[LU-6356] Kerberos revival

• Type: Bug
• Resolution: Fixed
• Priority: Major
• Fix Version/s: Lustre 2.8.0
• Affects Version/s: Lustre 2.7.0
• Labels: patch
• Severity: 3
• Assignee: Dmitry Eremin (Inactive)
• Reporter: Sebastien Buisson (Inactive)

Description

Hi,

In current master branch, Kerberos support is not functional. Apart from issue described in LU-3778, a number of areas in the code need to be fixed. The aim of this ticket is to gather information about the patches I made to revive Kerberos support in Lustre.

Sebastien.

Issue Links

• is related to: LU-7051 Remove code duplication in ptlrpc_check_set()
• is related to: LU-9414 LBUG and Hung on -ENOMEM in LNetMDAttach
• is related to: LU-6490 builds on 3.12 fail in gss
• is related to: LU-3289 IU Shared Secret Key authentication and encryption
• is related to: LU-3778 GSS doesn't know about proxy subsystems

Comments

[Andrew Perepechko]

Subject: LU-6356 tests: fix sanity-krb5

Question: Isn't the test still expected to fail when using a combined mgs+mds setup? tgt_connect_check_sptlrpc() has a "== LOLND" check, and if the check is successful the function authorizes usage of any flavour, so the test should not see the expected mds mount failure.

[Joseph Gmitter (Inactive)]

All patches have landed for 2.8.

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch http://review.whamcloud.com/16124/
Subject: LU-6356 tgt: add handlers for SEC_CTX_* requests
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: b33e22c4b4c6411af51805da21b741367c72ec71

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch http://review.whamcloud.com/15709/
Subject: LU-6356 tests: add delay in tgt_handle_request0 for ctx init
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 3a7d56b3078906f66e59a96f03d1e36fc27c7460

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch http://review.whamcloud.com/15556/
Subject: LU-6356 tests: fix sanity-krb5
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 6a5963882db22e7516b666b651247e0090767e30

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch http://review.whamcloud.com/15552/
Subject: LU-6356 sptlrpc: notify OSP and LWP for sptlrpc conf change
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: c27bfc3b78c13a164440f50c5de82aa4493235a9

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch http://review.whamcloud.com/15708/
Subject: LU-6356 ptlrpc: do not switch out-of-date context
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 09e5f8ad23a880cb12fdf521b46a30e1f0a11d03

[Sebastien Buisson (Inactive)]

A problem with security context refresh requests has been found during Kerberos tests at IU.
When the ticket of the client node expires before the ticket of the server nodes, the servers receive a context refresh request for which they have no handler (an export is associated to this request). The context refresh cannot happen, and the client keeps on retrying.

I have uploaded patch at http://review.whamcloud.com/16124 to address this issue.

[Gerrit Updater]

Sebastien Buisson ([e-mail]) uploaded a new patch: http://review.whamcloud.com/16124
Subject: LU-6356 tgt: add handlers for SEC_CTX_* requests
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 9fc69454defc3f9fbedf5dcc11af8a4a7c6b4b15

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch http://review.whamcloud.com/15070/
Subject: LU-6356 ptlrpc: do not sleep if encpool reached max capacity
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 7571f2b4ef59d8ec42c320e08d346cd9c6447f4b