From patchwork Fri Oct 25 17:09:34 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Weston Andros Adamson X-Patchwork-Id: 3097071 Return-Path: X-Original-To: patchwork-linux-nfs@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 488519F372 for ; Fri, 25 Oct 2013 17:09:48 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 1EFF720343 for ; Fri, 25 Oct 2013 17:09:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E43F120320 for ; Fri, 25 Oct 2013 17:09:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751875Ab3JYRJo (ORCPT ); Fri, 25 Oct 2013 13:09:44 -0400 Received: from mx11.netapp.com ([216.240.18.76]:61791 "EHLO mx11.netapp.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751788Ab3JYRJo (ORCPT ); Fri, 25 Oct 2013 13:09:44 -0400 X-IronPort-AV: E=Sophos;i="4.93,571,1378882800"; d="scan'208";a="64997652" Received: from vmwexceht01-prd.hq.netapp.com ([10.106.76.239]) by mx11-out.netapp.com with ESMTP; 25 Oct 2013 10:09:43 -0700 Received: from smtp2.corp.netapp.com (10.57.159.114) by VMWEXCEHT01-PRD.hq.netapp.com (10.106.76.239) with Microsoft SMTP Server id 14.3.123.3; Fri, 25 Oct 2013 10:09:42 -0700 Received: from vpn2ntap-409545.vpn.netapp.com (vpn2ntap-409545.vpn.netapp.com [10.55.76.198]) by smtp2.corp.netapp.com (8.13.1/8.13.1/NTAP-1.6) with ESMTP id r9PH9d0A011154; Fri, 25 Oct 2013 10:09:40 -0700 (PDT) From: Weston Andros Adamson To: CC: , Weston Andros Adamson Subject: [PATCH] gssd: validate cred in gssd_acquire_user_cred Date: Fri, 25 Oct 2013 13:09:34 -0400 Message-ID: <1382720974-2746-1-git-send-email-dros@netapp.com> X-Mailer: git-send-email 1.8.3.1 (Apple Git-46) MIME-Version: 1.0 Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Spam-Status: No, score=-7.3 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Call gss_inquire_cred after gssd_acquire_krb5_cred check for expired credentials. This fixes a recent regression (since 302de786930a2c533068f9d8909a817b40f07c32) that causes the user's ticket cache to grow unbounded with expired service tickets when the user's credentials expire. To reproduce this issue: - mount kerberos nfs export - kinit for a short lifetime (ie "kinit -l 1m") - run a job that opens a file and writes for more than the lifetime - run klist a few times after expiry and see the list grow, ie: Ticket cache: DIR::/run/user/1749600001/krb5cc/tktYmpGlX Default principal: dros@APIKIA.FAKE Valid starting Expires Service principal 10/21/2013 15:39:38 10/21/2013 15:40:35 krbtgt/APIKIA.FAKE@APIKIA.FAKE 10/21/2013 15:39:40 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:35 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:36 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:37 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:37 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:38 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:38 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:39 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:39 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:39 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:39 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:40 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:40 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:41 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:41 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:42 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:42 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE 10/21/2013 15:40:42 10/21/2013 15:40:35 nfs/zero.apikia.fake@APIKIA.FAKE Signed-off-by: Weston Andros Adamson Reviewed-by: Simo Sorce --- Version 2 of the patch - version 1 had compiler warnings I completely missed! I wonder how it worked before... but this now compiles cleanly and I verified that it fixes the growing tkt cache problem. Thanks, -dros utils/gssd/krb5_util.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c index c6e52fd..697d1d2 100644 --- a/utils/gssd/krb5_util.c +++ b/utils/gssd/krb5_util.c @@ -1405,6 +1405,13 @@ gssd_acquire_user_cred(uid_t uid, gss_cred_id_t *gss_cred) ret = gssd_acquire_krb5_cred(name, gss_cred); + /* force validation of cred to check for expiry */ + if (ret == 0) { + if (gss_inquire_cred(&min_stat, *gss_cred, NULL, NULL, + NULL, NULL) != GSS_S_COMPLETE) + ret = -1; + } + maj_stat = gss_release_name(&min_stat, &name); return ret; }