
+iscsi)
+	login_iscsi_osd $portal |& logger -t "osd_login"
+	;;
+*)
+	echo "Error: protocol $protocol not supported !" | logger -t "osd_login"
+	;;
+esac
+
+kill -9 $watchdog_pid
+exit 0

=== removed file '.pc/19-iscsiadm-path.patch/utils/osd_login/osd_login'
--- .pc/19-iscsiadm-path.patch/utils/osd_login/osd_login	2012-05-25 20:41:58 +0000
+++ .pc/19-iscsiadm-path.patch/utils/osd_login/osd_login	1970-01-01 00:00:00 +0000
@@ -1,118 +0,0 @@
-#!/bin/bash
-#
-# osd_login : This script is part of the autologin feature
-#             mandated by the pnfs-objects standard.
-# It is called from objlayoutdriver.ko in the kernel.
-
-# Copyright (C) 2012, Sachin Bhamare <[e-mail]>
-# Copyright (C) 2012, Boaz Harrosh <[e-mail]>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-# MA 02110-1301 USA
-
-umask 022
-
-PATH="/sbin:/usr/sbin:/bin:/usr/bin"
-
-iscsiadm=/sbin/iscsiadm
-
-PARENT_PID=$BASHPID
-WATCHDOG_TIMEOUT=15
-
-protocol=""
-portal=""
-uri=""
-osdname=""
-systemid=""
-
-usage()
-{
-	echo "Usage: $0 -u <URI> -o <OSDNAME> -s <SYSTEMID>"
-	echo "Options:"
-	echo  "-u		target uri e.g. iscsi://<ip>:<port>"
-	echo  "-o		osdname of the target OSD"
-	echo  "-s		systemid of the target OSD"
-}
-
-parse_cmdline()
-{
-	argc=$#
-	if [ $# -lt 3 ]; then
-		usage
-		exit 1
-	fi
-
-	# parse the input arguments
-	while getopts "u:o:s:" options; do
-	    case $options in
-		u ) uri=$OPTARG;;
-		o ) osdname=$OPTARG;;
-		s ) systemid=$OPTARG;;
-		\? ) usage
-			exit 1;;
-		* )  usage
-			exit 1;;
-	    esac
-	done
-
-	echo "-u : $uri"
-	echo "-o : $osdname"
-	echo "-s : $systemid"
-
-	protocol=`echo $uri | awk -F ':' '{print $1}'`
-	portal=`echo $uri | awk -F '//' '{print $2}'`
-}
-
-watchdog()
-{
-	timeout=$1
-	portal=$2
-
-	sleep $timeout
-	if kill -9 $PARENT_PID; then
-	    echo "watchdog : Timed out (>$timeout seconds) while login into $portal" | logger -t "osd_login"
-	fi
-	echo "watchdog: exiting .."
-	exit 2
-}
-
-login_iscsi_osd()
-{
-	echo "login into: $1"
-	if ! $iscsiadm -m discovery -o nonpersistent -t sendtargets -p $1 --login; then
-		echo "$iscsiadm -m discovery -t sendtargets -p $1 --login returned error $? !"
-		sleep 1;
-	fi
-}
-
-echo "============= osd_login ========="
-echo "progname : $0"
-parse_cmdline "$@"
-echo "protocol: $protocol"
-echo "portal: $portal"
-
-watchdog $WATCHDOG_TIMEOUT $portal &
-watchdog_pid=$!
-
-case $protocol in
-iscsi)
-	login_iscsi_osd $portal |& logger -t "osd_login"
-	;;
-*)
-	echo "Error: protocol $protocol not supported !" | logger -t "osd_login"
-	;;
-esac
-
-kill -9 $watchdog_pid
-exit 0

=== added directory '.pc/20-remove-autogenerated-man.patch'
=== removed directory '.pc/20-remove-autogenerated-man.patch'
=== added directory '.pc/20-remove-autogenerated-man.patch/utils'
=== removed directory '.pc/20-remove-autogenerated-man.patch/utils'
=== added directory '.pc/20-remove-autogenerated-man.patch/utils/nfsdcltrack'
=== removed directory '.pc/20-remove-autogenerated-man.patch/utils/nfsdcltrack'
=== added file '.pc/20-remove-autogenerated-man.patch/utils/nfsdcltrack/nfsdcltrack.man'
--- .pc/20-remove-autogenerated-man.patch/utils/nfsdcltrack/nfsdcltrack.man	1970-01-01 00:00:00 +0000
+++ .pc/20-remove-autogenerated-man.patch/utils/nfsdcltrack/nfsdcltrack.man	2013-05-24 21:14:25 +0000
@@ -0,0 +1,211 @@
+.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16)
+.\"
+.\" Standard preamble:
+.\" ========================================================================
+.de Sp \" Vertical space (when we can't use .PP)
+.if t .sp .5v
+.if n .sp
+..
+.de Vb \" Begin verbatim text
+.ft CW
+.nf
+.ne \\$1
+..
+.de Ve \" End verbatim text
+.ft R
+.fi
+..
+.\" Set up some character translations and predefined strings.  \*(-- will
+.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
+.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
+.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
+.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
+.\" nothing in troff, for use with C<>.
+.tr \(*W-
+.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
+.ie n \{\
+.    ds -- \(*W-
+.    ds PI pi
+.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
+.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
+.    ds L" ""
+.    ds R" ""
+.    ds C` ""
+.    ds C' ""
+'br\}
+.el\{\
+.    ds -- \|\(em\|
+.    ds PI \(*p
+.    ds L" ``
+.    ds R" ''
+'br\}
+.\"
+.\" Escape single quotes in literal strings from groff's Unicode transform.
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.\"
+.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
+.\" entries marked with X<> in POD.  Of course, you'll have to process the
+.\" output yourself in some meaningful fashion.
+.ie \nF \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
+..
+.    nr % 0
+.    rr F
+.\}
+.el \{\
+.    de IX
+..
+.\}
+.\"
+.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
+.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
+.    \" fudge factors for nroff and troff
+.if n \{\
+.    ds #H 0
+.    ds #V .8m
+.    ds #F .3m
+.    ds #[ \f1
+.    ds #] \fP
+.\}
+.if t \{\
+.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
+.    ds #V .6m
+.    ds #F 0
+.    ds #[ \&
+.    ds #] \&
+.\}
+.    \" simple accents for nroff and troff
+.if n \{\
+.    ds ' \&
+.    ds ` \&
+.    ds ^ \&
+.    ds , \&
+.    ds ~ ~
+.    ds /
+.\}
+.if t \{\
+.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
+.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
+.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
+.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
+.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
+.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
+.\}
+.    \" troff and (daisy-wheel) nroff accents
+.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
+.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
+.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
+.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
+.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
+.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
+.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
+.ds ae a\h'-(\w'a'u*4/10)'e
+.ds Ae A\h'-(\w'A'u*4/10)'E
+.    \" corrections for vroff
+.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
+.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
+.    \" for low resolution devices (crt and lpr)
+.if \n(.H>23 .if \n(.V>19 \
+\{\
+.    ds : e
+.    ds 8 ss
+.    ds o a
+.    ds d- d\h'-1'\(ga
+.    ds D- D\h'-1'\(hy
+.    ds th \o'bp'
+.    ds Th \o'LP'
+.    ds ae ae
+.    ds Ae AE
+.\}
+.rm #[ #] #H #V #F C
+.\" ========================================================================
+.\"
+.IX Title "NFSDCLTRACK 8"
+.TH NFSDCLTRACK 8 "2012-10-24" "" ""
+.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
+.\" way too many mistakes in technical documents.
+.if n .ad l
+.nh
+.SH "NAME"
+nfsdcltrack \- NFSv4 Client Tracking Callout Program
+.SH "SYNOPSIS"
+.IX Header "SYNOPSIS"
+nfsdcltrack [\-d] [\-f] [\-s stable storage dir] <command> <args...>
+.SH "DESCRIPTION"
+.IX Header "DESCRIPTION"
+nfsdcltack is the NFSv4 client tracking callout program. It is not necessary
+to install this daemon on machines that are not acting as NFSv4 servers.
+.PP
+When a network partition is combined with a server reboot, there are
+edge conditions that can cause the server to grant lock reclaims when
+other clients have taken conflicting locks in the interim. A more detailed
+explanation of this issue is described in \s-1RFC\s0 3530, section 8.6.3.
+.PP
+In order to prevent these problems, the server must track a small amount
+of per-client information on stable storage. This program provides the
+userspace piece of that functionality. When the kernel needs to manipulate
+the database that stores this info, it will execute this program to handle
+it.
+.SH "OPTIONS"
+.IX Header "OPTIONS"
+.IP "\fB\-d\fR, \fB\-\-debug\fR" 4
+.IX Item "-d, --debug"
+Enable debug level logging.
+.IP "\fB\-f\fR, \fB\-\-foreground\fR" 4
+.IX Item "-f, --foreground"
+Log to stderr instead of syslog.
+.IP "\fB\-s\fR \fIstoragedir\fR, \fB\-\-storagedir\fR=\fIstorage_dir\fR" 4
+.IX Item "-s storagedir, --storagedir=storage_dir"
+Directory where stable storage information should be kept. The default
+value is \fI/var/lib/nfs/nfsdcltrack\fR.
+.SH "COMMANDS"
+.IX Header "COMMANDS"
+nfsdcltrack requires a command for each invocation. Supported commands
+are:
+.IP "\fBinit\fR" 4
+.IX Item "init"
+Initialize the database. This command requires no argument.
+.IP "\fBcreate\fR" 4
+.IX Item "create"
+Create a new client record (or update the timestamp on an existing one). This command requires a hex-encoded nfs_client_id4 as an argument.
+.IP "\fBremove\fR" 4
+.IX Item "remove"
+Remove a client record from the database. This command requires a hex-encoded nfs_client_id4 as an argument.
+.IP "\fBcheck\fR" 4
+.IX Item "check"
+Check to see if a nfs_client_id4 is allowed to reclaim. This command requires a hex-encoded nfs_client_id4 as an argument.
+.IP "\fBgracedone\fR" 4
+.IX Item "gracedone"
+Remove any unreclaimed client records from the database. This command requires a epoch boot time as an argument.
+.SH "LEGACY TRANSITION MECHANISM"
+.IX Header "LEGACY TRANSITION MECHANISM"
+The Linux kernel NFSv4 server has historically tracked this information
+on stable storage by manipulating information on the filesystem
+directly, in the directory to which \fI/proc/fs/nfsd/nfsv4recoverydir\fR
+points. If the kernel passes the correct information, then nfsdcltrack
+can use it to allow a seamless transition from the old client tracking
+scheme to the new one.
+.PP
+On a \fBcheck\fR operation, if there is no record of the client in the
+database, nfsdcltrack will look to see if the \fB\s-1NFSDCLTRACK_LEGACY_RECDIR\s0\fR
+environment variable is set. If it is, then it will fetch that value and
+see if a directory exists by that name. If it does, then the check
+operation will succeed and the directory will be removed.
+.PP
+On a \fBgracedone\fR operation, nfsdcltrack will look to see if the
+\&\fB\s-1NFSDCLTRACK_LEGACY_TOPDIR\s0\fR environment variable is set. If it is, then
+it will attempt to clean out that directory prior to exiting.
+.PP
+Note that this transition is one-way. If the machine subsequently reboots
+back into an older kernel that does not support the nfsdcltrack upcall
+then the clients will not be able to recover their state.
+.SH "NOTES"
+.IX Header "NOTES"
+This program requires a kernel that supports the nfsdcltrack usermodehelper
+upcall. This support was first added to mainline kernels in 3.8.
+.SH "AUTHORS"
+.IX Header "AUTHORS"
+nfsdcltrack was developed by Jeff Layton <[e-mail]>.

=== removed file '.pc/20-remove-autogenerated-man.patch/utils/nfsdcltrack/nfsdcltrack.man'
--- .pc/20-remove-autogenerated-man.patch/utils/nfsdcltrack/nfsdcltrack.man	2013-05-14 00:46:42 +0000
+++ .pc/20-remove-autogenerated-man.patch/utils/nfsdcltrack/nfsdcltrack.man	1970-01-01 00:00:00 +0000
@@ -1,211 +0,0 @@
-.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16)
-.\"
-.\" Standard preamble:
-.\" ========================================================================
-.de Sp \" Vertical space (when we can't use .PP)
-.if t .sp .5v
-.if n .sp
-..
-.de Vb \" Begin verbatim text
-.ft CW
-.nf
-.ne \\$1
-..
-.de Ve \" End verbatim text
-.ft R
-.fi
-..
-.\" Set up some character translations and predefined strings.  \*(-- will
-.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
-.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
-.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
-.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
-.\" nothing in troff, for use with C<>.
-.tr \(*W-
-.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
-.ie n \{\
-.    ds -- \(*W-
-.    ds PI pi
-.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
-.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
-.    ds L" ""
-.    ds R" ""
-.    ds C` ""
-.    ds C' ""
-'br\}
-.el\{\
-.    ds -- \|\(em\|
-.    ds PI \(*p
-.    ds L" ``
-.    ds R" ''
-'br\}
-.\"
-.\" Escape single quotes in literal strings from groff's Unicode transform.
-.ie \n(.g .ds Aq \(aq
-.el       .ds Aq '
-.\"
-.\" If the F register is turned on, we'll generate index entries on stderr for
-.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
-.\" entries marked with X<> in POD.  Of course, you'll have to process the
-.\" output yourself in some meaningful fashion.
-.ie \nF \{\
-.    de IX
-.    tm Index:\\$1\t\\n%\t"\\$2"
-..
-.    nr % 0
-.    rr F
-.\}
-.el \{\
-.    de IX
-..
-.\}
-.\"
-.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
-.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
-.    \" fudge factors for nroff and troff
-.if n \{\
-.    ds #H 0
-.    ds #V .8m
-.    ds #F .3m
-.    ds #[ \f1
-.    ds #] \fP
-.\}
-.if t \{\
-.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
-.    ds #V .6m
-.    ds #F 0
-.    ds #[ \&
-.    ds #] \&
-.\}
-.    \" simple accents for nroff and troff
-.if n \{\
-.    ds ' \&
-.    ds ` \&
-.    ds ^ \&
-.    ds , \&
-.    ds ~ ~
-.    ds /
-.\}
-.if t \{\
-.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
-.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
-.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
-.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
-.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
-.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
-.\}
-.    \" troff and (daisy-wheel) nroff accents
-.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
-.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
-.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
-.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
-.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
-.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
-.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
-.ds ae a\h'-(\w'a'u*4/10)'e
-.ds Ae A\h'-(\w'A'u*4/10)'E
-.    \" corrections for vroff
-.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
-.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
-.    \" for low resolution devices (crt and lpr)
-.if \n(.H>23 .if \n(.V>19 \
-\{\
-.    ds : e
-.    ds 8 ss
-.    ds o a
-.    ds d- d\h'-1'\(ga
-.    ds D- D\h'-1'\(hy
-.    ds th \o'bp'
-.    ds Th \o'LP'
-.    ds ae ae
-.    ds Ae AE
-.\}
-.rm #[ #] #H #V #F C
-.\" ========================================================================
-.\"
-.IX Title "NFSDCLTRACK 8"
-.TH NFSDCLTRACK 8 "2012-10-24" "" ""
-.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
-.\" way too many mistakes in technical documents.
-.if n .ad l
-.nh
-.SH "NAME"
-nfsdcltrack \- NFSv4 Client Tracking Callout Program
-.SH "SYNOPSIS"
-.IX Header "SYNOPSIS"
-nfsdcltrack [\-d] [\-f] [\-s stable storage dir] <command> <args...>
-.SH "DESCRIPTION"
-.IX Header "DESCRIPTION"
-nfsdcltack is the NFSv4 client tracking callout program. It is not necessary
-to install this daemon on machines that are not acting as NFSv4 servers.
-.PP
-When a network partition is combined with a server reboot, there are
-edge conditions that can cause the server to grant lock reclaims when
-other clients have taken conflicting locks in the interim. A more detailed
-explanation of this issue is described in \s-1RFC\s0 3530, section 8.6.3.
-.PP
-In order to prevent these problems, the server must track a small amount
-of per-client information on stable storage. This program provides the
-userspace piece of that functionality. When the kernel needs to manipulate
-the database that stores this info, it will execute this program to handle
-it.
-.SH "OPTIONS"
-.IX Header "OPTIONS"
-.IP "\fB\-d\fR, \fB\-\-debug\fR" 4
-.IX Item "-d, --debug"
-Enable debug level logging.
-.IP "\fB\-f\fR, \fB\-\-foreground\fR" 4
-.IX Item "-f, --foreground"
-Log to stderr instead of syslog.
-.IP "\fB\-s\fR \fIstoragedir\fR, \fB\-\-storagedir\fR=\fIstorage_dir\fR" 4
-.IX Item "-s storagedir, --storagedir=storage_dir"
-Directory where stable storage information should be kept. The default
-value is \fI/var/lib/nfs/nfsdcltrack\fR.
-.SH "COMMANDS"
-.IX Header "COMMANDS"
-nfsdcltrack requires a command for each invocation. Supported commands
-are:
-.IP "\fBinit\fR" 4
-.IX Item "init"
-Initialize the database. This command requires no argument.
-.IP "\fBcreate\fR" 4
-.IX Item "create"
-Create a new client record (or update the timestamp on an existing one). This command requires a hex-encoded nfs_client_id4 as an argument.
-.IP "\fBremove\fR" 4
-.IX Item "remove"
-Remove a client record from the database. This command requires a hex-encoded nfs_client_id4 as an argument.
-.IP "\fBcheck\fR" 4
-.IX Item "check"
-Check to see if a nfs_client_id4 is allowed to reclaim. This command requires a hex-encoded nfs_client_id4 as an argument.
-.IP "\fBgracedone\fR" 4
-.IX Item "gracedone"
-Remove any unreclaimed client records from the database. This command requires a epoch boot time as an argument.
-.SH "LEGACY TRANSITION MECHANISM"
-.IX Header "LEGACY TRANSITION MECHANISM"
-The Linux kernel NFSv4 server has historically tracked this information
-on stable storage by manipulating information on the filesystem
-directly, in the directory to which \fI/proc/fs/nfsd/nfsv4recoverydir\fR
-points. If the kernel passes the correct information, then nfsdcltrack
-can use it to allow a seamless transition from the old client tracking
-scheme to the new one.
-.PP
-On a \fBcheck\fR operation, if there is no record of the client in the
-database, nfsdcltrack will look to see if the \fB\s-1NFSDCLTRACK_LEGACY_RECDIR\s0\fR
-environment variable is set. If it is, then it will fetch that value and
-see if a directory exists by that name. If it does, then the check
-operation will succeed and the directory will be removed.
-.PP
-On a \fBgracedone\fR operation, nfsdcltrack will look to see if the
-\&\fB\s-1NFSDCLTRACK_LEGACY_TOPDIR\s0\fR environment variable is set. If it is, then
-it will attempt to clean out that directory prior to exiting.
-.PP
-Note that this transition is one-way. If the machine subsequently reboots
-back into an older kernel that does not support the nfsdcltrack upcall
-then the clients will not be able to recover their state.
-.SH "NOTES"
-.IX Header "NOTES"
-This program requires a kernel that supports the nfsdcltrack usermodehelper
-upcall. This support was first added to mainline kernels in 3.8.
-.SH "AUTHORS"
-.IX Header "AUTHORS"
-nfsdcltrack was developed by Jeff Layton <[e-mail]>.

=== added directory '.pc/20-ticket-expired-error.patch'
=== added directory '.pc/20-ticket-expired-error.patch/utils'
=== added directory '.pc/20-ticket-expired-error.patch/utils/gssd'
=== added file '.pc/20-ticket-expired-error.patch/utils/gssd/gssd.c'
--- .pc/20-ticket-expired-error.patch/utils/gssd/gssd.c	1970-01-01 00:00:00 +0000
+++ .pc/20-ticket-expired-error.patch/utils/gssd/gssd.c	2013-05-24 21:14:25 +0000
@@ -0,0 +1,200 @@
+/*
+  gssd.c
+
+  Copyright (c) 2000 The Regents of the University of Michigan.
+  All rights reserved.
+
+  Copyright (c) 2000 Dug Song <[e-mail]>.
+  Copyright (c) 2002 Andy Adamson <[e-mail]>.
+  Copyright (c) 2002 Marius Aamodt Eriksen <[e-mail]>.
+  All rights reserved, all wrongs reversed.
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+
+  1. Redistributions of source code must retain the above copyright
+     notice, this list of conditions and the following disclaimer.
+  2. Redistributions in binary form must reproduce the above copyright
+     notice, this list of conditions and the following disclaimer in the
+     documentation and/or other materials provided with the distribution.
+  3. Neither the name of the University nor the names of its
+     contributors may be used to endorse or promote products derived
+     from this software without specific prior written permission.
+
+  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+*/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif	/* HAVE_CONFIG_H */
+
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <rpc/rpc.h>
+
+#include <unistd.h>
+#include <err.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <signal.h>
+#include "gssd.h"
+#include "err_util.h"
+#include "gss_util.h"
+#include "krb5_util.h"
+
+char pipefs_dir[PATH_MAX] = GSSD_PIPEFS_DIR;
+char keytabfile[PATH_MAX] = GSSD_DEFAULT_KEYTAB_FILE;
+char ccachedir[PATH_MAX] = GSSD_DEFAULT_CRED_DIR ":" GSSD_USER_CRED_DIR;
+char *ccachesearch[GSSD_MAX_CCACHE_SEARCH + 1];
+int  use_memcache = 0;
+int  root_uses_machine_creds = 1;
+unsigned int  context_timeout = 0;
+char *preferred_realm = NULL;
+
+void
+sig_die(int signal)
+{
+	/* destroy krb5 machine creds */
+	if (root_uses_machine_creds)
+		gssd_destroy_krb5_machine_creds();
+	printerr(1, "exiting on signal %d\n", signal);
+	exit(0);
+}
+
+void
+sig_hup(int signal)
+{
+	/* don't exit on SIGHUP */
+	printerr(1, "Received SIGHUP(%d)... Ignoring.\n", signal);
+	return;
+}
+
+static void
+usage(char *progname)
+{
+	fprintf(stderr, "usage: %s [-f] [-l] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir] [-t timeout] [-R preferred realm] [-D]\n",
+		progname);
+	exit(1);
+}
+
+int
+main(int argc, char *argv[])
+{
+	int fg = 0;
+	int verbosity = 0;
+	int rpc_verbosity = 0;
+	int opt;
+	int i;
+	extern char *optarg;
+	char *progname;
+
+	memset(ccachesearch, 0, sizeof(ccachesearch));
+	while ((opt = getopt(argc, argv, "DfvrlmnMp:k:d:t:R:")) != -1) {
+		switch (opt) {
+			case 'f':
+				fg = 1;
+				break;
+			case 'm':
+				/* Accept but ignore this. Now the default. */
+				break;
+			case 'M':
+				use_memcache = 1;
+				break;
+			case 'n':
+				root_uses_machine_creds = 0;
+				break;
+			case 'v':
+				verbosity++;
+				break;
+			case 'r':
+				rpc_verbosity++;
+				break;
+			case 'p':
+				strncpy(pipefs_dir, optarg, sizeof(pipefs_dir));
+				if (pipefs_dir[sizeof(pipefs_dir)-1] != '\0')
+					errx(1, "pipefs path name too long");
+				break;
+			case 'k':
+				strncpy(keytabfile, optarg, sizeof(keytabfile));
+				if (keytabfile[sizeof(keytabfile)-1] != '\0')
+					errx(1, "keytab path name too long");
+				break;
+			case 'd':
+				strncpy(ccachedir, optarg, sizeof(ccachedir));
+				if (ccachedir[sizeof(ccachedir)-1] != '\0')
+					errx(1, "ccachedir path name too long");
+				break;
+			case 't':
+				context_timeout = atoi(optarg);
+				break;
+			case 'R':
+				preferred_realm = strdup(optarg);
+				break;
+			case 'l':
+#ifdef HAVE_SET_ALLOWABLE_ENCTYPES
+				limit_to_legacy_enctypes = 1;
+#else 
+				errx(1, "Encryption type limits not supported by Kerberos libraries.");
+#endif
+				break;
+			case 'D':
+				avoid_dns = 0;
+				break;
+			default:
+				usage(argv[0]);
+				break;
+		}
+	}
+
+	i = 0;
+	ccachesearch[i++] = strtok(ccachedir, ":");
+	do {
+		ccachesearch[i++] = strtok(NULL, ":");
+	} while (ccachesearch[i-1] != NULL && i < GSSD_MAX_CCACHE_SEARCH);
+
+	if (preferred_realm == NULL)
+		gssd_k5_get_default_realm(&preferred_realm);
+
+	if ((progname = strrchr(argv[0], '/')))
+		progname++;
+	else
+		progname = argv[0];
+
+	initerr(progname, verbosity, fg);
+#ifdef HAVE_AUTHGSS_SET_DEBUG_LEVEL
+	if (verbosity && rpc_verbosity == 0)
+		rpc_verbosity = verbosity;
+	authgss_set_debug_level(rpc_verbosity);
+#else
+        if (rpc_verbosity > 0)
+		printerr(0, "Warning: rpcsec_gss library does not "
+			    "support setting debug level\n");
+#endif
+
+	if (gssd_check_mechs() != 0)
+		errx(1, "Problem with gssapi library");
+
+	if (!fg && daemon(0, 0) < 0)
+		errx(1, "fork");
+
+	signal(SIGINT, sig_die);
+	signal(SIGTERM, sig_die);
+	signal(SIGHUP, sig_hup);
+
+	gssd_run();
+	printerr(0, "gssd_run returned!\n");
+	abort();
+}

=== added file '.pc/20-ticket-expired-error.patch/utils/gssd/gssd.h'
--- .pc/20-ticket-expired-error.patch/utils/gssd/gssd.h	1970-01-01 00:00:00 +0000
+++ .pc/20-ticket-expired-error.patch/utils/gssd/gssd.h	2013-05-24 21:14:25 +0000
@@ -0,0 +1,106 @@
+/*
+  Copyright (c) 2004 The Regents of the University of Michigan.
+  All rights reserved.
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+
+  1. Redistributions of source code must retain the above copyright
+     notice, this list of conditions and the following disclaimer.
+  2. Redistributions in binary form must reproduce the above copyright
+     notice, this list of conditions and the following disclaimer in the
+     documentation and/or other materials provided with the distribution.
+  3. Neither the name of the University nor the names of its
+     contributors may be used to endorse or promote products derived
+     from this software without specific prior written permission.
+
+  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef _RPC_GSSD_H_
+#define _RPC_GSSD_H_
+
+#include <sys/types.h>
+#include <sys/queue.h>
+#include <gssapi/gssapi.h>
+
+#define MAX_FILE_NAMELEN	32
+#define FD_ALLOC_BLOCK		256
+#ifndef GSSD_PIPEFS_DIR
+#define GSSD_PIPEFS_DIR		"/var/lib/nfs/rpc_pipefs"
+#endif
+#define INFO			"info"
+#define KRB5			"krb5"
+#define DNOTIFY_SIGNAL		(SIGRTMIN + 3)
+
+#define GSSD_DEFAULT_CRED_DIR			"/tmp"
+#define GSSD_USER_CRED_DIR			"/run/user/%U"
+#define GSSD_DEFAULT_CRED_PREFIX		"krb5cc"
+#define GSSD_DEFAULT_MACHINE_CRED_SUFFIX	"machine"
+#define GSSD_DEFAULT_KEYTAB_FILE		"/etc/krb5.keytab"
+#define GSSD_SERVICE_NAME			"nfs"
+#define GSSD_SERVICE_NAME_LEN			3
+#define GSSD_MAX_CCACHE_SEARCH			16
+
+/*
+ * The gss mechanisms that we can handle
+ */
+enum {AUTHTYPE_KRB5, AUTHTYPE_LIPKEY};
+
+
+
+extern char			pipefs_dir[PATH_MAX];
+extern char			keytabfile[PATH_MAX];
+extern char			*ccachesearch[];
+extern int			use_memcache;
+extern int			root_uses_machine_creds;
+extern unsigned int 		context_timeout;
+extern char			*preferred_realm;
+
+TAILQ_HEAD(clnt_list_head, clnt_info) clnt_list;
+
+struct clnt_info {
+	TAILQ_ENTRY(clnt_info)	list;
+	char			*dirname;
+	int			dir_fd;
+	char			*servicename;
+	char			*servername;
+	int			prog;
+	int			vers;
+	char			*protocol;
+	int			krb5_fd;
+	int			krb5_poll_index;
+	int			krb5_close_me;
+	int                     gssd_fd;
+	int                     gssd_poll_index;
+	int			gssd_close_me;
+	struct sockaddr_storage addr;
+};
+
+TAILQ_HEAD(topdirs_list_head, topdirs_info) topdirs_list;
+
+struct topdirs_info {
+	TAILQ_ENTRY(topdirs_info)   list;
+	char			*dirname;
+	int			fd;
+};
+
+void init_client_list(void);
+int update_client_list(void);
+void handle_krb5_upcall(struct clnt_info *clp);
+void handle_gssd_upcall(struct clnt_info *clp);
+void gssd_run(void);
+
+
+#endif /* _RPC_GSSD_H_ */

=== added file '.pc/20-ticket-expired-error.patch/utils/gssd/gssd.man'
--- .pc/20-ticket-expired-error.patch/utils/gssd/gssd.man	1970-01-01 00:00:00 +0000
+++ .pc/20-ticket-expired-error.patch/utils/gssd/gssd.man	2013-05-24 21:14:25 +0000
@@ -0,0 +1,288 @@
+.\"
+.\" rpc.gssd(8)
+.\"
+.\" Copyright (C) 2003 J. Bruce Fields <[e-mail]>
+.\"
+.TH rpc.gssd 8 "20 Feb 2013"
+.SH NAME
+rpc.gssd \- RPCSEC_GSS daemon
+.SH SYNOPSIS
+.B rpc.gssd
+.RB [ \-DfMnlvr ]
+.RB [ \-k
+.IR keytab ]
+.RB [ \-p
+.IR pipefsdir ]
+.RB [ \-d
+.IR ccachedir ]
+.RB [ \-t
+.IR timeout ]
+.RB [ \-R
+.IR realm ]
+.SH INTRODUCTION
+The RPCSEC_GSS protocol, defined in RFC 5403, is used to provide
+strong security for RPC-based protocols such as NFS.
+.P
+Before exchanging RPC requests using RPCSEC_GSS, an RPC client must
+establish a GSS
+.IR "security context" .
+A security context is shared state on each
+end of a network transport that enables GSS-API security services.
+.P
+Security contexts are established using
+.IR "security credentials" .
+A credential grants temporary access to a secure network service,
+much as a railway ticket grants temporary access to use a rail service.
+.P
+A user typically obtains a credential by providing a password to the
+.BR kinit (1)
+command, or via a PAM library at login time.
+A credential acquired with a
+.I user principal
+is known as a
+.I user credential
+(see
+.BR kerberos (1)
+for more on principals).
+.P
+For certain operations, a credential is required
+which represents no user,
+is otherwise unprivileged,
+and is always available.
+This is referred to as a
+.IR "machine credential" .
+.P
+Machine credentials are typically established using a
+.IR "service principal" ,
+whose encrypted password, called its
+.IR key ,
+is stored in a file, called a
+.IR keytab ,
+to avoid requiring a user prompt.
+A machine credential effectively does not expire because the system
+can renew it as needed without user intervention.
+.P
+Once obtained, credentials are typically stored in local temporary files
+with well-known pathnames.
+.SH DESCRIPTION
+To establish GSS security contexts using these credential files,
+the Linux kernel RPC client depends on a userspace daemon called
+.BR rpc.gssd .
+The
+.B rpc.gssd
+daemon uses the rpc_pipefs filesystem to communicate with the kernel.
+.SS User Credentials
+When a user authenticates using a command such as
+.BR kinit (1),
+the resulting credential is stored in a file with a well-known name
+constructed using the user's UID.
+.P
+To interact with an NFS server
+on behalf of a particular Kerberos-authenticated user,
+the Linux kernel RPC client requests that
+.B rpc.gssd
+initialize a security context with the credential
+in that user's credential file.
+.P
+Typically, credential files are placed in
+.IR /tmp .
+However,
+.B rpc.gssd
+can search for credential files in more than one directory.
+See the description of the
+.B -d
+option for details.
+.SS Machine Credentials
+A user credential is established by a user and
+is then shared with the kernel and
+.BR rpc.gssd .
+A machine credential is established by
+.B rpc.gssd
+for the kernel when there is no user.
+Therefore
+.B rpc.gssd
+must already have the materials on hand to establish this credential
+without requiring user intervention.
+.P
+.B rpc.gssd
+searches the local system's keytab for a principal and key to use
+to establish the machine credential.
+By default,
+.B rpc.gssd
+assumes the file
+.I /etc/krb5.keytab
+contains principals and keys that can be used to obtain machine credentials.
+.P
+.B rpc.gssd
+searches in the following order for a principal to use.
+The first matching credential is used.
+For the search, <hostname> and <REALM> are replaced with the local
+system's hostname and Kerberos realm.
+.sp
+   <HOSTNAME>$@<REALM>
+.br
+   root/<hostname>@<REALM>
+.br
+   nfs/<hostname>@<REALM>
+.br
+   host/<hostname>@<REALM>
+.br
+   root/<anyname>@<REALM>
+.br
+   nfs/<anyname>@<REALM>
+.br
+   host/<anyname>@<REALM>
+.sp
+The <anyname> entries match on the service name and realm, but ignore the hostname.
+These can be used if a principal matching the local host's name is not found.
+.P
+Note that the first principal in the search order is a user principal
+that enables Kerberized NFS when the local system is joined
+to an Active Directory domain using Samba.
+A password for this principal must be provided in the local system's keytab.
+.P
+You can specify another keytab by using the
+.B -k
+option if
+.I /etc/krb5.keytab
+does not exist or does not provide one of these principals.
+.SS Credentials for UID 0
+UID 0 is a special case.
+By default
+.B rpc.gssd
+uses the system's machine credentials for UID 0 accesses
+that require GSS authentication.
+This limits the privileges of the root user
+when accessing network resources that require authentication.
+.P
+Specify the
+.B -n
+option when starting
+.B rpc.gssd
+if you'd like to force the root user to obtain a user credential
+rather than use the local system's machine credential.
+.P
+When
+.B -n
+is specified,
+the kernel continues to request a GSS context established
+with a machine credential for NFSv4 operations,
+such as SETCLIENTID or RENEW, that manage state.
+If
+.B rpc.gssd
+cannot obtain a machine credential (say, the local system has
+no keytab), NFSv4 operations that require machine credentials will fail.
+.SS Encryption types
+A realm administrator can choose to add keys encoded in a number of different
+encryption types to the local system's keytab.
+For instance, a host/ principal might have keys for the
+.BR aes256-cts-hmac-sha1-96 ,
+.BR aes128-cts-hmac-sha1-96 ,
+.BR des3-cbc-sha1 ", and"
+.BR arcfour-hmac " encryption types."
+This permits
+.B rpc.gssd
+to choose an appropriate encryption type that the target NFS server
+supports.
+.P
+These encryption types are stronger than legacy single-DES encryption types.
+To interoperate in environments where servers support
+only weak encryption types,
+you can restrict your client to use only single-DES encryption types
+by specifying the
+.B -l
+option when starting
+.BR rpc.gssd .
+.SH OPTIONS
+.TP
+.B -D
+DNS Reverse lookups are not used for determining the
+server names pass to GSSAPI. This option will reverses that and forces 
+the use of DNS Reverse resolution of the server's IP address to 
+retrieve the server name to use in GSAPI authentication.
+.TP
+.B -f
+Runs
+.B rpc.gssd
+in the foreground and sends output to stderr (as opposed to syslogd)
+.TP
+.B -n
+When specified, UID 0 is forced to obtain user credentials
+which are used instead of the local system's machine credentials.
+.TP
+.BI "-k " keytab
+Tells
+.B rpc.gssd
+to use the keys found in
+.I keytab
+to obtain machine credentials.
+The default value is
+.IR /etc/krb5.keytab .
+.TP
+.B -l
+When specified, restricts
+.B rpc.gssd
+to sessions to weak encryption types such as
+.BR des-cbc-crc .
+This option is available only when the local system's Kerberos library
+supports settable encryption types.
+.TP
+.BI "-p " path
+Tells
+.B rpc.gssd
+where to look for the rpc_pipefs filesystem.  The default value is
+.IR /var/lib/nfs/rpc_pipefs .
+.TP
+.BI "-d " search-path
+This option specifies a colon separated list of directories that
+.B rpc.gssd
+searches for credential files.  The default value is
+.IR /tmp:/run/user/%U .
+The literal sequence "%U" can be specified to substitue the UID
+of the user for whom credentials are being searched.
+.TP
+.B -M
+By default, machine credentials are stored in files in the first
+directory in the credential directory search path (see the
+.B -d
+option).  When
+.B -M
+is set,
+.B rpc.gssd
+stores machine credentials in memory instead.
+.TP
+.B -v
+Increases the verbosity of the output (can be specified multiple times).
+.TP
+.B -r
+If the RPCSEC_GSS library supports setting debug level,
+increases the verbosity of the output (can be specified multiple times).
+.TP
+.BI "-R " realm
+Kerberos tickets from this
+.I realm
+will be preferred when scanning available credentials cache files to be
+used to create a context.  By default, the default realm, as configured
+in the Kerberos configuration file, is preferred.
+.TP
+.BI "-t " timeout
+Timeout, in seconds, for kernel GSS contexts. This option allows you to force 
+new kernel contexts to be negotiated after
+.I timeout
+seconds, which allows changing Kerberos tickets and identities frequently.
+The default is no explicit timeout, which means the kernel context will live
+the lifetime of the Kerberos service ticket used in its creation.
+.SH SEE ALSO
+.BR rpc.svcgssd (8),
+.BR kerberos (1),
+.BR kinit (1),
+.BR krb5.conf (5)
+.SH AUTHORS
+.br
+Dug Song <[e-mail]>
+.br
+Andy Adamson <[e-mail]>
+.br
+Marius Aamodt Eriksen <[e-mail]>
+.br
+J. Bruce Fields <[e-mail]>

=== added file '.pc/20-ticket-expired-error.patch/utils/gssd/gssd_proc.c'
--- .pc/20-ticket-expired-error.patch/utils/gssd/gssd_proc.c	1970-01-01 00:00:00 +0000
+++ .pc/20-ticket-expired-error.patch/utils/gssd/gssd_proc.c	2013-05-24 21:14:25 +0000
@@ -0,0 +1,1261 @@
+/*
+  gssd_proc.c
+
+  Copyright (c) 2000-2004 The Regents of the University of Michigan.
+  All rights reserved.
+
+  Copyright (c) 2000 Dug Song <[e-mail]>.
+  Copyright (c) 2001 Andy Adamson <[e-mail]>.
+  Copyright (c) 2002 Marius Aamodt Eriksen <[e-mail]>.
+  Copyright (c) 2002 Bruce Fields <[e-mail]>
+  Copyright (c) 2004 Kevin Coffman <[e-mail]>
+  All rights reserved, all wrongs reversed.
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+
+  1. Redistributions of source code must retain the above copyright
+     notice, this list of conditions and the following disclaimer.
+  2. Redistributions in binary form must reproduce the above copyright
+     notice, this list of conditions and the following disclaimer in the
+     documentation and/or other materials provided with the distribution.
+  3. Neither the name of the University nor the names of its
+     contributors may be used to endorse or promote products derived
+     from this software without specific prior written permission.
+
+  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+*/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif	/* HAVE_CONFIG_H */
+
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE
+#endif
+
+#include <sys/param.h>
+#include <rpc/rpc.h>
+#include <sys/stat.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+#include <sys/fsuid.h>
+#include <sys/resource.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <pwd.h>
+#include <grp.h>
+#include <string.h>
+#include <dirent.h>
+#include <poll.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <unistd.h>
+#include <errno.h>
+#include <gssapi/gssapi.h>
+#include <netdb.h>
+#include <ctype.h>
+
+#include "gssd.h"
+#include "err_util.h"
+#include "gss_util.h"
+#include "krb5_util.h"
+#include "context.h"
+#include "nfsrpc.h"
+#include "nfslib.h"
+
+/*
+ * pollarray:
+ *      array of struct pollfd suitable to pass to poll. initialized to
+ *      zero - a zero struct is ignored by poll() because the events mask is 0.
+ *
+ * clnt_list:
+ *      linked list of struct clnt_info which associates a clntXXX directory
+ *	with an index into pollarray[], and other basic data about that client.
+ *
+ * Directory structure: created by the kernel
+ *      {rpc_pipefs}/{dir}/clntXX         : one per rpc_clnt struct in the kernel
+ *      {rpc_pipefs}/{dir}/clntXX/krb5    : read uid for which kernel wants
+ *					    a context, write the resulting context
+ *      {rpc_pipefs}/{dir}/clntXX/info    : stores info such as server name
+ *      {rpc_pipefs}/{dir}/clntXX/gssd    : pipe for all gss mechanisms using
+ *					    a text-based string of parameters
+ *
+ * Algorithm:
+ *      Poll all {rpc_pipefs}/{dir}/clntXX/YYYY files.  When data is ready,
+ *      read and process; performs rpcsec_gss context initialization protocol to
+ *      get a cred for that user.  Writes result to corresponding krb5 file
+ *      in a form the kernel code will understand.
+ *      In addition, we make sure we are notified whenever anything is
+ *      created or destroyed in {rpc_pipefs} or in any of the clntXX directories,
+ *      and rescan the whole {rpc_pipefs} when this happens.
+ */
+
+struct pollfd * pollarray;
+
+unsigned long pollsize;  /* the size of pollaray (in pollfd's) */
+
+/* Avoid DNS reverse lookups on server names */
+int avoid_dns = 1;
+
+/*
+ * convert a presentation address string to a sockaddr_storage struct. Returns
+ * true on success or false on failure.
+ *
+ * Note that we do not populate the sin6_scope_id field here for IPv6 addrs.
+ * gssd nececessarily relies on hostname resolution and DNS AAAA records
+ * do not generally contain scope-id's. This means that GSSAPI auth really
+ * can't work with IPv6 link-local addresses.
+ *
+ * We *could* consider changing this if we did something like adopt the
+ * Microsoft "standard" of using the ipv6-literal.net domainname, but it's
+ * not really feasible at present.
+ */
+static int
+addrstr_to_sockaddr(struct sockaddr *sa, const char *node, const char *port)
+{
+	int rc;
+	struct addrinfo *res;
+	struct addrinfo hints = { .ai_flags = AI_NUMERICHOST | AI_NUMERICSERV };
+
+#ifndef IPV6_SUPPORTED
+	hints.ai_family = AF_INET;
+#endif /* IPV6_SUPPORTED */
+
+	rc = getaddrinfo(node, port, &hints, &res);
+	if (rc) {
+		printerr(0, "ERROR: unable to convert %s|%s to sockaddr: %s\n",
+			 node, port, rc == EAI_SYSTEM ? strerror(errno) :
+						gai_strerror(rc));
+		return 0;
+	}
+
+#ifdef IPV6_SUPPORTED
+	/*
+	 * getnameinfo ignores the scopeid. If the address turns out to have
+	 * a non-zero scopeid, we can't use it -- the resolved host might be
+	 * completely different from the one intended.
+	 */
+	if (res->ai_addr->sa_family == AF_INET6) {
+		struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)res->ai_addr;
+		if (sin6->sin6_scope_id) {
+			printerr(0, "ERROR: address %s has non-zero "
+				    "sin6_scope_id!\n", node);
+			freeaddrinfo(res);
+			return 0;
+		}
+	}
+#endif /* IPV6_SUPPORTED */
+
+	memcpy(sa, res->ai_addr, res->ai_addrlen);
+	freeaddrinfo(res);
+	return 1;
+}
+
+/*
+ * convert a sockaddr to a hostname
+ */
+static char *
+get_servername(const char *name, const struct sockaddr *sa, const char *addr)
+{
+	socklen_t		addrlen;
+	int			err;
+	char			*hostname;
+	char			hbuf[NI_MAXHOST];
+	unsigned char		buf[sizeof(struct in6_addr)];
+	int			servername = 0;
+
+	if (avoid_dns) {
+		/*
+		 * Determine if this is a server name, or an IP address.
+		 * If it is an IP address, do the DNS lookup otherwise
+		 * skip the DNS lookup.
+		 */
+		servername = 0;
+		if (strchr(name, '.') && inet_pton(AF_INET, name, buf) == 1)
+			servername = 1; /* IPv4 */
+		else if (strchr(name, ':') && inet_pton(AF_INET6, name, buf) == 1)
+			servername = 1; /* or IPv6 */
+
+		if (servername) {
+			return strdup(name);
+		}
+	}
+
+	switch (sa->sa_family) {
+	case AF_INET:
+		addrlen = sizeof(struct sockaddr_in);
+		break;
+#ifdef IPV6_SUPPORTED
+	case AF_INET6:
+		addrlen = sizeof(struct sockaddr_in6);
+		break;
+#endif /* IPV6_SUPPORTED */
+	default:
+		printerr(0, "ERROR: unrecognized addr family %d\n",
+			 sa->sa_family);
+		return NULL;
+	}
+
+	err = getnameinfo(sa, addrlen, hbuf, sizeof(hbuf), NULL, 0,
+			  NI_NAMEREQD);
+	if (err) {
+		printerr(0, "ERROR: unable to resolve %s to hostname: %s\n",
+			 addr, err == EAI_SYSTEM ? strerror(err) :
+						   gai_strerror(err));
+		return NULL;
+	}
+
+	hostname = strdup(hbuf);
+
+	return hostname;
+}
+
+/* XXX buffer problems: */
+static int
+read_service_info(char *info_file_name, char **servicename, char **servername,
+		  int *prog, int *vers, char **protocol,
+		  struct sockaddr *addr) {
+#define INFOBUFLEN 256
+	char		buf[INFOBUFLEN + 1];
+	static char	server[128];
+	int		nbytes;
+	static char	service[128];
+	static char	address[128];
+	char		program[16];
+	char		version[16];
+	char		protoname[16];
+	char		port[128];
+	char		*p;
+	int		fd = -1;
+	int		numfields;
+
+	*servicename = *servername = *protocol = NULL;
+
+	if ((fd = open(info_file_name, O_RDONLY)) == -1) {
+		printerr(0, "ERROR: can't open %s: %s\n", info_file_name,
+			 strerror(errno));
+		goto fail;
+	}
+	if ((nbytes = read(fd, buf, INFOBUFLEN)) == -1)
+		goto fail;
+	close(fd);
+	buf[nbytes] = '\0';
+
+	numfields = sscanf(buf,"RPC server: %127s\n"
+		   "service: %127s %15s version %15s\n"
+		   "address: %127s\n"
+		   "protocol: %15s\n",
+		   server,
+		   service, program, version,
+		   address,
+		   protoname);
+
+	if (numfields == 5) {
+		strcpy(protoname, "tcp");
+	} else if (numfields != 6) {
+		goto fail;
+	}
+
+	port[0] = '\0';
+	if ((p = strstr(buf, "port")) != NULL)
+		sscanf(p, "port: %127s\n", port);
+
+	/* get program, and version numbers */
+	*prog = atoi(program + 1); /* skip open paren */
+	*vers = atoi(version);
+
+	if (!addrstr_to_sockaddr(addr, address, port))
+		goto fail;
+
+	*servername = get_servername(server, addr, address);
+	if (*servername == NULL)
+		goto fail;
+
+	nbytes = snprintf(buf, INFOBUFLEN, "%s@%s", service, *servername);
+	if (nbytes > INFOBUFLEN)
+		goto fail;
+
+	if (!(*servicename = calloc(strlen(buf) + 1, 1)))
+		goto fail;
+	memcpy(*servicename, buf, strlen(buf));
+
+	if (!(*protocol = strdup(protoname)))
+		goto fail;
+	return 0;
+fail:
+	printerr(0, "ERROR: failed to read service info\n");
+	if (fd != -1) close(fd);
+	free(*servername);
+	free(*servicename);
+	free(*protocol);
+	*servicename = *servername = *protocol = NULL;
+	return -1;
+}
+
+static void
+destroy_client(struct clnt_info *clp)
+{
+	if (clp->krb5_poll_index != -1)
+		memset(&pollarray[clp->krb5_poll_index], 0,
+					sizeof(struct pollfd));
+	if (clp->gssd_poll_index != -1)
+		memset(&pollarray[clp->gssd_poll_index], 0,
+					sizeof(struct pollfd));
+	if (clp->dir_fd != -1) close(clp->dir_fd);
+	if (clp->krb5_fd != -1) close(clp->krb5_fd);
+	if (clp->gssd_fd != -1) close(clp->gssd_fd);
+	free(clp->dirname);
+	free(clp->servicename);
+	free(clp->servername);
+	free(clp->protocol);
+	free(clp);
+}
+
+static struct clnt_info *
+insert_new_clnt(void)
+{
+	struct clnt_info	*clp = NULL;
+
+	if (!(clp = (struct clnt_info *)calloc(1,sizeof(struct clnt_info)))) {
+		printerr(0, "ERROR: can't malloc clnt_info: %s\n",
+			 strerror(errno));
+		goto out;
+	}
+	clp->krb5_poll_index = -1;
+	clp->gssd_poll_index = -1;
+	clp->krb5_fd = -1;
+	clp->gssd_fd = -1;
+	clp->dir_fd = -1;
+
+	TAILQ_INSERT_HEAD(&clnt_list, clp, list);
+out:
+	return clp;
+}
+
+static int
+process_clnt_dir_files(struct clnt_info * clp)
+{
+	char	name[PATH_MAX];
+	char	gname[PATH_MAX];
+	char	info_file_name[PATH_MAX];
+
+	if (clp->gssd_close_me) {
+		printerr(2, "Closing 'gssd' pipe for %s\n", clp->dirname);
+		close(clp->gssd_fd);
+		memset(&pollarray[clp->gssd_poll_index], 0,
+			sizeof(struct pollfd));
+		clp->gssd_fd = -1;
+		clp->gssd_poll_index = -1;
+		clp->gssd_close_me = 0;
+	}
+	if (clp->krb5_close_me) {
+		printerr(2, "Closing 'krb5' pipe for %s\n", clp->dirname);
+		close(clp->krb5_fd);
+		memset(&pollarray[clp->krb5_poll_index], 0,
+			sizeof(struct pollfd));
+		clp->krb5_fd = -1;
+		clp->krb5_poll_index = -1;
+		clp->krb5_close_me = 0;
+	}
+
+	if (clp->gssd_fd == -1) {
+		snprintf(gname, sizeof(gname), "%s/gssd", clp->dirname);
+		clp->gssd_fd = open(gname, O_RDWR);
+	}
+	if (clp->gssd_fd == -1) {
+		if (clp->krb5_fd == -1) {
+			snprintf(name, sizeof(name), "%s/krb5", clp->dirname);
+			clp->krb5_fd = open(name, O_RDWR);
+		}
+
+		/* If we opened a gss-specific pipe, let's try opening
+		 * the new upcall pipe again. If we succeed, close
+		 * gss-specific pipe(s).
+		 */
+		if (clp->krb5_fd != -1) {
+			clp->gssd_fd = open(gname, O_RDWR);
+			if (clp->gssd_fd != -1) {
+				if (clp->krb5_fd != -1)
+					close(clp->krb5_fd);
+				clp->krb5_fd = -1;
+			}
+		}
+	}
+
+	if ((clp->krb5_fd == -1) && (clp->gssd_fd == -1))
+		return -1;
+	snprintf(info_file_name, sizeof(info_file_name), "%s/info",
+			clp->dirname);
+	if ((clp->servicename == NULL) &&
+	     read_service_info(info_file_name, &clp->servicename,
+				&clp->servername, &clp->prog, &clp->vers,
+				&clp->protocol, (struct sockaddr *) &clp->addr))
+		return -1;
+	return 0;
+}
+
+static int
+get_poll_index(int *ind)
+{
+	unsigned int i;
+
+	*ind = -1;
+	for (i=0; i<pollsize; i++) {
+		if (pollarray[i].events == 0) {
+			*ind = i;
+			break;
+		}
+	}
+	if (*ind == -1) {
+		printerr(0, "ERROR: No pollarray slots open\n");
+		return -1;
+	}
+	return 0;
+}
+
+
+static int
+insert_clnt_poll(struct clnt_info *clp)
+{
+	if ((clp->gssd_fd != -1) && (clp->gssd_poll_index == -1)) {
+		if (get_poll_index(&clp->gssd_poll_index)) {
+			printerr(0, "ERROR: Too many gssd clients\n");
+			return -1;
+		}
+		pollarray[clp->gssd_poll_index].fd = clp->gssd_fd;
+		pollarray[clp->gssd_poll_index].events |= POLLIN;
+	}
+
+	if ((clp->krb5_fd != -1) && (clp->krb5_poll_index == -1)) {
+		if (get_poll_index(&clp->krb5_poll_index)) {
+			printerr(0, "ERROR: Too many krb5 clients\n");
+			return -1;
+		}
+		pollarray[clp->krb5_poll_index].fd = clp->krb5_fd;
+		pollarray[clp->krb5_poll_index].events |= POLLIN;
+	}
+
+	return 0;
+}
+
+static void
+process_clnt_dir(char *dir, char *pdir)
+{
+	struct clnt_info *	clp;
+
+	if (!(clp = insert_new_clnt()))
+		goto fail_destroy_client;
+
+	/* An extra for the '/', and an extra for the null */
+	if (!(clp->dirname = calloc(strlen(dir) + strlen(pdir) + 2, 1))) {
+		goto fail_destroy_client;
+	}
+	sprintf(clp->dirname, "%s/%s", pdir, dir);
+	if ((clp->dir_fd = open(clp->dirname, O_RDONLY)) == -1) {
+		printerr(0, "ERROR: can't open %s: %s\n",
+			 clp->dirname, strerror(errno));
+		goto fail_destroy_client;
+	}
+	fcntl(clp->dir_fd, F_SETSIG, DNOTIFY_SIGNAL);
+	fcntl(clp->dir_fd, F_NOTIFY, DN_CREATE | DN_DELETE | DN_MULTISHOT);
+
+	if (process_clnt_dir_files(clp))
+		goto fail_keep_client;
+
+	if (insert_clnt_poll(clp))
+		goto fail_destroy_client;
+
+	return;
+
+fail_destroy_client:
+	if (clp) {
+		TAILQ_REMOVE(&clnt_list, clp, list);
+		destroy_client(clp);
+	}
+fail_keep_client:
+	/* We couldn't find some subdirectories, but we keep the client
+	 * around in case we get a notification on the directory when the
+	 * subdirectories are created. */
+	return;
+}
+
+void
+init_client_list(void)
+{
+	struct rlimit rlim;
+	TAILQ_INIT(&clnt_list);
+	/* Eventually plan to grow/shrink poll array: */
+	pollsize = FD_ALLOC_BLOCK;
+	if (getrlimit(RLIMIT_NOFILE, &rlim) == 0 &&
+	    rlim.rlim_cur != RLIM_INFINITY)
+		pollsize = rlim.rlim_cur;
+	pollarray = calloc(pollsize, sizeof(struct pollfd));
+}
+
+/*
+ * This is run after a DNOTIFY signal, and should clear up any
+ * directories that are no longer around, and re-scan any existing
+ * directories, since the DNOTIFY could have been in there.
+ */
+static void
+update_old_clients(struct dirent **namelist, int size, char *pdir)
+{
+	struct clnt_info *clp;
+	void *saveprev;
+	int i, stillhere;
+	char fname[PATH_MAX];
+
+	for (clp = clnt_list.tqh_first; clp != NULL; clp = clp->list.tqe_next) {
+		/* only compare entries in the global list that are from the
+		 * same pipefs parent directory as "pdir"
+		 */
+		if (strncmp(clp->dirname, pdir, strlen(pdir)) != 0) continue;
+
+		stillhere = 0;
+		for (i=0; i < size; i++) {
+			snprintf(fname, sizeof(fname), "%s/%s",
+				 pdir, namelist[i]->d_name);
+			if (strcmp(clp->dirname, fname) == 0) {
+				stillhere = 1;
+				break;
+			}
+		}
+		if (!stillhere) {
+			printerr(2, "destroying client %s\n", clp->dirname);
+			saveprev = clp->list.tqe_prev;
+			TAILQ_REMOVE(&clnt_list, clp, list);
+			destroy_client(clp);
+			clp = saveprev;
+		}
+	}
+	for (clp = clnt_list.tqh_first; clp != NULL; clp = clp->list.tqe_next) {
+		if (!process_clnt_dir_files(clp))
+			insert_clnt_poll(clp);
+	}
+}
+
+/* Search for a client by directory name, return 1 if found, 0 otherwise */
+static int
+find_client(char *dirname, char *pdir)
+{
+	struct clnt_info	*clp;
+	char fname[PATH_MAX];
+
+	for (clp = clnt_list.tqh_first; clp != NULL; clp = clp->list.tqe_next) {
+		snprintf(fname, sizeof(fname), "%s/%s", pdir, dirname);
+		if (strcmp(clp->dirname, fname) == 0)
+			return 1;
+	}
+	return 0;
+}
+
+static int
+process_pipedir(char *pipe_name)
+{
+	struct dirent **namelist;
+	int i, j;
+
+	if (chdir(pipe_name) < 0) {
+		printerr(0, "ERROR: can't chdir to %s: %s\n",
+			 pipe_name, strerror(errno));
+		return -1;
+	}
+
+	j = scandir(pipe_name, &namelist, NULL, alphasort);
+	if (j < 0) {
+		printerr(0, "ERROR: can't scandir %s: %s\n",
+			 pipe_name, strerror(errno));
+		return -1;
+	}
+
+	update_old_clients(namelist, j, pipe_name);
+	for (i=0; i < j; i++) {
+		if (!strncmp(namelist[i]->d_name, "clnt", 4)
+		    && !find_client(namelist[i]->d_name, pipe_name))
+			process_clnt_dir(namelist[i]->d_name, pipe_name);
+		free(namelist[i]);
+	}
+
+	free(namelist);
+
+	return 0;
+}
+
+/* Used to read (and re-read) list of clients, set up poll array. */
+int
+update_client_list(void)
+{
+	int retval = -1;
+	struct topdirs_info *tdi;
+
+	TAILQ_FOREACH(tdi, &topdirs_list, list) {
+		retval = process_pipedir(tdi->dirname);
+		if (retval)
+			printerr(1, "WARNING: error processing %s\n",
+				 tdi->dirname);
+
+	}
+	return retval;
+}
+
+/* Encryption types supported by the kernel rpcsec_gss code */
+int num_krb5_enctypes = 0;
+krb5_enctype *krb5_enctypes = NULL;
+
+/*
+ * Parse the supported encryption type information
+ */
+static int
+parse_enctypes(char *enctypes)
+{
+	int n = 0;
+	char *curr, *comma;
+	int i;
+	static char *cached_types;
+
+	if (cached_types && strcmp(cached_types, enctypes) == 0)
+		return 0;
+	free(cached_types);
+
+	if (krb5_enctypes != NULL) {
+		free(krb5_enctypes);
+		krb5_enctypes = NULL;
+		num_krb5_enctypes = 0;
+	}
+
+	/* count the number of commas */
+	for (curr = enctypes; curr && *curr != '\0'; curr = ++comma) {
+		comma = strchr(curr, ',');
+		if (comma != NULL)
+			n++;
+		else
+			break;
+	}
+	/* If no more commas and we're not at the end, there's one more value */
+	if (*curr != '\0')
+		n++;
+
+	/* Empty string, return an error */
+	if (n == 0)
+		return ENOENT;
+
+	/* Allocate space for enctypes array */
+	if ((krb5_enctypes = (int *) calloc(n, sizeof(int))) == NULL) {
+		return ENOMEM;
+	}
+
+	/* Now parse each value into the array */
+	for (curr = enctypes, i = 0; curr && *curr != '\0'; curr = ++comma) {
+		krb5_enctypes[i++] = atoi(curr);
+		comma = strchr(curr, ',');
+		if (comma == NULL)
+			break;
+	}
+
+	num_krb5_enctypes = n;
+	if ((cached_types = malloc(strlen(enctypes)+1)))
+		strcpy(cached_types, enctypes);
+
+	return 0;
+}
+
+static int
+do_downcall(int k5_fd, uid_t uid, struct authgss_private_data *pd,
+	    gss_buffer_desc *context_token, OM_uint32 lifetime_rec)
+{
+	char    *buf = NULL, *p = NULL, *end = NULL;
+	unsigned int timeout = context_timeout;
+	unsigned int buf_size = 0;
+
+	printerr(1, "doing downcall lifetime_rec %u\n", lifetime_rec);
+	buf_size = sizeof(uid) + sizeof(timeout) + sizeof(pd->pd_seq_win) +
+		sizeof(pd->pd_ctx_hndl.length) + pd->pd_ctx_hndl.length +
+		sizeof(context_token->length) + context_token->length;
+	p = buf = malloc(buf_size);
+	end = buf + buf_size;
+
+	/* context_timeout set by -t option overrides context lifetime */
+	if (timeout == 0)
+		timeout = lifetime_rec;
+	if (WRITE_BYTES(&p, end, uid)) goto out_err;
+	if (WRITE_BYTES(&p, end, timeout)) goto out_err;
+	if (WRITE_BYTES(&p, end, pd->pd_seq_win)) goto out_err;
+	if (write_buffer(&p, end, &pd->pd_ctx_hndl)) goto out_err;
+	if (write_buffer(&p, end, context_token)) goto out_err;
+
+	if (write(k5_fd, buf, p - buf) < p - buf) goto out_err;
+	if (buf) free(buf);
+	return 0;
+out_err:
+	if (buf) free(buf);
+	printerr(1, "Failed to write downcall!\n");
+	return -1;
+}
+
+static int
+do_error_downcall(int k5_fd, uid_t uid, int err)
+{
+	char	buf[1024];
+	char	*p = buf, *end = buf + 1024;
+	unsigned int timeout = 0;
+	int	zero = 0;
+
+	printerr(2, "doing error downcall\n");
+
+	if (WRITE_BYTES(&p, end, uid)) goto out_err;
+	if (WRITE_BYTES(&p, end, timeout)) goto out_err;
+	/* use seq_win = 0 to indicate an error: */
+	if (WRITE_BYTES(&p, end, zero)) goto out_err;
+	if (WRITE_BYTES(&p, end, err)) goto out_err;
+
+	if (write(k5_fd, buf, p - buf) < p - buf) goto out_err;
+	return 0;
+out_err:
+	printerr(1, "Failed to write error downcall!\n");
+	return -1;
+}
+
+/*
+ * If the port isn't already set, do an rpcbind query to the remote server
+ * using the program and version and get the port.
+ *
+ * Newer kernels send the value of the port= mount option in the "info"
+ * file for the upcall or '0' for NFSv2/3. For NFSv4 it sends the value
+ * of the port= option or '2049'. The port field in a new sockaddr should
+ * reflect the value that was sent by the kernel.
+ */
+static int
+populate_port(struct sockaddr *sa, const socklen_t salen,
+	      const rpcprog_t program, const rpcvers_t version,
+	      const unsigned short protocol)
+{
+	struct sockaddr_in	*s4 = (struct sockaddr_in *) sa;
+#ifdef IPV6_SUPPORTED
+	struct sockaddr_in6	*s6 = (struct sockaddr_in6 *) sa;
+#endif /* IPV6_SUPPORTED */
+	unsigned short		port;
+
+	/*
+	 * Newer kernels send the port in the upcall. If we already have
+	 * the port, there's no need to look it up.
+	 */
+	switch (sa->sa_family) {
+	case AF_INET:
+		if (s4->sin_port != 0) {
+			printerr(2, "DEBUG: port already set to %d\n",
+				 ntohs(s4->sin_port));
+			return 1;
+		}
+		break;
+#ifdef IPV6_SUPPORTED
+	case AF_INET6:
+		if (s6->sin6_port != 0) {
+			printerr(2, "DEBUG: port already set to %d\n",
+				 ntohs(s6->sin6_port));
+			return 1;
+		}
+		break;
+#endif /* IPV6_SUPPORTED */
+	default:
+		printerr(0, "ERROR: unsupported address family %d\n",
+			    sa->sa_family);
+		return 0;
+	}
+
+	/*
+	 * Newer kernels that send the port in the upcall set the value to
+	 * 2049 for NFSv4 mounts when one isn't specified. The check below is
+	 * only for kernels that don't send the port in the upcall. For those
+	 * we either have to do an rpcbind query or set it to the standard
+	 * port. Doing a query could be problematic (firewalls, etc), so take
+	 * the latter approach.
+	 */
+	if (program == 100003 && version == 4) {
+		port = 2049;
+		goto set_port;
+	}
+
+	port = nfs_getport(sa, salen, program, version, protocol);
+	if (!port) {
+		printerr(0, "ERROR: unable to obtain port for prog %ld "
+			    "vers %ld\n", program, version);
+		return 0;
+	}
+
+set_port:
+	printerr(2, "DEBUG: setting port to %hu for prog %lu vers %lu\n", port,
+		 program, version);
+
+	switch (sa->sa_family) {
+	case AF_INET:
+		s4->sin_port = htons(port);
+		break;
+#ifdef IPV6_SUPPORTED
+	case AF_INET6:
+		s6->sin6_port = htons(port);
+		break;
+#endif /* IPV6_SUPPORTED */
+	}
+
+	return 1;
+}
+
+/*
+ * Create an RPC connection and establish an authenticated
+ * gss context with a server.
+ */
+static int
+create_auth_rpc_client(struct clnt_info *clp,
+		       CLIENT **clnt_return,
+		       AUTH **auth_return,
+		       uid_t uid,
+		       int authtype,
+		       gss_cred_id_t cred)
+{
+	CLIENT			*rpc_clnt = NULL;
+	struct rpc_gss_sec	sec;
+	AUTH			*auth = NULL;
+	uid_t			save_uid = -1;
+	int			retval = -1;
+	OM_uint32		min_stat;
+	char			rpc_errmsg[1024];
+	int			protocol;
+	struct timeval		timeout = {5, 0};
+	struct sockaddr		*addr = (struct sockaddr *) &clp->addr;
+	socklen_t		salen;
+
+	/* Create the context as the user (not as root) */
+	save_uid = geteuid();
+	if (setfsuid(uid) != 0) {
+		printerr(0, "WARNING: Failed to setfsuid for "
+			    "user with uid %d\n", uid);
+		goto out_fail;
+	}
+	printerr(2, "creating context using fsuid %d (save_uid %d)\n",
+			uid, save_uid);
+
+	sec.qop = GSS_C_QOP_DEFAULT;
+	sec.svc = RPCSEC_GSS_SVC_NONE;
+	sec.cred = cred;
+	sec.req_flags = 0;
+	if (authtype == AUTHTYPE_KRB5) {
+		sec.mech = (gss_OID)&krb5oid;
+		sec.req_flags = GSS_C_MUTUAL_FLAG;
+	}
+	else {
+		printerr(0, "ERROR: Invalid authentication type (%d) "
+			"in create_auth_rpc_client\n", authtype);
+		goto out_fail;
+	}
+
+
+	if (authtype == AUTHTYPE_KRB5) {
+#ifdef HAVE_SET_ALLOWABLE_ENCTYPES
+		/*
+		 * Do this before creating rpc connection since we won't need
+		 * rpc connection if it fails!
+		 */
+		if (limit_krb5_enctypes(&sec)) {
+			printerr(1, "WARNING: Failed while limiting krb5 "
+				    "encryption types for user with uid %d\n",
+				 uid);
+			goto out_fail;
+		}
+#endif
+	}
+
+	/* create an rpc connection to the nfs server */
+
+	printerr(2, "creating %s client for server %s\n", clp->protocol,
+			clp->servername);
+
+	if ((strcmp(clp->protocol, "tcp")) == 0) {
+		protocol = IPPROTO_TCP;
+	} else if ((strcmp(clp->protocol, "udp")) == 0) {
+		protocol = IPPROTO_UDP;
+	} else {
+		printerr(0, "WARNING: unrecognized protocol, '%s', requested "
+			 "for connection to server %s for user with uid %d\n",
+			 clp->protocol, clp->servername, uid);
+		goto out_fail;
+	}
+
+	switch (addr->sa_family) {
+	case AF_INET:
+		salen = sizeof(struct sockaddr_in);
+		break;
+#ifdef IPV6_SUPPORTED
+	case AF_INET6:
+		salen = sizeof(struct sockaddr_in6);
+		break;
+#endif /* IPV6_SUPPORTED */
+	default:
+		printerr(1, "ERROR: Unknown address family %d\n",
+			 addr->sa_family);
+		goto out_fail;
+	}
+
+	if (!populate_port(addr, salen, clp->prog, clp->vers, protocol))
+		goto out_fail;
+
+	rpc_clnt = nfs_get_rpcclient(addr, salen, protocol, clp->prog,
+				     clp->vers, &timeout);
+	if (!rpc_clnt) {
+		snprintf(rpc_errmsg, sizeof(rpc_errmsg),
+			 "WARNING: can't create %s rpc_clnt to server %s for "
+			 "user with uid %d",
+			 protocol == IPPROTO_TCP ? "tcp" : "udp",
+			 clp->servername, uid);
+		printerr(0, "%s\n",
+			 clnt_spcreateerror(rpc_errmsg));
+		goto out_fail;
+	}
+
+	printerr(2, "creating context with server %s\n", clp->servicename);
+	auth = authgss_create_default(rpc_clnt, clp->servicename, &sec);
+	if (!auth) {
+		/* Our caller should print appropriate message */
+		printerr(2, "WARNING: Failed to create krb5 context for "
+			    "user with uid %d for server %s\n",
+			 uid, clp->servername);
+		goto out_fail;
+	}
+
+	/* Success !!! */
+	rpc_clnt->cl_auth = auth;
+	*clnt_return = rpc_clnt;
+	*auth_return = auth;
+	retval = 0;
+
+  out:
+	if (sec.cred != GSS_C_NO_CREDENTIAL)
+		gss_release_cred(&min_stat, &sec.cred);
+	/* Restore euid to original value */
+	if (((int)save_uid != -1) && (setfsuid(save_uid) != (int)uid)) {
+		printerr(0, "WARNING: Failed to restore fsuid"
+			    " to uid %d from %d\n", save_uid, uid);
+	}
+	return retval;
+
+  out_fail:
+	/* Only destroy here if failure.  Otherwise, caller is responsible */
+	if (rpc_clnt) clnt_destroy(rpc_clnt);
+
+	goto out;
+}
+
+/*
+ * this code uses the userland rpcsec gss library to create a krb5
+ * context on behalf of the kernel
+ */
+static void
+process_krb5_upcall(struct clnt_info *clp, uid_t uid, int fd, char *tgtname,
+		    char *service)
+{
+	CLIENT			*rpc_clnt = NULL;
+	AUTH			*auth = NULL;
+	struct authgss_private_data pd;
+	gss_buffer_desc		token;
+	char			**credlist = NULL;
+	char			**ccname;
+	char			**dirname;
+	int			create_resp = -1;
+	int			err, downcall_err = -EACCES;
+	gss_cred_id_t		gss_cred;
+	OM_uint32		maj_stat, min_stat, lifetime_rec;
+
+	printerr(2, "handling krb5 upcall (%s)\n", clp->dirname);
+
+	token.length = 0;
+	token.value = NULL;
+	memset(&pd, 0, sizeof(struct authgss_private_data));
+
+	/*
+	 * If "service" is specified, then the kernel is indicating that
+	 * we must use machine credentials for this request.  (Regardless
+	 * of the uid value or the setting of root_uses_machine_creds.)
+	 * If the service value is "*", then any service name can be used.
+	 * Otherwise, it specifies the service name that should be used.
+	 * (For now, the values of service will only be "*" or "nfs".)
+	 *
+	 * Restricting gssd to use "nfs" service name is needed for when
+	 * the NFS server is doing a callback to the NFS client.  In this
+	 * case, the NFS server has to authenticate itself as "nfs" --
+	 * even if there are other service keys such as "host" or "root"
+	 * in the keytab.
+	 *
+	 * Another case when the kernel may specify the service attribute
+	 * is when gssd is being asked to create the context for a
+	 * SETCLIENT_ID operation.  In this case, machine credentials
+	 * must be used for the authentication.  However, the service name
+	 * used for this case is not important.
+	 *
+	 */
+	printerr(2, "%s: service is '%s'\n", __func__,
+		 service ? service : "<null>");
+	if (uid != 0 || (uid == 0 && root_uses_machine_creds == 0 &&
+				service == NULL)) {
+		/* Tell krb5 gss which credentials cache to use */
+		/* Try first to acquire credentials directly via GSSAPI */
+		err = gssd_acquire_user_cred(uid, &gss_cred);
+		if (!err)
+			create_resp = create_auth_rpc_client(clp, &rpc_clnt, &auth, uid,
+							     AUTHTYPE_KRB5, gss_cred);
+		/* if create_auth_rplc_client fails try the traditional method of
+		 * trolling for credentials */
+		for (dirname = ccachesearch; create_resp != 0 && *dirname != NULL; dirname++) {
+			err = gssd_setup_krb5_user_gss_ccache(uid, clp->servername, *dirname);
+			if (err == -EKEYEXPIRED)
+				downcall_err = -EKEYEXPIRED;
+			else if (!err)
+				create_resp = create_auth_rpc_client(clp, &rpc_clnt, &auth, uid,
+							     AUTHTYPE_KRB5, GSS_C_NO_CREDENTIAL);
+		}
+	}
+	if (create_resp != 0) {
+		if (uid == 0 && (root_uses_machine_creds == 1 ||
+				service != NULL)) {
+			int nocache = 0;
+			int success = 0;
+			do {
+				gssd_refresh_krb5_machine_credential(clp->servername,
+								     NULL, service,
+								     tgtname);
+				/*
+				 * Get a list of credential cache names and try each
+				 * of them until one works or we've tried them all
+				 */
+				if (gssd_get_krb5_machine_cred_list(&credlist)) {
+					printerr(0, "ERROR: No credentials found "
+						 "for connection to server %s\n",
+						 clp->servername);
+					goto out_return_error;
+				}
+				for (ccname = credlist; ccname && *ccname; ccname++) {
+					gssd_setup_krb5_machine_gss_ccache(*ccname);
+					if ((create_auth_rpc_client(clp, &rpc_clnt,
+								    &auth, uid,
+								    AUTHTYPE_KRB5,
+								    GSS_C_NO_CREDENTIAL)) == 0) {
+						/* Success! */
+						success++;
+						break;
+					}
+					printerr(2, "WARNING: Failed to create machine krb5 context "
+						 "with credentials cache %s for server %s\n",
+						 *ccname, clp->servername);
+				}
+				gssd_free_krb5_machine_cred_list(credlist);
+				if (!success) {
+					if(nocache == 0) {
+						nocache++;
+						printerr(2, "WARNING: Machine cache is prematurely expired or corrupted "
+						            "trying to recreate cache for server %s\n", clp->servername);
+					} else {
+						printerr(1, "WARNING: Failed to create machine krb5 context "
+						 "with any credentials cache for server %s\n",
+						 clp->servername);
+						goto out_return_error;
+					}
+				}
+			} while(!success);
+		} else {
+			printerr(1, "WARNING: Failed to create krb5 context "
+				 "for user with uid %d for server %s\n",
+				 uid, clp->servername);
+			goto out_return_error;
+		}
+	}
+
+	if (!authgss_get_private_data(auth, &pd)) {
+		printerr(2, "WARNING: Failed to obtain authentication "
+			    "data for user with uid %d for server %s\n",
+			 uid, clp->servername);
+		goto out_return_error;
+	}
+
+	/* Grab the context lifetime to pass to the kernel. lifetime_rec
+	 * is set to zero on error */
+	maj_stat = gss_inquire_context(&min_stat, pd.pd_ctx, NULL, NULL,
+				       &lifetime_rec, NULL, NULL, NULL, NULL);
+
+	if (maj_stat)
+		printerr(1, "WARNING: Failed to inquire context for lifetme "
+			    "maj_stat %u\n", maj_stat);
+
+	if (serialize_context_for_kernel(&pd.pd_ctx, &token, &krb5oid, NULL)) {
+		printerr(0, "WARNING: Failed to serialize krb5 context for "
+			    "user with uid %d for server %s\n",
+			 uid, clp->servername);
+		goto out_return_error;
+	}
+
+	do_downcall(fd, uid, &pd, &token, lifetime_rec);
+
+out:
+	if (token.value)
+		free(token.value);
+#ifdef HAVE_AUTHGSS_FREE_PRIVATE_DATA
+	if (pd.pd_ctx_hndl.length != 0 || pd.pd_ctx != 0)
+		authgss_free_private_data(&pd);
+#endif
+	if (auth)
+		AUTH_DESTROY(auth);
+	if (rpc_clnt)
+		clnt_destroy(rpc_clnt);
+	return;
+
+out_return_error:
+	do_error_downcall(fd, uid, downcall_err);
+	goto out;
+}
+
+void
+handle_krb5_upcall(struct clnt_info *clp)
+{
+	uid_t			uid;
+
+	if (read(clp->krb5_fd, &uid, sizeof(uid)) < (ssize_t)sizeof(uid)) {
+		printerr(0, "WARNING: failed reading uid from krb5 "
+			    "upcall pipe: %s\n", strerror(errno));
+		return;
+	}
+
+	process_krb5_upcall(clp, uid, clp->krb5_fd, NULL, NULL);
+}
+
+void
+handle_gssd_upcall(struct clnt_info *clp)
+{
+	uid_t			uid;
+	char			*lbuf = NULL;
+	int			lbuflen = 0;
+	char			*p;
+	char			*mech = NULL;
+	char			*target = NULL;
+	char			*service = NULL;
+	char			*enctypes = NULL;
+
+	printerr(1, "handling gssd upcall (%s)\n", clp->dirname);
+
+	if (readline(clp->gssd_fd, &lbuf, &lbuflen) != 1) {
+		printerr(0, "WARNING: handle_gssd_upcall: "
+			    "failed reading request\n");
+		return;
+	}
+	printerr(2, "%s: '%s'\n", __func__, lbuf);
+
+	/* find the mechanism name */
+	if ((p = strstr(lbuf, "mech=")) != NULL) {
+		mech = malloc(lbuflen);
+		if (!mech)
+			goto out;
+		if (sscanf(p, "mech=%s", mech) != 1) {
+			printerr(0, "WARNING: handle_gssd_upcall: "
+				    "failed to parse gss mechanism name "
+				    "in upcall string '%s'\n", lbuf);
+			goto out;
+		}
+	} else {
+		printerr(0, "WARNING: handle_gssd_upcall: "
+			    "failed to find gss mechanism name "
+			    "in upcall string '%s'\n", lbuf);
+		goto out;
+	}
+
+	/* read uid */
+	if ((p = strstr(lbuf, "uid=")) != NULL) {
+		if (sscanf(p, "uid=%d", &uid) != 1) {
+			printerr(0, "WARNING: handle_gssd_upcall: "
+				    "failed to parse uid "
+				    "in upcall string '%s'\n", lbuf);
+			goto out;
+		}
+	} else {
+		printerr(0, "WARNING: handle_gssd_upcall: "
+			    "failed to find uid "
+			    "in upcall string '%s'\n", lbuf);
+		goto out;
+	}
+
+	/* read supported encryption types if supplied */
+	if ((p = strstr(lbuf, "enctypes=")) != NULL) {
+		enctypes = malloc(lbuflen);
+		if (!enctypes)
+			goto out;
+		if (sscanf(p, "enctypes=%s", enctypes) != 1) {
+			printerr(0, "WARNING: handle_gssd_upcall: "
+				    "failed to parse encryption types "
+				    "in upcall string '%s'\n", lbuf);
+			goto out;
+		}
+		if (parse_enctypes(enctypes) != 0) {
+			printerr(0, "WARNING: handle_gssd_upcall: "
+				"parsing encryption types failed: errno %d\n", errno);
+		}
+	}
+
+	/* read target name */
+	if ((p = strstr(lbuf, "target=")) != NULL) {
+		target = malloc(lbuflen);
+		if (!target)
+			goto out;
+		if (sscanf(p, "target=%s", target) != 1) {
+			printerr(0, "WARNING: handle_gssd_upcall: "
+				    "failed to parse target name "
+				    "in upcall string '%s'\n", lbuf);
+			goto out;
+		}
+	}
+
+	/*
+	 * read the service name
+	 *
+	 * The presence of attribute "service=" indicates that machine
+	 * credentials should be used for this request.  If the value
+	 * is "*", then any machine credentials available can be used.
+	 * If the value is anything else, then machine credentials for
+	 * the specified service name (always "nfs" for now) should be
+	 * used.
+	 */
+	if ((p = strstr(lbuf, "service=")) != NULL) {
+		service = malloc(lbuflen);
+		if (!service)
+			goto out;
+		if (sscanf(p, "service=%s", service) != 1) {
+			printerr(0, "WARNING: handle_gssd_upcall: "
+				    "failed to parse service type "
+				    "in upcall string '%s'\n", lbuf);
+			goto out;
+		}
+	}
+
+	if (strcmp(mech, "krb5") == 0)
+		process_krb5_upcall(clp, uid, clp->gssd_fd, target, service);
+	else
+		printerr(0, "WARNING: handle_gssd_upcall: "
+			    "received unknown gss mech '%s'\n", mech);
+
+out:
+	free(lbuf);
+	free(mech);
+	free(enctypes);
+	free(target);
+	free(service);
+	return;
+}
+

=== modified file '.pc/applied-patches'
--- .pc/applied-patches	2013-05-14 00:46:42 +0000
+++ .pc/applied-patches	2013-05-24 21:14:25 +0000
@@ -5,4 +5,5 @@
 16-mount.nfs.man-update-distinction-between-fstype.patch
 17-multiarch-kerberos-paths.patch
 19-iscsiadm-path.patch
+20-ticket-expired-error.patch
 20-remove-autogenerated-man.patch

=== modified file 'debian/changelog'
--- debian/changelog	2013-05-14 00:46:42 +0000
+++ debian/changelog	2013-05-24 21:14:25 +0000
@@ -1,3 +1,40 @@
+nfs-utils (1:1.2.8-2ubuntu1) UNRELEASED; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/nfs-common.{statd,statd-mounting,gssd,idmapd}.upstart,
+      debian/control, debian/nfs-common.{preinst,postinst,prerm,postrm},
+      debian/rules: drop nfs-common init script in favor of upstart jobs,
+      and build-depend on debhelper (>= 7.3.15ubuntu3) for correct upstart
+      init handling.
+    - Depend on rpcbind (>= 0.2.0-6ubuntu1) for upstart support.
+    - debian/nfs-kernel-server.postinst: don't call "invoke-rc.d nfs-common"
+      in the postinst, this is redundant anyway and the nfs-common init script
+      is gone now.
+    - nfs-kernel-server.init: Unmount nfsd fs when init script stops
+    - Allow issuing options to rpc.nfsd
+    - debian/nfs-common.defaults: always start idmapd automatically; drop
+      the configuration option.
+    - Move /var/lib/nfs/rpc_pipefs to /run/rpc_pipefs.  This does not belong
+      in /var/lib.
+    - Add "-e" (ticket expiry is error) option to rpc.gssd to prevent hangs due
+      to EKEYEXPIRED error from kernel on ticket expiry. LP: #794112
+    - Adjust upstart jobs to treat TYPE=nfs and TYPE=nfs4 mounts identically,
+      since TYPE=nfs4 is considered deprecated.
+    - Fix various boot-time race conditions between mountall and nfs-utils by
+      moving handling of the 'mounting' events to separate gssd-mounting and
+      idmapd-mounting jobs.  Requires mountall 2.41 or better to avoid deadlock
+      on boot.  LP: #643289, LP: #611397.
+    - Fix the stop conditions: never stop on 'runlevel [06]' since that gives
+      the system no time to cleanly unmount nfs mounts; instead, stop only on
+      the unmounted-remote-filesystems event.  LP: #569094.
+    - Newer versions of gssd don't talk to portmap, so don't make the upstart
+      job depend on it.
+    - Add an instance to statd-mounting, and change it to just wait for statd
+      instead of trying to trigger it potentially out of order.  This also
+      means we don't need to try to force portmap to start from statd.
+
+ -- Stéphane Graber <[e-mail]>  Fri, 24 May 2013 16:47:37 -0400
+
 nfs-utils (1:1.2.8-2) unstable; urgency=medium
 
   * Fix reportbug scripts to use rpcinfo in /usr/sbin.
@@ -27,12 +64,80 @@
 
  -- Luk Claes <[e-mail]>  Fri, 10 May 2013 14:27:47 +0200
 
+nfs-utils (1:1.2.6-3ubuntu2) quantal; urgency=low
+
+  [ Steve Langasek ]
+  * Adjust upstart jobs to treat TYPE=nfs and TYPE=nfs4 mounts identically,
+    since TYPE=nfs4 is considered deprecated.
+  * Fix various boot-time race conditions between mountall and nfs-utils by
+    moving handling of the 'mounting' events to separate gssd-mounting and
+    idmapd-mounting jobs.  Requires mountall 2.41 or better to avoid deadlock
+    on boot.  LP: #643289, LP: #611397.
+  * Fix the stop conditions: never stop on 'runlevel [06]' since that gives
+    the system no time to cleanly unmount nfs mounts; instead, stop only on
+    the unmounted-remote-filesystems event.  LP: #569094.
+  * Newer versions of gssd don't talk to portmap, so don't make the upstart
+    job depend on it.
+  * Add an instance to statd-mounting, and change it to just wait for statd
+    instead of trying to trigger it potentially out of order.  This also means
+    we don't need to try to force portmap to start from statd.
+
+  [ Matthew L. Dailey ]
+  * Add "-e" (ticket expiry is error) option to rpc.gssd to prevent hangs due
+    to EKEYEXPIRED error from kernel on ticket expiry. LP: #794112
+
+ -- Stéphane Graber <[e-mail]>  Fri, 28 Sep 2012 13:58:43 -0400
+
+nfs-utils (1:1.2.6-3ubuntu1) quantal; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/nfs-common.{statd,statd-mounting,gssd,idmapd}.upstart,
+      debian/control, debian/nfs-common.{preinst,postinst,prerm,postrm},
+      debian/rules: drop nfs-common init script in favor of upstart jobs,
+      and build-depend on debhelper (>= 7.3.15ubuntu3) for correct upstart
+      init handling.
+    - Depend on rpcbind (>= 0.2.0-6ubuntu1) for upstart support.
+    - debian/nfs-kernel-server.postinst: don't call "invoke-rc.d nfs-common"
+      in the postinst, this is redundant anyway and the nfs-common init script
+      is gone now.
+    - nfs-kernel-server.init: Unmount nfsd fs when init script stops
+    - Allow issuing options to rpc.nfsd
+    - debian/nfs-common.defaults: always start idmapd automatically; drop
+      the configuration option.
+    - Move /var/lib/nfs/rpc_pipefs to /run/rpc_pipefs.  This does not belong
+      in /var/lib.
+
+ -- Logan Rosen <[e-mail]>  Sun, 05 Aug 2012 00:56:05 -0400
+
 nfs-utils (1:1.2.6-3) unstable; urgency=low
 
   * Iterate through exports.d to look for expors (Closes: #676604).
 
  -- Luk Claes <[e-mail]>  Tue, 10 Jul 2012 19:38:22 +0200
 
+nfs-utils (1:1.2.6-2ubuntu1) quantal; urgency=low
+
+  * Merge from Debian unstable, remaining changes:
+    - debian/nfs-common.{statd,statd-mounting,gssd,idmapd}.upstart,
+      debian/control, debian/nfs-common.{preinst,postinst,prerm,postrm},
+      debian/rules: drop nfs-common init script in favor of upstart jobs,
+      and build-depend on debhelper (>= 7.3.15ubuntu3) for correct upstart
+      init handling.
+    - Depend on rpcbind (>= 0.2.0-6ubuntu1) for upstart support.
+    - debian/nfs-kernel-server.postinst: don't call "invoke-rc.d nfs-common"
+      in the postinst, this is redundant anyway and the nfs-common init script
+      is gone now.
+    - nfs-kernel-server.init: Unmount nfsd fs when init script stops
+    - Allow issuing options to rpc.nfsd
+    - debian/nfs-common.defaults: always start idmapd automatically; drop
+      the configuration option.
+    - Move /var/lib/nfs/rpc_pipefs to /run/rpc_pipefs.  This does not belong
+      in /var/lib.
+  * Dropped changes, included in Debian:
+    - nfs-kernel-server.default:  Add comment about how to disable nfs4.
+
+ -- Steve Langasek <[e-mail]>  Fri, 22 Jun 2012 11:25:28 -0700
+
 nfs-utils (1:1.2.6-2) unstable; urgency=low
 
   * Move open-iscsi and watchdog to Suggests.
@@ -60,6 +165,44 @@
 
  -- Luk Claes <[e-mail]>  Sun, 22 Jan 2012 15:46:25 +0100
 
+nfs-utils (1:1.2.5-3ubuntu3) precise; urgency=low
+
+  * In some cases, /var/lib/nfs/rpc_pipefs is successfully unmounted on
+    upgrade but the directory still has contents within it.  Since this is
+    /var/lib we shouldn't assume it's ok for delete these; instead, pass
+    --ignore-fail-on-non-empty to rmdir.  LP: #954619.
+
+ -- Steve Langasek <[e-mail]>  Sun, 08 Apr 2012 22:44:40 -0700
+
+nfs-utils (1:1.2.5-3ubuntu2) precise; urgency=low
+
+  * Fix wrong path to rpcinfo in the init script, which breaks use of nfs
+    v3 support in the server.  LP: #945651.
+
+ -- Steve Langasek <[e-mail]>  Tue, 27 Mar 2012 10:44:03 -0700
+
+nfs-utils (1:1.2.5-3ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing, remaining changes:
+    - debian/nfs-common.{statd,statd-mounting,gssd,idmapd}.upstart,
+      debian/control, debian/nfs-common.{preinst,postinst,prerm,postrm},
+      debian/rules: drop nfs-common init script in favor of upstart jobs,
+      and build-depend on debhelper (>= 7.3.15ubuntu3) for correct upstart
+      init handling.
+    - Depend on rpcbind (>= 0.2.0-6ubuntu1) for upstart support.
+    - debian/nfs-kernel-server.postinst: don't call "invoke-rc.d nfs-common"
+      in the postinst, this is redundant anyway and the nfs-common init script
+      is gone now.
+    - nfs-kernel-server.default:  Add comment about how to disable nfs4.
+    - nfs-kernel-server.init: Unmount nfsd fs when init script stops
+    - Allow issuing options to rpc.nfsd
+    - debian/nfs-common.defaults: always start idmapd automatically; drop
+      the configuration option.
+    - Move /var/lib/nfs/rpc_pipefs to /run/rpc_pipefs.  This does not belong
+      in /var/lib.
+
+ -- Steve Langasek <[e-mail]>  Wed, 04 Jan 2012 09:20:27 -0800
+
 nfs-utils (1:1.2.5-3) unstable; urgency=low
 
   [ Roger Leigh ]
@@ -78,6 +221,33 @@
 
  -- Luk Claes <[e-mail]>  Fri, 09 Dec 2011 11:55:31 +0100
 
+nfs-utils (1:1.2.5-2ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing, remaining changes:
+    - debian/nfs-common.{statd,statd-mounting,gssd,idmapd}.upstart,
+      debian/control, debian/nfs-common.{preinst,postinst,prerm,postrm},
+      debian/rules: drop nfs-common init script in favor of upstart jobs,
+      and build-depend on debhelper (>= 7.3.15ubuntu3) for correct upstart
+      init handling.
+    - Depend on rpcbind (>= 0.2.0-6ubuntu1) for upstart support.
+    - debian/nfs-kernel-server.postinst: don't call "invoke-rc.d nfs-common"
+      in the postinst, this is redundant anyway and the nfs-common init script
+      is gone now.
+    - nfs-kernel-server.default:  Add comment about how to disable nfs4.
+    - nfs-kernel-server.init: Unmount nfsd fs when init script stops
+    - Allow issuing options to rpc.nfsd
+    - debian/nfs-common.defaults: always start idmapd automatically; drop
+      the configuration option.
+    - Move /var/lib/nfs/rpc_pipefs to /run/rpc_pipefs.  This does not belong
+      in /var/lib.
+  * Dropped changes, superseded in Debian/upstream:
+    - debian/patches/multiarch-kerberos-paths: Search for kerberos libs
+      in multiarch locations.
+    - ubuntu-fix-kernel-version-handling: avoid segfaults from short kernel
+      version numbers.
+
+ -- Steve Langasek <[e-mail]>  Sun, 30 Oct 2011 00:12:50 +0000
+
 nfs-utils (1:1.2.5-2) unstable; urgency=low
 
   * debian/patches/18-dont-use-PAGE_SIZE.patch
@@ -120,6 +290,57 @@
 
  -- Luk Claes <[e-mail]>  Sat, 06 Aug 2011 07:38:48 +0200
 
+nfs-utils (1:1.2.4-1ubuntu4) precise; urgency=low
+
+  * debian/nfs-common.postinst: handle the case when /var/lib/nfs/rpc_pipefs
+    is not already mounted on upgrade - dpkg will already remove the
+    directory for us on upgrade, so don't fail when it's missing.
+    LP: #882799.
+
+ -- Steve Langasek <[e-mail]>  Thu, 27 Oct 2011 16:21:22 -0700
+
+nfs-utils (1:1.2.4-1ubuntu3) precise; urgency=low
+
+  * debian/nfs-common.defaults, debian/nfs-common.idmapd.upstart: idmapd
+    should always be started automatically, because we can no longer assume
+    that a mount of type 'nfs' in /etc/fstab is not nfs4.  This also lets
+    things work by default with nfs4 autofs.  LP: #662711.
+  * Move /var/lib/nfs/rpc_pipefs to /run/rpc_pipefs.  This does not belong
+    in /var/lib.
+  * Ignore errors from mount if the filesystem is already mounted.
+    LP: #811823.
+
+ -- Steve Langasek <[e-mail]>  Thu, 27 Oct 2011 12:04:58 -0700
+
+nfs-utils (1:1.2.4-1ubuntu2) oneiric; urgency=low
+
+  * Allow issuing options to rpc.nfsd
+    (LP: #567491)
+
+ -- Bryce Harrington <[e-mail]>  Mon, 08 Aug 2011 16:37:26 -0700
+
+nfs-utils (1:1.2.4-1ubuntu1) oneiric; urgency=low
+
+  * Merge from Debian unstable (LP: #728586, LP: #789117), remaining
+    changes:
+    - debian/nfs-common.{statd,statd-mounting,gssd,idmapd}.upstart,
+      debian/control, debian/nfs-common.{preinst,postinst,prerm,postrm},
+      debian/rules: drop nfs-common init script in favor of upstart jobs,
+      and build-depend on debhelper (>= 7.3.15ubuntu3) for correct upstart
+      init handling.
+    - Depend on rpcbind (>= 0.2.0-6ubuntu1) for upstart support.
+    - debian/nfs-kernel-server.postinst: don't call "invoke-rc.d nfs-common"
+      in the postinst, this is redundant anyway and the nfs-common init script
+      is gone now.
+    - nfs-kernel-server.default:  Add comment about how to disable nfs4.
+    - debian/patches/multiarch-kerberos-paths: Search for kerberos libs
+      in multiarch locations.
+    - nfs-kernel-server.init: Unmount nfsd fs when init script stops
+    - ubuntu-fix-kernel-version-handling: avoid segfaults from short kernel
+      version numbers.
+
+ -- Steve Langasek <[e-mail]>  Sat, 23 Jul 2011 17:54:36 +0200
+
 nfs-utils (1:1.2.4-1) unstable; urgency=low
 
   * New upstream version
@@ -207,6 +428,93 @@
 
  -- Luk Claes <[e-mail]>  Wed, 16 Mar 2011 23:10:15 +0100
 
+nfs-utils (1:1.2.2-4ubuntu8) oneiric; urgency=low
+
+  * debian/nfs-common.idmapd.upstart: don't use a script unnecessarily for
+    our job when we can exec directly - making the job more resilient in
+    the face of races with /usr being mounted.  LP: #811823.
+  * Drop rpc_pipefs.conf; this has gotten far more complicated than it
+    should be, just do the mount in-line in each of the gssd and idmapd
+    jobs.
+
+ -- Steve Langasek <[e-mail]>  Sun, 17 Jul 2011 02:23:01 -0700
+
+nfs-utils (1:1.2.2-4ubuntu7) oneiric; urgency=low
+
+  [ Andy Whitcroft ]
+  * ubuntu-fix-kernel-version-handling: avoid segfaults from short kernel
+    version numbers. (LP: #796611)
+
+ -- Evan Dandrea <[e-mail]>  Tue, 14 Jun 2011 17:13:14 +0100
+
+nfs-utils (1:1.2.2-4ubuntu6) oneiric; urgency=low
+
+  * nfs-kernel-server.init: Unmount nfsd fs when init script stops
+    (LP: #251026)
+
+ -- Bryce Harrington <[e-mail]>  Mon, 06 Jun 2011 19:18:16 -0700
+
+nfs-utils (1:1.2.2-4ubuntu5) natty; urgency=low
+
+  * Search kerberos libs in multiarch locations.
+
+ -- Matthias Klose <[e-mail]>  Fri, 01 Apr 2011 12:35:30 +0200
+
+nfs-utils (1:1.2.2-4ubuntu4) natty; urgency=low
+
+  * nvs-kernel-server.default:  Add comment about how to disable nfs4.
+    There are corner cases where the server providing nfsv4 as the default
+    can confuse the client (117957, 680680) or even cause kernel problems
+    (716811), so it is worthwhile to document how to fallback to nfs3 only.
+
+ -- Bryce Harrington <[e-mail]>  Mon, 14 Feb 2011 13:20:27 -0800
+
+nfs-utils (1:1.2.2-4ubuntu3) natty; urgency=low
+
+  * debian/nfs-common.statd.upstart: pass a new WAITER= variable
+    to portmap-wait, so that multiple jobs can wait in parallel, fixing
+    another subtle race condition; and bump the portmap dependency again for
+    the necessary instance support.
+  * also fix the grouping in the start condition, so that restarts work
+    correctly when portmap is restarted.
+  * debian/nfs-common.rpc_pipefs.upstart: instantiate this job separately for
+    gssd and idmapd, so that the filesystem gets mounted and unmounted
+    correctly even if both of gssd and idmapd aren't being run, or if one of
+    the two tries to start before the filesystem is fully mounted.  Though
+    it may be simpler now to move this logic back into the gssd and idmapd
+    jobs directly, leave that for a later date.
+
+ -- Steve Langasek <[e-mail]>  Tue, 18 Jan 2011 17:45:45 -0800
+
+nfs-utils (1:1.2.2-4ubuntu2) natty; urgency=low
+
+  * debian/nfs-common.statd.upstart, 
+    debian/nfs-common.statd-mounting.upstart: refactor startup to wait for
+    local-filesystems. (LP: #525154)
+  * debian/control: depend on portmap version that sets ON_BOOT=y and
+    has the portmap-wait job.
+  * debian/rules: install new statd-mounting upstart job
+
+ -- Clint Byrum <[e-mail]>  Wed, 05 Jan 2011 12:27:32 -0800
+
+nfs-utils (1:1.2.2-4ubuntu1) natty; urgency=low
+
+  * Merge from debian unstable (LP: #685860), remaining changes:
+    - debian/nfs-common.{statd,gssd,idmapd,rpc_pipefs}.upstart,
+      debian/control, debian/nfs-common.{preinst,postinst,prerm,postrm},
+      debian/rules: drop nfs-common init script in favor of upstart jobs, and
+      build-depend on debhelper (>= 7.3.15ubuntu3) for correct upstart init
+      handling.
+    - debian/control: 
+      + depend on the upstart-using version of portmap, 6.0-10ubuntu1; and 
+        drop the alternative depends on rpcbind, which hasn't been converted.
+      + depend on portmap 6.0-10ubuntu1.
+    - debian/nfs-kernel-server.postinst: don't call "invoke-rc.d nfs-common"
+      in the postinst, this is redundant anyway and the nfs-common init script
+      is gone now.
+
+ -- Lorenzo De Liso <[e-mail]>  Wed, 15 Dec 2010 21:42:55 +0100
+
 nfs-utils (1:1.2.2-4) unstable; urgency=low
 
   * mountd: fix path comparison for v4 crossmnt (Closes: #578317)
@@ -234,6 +542,28 @@
 
  -- Anibal Monsalve Salazar <[e-mail]>  Tue, 13 Jul 2010 15:20:17 +1000
  
+nfs-utils (1:1.2.2-1ubuntu1) maverick; urgency=low
+
+  * Merge from Debian unstable, remaining changes:
+    - debian/nfs-common.{statd,gssd,idmapd,rpc_pipefs}.upstart,
+      debian/control, debian/nfs-common.{preinst,postinst,prerm,postrm},
+      debian/rules: drop nfs-common init script in favor of upstart jobs, and
+      build-depend on debhelper (>= 7.3.15ubuntu3) for correct upstart init
+      handling.
+    - debian/control: depend on the upstart-using version of portmap,
+      6.0-10ubuntu1; and drop the alternative depends on rpcbind, which
+      hasn't been converted.
+    - debian/nfs-kernel-server.postinst: don't call "invoke-rc.d nfs-common"
+      in the postinst, this is redundant anyway and the nfs-common init script
+      is gone now.
+  * Dropped changes, included in Debian:
+    - debian/control: add ${misc:Depends} line for nfs-common, for the
+      upstart deps
+    - debian/nfs-kernel-server.init: updated check for presence of nfsd
+      support
+
+ -- Steve Langasek <[e-mail]>  Fri, 04 Jun 2010 09:55:28 +0000
+
 nfs-utils (1:1.2.2-1) unstable; urgency=low
 
   [ Anibal Monsalve Salazar ]
@@ -305,6 +635,51 @@
 
  -- Ben Hutchings <[e-mail]>  Wed, 16 Dec 2009 22:14:01 +0000
 
+nfs-utils (1:1.2.0-4ubuntu4) lucid; urgency=low
+
+  * debian/nfs-common.gssd.upstart:
+    - fix the OPTIONS= match for the start condition (missing a leading '*')
+      so that we actually match on nfs4 mounts
+    - drop the 'script' for a straight exec of rpc.gssd; if /usr is a separate
+      partition then nfs4 mounts might be attempted in parallel, and upstart
+      gets mightily confused when this happens.  LP: #545673
+
+ -- Steve Langasek <[e-mail]>  Tue, 23 Mar 2010 22:26:07 -0700
+
+nfs-utils (1:1.2.0-4ubuntu3) lucid; urgency=low
+
+  * debian/nfs-common.*.upstart: start on new 'mounting' signal instead of
+    obsolete 'mount' signal.
+
+ -- Steve Langasek <[e-mail]>  Thu, 25 Feb 2010 06:41:46 -0800
+
+nfs-utils (1:1.2.0-4ubuntu2) lucid; urgency=low
+
+  * debian/nfs-kernel-server.init: 2.6.32 kernels no longer export the
+    same symbols.  Switch symbol check to nfsd_serv which has been present
+    since 2005.  LP: #493145.
+
+ -- Andy Whitcroft <[e-mail]>  Mon, 07 Dec 2009 16:56:56 +0000
+
+nfs-utils (1:1.2.0-4ubuntu1) lucid; urgency=low
+
+  * Merge from Debian testing, remaining changes:
+    - debian/nfs-common.{statd,gssd,idmapd,rpc_pipefs}.upstart,
+      debian/control, debian/nfs-common.{preinst,postinst,prerm,postrm},
+      debian/rules: drop nfs-common init script in favor of upstart jobs, and
+      build-depend on debhelper (>= 7.3.15ubuntu3) for correct upstart init
+      handling.
+    - debian/control: depend on the upstart-using version of portmap,
+      6.0-10ubuntu1; and drop the alternative depends on rpcbind, which
+      hasn't been converted.
+    - debian/control: add ${misc:Depends} line for nfs-common, for the
+      upstart deps
+    - debian/nfs-kernel-server.postinst: don't call "invoke-rc.d nfs-common"
+      in the postinst, this is redundant anyway and the nfs-common init script
+      is gone now.
+
+ -- Steve Langasek <[e-mail]>  Fri, 04 Dec 2009 18:37:48 -0800
+
 nfs-utils (1:1.2.0-4) unstable; urgency=low
 
   * Removing myself from uploaders.
@@ -319,6 +694,94 @@
 
  -- Steinar H. Gunderson <[e-mail]>  Sun, 09 Aug 2009 12:47:00 +0200
 
+nfs-utils (1:1.2.0-2ubuntu9) lucid; urgency=low
+
+  * debian/nfs-common.statd.upstart: check for a started portmap in a
+    non-racy manner.  LP: #484209.
+
+ -- Steve Langasek <[e-mail]>  Tue, 17 Nov 2009 11:27:37 -0600
+
+nfs-utils (1:1.2.0-2ubuntu8) karmic; urgency=low
+
+  * debian/control: add missing ${misc:Depends} for nfs-common, else we don't
+    get the dependency on upstart that we should have.  LP: #456281.
+
+ -- Steve Langasek <[e-mail]>  Tue, 20 Oct 2009 13:10:01 +0000
+
+nfs-utils (1:1.2.0-2ubuntu7) karmic; urgency=low
+
+  * debian/rules: now that the jobs will exit cleanly on their own when
+    'start' is called but the job is a no-op, remove the --error-handler
+    option to dh_installinit so that we don't accidentally ignore other
+    kinds of errors that could point to real problems.
+
+ -- Steve Langasek <[e-mail]>  Sun, 11 Oct 2009 08:51:39 +0000
+
+nfs-utils (1:1.2.0-2ubuntu6) karmic; urgency=low
+
+  * Drop the gssd upstart job's dependency on "local-filesystems"; at boot
+    time this is always implied transitively by the dep on portmap, and using
+    a combination of 'or' and 'and' operators in the dependency list seems
+    to confuse upstart quite badly, causing kerberized mounts to hang at boot.
+    LP: #447654.
+
+ -- Steve Langasek <[e-mail]>  Sat, 10 Oct 2009 20:12:11 +0000
+
+nfs-utils (1:1.2.0-2ubuntu5) karmic; urgency=low
+
+  * Set upstart jobs to also start on mount attempt, in the event that
+    mountall gets to them before the daemons are done starting.  Really-fixes
+    LP: #431248.
+  * Call 'stop' in the pre-start scripts for all jobs when we want to prevent
+    the job from starting; this lets upstart know that it's a clean stop,
+    and avoids boot-time messages about service start failures
+
+ -- Steve Langasek <[e-mail]>  Fri, 09 Oct 2009 19:17:34 +0000
+
+nfs-utils (1:1.2.0-2ubuntu4) karmic; urgency=low
+
+  * Mounting rpc_pipefs also requires the sunrpc module, so move this
+    modprobe to the right upstart job.
+
+ -- Steve Langasek <[e-mail]>  Mon, 05 Oct 2009 22:04:28 -0700
+
+nfs-utils (1:1.2.0-2ubuntu3) karmic; urgency=low
+
+  * nfs-kernel-server: don't call invoke-rc.d nfs-common in the postinst,
+    this is redundant anyway and the nfs-common init script is gone now.
+    LP: #441855.
+
+ -- Steve Langasek <[e-mail]>  Sat, 03 Oct 2009 23:07:09 -0700
+
+nfs-utils (1:1.2.0-2ubuntu2) karmic; urgency=low
+
+  * Configure gssd and idmapd upstart jobs to stop on runlevels 0 and 6; this
+    is consistent with previous initscript-based behavior, and spares upstart
+    trying to restart the jobs repeatedly when sendsigs runs.
+  * When autodetecting gssd, handle the case of 'sec=krb5' being embedded in
+    the middle of the options list in /etc/fstab.  LP: #364861.
+  * Fix transition idempotency error when stopping old nfs-common init
+    script, in case the postinst fails to finish afterwards (e.g., failure to
+    restart the daemons).
+  * Fix statd upstart job to properly honor NEED_STATD=no and not get stuck
+    respawning indefinitely.
+  * Ignore failures to start the daemons on upgrade, since if they aren't
+    needed we don't *want* them to start.  LP: #441055.
+  * Fix up the rpc_pipefs job, the wrong version of the file slipped into
+    the previous upload.
+
+ -- Steve Langasek <[e-mail]>  Sat, 03 Oct 2009 01:52:21 +0000
+
+nfs-utils (1:1.2.0-2ubuntu1) karmic; urgency=low
+
+  * Drop nfs-common init script in favor of new upstart jobs.  LP: #431248.
+  * Build-depend on debhelper (>= 7.3.15ubuntu3) for correct upstart init
+    handling.
+  * Depend the upstart-using version of portmap, 6.0-10ubuntu1; and drop the
+    alternative depends on rpcbind, which hasn't been converted.
+
+ -- Steve Langasek <[e-mail]>  Fri, 02 Oct 2009 19:23:19 +0000
+
 nfs-utils (1:1.2.0-2) unstable; urgency=low
 
   * Merge from Ubuntu

=== modified file 'debian/control'
--- debian/control	2013-05-10 19:27:47 +0000
+++ debian/control	2013-05-24 21:14:25 +0000
@@ -1,9 +1,10 @@
 Source: nfs-utils
 Priority: standard
 Section: net
-Maintainer: Debian kernel team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian kernel team <[e-mail]>
 Uploaders: Anibal Monsalve Salazar <[e-mail]>, Ben Hutchings <[e-mail]>, Luk Claes <[e-mail]>
-Build-Depends: debhelper (>= 7), libwrap0-dev, libevent-dev, libnfsidmap-dev (>= 0.24), libkrb5-dev, libgssglue-dev (>= 0.3), libblkid-dev, libkeyutils-dev, pkg-config, libldap2-dev, libcap-dev, libtirpc-dev, libdevmapper-dev, dh-autoreconf, libmount-dev, libsqlite3-dev
+Build-Depends: debhelper (>= 7.3.15ubuntu3), libwrap0-dev, libevent-dev, libnfsidmap-dev (>= 0.24), libkrb5-dev, libgssglue-dev (>= 0.3), libblkid-dev, libkeyutils-dev, pkg-config, libldap2-dev, libcap-dev, libtirpc-dev, libdevmapper-dev, dh-autoreconf, libmount-dev, libsqlite3-dev
 Standards-Version: 3.9.0
 Homepage: http://nfs.sourceforge.net/
 Vcs-Git: git://git.debian.org/kernel/nfs-utils.git
@@ -32,7 +33,7 @@
 
 Package: nfs-common
 Architecture: any
-Depends: ${shlibs:Depends}, ${misc:Depends}, rpcbind, adduser, ucf, lsb-base (>= 1.3-9ubuntu3), initscripts (>= 2.88dsf-13.3)
+Depends: ${shlibs:Depends}, ${misc:Depends}, rpcbind (>= 0.2.0-6ubuntu1), adduser, ucf, lsb-base (>= 1.3-9ubuntu3), initscripts (>= 2.88dsf-13.10ubuntu1), mountall (>= 2.41)
 Recommends: python
 Suggests: open-iscsi, watchdog
 Provides: nfs-client

=== modified file 'debian/idmapd.conf'
--- debian/idmapd.conf	2011-10-02 18:29:53 +0000
+++ debian/idmapd.conf	2013-05-24 21:14:25 +0000
@@ -1,7 +1,7 @@
 [General]
 
 Verbosity = 0
-Pipefs-Directory = /var/lib/nfs/rpc_pipefs
+Pipefs-Directory = /run/rpc_pipefs
 # set your own domain here, if id differs from FQDN minus hostname
 # Domain = localdomain
 

=== modified file 'debian/nfs-common.default'
--- debian/nfs-common.default	2011-03-16 23:10:15 +0000
+++ debian/nfs-common.default	2013-05-24 21:14:25 +0000
@@ -12,8 +12,5 @@
 #   For more information, see rpc.statd(8) or http://wiki.debian.org/SecuringNFS
 STATDOPTS=
 
-# Do you want to start the idmapd daemon? It is only needed for NFSv4.
-NEED_IDMAPD=
-
 # Do you want to start the gssd daemon? It is required for Kerberos mounts.
 NEED_GSSD=

=== modified file 'debian/nfs-common.dirs'
--- debian/nfs-common.dirs	2011-03-27 18:54:45 +0000
+++ debian/nfs-common.dirs	2013-05-24 21:14:25 +0000
@@ -4,7 +4,6 @@
 var/lib/nfs
 var/lib/nfs/sm
 var/lib/nfs/sm.bak
-var/lib/nfs/rpc_pipefs
 usr/share/nfs-common/conffiles
 usr/share/bug/nfs-common
 usr/share/bug/nfs-utils

=== added file 'debian/nfs-common.gssd-mounting.upstart'
--- debian/nfs-common.gssd-mounting.upstart	1970-01-01 00:00:00 +0000
+++ debian/nfs-common.gssd-mounting.upstart	2013-05-24 21:14:25 +0000
@@ -0,0 +1,57 @@
+# gssd-mounting
+
+description "Block the mounting event for NFS4 filesytems until gssd is running"
+author "Steve Langasek <[e-mail]>"
+
+instance $MOUNTPOINT
+
+start on mounting TYPE=nfs* OPTIONS=*sec*krb5*
+stop on started gssd or stopped gssd
+task
+
+# This is required so that the task is still considered
+# successful when it gets killed
+normal exit TERM
+
+script
+
+  DEFAULTFILE=/etc/default/nfs-common
+
+  if [ -f "$DEFAULTFILE" ]; then
+    . "$DEFAULTFILE"
+  fi
+
+  if [ -f /etc/fstab ]; then
+    exec 9<&0 </etc/fstab
+
+    while read DEV MTPT FSTYPE OPTS REST
+    do
+      case "$OPTS" in
+        sec=krb5|*,sec=krb5|sec=krb5,*|*,sec=krb5,*|sec=krb5i|*,sec=krb5i|sec=krb5i,*|*,sec=krb5i,*|sec=krb5p|*,sec=krb5p|sec=krb5p,*|*,sec=krb5p,*)
+          AUTO_NEED_GSSD=yes
+          ;;
+      esac
+    done
+
+    exec 0<&9 9<&-
+  fi
+
+  case "$NEED_GSSD" in
+    yes|no)
+      ;;
+    *)
+      NEED_GSSD=$AUTO_NEED_GSSD
+      ;;
+  esac
+  [ "x$NEED_GSSD" = xyes ] || { stop; exit 0; }
+
+  status gssd | grep -q "start/running" && exit 0
+
+  # If it's already starting we'll get killed by the impending 'stop on
+  # started gssd' 
+  # If it wasn't already starting, we'll either get killed by the stop
+  # on started or stopped.
+  # So, its safe to sleep forever here and rely on upstart to kill us,
+
+  while sleep 3600; do :; done
+end script

=== added file 'debian/nfs-common.gssd.upstart'
--- debian/nfs-common.gssd.upstart	1970-01-01 00:00:00 +0000
+++ debian/nfs-common.gssd.upstart	2013-05-24 21:14:25 +0000
@@ -0,0 +1,86 @@
+# gssd - rpcsec_gss daemon
+
+# The rpcsec_gss protocol gives a means of using the GSS-API generic security
+# API to provide security for protocols using RPC (in particular, NFS).
+
+description	"rpcsec_gss daemon"
+author		"Steve Langasek <[e-mail]>"
+
+start on local-filesystems
+stop on unmounted-remote-filesystems
+
+expect fork
+respawn
+
+env DEFAULTFILE=/etc/default/nfs-common
+env PIPEFS_MOUNTPOINT=/run/rpc_pipefs
+
+pre-start script
+	do_modprobe() {
+		modprobe -q "$1" || true
+	}
+
+	if [ -f "$DEFAULTFILE" ]; then
+		. "$DEFAULTFILE"
+	fi
+
+	#
+	# Parse the fstab file, and determine whether we need gssd. (The
+	# /etc/defaults settings, if any, will override our autodetection.)
+	# This code is partially adapted from the mountnfs.sh script in the
+	# sysvinit package.
+
+	if [ -f /etc/fstab ]; then
+		exec 9<&0 </etc/fstab
+
+		while read DEV MTPT FSTYPE OPTS REST
+		do
+			case "$OPTS" in
+				sec=krb5|*,sec=krb5|sec=krb5,*|*,sec=krb5,*|sec=krb5i|*,sec=krb5i|sec=krb5i,*|*,sec=krb5i,*|sec=krb5p|*,sec=krb5p|sec=krb5p,*|*,sec=krb5p,*)
+					AUTO_NEED_GSSD=yes
+					;;
+			esac
+		done
+
+		exec 0<&9 9<&-
+	fi
+
+	case "$NEED_GSSD" in
+		yes|no)
+			;;
+		*)
+			NEED_GSSD=$AUTO_NEED_GSSD
+			;;
+	esac
+	[ "x$NEED_GSSD" = xyes ] || { stop; exit 0; }
+
+	# we need this available; better to fail now than
+	# mysteriously on the first mount
+	if ! grep -q -E '^nfs[	 ]' /etc/services; then
+		echo "broken /etc/services, please see /usr/share/doc/nfs-common/README.Debian.nfsv4"
+		exit 1
+	fi
+
+	do_modprobe nfs
+	do_modprobe nfsd
+	do_modprobe rpcsec_gss_krb5
+
+	do_modprobe sunrpc
+
+	if ! mountpoint -q "$PIPEFS_MOUNTPOINT"
+	then
+		mkdir -p "$PIPEFS_MOUNTPOINT"
+		mount -t rpc_pipefs rpc_pipefs "$PIPEFS_MOUNTPOINT" || true
+	fi
+end script
+
+exec rpc.gssd
+
+post-stop script
+	if mountpoint -q "$PIPEFS_MOUNTPOINT"
+	then
+		# ignore any failures caused by the filesystem still
+		# being in use
+		umount "$PIPEFS_MOUNTPOINT" || true
+	fi
+end script

=== added file 'debian/nfs-common.idmapd-mounting.upstart'
--- debian/nfs-common.idmapd-mounting.upstart	1970-01-01 00:00:00 +0000
+++ debian/nfs-common.idmapd-mounting.upstart	2013-05-24 21:14:25 +0000
@@ -0,0 +1,27 @@
+# idmapd-mounting
+
+description "Block the mounting event for NFS4 filesytems until idmapd is running"
+author "Steve Langasek <[e-mail]>"
+
+instance $MOUNTPOINT
+
+start on mounting TYPE=nfs*
+stop on started idmapd or stopped idmapd
+task
+
+# This is required so that the task is still considered
+# successful when it gets killed
+normal exit TERM
+
+script
+
+  status idmapd | grep -q "start/running" && exit 0
+
+  # If it's already starting we'll get killed by the impending 'stop on
+  # started idmapd' 
+  # If it wasn't already starting, we'll either get killed by the stop
+  # on started or stopped.
+  # So, its safe to sleep forever here and rely on upstart to kill us,
+
+  while sleep 3600; do :; done
+end script

=== added file 'debian/nfs-common.idmapd.upstart'
--- debian/nfs-common.idmapd.upstart	1970-01-01 00:00:00 +0000
+++ debian/nfs-common.idmapd.upstart	2013-05-24 21:14:25 +0000
@@ -0,0 +1,46 @@
+# idmapd - NFSv4 id <-> name mapper
+
+# rpc.idmapd is the NFSv4 ID <-> name mapping daemon.  It provides
+# functionality to the NFSv4 kernel client and server, to which it
+# communicates via upcalls, by translating user and group IDs to names, and
+# vice versa.
+
+description	"NFSv4 id <-> name mapper"
+author		"Steve Langasek <[e-mail]>"
+
+start on local-filesystems
+stop on unmounted-remote-filesystems
+
+expect fork
+respawn
+
+env PIPEFS_MOUNTPOINT=/run/rpc_pipefs
+
+pre-start script
+	do_modprobe() {
+		modprobe -q "$1" || true
+	}
+
+	do_modprobe nfs
+	do_modprobe nfsd
+
+	do_modprobe sunrpc
+
+	if ! mountpoint -q "$PIPEFS_MOUNTPOINT"
+	then
+		mkdir -p "$PIPEFS_MOUNTPOINT"
+		mount -t rpc_pipefs rpc_pipefs "$PIPEFS_MOUNTPOINT" || true
+	fi
+end script
+
+exec rpc.idmapd
+
+post-stop script
+	if mountpoint -q "$PIPEFS_MOUNTPOINT"
+	then
+		# ignore any failures caused by the filesystem still
+		# being in use
+		umount "$PIPEFS_MOUNTPOINT" || true
+	fi
+end script
+

=== modified file 'debian/nfs-common.init'
--- debian/nfs-common.init	2013-05-10 19:27:47 +0000
+++ debian/nfs-common.init	2013-05-24 21:14:25 +0000
@@ -20,7 +20,7 @@
 NEED_STATD=
 NEED_IDMAPD=
 NEED_GSSD=
-PIPEFS_MOUNTPOINT=/var/lib/nfs/rpc_pipefs
+PIPEFS_MOUNTPOINT=/run/rpc_pipefs
 RPCGSSDOPTS=
 if [ -f $DEFAULTFILE ]; then
     . $DEFAULTFILE
@@ -172,6 +172,7 @@
 	    do_modprobe sunrpc
 	    do_modprobe nfs
 	    do_modprobe nfsd
+	    mkdir -p "$PIPEFS_MOUNTPOINT"
 	    if do_mount rpc_pipefs $PIPEFS_MOUNTPOINT
 	    then
 	    	if [ "$NEED_IDMAPD" = yes ]

=== modified file 'debian/nfs-common.postinst'
--- debian/nfs-common.postinst	2012-01-22 15:46:25 +0000
+++ debian/nfs-common.postinst	2013-05-24 21:14:25 +0000
@@ -2,18 +2,23 @@
 
 set -e
 
-#DEBHELPER#
+finish_rm_conffile() {
+	local CONFFILE="$1"
+
+	if [ -e "$CONFFILE.dpkg-backup" ]; then
+		mv -f "$CONFFILE.dpkg-backup" "$CONFFILE.dpkg-bak"
+	fi
+	if [ -e "$CONFFILE.dpkg-remove" ]; then
+		echo "Removing obsolete conffile $CONFFILE ..."
+		rm -f "$CONFFILE.dpkg-remove"
+	fi
+}
 
 case "$1" in
     configure)
         ucf --three-way /usr/share/nfs-common/conffiles/idmapd.conf /etc/idmapd.conf
         ucf --three-way /usr/share/nfs-common/conffiles/nfs-common.default /etc/default/nfs-common
 
-        if [ "$2" != "" ] && dpkg --compare-versions "$2" lt 1:1.1.0-10; then
-            update-rc.d -f nfs-common remove >/dev/null
-        fi
-        update-rc.d nfs-common start 20 2 3 4 5 . stop 20 0 1 6 . start 44 S . >/dev/null
-
         if ! getent passwd statd >/dev/null; then
             adduser --system --home /var/lib/nfs --no-create-home statd
         fi
@@ -26,7 +31,6 @@
 
         chown statd: /var/lib/nfs/sm \
             /var/lib/nfs/sm.bak \
-            /var/lib/nfs/rpc_pipefs \
             /var/lib/nfs
         if [ -f /var/lib/nfs/state ]; then
             chown statd /var/lib/nfs/state
@@ -38,6 +42,26 @@
             fi
         fi
 
+	if dpkg --compare-versions "$2" lt-nl 1:1.2.0-2ubuntu1
+	then
+		if [ -e /etc/init.d/nfs-common.dpkg-remove ]
+		then
+			invoke-rc.d nfs-common.dpkg-remove stop
+		elif [ -e /etc/init.d/nfs-common.dpkg-backup ]
+		then
+			invoke-rc.d nfs-common.dpkg-backup stop
+		fi
+		update-rc.d nfs-common remove
+	elif dpkg --compare-versions "$2" lt-nl 1:1.2.4-1ubuntu3
+	then
+		# handle the move of rpc_pipefs from /var/lib to /run
+		invoke-rc.d idmapd stop
+		invoke-rc.d gssd stop
+		if [ -d /var/lib/nfs/rpc_pipefs ]; then
+			rmdir --ignore-fail-on-non-empty /var/lib/nfs/rpc_pipefs
+		fi
+	fi
+
 	# Migrate /lib/init/rw/sendsigs.omit.statd to /run.
 	if [ -f /lib/init/rw/sendsigs.omit.d/statd ]; then 
 	    mv /lib/init/rw/sendsigs.omit.d/statd /run/sendsigs.omit.d/statd
@@ -45,6 +69,10 @@
     ;;
 esac
 
-act="restart"
-[ "$1:$2" = "configure:" ] && act="start"
-invoke-rc.d nfs-common $act
+finish_rm_conffile /etc/init/rpc_pipefs.conf
+
+
+
+#DEBHELPER#
+
+finish_rm_conffile /etc/init.d/nfs-common

=== modified file 'debian/nfs-common.postrm'
--- debian/nfs-common.postrm	2009-06-06 01:19:54 +0000
+++ debian/nfs-common.postrm	2013-05-24 21:14:25 +0000
@@ -6,7 +6,6 @@
 
 case "$1" in
     purge)
-	update-rc.d nfs-common remove >/dev/null
 
 	for FILE in /etc/default/nfs-common /etc/idmapd.conf; do
 	    # Taken from the ucf example postrm

=== added file 'debian/nfs-common.preinst'
--- debian/nfs-common.preinst	1970-01-01 00:00:00 +0000
+++ debian/nfs-common.preinst	2013-05-24 21:14:25 +0000
@@ -0,0 +1,33 @@
+#!/bin/sh
+
+set -e
+
+prepare_rm_conffile() {
+	local CONFFILE="$1"
+	local PACKAGE="$2"
+
+	[ -e "$CONFFILE" ] || return 0
+
+	local md5sum="$(md5sum $CONFFILE | sed -e 's/ .*//')"
+	local old_md5sum="$(dpkg-query -W -f='${Conffiles}' $PACKAGE | \
+		sed -n -e "\' $CONFFILE ' { s/ obsolete$//; s/.* //; p }")"
+	if [ "$md5sum" != "$old_md5sum" ]; then
+		echo "Obsolete conffile $CONFFILE has been modified by you."
+		echo "Saving as $CONFFILE.dpkg-bak ..."
+		mv -f "$CONFFILE" "$CONFFILE.dpkg-backup"
+	else
+		echo "Moving obsolete conffile $CONFFILE out of the way..."
+		mv -f "$CONFFILE" "$CONFFILE.dpkg-remove"
+	fi
+}
+
+# remove the obsolete init script (replaced by an upstart job)
+if [ "$1" = install ] || [ "$1" = upgrade ]; then
+	if [ -e "/etc/init.d/nfs-common" ] && [ ! -L "/etc/init.d/nfs-common" ]; then
+		prepare_rm_conffile /etc/init.d/nfs-common nfs-common
+	fi
+fi
+
+prepare_rm_conffile /etc/init/rpc_pipefs.conf nfs-common
+
+#DEBHELPER#

=== modified file 'debian/nfs-common.prerm'
--- debian/nfs-common.prerm	2009-06-06 01:19:54 +0000
+++ debian/nfs-common.prerm	2013-05-24 21:14:25 +0000
@@ -4,13 +4,6 @@
 
 #DEBHELPER#
 
-case "$1" in
-    remove|purge)
-	[ -x /etc/init.d/nfs-common ] &&
-	    invoke-rc.d nfs-common stop
-	;;
-esac
-
 if [ "$1" != upgrade ]
 then
     rm -f /var/lib/nfs/sm/*      \

=== added file 'debian/nfs-common.statd-mounting.upstart'
--- debian/nfs-common.statd-mounting.upstart	1970-01-01 00:00:00 +0000
+++ debian/nfs-common.statd-mounting.upstart	2013-05-24 21:14:25 +0000
@@ -0,0 +1,30 @@
+# statd-mounting
+
+description "Block the mounting event for NFS filesytems until statd is running"
+author "Clint Byrum <[e-mail]>"
+
+instance $MOUNTPOINT
+
+start on mounting TYPE=nfs
+stop on started statd or stopped statd
+task
+
+# This is required so that the task is still considered
+# successful when it gets killed
+normal exit 2
+
+script
+
+  . /etc/default/nfs-common
+
+  [ "x$NEED_STATD" != "xno" ] || exit 0
+  status statd | grep -q "start/running" && exit 0
+
+  # If its already starting we'll get killed by the impending 'stop on
+  # started statd' 
+  # If it wasn't already starting, we'll either get killed by the stop
+  # on started or stopped.
+  # So, its safe to sleep forever here and rely on upstart to kill us,
+
+  while sleep 3600; do :; done
+end script

=== added file 'debian/nfs-common.statd.upstart'
--- debian/nfs-common.statd.upstart	1970-01-01 00:00:00 +0000
+++ debian/nfs-common.statd.upstart	2013-05-24 21:14:25 +0000
@@ -0,0 +1,43 @@
+# statd - NSM status monitor
+
+description	"NSM status monitor"
+author		"Steve Langasek <[e-mail]>"
+
+# ON_BOOT is set to y in portmap's special portmap-boot.conf
+# It will not be set when users run 'restart portmap' or 'start portmap'
+# This is so that we don't start until we have local filesystems on
+# bootup but we also restart whenever portmap is restarted. -Clint Byrum
+#
+# The case where we need to make sure statd is started on mounting
+# TYPE=nfs is handled in the "statd-mounting" job.
+#
+start on (started portmap ON_BOOT=
+          or (local-filesystems and started portmap ON_BOOT=y))
+stop on stopping portmap
+
+expect fork
+respawn
+
+env DEFAULTFILE=/etc/default/nfs-common
+
+pre-start script
+	if [ -f "$DEFAULTFILE" ]; then
+	    . "$DEFAULTFILE"
+	fi
+
+	[ "x$NEED_STATD" != xno ] || { stop; exit 0; }
+	logger -t statd-pre-start "$UPSTART_EVENTS" || true
+	echo UPSTART_EVENTS = "$UPSTART_EVENTS"
+
+    exec sm-notify
+end script
+
+script
+	if [ -f "$DEFAULTFILE" ]; then
+	    . "$DEFAULTFILE"
+	fi
+
+	if [ "x$NEED_STATD" != xno ]; then
+		exec rpc.statd -L $STATDOPTS
+	fi
+end script

=== modified file 'debian/nfs-kernel-server.default'
--- debian/nfs-kernel-server.default	2011-10-02 18:29:53 +0000
+++ debian/nfs-kernel-server.default	2013-05-24 21:14:25 +0000
@@ -6,7 +6,7 @@
 
 # Options for rpc.mountd.
 # If you have a port-based firewall, you might want to set up
-# a fixed port here using the --port option. For more information, 
+# a fixed port here using the --port option. For more information,
 # see rpc.mountd(8) or http://wiki.debian.org/SecuringNFS
 # To disable NFSv4 on the server, specify '--no-nfs-version 4' here
 RPCMOUNTDOPTS=--manage-gids
@@ -17,3 +17,6 @@
 
 # Options for rpc.svcgssd.
 RPCSVCGSSDOPTS=
+
+# Options for rpc.nfsd.
+RPCNFSDOPTS=

=== modified file 'debian/nfs-kernel-server.init'
--- debian/nfs-kernel-server.init	2013-05-10 19:27:47 +0000
+++ debian/nfs-kernel-server.init	2013-05-24 21:14:25 +0000
@@ -30,6 +30,7 @@
 RPCMOUNTDOPTS=
 NEED_SVCGSSD=no
 RPCSVCGSSDOPTS=
+RPCNFSDOPTS=
 PROCNFSD_MOUNTPOINT=/proc/fs/nfsd
 if [ -f $DEFAULTFILE ]; then
     . $DEFAULTFILE
@@ -75,7 +76,7 @@
 			log_warning_msg "Not starting $DESC: no support in current kernel."
 			exit 0
 		fi
-		
+
 		do_mount nfsd $PROCNFSD_MOUNTPOINT || NEED_SVCGSSD=no
 		log_begin_msg "Exporting directories for $DESC..."
 		$PREFIX/sbin/exportfs -r
@@ -88,7 +89,7 @@
 
 		log_daemon_msg "Starting $DESC"
 		log_progress_msg "nfsd"
-		
+
 		# See if rpcbind is running
 		$PREFIX/sbin/rpcinfo -p >/dev/null 2>&1
 		RET=$?
@@ -100,7 +101,7 @@
 
 		start-stop-daemon --start --oknodo --quiet \
 		    --nicelevel $RPCNFSDPRIORITY \
-		    --exec $PREFIX/sbin/rpc.nfsd -- $RPCNFSDCOUNT
+		    --exec $PREFIX/sbin/rpc.nfsd -- $RPCNFSDOPTS $RPCNFSDCOUNT
 		RET=$?
 		if [ $RET != 0 ]; then
 			log_end_msg $RET
@@ -195,6 +196,7 @@
 	if mountpoint -q $PROCNFSD_MOUNTPOINT
 	then
 	    $PREFIX/sbin/exportfs -f
+            umount $PROCNFSD_MOUNTPOINT
 	fi
 	;;
 

=== modified file 'debian/nfs-kernel-server.postinst'
--- debian/nfs-kernel-server.postinst	2010-01-13 10:39:08 +0000
+++ debian/nfs-kernel-server.postinst	2013-05-24 21:14:25 +0000
@@ -21,5 +21,4 @@
 
 act="restart"
 [ "$1:$2" = "configure:" ] && act="start"
-[ "$1:$2" = "configure:" ] && invoke-rc.d nfs-common start
 invoke-rc.d nfs-kernel-server $act

=== added file 'debian/patches/20-ticket-expired-error.patch'
--- debian/patches/20-ticket-expired-error.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/20-ticket-expired-error.patch	2013-05-24 21:14:25 +0000
@@ -0,0 +1,79 @@
+## Description: add some description
+## Origin/Author: add some origin or author
+## Bug: bug URL
+Index: ubuntu/utils/gssd/gssd.c
+===================================================================
+--- ubuntu.orig/utils/gssd/gssd.c	2013-05-24 16:44:14.635084023 -0400
++++ ubuntu/utils/gssd/gssd.c	2013-05-24 16:45:41.339080825 -0400
+@@ -63,6 +63,7 @@
+ int  root_uses_machine_creds = 1;
+ unsigned int  context_timeout = 0;
+ char *preferred_realm = NULL;
++int ticket_expiry_is_error = 0;
+ 
+ void
+ sig_die(int signal)
+@@ -85,7 +86,7 @@
+ static void
+ usage(char *progname)
+ {
+-	fprintf(stderr, "usage: %s [-f] [-l] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir] [-t timeout] [-R preferred realm] [-D]\n",
++	fprintf(stderr, "usage: %s [-e] [-f] [-l] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir] [-t timeout] [-R preferred realm] [-D]\n",
+ 		progname);
+ 	exit(1);
+ }
+@@ -102,8 +103,11 @@
+ 	char *progname;
+ 
+ 	memset(ccachesearch, 0, sizeof(ccachesearch));
+-	while ((opt = getopt(argc, argv, "DfvrlmnMp:k:d:t:R:")) != -1) {
++	while ((opt = getopt(argc, argv, "eDfvrlmnMp:k:d:t:R:")) != -1) {
+ 		switch (opt) {
++			case 'e':
++				ticket_expiry_is_error = 1;
++				break;
+ 			case 'f':
+ 				fg = 1;
+ 				break;
+Index: ubuntu/utils/gssd/gssd.h
+===================================================================
+--- ubuntu.orig/utils/gssd/gssd.h	2013-05-24 16:44:14.635084023 -0400
++++ ubuntu/utils/gssd/gssd.h	2013-05-24 16:44:14.627084023 -0400
+@@ -67,6 +67,7 @@
+ extern int			root_uses_machine_creds;
+ extern unsigned int 		context_timeout;
+ extern char			*preferred_realm;
++extern int			ticket_expiry_is_error;
+ 
+ TAILQ_HEAD(clnt_list_head, clnt_info) clnt_list;
+ 
+Index: ubuntu/utils/gssd/gssd.man
+===================================================================
+--- ubuntu.orig/utils/gssd/gssd.man	2013-05-24 16:44:14.635084023 -0400
++++ ubuntu/utils/gssd/gssd.man	2013-05-24 16:44:14.627084023 -0400
+@@ -272,6 +272,12 @@
+ seconds, which allows changing Kerberos tickets and identities frequently.
+ The default is no explicit timeout, which means the kernel context will live
+ the lifetime of the Kerberos service ticket used in its creation.
++.TP
++.B -e
++Return EACCESS instead of EKEYEXPIRED when a user's credentials expire.
++Returning EKEYEXPIRED was introduced around kernel 2.6.34 and causes all nfs4
++I/O to block when a user's credentials expire. This option reverts to old
++bevavior.
+ .SH SEE ALSO
+ .BR rpc.svcgssd (8),
+ .BR kerberos (1),
+Index: ubuntu/utils/gssd/gssd_proc.c
+===================================================================
+--- ubuntu.orig/utils/gssd/gssd_proc.c	2013-05-24 16:44:14.635084023 -0400
++++ ubuntu/utils/gssd/gssd_proc.c	2013-05-24 16:46:28.887079072 -0400
+@@ -1019,7 +1019,7 @@
+ 		 * trolling for credentials */
+ 		for (dirname = ccachesearch; create_resp != 0 && *dirname != NULL; dirname++) {
+ 			err = gssd_setup_krb5_user_gss_ccache(uid, clp->servername, *dirname);
+-			if (err == -EKEYEXPIRED)
++			if (err == -EKEYEXPIRED && !ticket_expiry_is_error)
+ 				downcall_err = -EKEYEXPIRED;
+ 			else if (!err)
+ 				create_resp = create_auth_rpc_client(clp, &rpc_clnt, &auth, uid,

=== modified file 'debian/patches/series'
--- debian/patches/series	2013-05-14 00:46:42 +0000
+++ debian/patches/series	2013-05-24 21:14:25 +0000
@@ -5,4 +5,5 @@
 16-mount.nfs.man-update-distinction-between-fstype.patch
 17-multiarch-kerberos-paths.patch
 19-iscsiadm-path.patch
+20-ticket-expired-error.patch
 20-remove-autogenerated-man.patch

=== modified file 'debian/rules'
--- debian/rules	2013-05-10 19:27:47 +0000
+++ debian/rules	2013-05-24 21:14:25 +0000
@@ -2,7 +2,9 @@
 
 # Parsing of DEB_BUILD_OPTIONS flags.
 # Note that nostrip is handled automatically by debhelper.
-CFLAGS := -g -Wall
+CFLAGS := -g -Wall -DPIPEFS_DIR=\\\"/run/rpc_pipefs\\\" \
+		-DGSSD_PIPEFS_DIR=\\\"/run/rpc_pipefs\\\"
+
 ifneq (,$(filter noopt,$(DEB_BUILD_OPTIONS)))
     CFLAGS += -O0
 else
@@ -52,7 +54,12 @@
 	dh_install -Xman --fail-missing
 	dh_installdocs -A
 	dh_installdocs -pnfs-common debian/README.Debian.nfsv4
-	install -m 0755 debian/nfs-common.init debian/nfs-common/etc/init.d/nfs-common
+	dh_installinit -pnfs-common --upstart-only -R --name statd
+	dh_installinit -pnfs-common --upstart-only --no-start --name statd-mounting
+	dh_installinit -pnfs-common --upstart-only -R --name gssd
+	dh_installinit -pnfs-common --upstart-only --no-start --name gssd-mounting
+	dh_installinit -pnfs-common --upstart-only -R --name idmapd
+	dh_installinit -pnfs-common --upstart-only --no-start --name idmapd-mounting
 	install -m 0755 debian/nfs-kernel-server.init debian/nfs-kernel-server/etc/init.d/nfs-kernel-server
 	install -m 0644 debian/nfs-common.bugcontrol debian/nfs-common/usr/share/bug/nfs-common/control
 	install -m 0755 debian/nfs-common.bugscript debian/nfs-common/usr/share/bug/nfs-common/script

=== modified file 'utils/gssd/gssd.c'
--- utils/gssd/gssd.c	2013-05-10 19:27:47 +0000
+++ utils/gssd/gssd.c	2013-05-24 21:14:25 +0000
@@ -63,6 +63,7 @@
 int  root_uses_machine_creds = 1;
 unsigned int  context_timeout = 0;
 char *preferred_realm = NULL;
+int ticket_expiry_is_error = 0;
 
 void
 sig_die(int signal)
@@ -85,7 +86,7 @@
 static void
 usage(char *progname)
 {
-	fprintf(stderr, "usage: %s [-f] [-l] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir] [-t timeout] [-R preferred realm] [-D]\n",
+	fprintf(stderr, "usage: %s [-e] [-f] [-l] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir] [-t timeout] [-R preferred realm] [-D]\n",
 		progname);
 	exit(1);
 }
@@ -102,8 +103,11 @@
 	char *progname;
 
 	memset(ccachesearch, 0, sizeof(ccachesearch));
-	while ((opt = getopt(argc, argv, "DfvrlmnMp:k:d:t:R:")) != -1) {
+	while ((opt = getopt(argc, argv, "eDfvrlmnMp:k:d:t:R:")) != -1) {
 		switch (opt) {
+			case 'e':
+				ticket_expiry_is_error = 1;
+				break;
 			case 'f':
 				fg = 1;
 				break;

=== modified file 'utils/gssd/gssd.h'
--- utils/gssd/gssd.h	2013-05-10 19:27:47 +0000
+++ utils/gssd/gssd.h	2013-05-24 21:14:25 +0000
@@ -67,6 +67,7 @@
 extern int			root_uses_machine_creds;
 extern unsigned int 		context_timeout;
 extern char			*preferred_realm;
+extern int			ticket_expiry_is_error;
 
 TAILQ_HEAD(clnt_list_head, clnt_info) clnt_list;
 

=== modified file 'utils/gssd/gssd.man'
--- utils/gssd/gssd.man	2013-05-10 19:27:47 +0000
+++ utils/gssd/gssd.man	2013-05-24 21:14:25 +0000
@@ -272,6 +272,12 @@
 seconds, which allows changing Kerberos tickets and identities frequently.
 The default is no explicit timeout, which means the kernel context will live
 the lifetime of the Kerberos service ticket used in its creation.
+.TP
+.B -e
+Return EACCESS instead of EKEYEXPIRED when a user's credentials expire.
+Returning EKEYEXPIRED was introduced around kernel 2.6.34 and causes all nfs4
+I/O to block when a user's credentials expire. This option reverts to old
+bevavior.
 .SH SEE ALSO
 .BR rpc.svcgssd (8),
 .BR kerberos (1),

=== modified file 'utils/gssd/gssd_proc.c'
--- utils/gssd/gssd_proc.c	2013-05-10 19:27:47 +0000
+++ utils/gssd/gssd_proc.c	2013-05-24 21:14:25 +0000
@@ -1019,7 +1019,7 @@
 		 * trolling for credentials */
 		for (dirname = ccachesearch; create_resp != 0 && *dirname != NULL; dirname++) {
 			err = gssd_setup_krb5_user_gss_ccache(uid, clp->servername, *dirname);
-			if (err == -EKEYEXPIRED)
+			if (err == -EKEYEXPIRED && !ticket_expiry_is_error)
 				downcall_err = -EKEYEXPIRED;
 			else if (!err)
 				create_resp = create_auth_rpc_client(clp, &rpc_clnt, &auth, uid,