From: Sebastien Buisson Date: Fri, 7 Jun 2019 14:45:26 +0000 (+0900) Subject: LU-12401 gss: fix checksum for Kerberos and SSK X-Git-Tag: 2.12.57~145 X-Git-Url: https://git.whamcloud.com/?p=fs%2Flustre-release.git;a=commitdiff_plain;h=218fc688c11f081881b2cc1c1632ceaf9ec77a77;hp=218fc688c11f081881b2cc1c1632ceaf9ec77a77;ds=sidebyside LU-12401 gss: fix checksum for Kerberos and SSK When computing checksum for Kerberos, krb5 wire token header is appended to the plain text. Make sure the actual header is appended in gss_digest_hash(). For interop with older clients, introduce new server side tunable 'sptlrpc.gss.krb5_allow_old_client_csum'. When not set, servers refuse Kerberos connection from older clients. In gss_crypt_generic(), protect against an undefined behavior by switching from memcpy to memmove. When computing checksum for SSK, make sure the actual token is used to store the checksum. Fixes: a21c13d4df ("LU-8602 gss: Properly port gss to newer crypto api.") Test-Parameters: envdefinitions=SHARED_KEY=true testlist=sanity,recovery-small,sanity-sec Test-Parameters: envdefinitions=SHARED_KEY=true clientbuildno=6308 clientjob=lustre-reviews-patchless testlist=sanity,recovery-small,sanity-sec Signed-off-by: Sebastien Buisson Change-Id: I0233ada481f132af112bf88c065f5421902c942e Reviewed-on: https://review.whamcloud.com/35099 Reviewed-by: Andreas Dilger Reviewed-by: Jeremy Filizetti Tested-by: jenkins Tested-by: Maloo Reviewed-by: Oleg Drokin ---