Whamcloud - gitweb
LU-17015 gss: support large kerberos token for rpc sec init 24/52224/28
authorSebastien Buisson <sbuisson@ddn.com>
Thu, 7 Sep 2023 07:28:45 +0000 (09:28 +0200)
committerOleg Drokin <green@whamcloud.com>
Wed, 25 Oct 2023 18:07:26 +0000 (18:07 +0000)
commit8d828762d18ffaa2945bde56039127d0e75aceb3
tree9045429d1e568e266a36e9b5903f2b7b6656c3d1
parent5a0f59d05147ee32e10d8db606c6da17d4099721
LU-17015 gss: support large kerberos token for rpc sec init

If the current Kerberos setup is using large token, like when PAC
feature is enabled for Kerberos, authentication can fail due to server
side unable to exchange token between kernel and userspace.
This limitation is inherent to the sunrpc cache mechanism, that can
only handle tokens up to PAGE_SIZE.

For RPC sec init phase, use Lustre's upcall cache mechanism
instead of deprecated kernel's sunrpc cache. The upcall calls a new
userspace command 'l_getauth', that fowards the sec init request to
the lsvcgssd daemon via Unix domain sockets.

Test-Parameters: kerberos=true testlist=sanity-krb5
Change-Id: I709cd79894a5a13fc4cdfab2109c86f2230db3b8
Signed-off-by: Sebastien Buisson <sbuisson@ddn.com>
Reviewed-on: https://review.whamcloud.com/c/fs/lustre-release/+/52224
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: Oleg Drokin <green@whamcloud.com>
Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
Reviewed-by: Aurelien Degremont <adegremont@nvidia.com>
26 files changed:
libcfs/libcfs/crypto/fname.c
libcfs/libcfs/crypto/llcrypt_private.h
lustre/include/lustre_sec.h
lustre/include/uapi/linux/lustre/lgss.h
lustre/include/uapi/linux/lustre/lustre_disk.h
lustre/include/uapi/linux/lustre/lustre_idl.h
lustre/include/upcall_cache.h
lustre/obdclass/Makefile.in
lustre/obdclass/upcall_cache.c
lustre/ptlrpc/gss/gss_api.h
lustre/ptlrpc/gss/gss_internal.h
lustre/ptlrpc/gss/gss_svc_upcall.c
lustre/ptlrpc/gss/lproc_gss.c
lustre/ptlrpc/wiretest.c
lustre/tests/sanity-sec.sh
lustre/tests/test-framework.sh
lustre/utils/gss/.gitignore
lustre/utils/gss/Makefile.am
lustre/utils/gss/l_getauth.c [new file with mode: 0644]
lustre/utils/gss/lsupport.h
lustre/utils/gss/svcgssd.c
lustre/utils/gss/svcgssd.h
lustre/utils/gss/svcgssd_main_loop.c
lustre/utils/gss/svcgssd_proc.c
lustre/utils/wirecheck.c
lustre/utils/wiretest.c