Whamcloud - gitweb
LU-17015 gss: support large kerberos token on client
authorAurelien Degremont <adegremont@nvidia.com>
Tue, 15 Aug 2023 14:03:07 +0000 (16:03 +0200)
committerAndreas Dilger <adilger@whamcloud.com>
Mon, 28 Aug 2023 16:18:41 +0000 (16:18 +0000)
commit47fa6223d23cf544f3b74888d58a741392a41a09
tree79a8ed13acff3fc6a42ff3b6259d23e4d29b27ad
parent6470837534a8d4aef4120d961d802ec4ed93e0e0
LU-17015 gss: support large kerberos token on client

If the current Kerberos setup is using large token, like
when PAC feature is enabled for Kerberos, client can crash.

Return an error instead of asserting to avoid the crash
and increase the default buffer size to 4kB instead of 1kB.
This will only increase the SEC_CTX_INIT request size, and
the buffer is shrunk before being sent over the wire.

This will allow security token up to 2kB to be properly
handled by Lustre. Above that size, a different issue will
happen on server side that will require another patch.

Lustre-change: https://review.whamcloud.com/51946
Lustre-commit: TBD (from 374417f3f7c1e74e402a01ae9737ff01334d1dd4)

Test-Parameters: trivial kerberos=true testlist=sanity-krb5
Signed-off-by: Aurelien Degremont <adegremont@nvidia.com>
Change-Id: I9ce30ee7f8c95bfe41525c49986ffac45ffac97c
Reviewed-on: https://review.whamcloud.com/c/ex/lustre-release/+/51951
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
lustre/ptlrpc/gss/gss_cli_upcall.c
lustre/ptlrpc/gss/gss_internal.h