Whamcloud - gitweb
LU-17015 gss: support large kerberos token for rpc sec ctxt
authorSebastien Buisson <sbuisson@ddn.com>
Thu, 7 Sep 2023 07:33:36 +0000 (09:33 +0200)
committerAndreas Dilger <adilger@whamcloud.com>
Fri, 29 Dec 2023 10:52:09 +0000 (10:52 +0000)
commitc5385ab441bb0a1ad5b2d400f64ae69ccae8de64
tree4a35336d4fb5e932f6143ef9aaeb0251d82dd987
parente9e8f4f3b492393110cb2deb8a0854f24d1b719f
LU-17015 gss: support large kerberos token for rpc sec ctxt

If the current Kerberos setup is using large token, like when PAC
feature is enabled for Kerberos, authentication can fail due to server
side unable to exchange token between kernel and userspace.
This limitation is inherent to the sunrpc cache mechanism, that can
only handle tokens up to PAGE_SIZE.

For RPC sec context phase, use Lustre's upcall cache mechanism
instead of deprecated kernel's sunrpc cache. Note this phase does not
involve a proper upcall, only the downcall part is relevant to
populate the context computed in userspace.

Lustre-change: https://review.whamcloud.com/52305
Lustre-commit: 473a41fec6fb600c9b6e26010d88772f5252d1e1

Test-Parameters: kerberos=true testlist=sanity-krb5
Signed-off-by: Sebastien Buisson <sbuisson@ddn.com>
Change-Id: I94e945a99cab60d5b6a4c40076c40fffede217ab
Reviewed-by: Aurelien Degremont <adegremont@nvidia.com>
Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
Reviewed-on: https://review.whamcloud.com/c/ex/lustre-release/+/53254
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
12 files changed:
lustre/include/uapi/linux/lustre/lgss.h
lustre/include/upcall_cache.h
lustre/ptlrpc/gss/gss_internal.h
lustre/ptlrpc/gss/gss_svc_upcall.c
lustre/ptlrpc/gss/lproc_gss.c
lustre/ptlrpc/wiretest.c
lustre/tests/recovery-small.sh
lustre/tests/sanity-sec.sh
lustre/tests/sanity.sh
lustre/utils/gss/svcgssd_proc.c
lustre/utils/wirecheck.c
lustre/utils/wiretest.c