From nobody Thu Jan 26 03:08:32 2023 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4P2QdX5qrVz3b9N8; Thu, 26 Jan 2023 03:08:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4P2QdX5Jbdz3HyN; Thu, 26 Jan 2023 03:08:32 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1674702512; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uvchpv7s3cbqIeAZ7l03b7Ln/Nhr3oPIDmR+V6kjDnI=; b=R4M88VklVpXQ6NgtJtbJmM0NqgPGXcWF99itu7XbXMAUBn4pMUWmu2OLmGJ4h05SOvkiIR vtAvz2DPH1XG4RxDZSgoMNPbjZUprTKyYxR69mV/3tSffBpivPIrlO2zeXdqDBrvIgBnQ9 hegQPb6/Me1XAOVWL33IVqnyEtbYF1EJvnJvu1gkYZOxIM01aIehVnzEhWCWOf9xUhsXaE 9kth9JwOO0kLmqG8azQJ29x+/YCOYEbx5sh4rpyKi0n9ANj2+YCVPw7ierVRGGugnm4fwr aqHE8NxrVTaFEW/inh78JtYH4bzhQwfqSwjZvb5XDI5ZICIsE483iMV1UtA/fA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1674702512; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uvchpv7s3cbqIeAZ7l03b7Ln/Nhr3oPIDmR+V6kjDnI=; b=toDM/ZptV6nYgoYCKoBiaEaF6TghC/89Aj1Q+wCppkAphf1cyFKK4uwfoTrmx+sf+8zQ0w mOfzdXf8mCVu6rNyYdcD4u/P5I60ldjg4nI4xviCZFERrdpLZxgYJzutrZ6M/B7duleOOr 50Tuo6wWKvPahDimGPtumSKRVkhH3euZCwgMFLOtpvcnE9y8ep8UFCoMxs/h91ZGLvko7x cVRs2xPsREz3d1qtS7zE+1rT5wshdrr0s5UoGjEbvjUHijvzFMOxNxti0MkSTQhzVUrltB XivQLgrVLaFYfmCgxZ70WtnO4EYVa93CvApgsXmZEX7E+KDcJDmlHQEDJJrSbA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1674702512; a=rsa-sha256; cv=none; b=vHj+loPSiitWquqOFkr1bI4KuiqndnEli0+NypVckelalLr1buGQ3eVO1pV6YFWDEmjpHx 8HFNvDnFaNHXOWyAi5PrKZhDI4sHNYxbscBG8yiXO6EsYpHODg1nQG41JQXfV0vG6h3VA3 enproAL+J7mKl9eUAcLpS1hHjfcGVw5IhdGffdXBamJskLERefou+IwdDvMyUvWaIbOqZ0 XYYbfCh3Mcc4f9av6yf9dUkGAphEFVhr/XjsSlUMGgjy5/itGSvcWsB23lfzFcC3AO2ApS FO4YN/9JETogXGLcMyy/fEBRDDulWJkI0nEjokc9YISCRlD43CJsRoJEUzyEng== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4P2QdX4M0xzF5c; Thu, 26 Jan 2023 03:08:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 30Q38Wki081850; Thu, 26 Jan 2023 03:08:32 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 30Q38WKH081849; Thu, 26 Jan 2023 03:08:32 GMT (envelope-from git) Date: Thu, 26 Jan 2023 03:08:32 GMT Message-Id: <202301260308.30Q38WKH081849@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Rick Macklem Subject: git: 9d35b4b38e1a - stable/12 - kgssapi: Increase timeout for kernel to gssd(8) upcalls List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rmacklem X-Git-Repository: src X-Git-Refname: refs/heads/stable/12 X-Git-Reftype: branch X-Git-Commit: 9d35b4b38e1a466371c551568538488b6f873d07 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch stable/12 has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=9d35b4b38e1a466371c551568538488b6f873d07 commit 9d35b4b38e1a466371c551568538488b6f873d07 Author: Rick Macklem AuthorDate: 2023-01-11 21:20:31 +0000 Commit: Rick Macklem CommitDate: 2023-01-26 03:07:41 +0000 kgssapi: Increase timeout for kernel to gssd(8) upcalls It turns out that the underlying problem that caused a Kerberized NFS mount with the "gssname" option to fail was that the kernel upcall to the gssd(8) daemon would time out prematurely after 25 seconds. The gss_acquire_cred() GSSAPI library call takes about 27 seconds for the case where a desired_name argument is specified. A similarly long delay occurs when the gss_init_sec_context() call is made and the user principal's TGT has expired. Once the upcall timed out, the kernel code assumed that the gssd(8) daemon had died and closed the socket. Ironically, closing the socket did cause the gssd(8) daemon to terminate via a SIGPIPE signal. This patch increases the timeout to 5 minutes. Since a timeout should only occur when the gssd(8) daemon has died, a long timeout should be ok and seems to fix this problem. I still think that commit c33509d49a should remain in the system, since it allows the mount to complete quickly and not take nearly 30 seconds. PR: 268823 (cherry picked from commit e3c26ce5cb410e4e58e131dfea7054e0bf11e3ca) --- sys/kgssapi/gss_impl.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/sys/kgssapi/gss_impl.c b/sys/kgssapi/gss_impl.c index 07e10d0999c4..9b1277298e32 100644 --- a/sys/kgssapi/gss_impl.c +++ b/sys/kgssapi/gss_impl.c @@ -119,7 +119,17 @@ sys_gssd_syscall(struct thread *td, struct gssd_syscall_args *uap) */ if (cl != NULL) { int retry_count = 5; + struct timeval timo; CLNT_CONTROL(cl, CLSET_RETRIES, &retry_count); + + /* + * Set the timeout for an upcall to 5 minutes. The + * default of 25 seconds is not long enough for some + * gss_XXX() calls done by the gssd(8) daemon. + */ + timo.tv_sec = 5 * 60; + timo.tv_usec = 0; + CLNT_CONTROL(cl, CLSET_TIMEOUT, &timo); } } else cl = NULL;