Projects/Parallel KDC - Revision history

Ghudson at 15:54, 1 October 2010

2010-10-01T15:54:18Z

Ghudson at 15:53, 1 October 2010

2010-10-01T15:53:39Z

Ghudson at 15:53, 1 October 2010

2010-10-01T15:53:28Z

Ghudson: /* Design of Proposed Solution */

2010-09-16T19:30:25Z

‎Design of Proposed Solution

Ghudson at 19:25, 16 September 2010

2010-09-16T19:25:53Z

Ghudson: /* Design of Proposed Solution */

2010-09-16T19:24:52Z

‎Design of Proposed Solution

Ghudson: /* Design of Proposed Solution */

2010-09-13T19:31:16Z

‎Design of Proposed Solution

Ghudson: /* Design of Proposed Solution */

2010-09-13T17:53:56Z

‎Design of Proposed Solution

KenRaeburn: /* Design of Proposed Solution */

2010-03-27T19:50:58Z

‎Design of Proposed Solution

Ghudson: /* Design of Proposed Solution */

2010-03-17T18:44:53Z

‎Design of Proposed Solution

← Older revision		Revision as of 15:54, 1 October 2010
Line 1:		Line 1:
−	{{project-~~completed~~\|1.9}}	+	{{project-rel\|1.9}}

	== Problem ==		== Problem ==

← Older revision		Revision as of 15:53, 1 October 2010
Line 1:		Line 1:
−	{{project-~~complete~~\|1.9}}	+	{{project-completed\|1.9}}

	== Problem ==		== Problem ==

@@ Line 1: / Line 1: @@
-{{project-review|2010-09-24}}
+{{project-complete|1.9}}
 == Problem ==
@@ Line 46: / Line 46: @@
 Automated testing of this functionality would be pretty tricky; we would need a special stub KDB back end to cause worker processes to block, as well as a way to control the client retry loop.

@@ Line 29: / Line 29: @@
 A new option will need to be added to the getopt() loop in initialize_realms() to specify the number of worker threads.  The -w option is a reasonable option since it is currently unused.
-Code to create the worker processes will be invoked from main() after the call to write_pid_file().  The parent process will act as a proxy for SIGTERM and SIGHUP so that killing the pid in the pid file terminates or signals all worker processes.
+Code to create the worker processes will be invoked from main() after the call to write_pid_file().  The parent process will act as a proxy for SIGTERM and SIGHUP so that killing the pid in the pid file terminates or signals all worker processes.  When any child process exits, the parent will terminate the other worker processes and exit.
 The network socket will need to set UDP listening sockets to non-blocking (TCP listener sockets already are), and process_packet() will need to ignore EAGAIN errors instead of logging them.

← Older revision		Revision as of 19:25, 16 September 2010
Line 1:		Line 1:
−	{{project-~~early~~}}	+	{{project-review\|2010-09-24}}

	== Problem ==		== Problem ==

@@ Line 35: / Line 35: @@
 On platforms with no IP_PKTINFO support, the KDC must bind to each interface address in order to send UDP relies from the same address as the request was received.  When the host network is reconfigured, the KDC will try to recognize this and rebind the UDP listener ports.  This cannot be done in the worker subprocesses since multiple processes cannot all bind to the same port.  It would be possible to rebind the ports in the supervisor and then terminate and restart the worker processes, but that would be very complicated.  The proposed solution is to disable reconfiguration when worker processes are in use and document the limitation.
-The KDB module must be independently opened in each worker process (rather than opening it once and cloning the resulting process state).  It is also probably a good idea to open and then close the KDB module in the supervisor, prior to starting worker processes, in order to get a more controlled failure if the KDB module is misconfigured.
+KDB modules must be independently opened in each worker process, rather than opening it once and cloning the resulting process state.  It is still a good idea to open and then close the KDB module in the supervisor, prior to starting worker processes, in order to get a more controlled failure if a module is misconfigured.  This will be handled by calling finish_realms() prior to creating working process, and then calling initialize_realms() again inside the child process.
 The logging code will need to be examined to make sure that concurrent access to the same logging sinks would not create problems.

@@ Line 27: / Line 27: @@
 == Design of Proposed Solution ==
-A new option would need to be added to the getopt() loop in initialize_realms() to specify the number of worker threads.  The -w option is a reasonable option since it is currently unused.
+A new option will need to be added to the getopt() loop in initialize_realms() to specify the number of worker threads.  The -w option is a reasonable option since it is currently unused.
-Code to create the worker processes would be invoked from main() after the call to write_pid_file().  The parent process would act as a proxy for SIGTERM and SIGHUP so that killing the pid in the pid file terminates or signals all worker processes.
+Code to create the worker processes will be invoked from main() after the call to write_pid_file().  The parent process will act as a proxy for SIGTERM and SIGHUP so that killing the pid in the pid file terminates or signals all worker processes.
-The network socket code would likely need to set the listening sockets to non-blocking, and process_packet() would need to ignore EAGAIN errors instead of logging them.
+The network socket will need to set UDP listening sockets to non-blocking (TCP listener sockets already are), and process_packet() will need to ignore EAGAIN errors instead of logging them.
 On platforms with no IP_PKTINFO support, the KDC must bind to each interface address in order to send UDP relies from the same address as the request was received.  When the host network is reconfigured, the KDC will try to recognize this and rebind the UDP listener ports.  This cannot be done in the worker subprocesses since multiple processes cannot all bind to the same port.  It would be possible to rebind the ports in the supervisor and then terminate and restart the worker processes, but that would be very complicated.  The proposed solution is to disable reconfiguration when worker processes are in use and document the limitation.
-The KDB module should be independently opened in each worker process (rather than opening it once and cloning the resulting process state).  It is also probably a good idea to open and then close the KDB module in the supervisor, prior to starting worker processes, in order to get a more controlled failure if the KDB module is misconfigured.
+The KDB module must be independently opened in each worker process (rather than opening it once and cloning the resulting process state).  It is also probably a good idea to open and then close the KDB module in the supervisor, prior to starting worker processes, in order to get a more controlled failure if the KDB module is misconfigured.
-The logging code would need to be examined to make sure that concurrent access to the same logging sinks would not create problems.
+The logging code will need to be examined to make sure that concurrent access to the same logging sinks would not create problems.
-Additional attention to bug #1671 (no file locking used by replay cache) may be necessary to evaluate whether there is a security impact on a multi-process KDC, keeping in mind that allowing one replay to each independent KDC processes is typically not considered a serious security threat in master/slave scenarios.
+Additional attention to bug #1671 (no file locking used by replay cache) may be necessary to evaluate whether there is a security impact on a multi-process KDC, keeping in mind that allowing one replay to each independent KDC processes is typically not considered a serious security threat in master/slave scenarios.  This may be moot in light of the SecurID project work, as the replay cache may no longer be needed in the KDC.
 == Testing Plan ==

@@ Line 33: / Line 33: @@
 The network socket code would likely need to set the listening sockets to non-blocking, and process_packet() would need to ignore EAGAIN errors instead of logging them.
-When the host network is reconfigured, the KDC must rebind its UDP listening sockets, on platforms with no IP_PKTINFO support.  (This is necessary to send UDP replies from the same interface we received the request on.)  This cannot be done in the worker subprocesses since multiple processes cannot all bind to the same port, so workers would have to be terminated and restarted to perform reconfiguration.  Alternatively, the network reconfiguration support could be disabled when worker processes are used, or removed entirely; an inventory of IP_PKTINFO platform support would be helpful to evaluate the viability of these options.
+When the host network is reconfigured, the KDC must rebind its UDP listening sockets, on platforms with no IP_PKTINFO support.  (This is necessary to send UDP replies from the same address we received the request at.)  This cannot be done in the worker subprocesses since multiple processes cannot all bind to the same port, so workers would have to be terminated and restarted to perform reconfiguration.  Alternatively, the network reconfiguration support could be disabled when worker processes are used, or removed entirely; an inventory of IP_PKTINFO platform support would be helpful to evaluate the viability of these options.
 The KDB module should be independently opened in each worker process (rather than opening it once and cloning the resulting process state).  It is also probably a good idea to open and then close the KDB module in the supervisor, prior to starting worker processes, in order to get a more controlled failure if the KDB module is misconfigured.