https://jira.whamcloud.com This file is an XML representation of an issue en-us 9.4.14 940014 05-12-2023 https://jira.whamcloud.com/browse/LU-6356 Lustre <p>Hi,</p> <p>In current master branch, Kerberos support is not functional. Apart from issue described in <a href="https://jira.whamcloud.com/browse/LU-3778" title="GSS doesn&#39;t know about proxy subsystems" class="issue-link" data-issue-key="LU-3778"><del>LU-3778</del></a>, a number of areas in the code need to be fixed. The aim of this ticket is to gather information about the patches I made to revive Kerberos support in Lustre.</p> <p>Sebastien.</p> LU-6356

Kerberos revival

Bug Major Resolved Fixed Dmitry Eremin Sebastien Buisson patch Wed, 11 Mar 2015 14:02:15 +0000 Tue, 16 May 2017 07:17:00 +0000 Wed, 16 Sep 2015 13:35:15 +0000 Lustre 2.7.0 Lustre 2.8.0 0 14 <p>Sebastien Buisson (sebastien.buisson@bull.net) uploaded a new patch: <a href="http://review.whamcloud.com/14041" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/14041</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> tgt: handle sec context requests properly<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: 1e28304574d31c8572a9a8e8e4fc531989389c86</p> <p>Sebastien Buisson (sebastien.buisson@bull.net) uploaded a new patch: <a href="http://review.whamcloud.com/14042" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/14042</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> gss: call out info must include 'self nid'<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: 9c3bb15914e2c95c260074a66bcd3a78188d56b7</p> <p>Sebastien Buisson (sebastien.buisson@bull.net) uploaded a new patch: <a href="http://review.whamcloud.com/14043" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/14043</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> ptlrpc: ret -ECONNREFUSED if not context found in req<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: b70c99d7185321d5580d1c73d45fcc0fc2174086</p> <p>Sebastien Buisson (sebastien.buisson@bull.net) uploaded a new patch: <a href="http://review.whamcloud.com/14044" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/14044</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> target: all bulk IO must be (un)wrapped if necessary<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: 2880d4d14479adffcf66deca9fc104144e7c9a52</p> <p>Dmitry,<br/> Could you complete reviews on these patches?<br/> Thank you!</p> <p>Oleg Drokin (oleg.drokin@intel.com) merged in patch <a href="http://review.whamcloud.com/14043/" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/14043/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> ptlrpc: ret -ECONNREFUSED if not context found in req<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: acd3cea50d0f43b5b0fc99aee54f0a71ccb2cacb</p> <p>Sebastien Buisson (sebastien.buisson@bull.net) uploaded a new patch: <a href="http://review.whamcloud.com/14349" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/14349</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> mgs: fix security flavor setting for connection to mgs<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: b4da8c64dd6c5442a0d14dd9a140200d8b15f9ce</p> <p>Sebastien Buisson (sebastien.buisson@bull.net) uploaded a new patch: <a href="http://review.whamcloud.com/14404" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/14404</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> ptlrpc: dont take unwrap in req_waittime calculation<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: cfc9e2cc32672673d90badbee69820998c5a1748</p> <p>Oleg Drokin (oleg.drokin@intel.com) merged in patch <a href="http://review.whamcloud.com/14404/" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/14404/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> ptlrpc: dont take unwrap in req_waittime calculation<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: d9233853ae5a1c0a1a4fe150275df2c3d660ebb7</p> <p>Oleg Drokin (oleg.drokin@intel.com) merged in patch <a href="http://review.whamcloud.com/14042/" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/14042/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> gss: call out info must include 'self nid'<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: 0d88b3296cf28c8222359f9a19e42e423e2e3b28</p> <p>Does the Kerberos code also depend on <a href="http://review.whamcloud.com/14040" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/14040</a> ? If yes, that bug should be linked here so that it is clear it needs to land for Kerberos to work.</p> <p>Hi,</p> <p>In order to address the deadlock issue with the encoding pool we discussed at last Lustre Developer Day in Denver, I have decided to implement solutions a) and c) (see PDF extract from Lustre Dev Day):<br/> a) make epp_max_pages tunable via a ptlrpc kernel module parameter<br/> c) prevent thread to enter wait queue if encoding pool has already reached its maximum capacity, instead return -ENOMEM and put request back in request queue</p> <p>I will push the patches in Gerrit right now.</p> <p>Sebastien.</p> <p>Sebastien Buisson (sebastien.buisson@bull.net) uploaded a new patch: <a href="http://review.whamcloud.com/15069" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/15069</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> ptlrpc: add a 'enc_pool_max_memory_mb' module param<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: 37f2e23428db37e848c0723ed7550c839a998af5</p> <p>Sebastien Buisson (sebastien.buisson@bull.net) uploaded a new patch: <a href="http://review.whamcloud.com/15070" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/15070</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> ptlrpc: do not sleep if encpool reached max capacity<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: d8328c2a2162bd700a443a5c1df1945fea1920ee</p> <p>Sebastien Buisson (sebastien.buisson@bull.net) uploaded a new patch: <a href="http://review.whamcloud.com/15138" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/15138</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> tgt: handle sec context requests properly<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: 03c911a0f5dff0311d98f4f384390da428c95f27</p> <p>Oleg Drokin (oleg.drokin@intel.com) merged in patch <a href="http://review.whamcloud.com/14041/" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/14041/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> tgt: handle sec context requests properly<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: 6a0d6dd10e3ddcc5eafef07df4330a613b539c5f</p> <p>Oleg Drokin (oleg.drokin@intel.com) merged in patch <a href="http://review.whamcloud.com/14349/" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/14349/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> mgs: fix security flavor setting for connection to mgs<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: 63de9170d13d63187b03c48271a72ac7b27e54ba</p> <p>Hi,</p> <p>Please find attached the Test Plan for Kerberos.<br/> Patches will be submitted soon to address some of the problems found with sanity-krb5.</p> <p>Sebastien.</p> <p>Sebastien Buisson (sebastien.buisson@bull.net) uploaded a new patch: <a href="http://review.whamcloud.com/15552" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/15552</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> sptlrpc: notify OSP and LWP for sptlrpc conf change<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: 8aba4049bbee736ce5cd8f41c1258a9c24491d2a</p> <p>Sebastien Buisson (sebastien.buisson@bull.net) uploaded a new patch: <a href="http://review.whamcloud.com/15556" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/15556</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> tests: fix sanity-krb5<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: fe0f9c4e77e9455238a47a4e7c7cd711442b2172</p> <p>Sebastien Buisson (sebastien.buisson@bull.net) uploaded a new patch: <a href="http://review.whamcloud.com/15708" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/15708</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> ptlrpc: do not switch out-of-date context<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: 909df252ab2fe1055560ad9330f051005545bda9</p> <p>Sebastien Buisson (sebastien.buisson@bull.net) uploaded a new patch: <a href="http://review.whamcloud.com/15709" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/15709</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> tests: add delay in tgt_handle_request0 for ctx init<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: 8d45fc7a1c9edaa35417d6decaef9ba460e518b7</p> <p>Updated Test Plan for Kerberos.</p> <p>Oleg Drokin (oleg.drokin@intel.com) merged in patch <a href="http://review.whamcloud.com/15069/" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/15069/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> ptlrpc: add a 'enc_pool_max_memory_mb' module param<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: 78add6cb8aad0dda0528423dc930fec54ed36259</p> <p>Oleg Drokin (oleg.drokin@intel.com) merged in patch <a href="http://review.whamcloud.com/15070/" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/15070/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> ptlrpc: do not sleep if encpool reached max capacity<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: 7571f2b4ef59d8ec42c320e08d346cd9c6447f4b</p> <p>Sebastien Buisson (sebastien.buisson@bull.net) uploaded a new patch: <a href="http://review.whamcloud.com/16124" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/16124</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> tgt: add handlers for SEC_CTX_* requests<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: 1<br/> Commit: 9fc69454defc3f9fbedf5dcc11af8a4a7c6b4b15</p> <p>A problem with security context refresh requests has been found during Kerberos tests at IU.<br/> When the ticket of the client node expires before the ticket of the server nodes, the servers receive a context refresh request for which they have no handler (an export is associated to this request). The context refresh cannot happen, and the client keeps on retrying.</p> <p>I have uploaded patch at <a href="http://review.whamcloud.com/16124" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/16124</a> to address this issue.</p> <p>Oleg Drokin (oleg.drokin@intel.com) merged in patch <a href="http://review.whamcloud.com/15708/" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/15708/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> ptlrpc: do not switch out-of-date context<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: 09e5f8ad23a880cb12fdf521b46a30e1f0a11d03</p> <p>Oleg Drokin (oleg.drokin@intel.com) merged in patch <a href="http://review.whamcloud.com/15552/" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/15552/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> sptlrpc: notify OSP and LWP for sptlrpc conf change<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: c27bfc3b78c13a164440f50c5de82aa4493235a9</p> <p>Oleg Drokin (oleg.drokin@intel.com) merged in patch <a href="http://review.whamcloud.com/15556/" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/15556/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> tests: fix sanity-krb5<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: 6a5963882db22e7516b666b651247e0090767e30</p> <p>Oleg Drokin (oleg.drokin@intel.com) merged in patch <a href="http://review.whamcloud.com/15709/" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/15709/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> tests: add delay in tgt_handle_request0 for ctx init<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: 3a7d56b3078906f66e59a96f03d1e36fc27c7460</p> <p>Oleg Drokin (oleg.drokin@intel.com) merged in patch <a href="http://review.whamcloud.com/16124/" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/16124/</a><br/> Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> tgt: add handlers for SEC_CTX_* requests<br/> Project: fs/lustre-release<br/> Branch: master<br/> Current Patch Set: <br/> Commit: b33e22c4b4c6411af51805da21b741367c72ec71</p> <p>All patches have landed for 2.8.</p> <blockquote><p>Subject: <a href="https://jira.whamcloud.com/browse/LU-6356" title="Kerberos revival" class="issue-link" data-issue-key="LU-6356"><del>LU-6356</del></a> tests: fix sanity-krb5</p></blockquote> <p>Question: Isn't the test still expected to fail when using a combined mgs+mds setup? tgt_connect_check_sptlrpc() has a "== LOLND" check, and if the check is successful the function authorizes usage of any flavour, so the test should not see the expected mds mount failure.</p> Related LU-7051 LU-9414 LU-6490 LU-3289 LU-3778 Development Rank 1|hzx82n: Rank (Obsolete) 17800 Severity