Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) client-ip=23.128.96.33;
Message-ID: <82c3168c-acf3-469b-8065-d7731e7e62ff@redhat.com>
Date:   Mon, 16 Oct 2023 12:15:07 -0400
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH v2 0/3] nfs-utils: gssd support for
 KRB5_AP_ERR_BAD_INTEGRITY
To:     Olga Kornievskaia <olga.kornievskaia@gmail.com>
Cc:     linux-nfs@vger.kernel.org
References: <20231004173240.46924-1-olga.kornievskaia@gmail.com>
Content-Language: en-US
From:   Steve Dickson <steved@redhat.com>
In-Reply-To: <20231004173240.46924-1-olga.kornievskaia@gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 10/4/23 1:32 PM, Olga Kornievskaia wrote:
> From: Olga Kornievskaia <kolga@netapp.com>
> 
> Together with libtirpc patch this series attempts to provide
> support for handling KRB5_AP_ERR_BAD_INTEGRITY.
> 
> Such error can be returned by the server when it has changed
> its key material and the client is still using the service
> ticket that was issues prior to the change.
> 
> Upon calling authgss_create_default() and receiving a NULL
> context, we can inspect the returned structure to see
> if gss major/minor error code was set. If the client
> determines that it received KRB5_AP_ERR_BAD_INTEGRITY error,
> it will proceed to handle it based on what type of credentials
> were used for context establishement. If machine credentials
> were used, the client can call into a routine and force
> credential renewal. If user credentials were used, the client
> needs to remove the existing service ticket and then retry
> the request.
> 
> -- fix compile warning in libtirpc patch
> 
> Olga Kornievskaia (3):
>    gssd: enable forcing cred renewal using the keytab
>    gssd: handle KRB5_AP_ERR_BAD_INTEGRITY for machine credentials
>    gssd: handle KRB5_AP_ERR_BAD_INTEGRITY for user credentials
Committed... (tag: nfs-utils-2-6-4-rc4)

steved.

> 
>   utils/gssd/gssd_proc.c | 20 ++++++++++++--
>   utils/gssd/krb5_util.c | 62 ++++++++++++++++++++++++++++++++++++------
>   utils/gssd/krb5_util.h |  4 ++-
>   3 files changed, 75 insertions(+), 11 deletions(-)
>