https://jira.whamcloud.com This file is an XML representation of an issue en-us 9.4.14 940014 05-12-2023 https://jira.whamcloud.com/browse/LU-3778 Lustre <p>Trying to use a GSS-enabled Lustre build with Kerberos authentication with 2.4.0 leads to instand LBUGs on connect because gss_internal.h::import_to_gss_svc() only knows about mgc, mdc, and osc. It bails out as soon as another component like osp or lwp tries to initiate an authenticated connection. It depends on the srpc configuration, which of the components triggers the LBUG first, but the root cause is always the proxies trying to use GSS authentication while the GSS subsystem doesn't known about them.</p> LU-3778

GSS doesn't know about proxy subsystems

Technical task LU-3289 Critical Resolved Fixed WC Triage Daniel Kobras SSK patch Mon, 19 Aug 2013 15:38:09 +0000 Wed, 30 Nov 2016 18:27:01 +0000 Thu, 2 Jul 2015 13:47:19 +0000 Lustre 2.4.0 Lustre 2.8.0 0 20 <p>Mike,<br/> Could you please comment on this one?<br/> Thank you!</p> <p>Is this a problem with any GSS usage in 2.4, or do you need to do something specific?</p> <p>I remember seeing this LBUG when testing GSS/Kerberos on 2.4; according to my notes, it happened soon after the Kerberos mode was switched to krb5p.</p> <p>So far, I haven't found a way to avoid this bug when trying to use GSS with 2.4. From my testing, osp and lwp seem to be treated as 'clients' by sptlrpc: The LBUG is hit if krb5p is configured for directions default, cli2mdt, and cli2ost. It might not trigger if only mdt2mdt or mdt2ost are used, but I haven't verified these combinations.</p> <p>The easiest reproducer is:</p> <ul> <li>Start MGS</li> <li>Run lctl conf_param &lt;fsname&gt;.srpc.flavor.default=krb5p</li> <li>Start MDT -&gt; immediate LBUG.</li> </ul> <p>It looks like we need to initialize the sptlrpc subsystem for OSP and LWP connections, presumably using sptlrpc_lprocfs_cliobd_attach(). That will also configure the srpc_info and srpc_contexts files in /proc that test-framework.sh::flvr_cnt_mdt2ost-&gt;get_mdtosc_proc_path() needs for sanity-gss.sh to work.</p> <p>Shared key crypto will not be in the 2.7 Release.</p> <p>Hi,</p> <p>Following Andreas' advice, I have made a patch that initializes the sptlrpc subsystem for OSP and LWP connections, by calling sptlrpc_lprocfs_cliobd_attach(). I also found that GSS related functions must not return an LBUG when dealing with OSP and LWP OBDs.</p> <p>Sebastien.</p> <p>Sebastien Buisson (sebastien.buisson@bull.net) uploaded a new patch: <a href="http://review.whamcloud.com/14040" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/14040</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-3778" title="GSS doesn&#39;t know about proxy subsystems" class="issue-link" data-issue-key="LU-3778"><del>LU-3778</del></a> sptlrpc: OSP and LWP don't know sptlrpc<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: fa5a6d591d883c6940179dd09e3288483769bfb6</p> <p>Oleg Drokin (oleg.drokin@intel.com) merged in patch <a href="http://review.whamcloud.com/14040/" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/14040/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-3778" title="GSS doesn&#39;t know about proxy subsystems" class="issue-link" data-issue-key="LU-3778"><del>LU-3778</del></a> sptlrpc: OSP and LWP don't know sptlrpc<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: cf57dfc4c9bf4b9d36e356d6f33550676b21e066</p> <p>Landed for 2.8</p> Related LU-6356 LU-3289 LU-8880 Development Rank 1|hzvyj3: Rank (Obsolete) 9779