From: Lukas Hejtmanek <xhejtman@gmail.com>
Date: Wed, 20 Mar 2013 17:24:02 +0000 (-0400)
Subject: gssd - expired credentials problem
X-Git-Tag: debian/1%1.2.8-1~11^2^2~32
X-Git-Url: https://git.decadent.org.uk/gitweb/?a=commitdiff_plain;h=da54dec3cb40095cac96fd2d838144129262ac7f;p=nfs-utils.git

gssd - expired credentials problem

I noticed that there is a problem with expired credentials if NFS
client's time is even few seconds behind KDC's or NFS server's time.
Client's kernel requests new GSS context but rpc.gssd is happy with
existing krb cache as it valid according to local time.

Signed-off-by: Steve Dickson <steved@redhat.com>
---

diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c
index 4befa72..8178ae7 100644
--- a/utils/gssd/krb5_util.c
+++ b/utils/gssd/krb5_util.c
@@ -350,6 +350,11 @@ gssd_get_single_krb5_cred(krb5_context context,
 
 	memset(&my_creds, 0, sizeof(my_creds));
 
+	/*
+	 * Workaround for clock skew among NFS server, NFS client and KDC
+	 * 300 because clock skew must be within 300sec for kerberos
+	 */
+	now += 300;
 	if (ple->ccname && ple->endtime > now && !nocache) {
 		printerr(2, "INFO: Credentials in CC '%s' are good until %d\n",
 			 ple->ccname, ple->endtime);