Whamcloud - gitweb
LU-17015 gss: support large kerberos token on client side 46/51946/4
authorAurelien Degremont <adegremont@nvidia.com>
Tue, 15 Aug 2023 14:03:07 +0000 (16:03 +0200)
committerAurelien Degremont <adegremont@nvidia.com>
Mon, 21 Aug 2023 13:49:23 +0000 (15:49 +0200)
commit374417f3f7c1e74e402a01ae9737ff01334d1dd4
treeed7c34ff62e0e8276894e2e574789df5021807b6
parent673ff86a84ad5d11cde24aa7411c45385ad1c633
LU-17015 gss: support large kerberos token on client side

If the current Kerberos setup is using large token, like
when MS-PAC feature is enabled, client can crash.

Instead of asserting, return E2BIG to avoid the crash
and increase the default buffer size to 4kB instead of 1kB.
This will only increase the SEC_CTX_INIT RPC size accordingly
as the buffer is shrunk before being sent over the wire.

Up to 2kB security token will be properly handled by Lustre.
But, above that size, a different issue will happen on
server side that will require an other patch.

Test-Parameters: kerberos=true testlist=sanity-krb5
Signed-off-by: Aurelien Degremont <adegremont@nvidia.com>
Change-Id: I9ce30ee7f8c95bfe41525c49986ffac45ffac97c
lustre/ptlrpc/gss/gss_cli_upcall.c
lustre/ptlrpc/gss/gss_internal.h