[LU-11750] lsvcgssd crash with latest krb5-libs

• Type: Bug
• Resolution: Fixed
• Priority: Critical
• Fix Version/s: Lustre 2.13.0, Lustre 2.12.1
• Affects Version/s: Lustre 2.12.0, Lustre 2.10.5
• Labels: krb5 patch
• Severity: 3
• Assignee: Sebastien Buisson
• Reporter: Sebastien Buisson

Description

When preparing RFP for customer DDBJ (DNA Bank of Japan), we noticed Lustre does not support latest krb5 version, as provided in CentOS 7.
Indeed, from krb5-libs version 1.15, lsvcgssd daemon crashes when invoked for Kerberos credentials handling, thus preventing use of any Kerberos flavor with Lustre.

Comments

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch https://review.whamcloud.com/33961/
Subject: LU-11750 krb5: krb5int_derive_key has 'hash' extra parameter
Project: fs/lustre-release
Branch: b2_12
Current Patch Set:
Commit: 79efb69ef637538df360ef032981a56d34ed6a89

[Gerrit Updater]

Sebastien Buisson ([e-mail]) uploaded a new patch: https://review.whamcloud.com/33961
Subject: LU-11750 krb5: krb5int_derive_key has 'hash' extra parameter
Project: fs/lustre-release
Branch: b2_12
Current Patch Set: 1
Commit: 1cde0d1bad05c1d08774d9cdcc1e07b8521ba796

[Sebastien Buisson]

Yes, I will push a patch for 2.12 now that it has been rolled out.

[Peter Jones]

Sebastien

Do we want this for b2_12 also?

Peter

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch https://review.whamcloud.com/33817/
Subject: LU-11750 krb5: krb5int_derive_key has 'hash' extra parameter
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 4d1d6ed7849b0532e44f2fd742d4e07b649d6f66

[Gerrit Updater]

Sebastien Buisson ([e-mail]) uploaded a new patch: https://review.whamcloud.com/33818
Subject: LU-11750 krb5: krb5int_derive_key has 'hash' extra parameter
Project: fs/lustre-release
Branch: b2_10
Current Patch Set: 1
Commit: 15ea8b45726de55074e8cf89bd7c6b1b6a9ef002

[Gerrit Updater]

Sebastien Buisson ([e-mail]) uploaded a new patch: https://review.whamcloud.com/33817
Subject: LU-11750 krb5: krb5int_derive_key has 'hash' extra parameter
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 9e8f4c75a40a23c14420341fca4e9ba48eaf4004

[Sebastien Buisson]

The issue is due to the following patch in krb5, adding support for aes-sha2:
https://github.com/krb5/krb5/commit/135a9ac3c58b444998361a3b13f5decfdece2105

This patch modified the number of parameters taken by function krb5int_derive_key().

I will propose a patch in Lustre to be able to support krb5int_derive_key() with 5 or 6 parameters.