diff options
| author | Andy Adamson <andros@netapp.com> | 2012-11-27 16:34:19 +0100 |
|---|---|---|
| committer | Trond Myklebust <Trond.Myklebust@netapp.com> | 2012-12-12 21:36:02 +0100 |
| commit | eb96d5c97b0825d542e9c4ba5e0a22b519355166 (patch) | |
| tree | 62c98e2bdbcc7334a7043725d1fd81a589a75177 /fs/nfs/nfs4filelayout.c | |
| parent | SUNRPC set gss gc_expiry to full lifetime (diff) | |
| download | linux-eb96d5c97b0825d542e9c4ba5e0a22b519355166.tar.xz linux-eb96d5c97b0825d542e9c4ba5e0a22b519355166.zip | |
SUNRPC handle EKEYEXPIRED in call_refreshresult
Currently, when an RPCSEC_GSS context has expired or is non-existent
and the users (Kerberos) credentials have also expired or are non-existent,
the client receives the -EKEYEXPIRED error and tries to refresh the context
forever. If an application is performing I/O, or other work against the share,
the application hangs, and the user is not prompted to refresh/establish their
credentials. This can result in a denial of service for other users.
Users are expected to manage their Kerberos credential lifetimes to mitigate
this issue.
Move the -EKEYEXPIRED handling into the RPC layer. Try tk_cred_retry number
of times to refresh the gss_context, and then return -EACCES to the application.
Signed-off-by: Andy Adamson <andros@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'fs/nfs/nfs4filelayout.c')
| -rw-r--r-- | fs/nfs/nfs4filelayout.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c index 1e42413fab8f..194c48410336 100644 --- a/fs/nfs/nfs4filelayout.c +++ b/fs/nfs/nfs4filelayout.c @@ -179,7 +179,6 @@ static int filelayout_async_handle_error(struct rpc_task *task, break; case -NFS4ERR_DELAY: case -NFS4ERR_GRACE: - case -EKEYEXPIRED: rpc_delay(task, FILELAYOUT_POLL_RETRY_MAX); break; case -NFS4ERR_RETRY_UNCACHED_REP: |