Making the keytab option work
Roberto C. Sánchez <[email protected]>
| Newsgroups | gmane.comp.security.cyrus.sasl |
|---|---|
| Message-ID | <[email protected]> |
I am working on fixing some of the bugs filed against the Debian cyrus-sasl2 package. There is one bug that pertains to the keytab option not working when SASL is compiled against MIT Kerberos. I have implemented the attached patch in the Debian package (version 2.1.25). I am providing it here for review and comment. If it can be incorporated upstream as is, that would be excellent. If any changes are required, please let me know. For reference, the bug report can be viewed here: http://bugs.debian.org/651308 Regards, -Roberto -- Roberto C. Sánchez http://people.connexer.com/~roberto http://www.connexer.com
0041_fix_keytab_option_for_MIT_kerberos.patch
(text/x-diff, 3.7 KB)
Author: Roberto C. Sanchez <[email protected]> Description: Fix buginess that results in the keytab configuration option not working on MIT Kerberos (Closes: #651308). --- cyrus-sasl2.git.orig/cmulocal/sasl2.m4 +++ cyrus-sasl2.git/cmulocal/sasl2.m4 @@ -266,6 +266,7 @@ cmu_save_LIBS="$LIBS" LIBS="$LIBS $GSSAPIBASE_LIBS" AC_CHECK_FUNCS(gsskrb5_register_acceptor_identity) + AC_CHECK_FUNCS(krb5_gss_register_acceptor_identity) AC_CHECK_FUNCS(gss_decapsulate_token) AC_CHECK_FUNCS(gss_encapsulate_token) AC_CHECK_FUNCS(gss_oid_equal) --- cyrus-sasl2.git.orig/config.h.in +++ cyrus-sasl2.git/config.h.in @@ -126,6 +126,10 @@ */ #undef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY +/* Define to 1 if you have the `krb5_gss_register_acceptor_identity' function. + */ +#undef HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY + /* Define if your GSSAPI implementation defines GSS_C_NT_HOSTBASED_SERVICE */ #undef HAVE_GSS_C_NT_HOSTBASED_SERVICE --- cyrus-sasl2.git.orig/configure +++ cyrus-sasl2.git/configure @@ -13333,7 +13333,7 @@ cmu_save_LIBS="$LIBS" LIBS="$LIBS $GSSAPIBASE_LIBS" -for ac_func in gsskrb5_register_acceptor_identity +for ac_func in gsskrb5_register_acceptor_identity krb5_gss_regster_acceptor_identity do as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` { $as_echo "$as_me:$LINENO: checking for $ac_func" >&5 --- cyrus-sasl2.git.orig/plugins/gssapi.c +++ cyrus-sasl2.git/plugins/gssapi.c @@ -50,6 +50,9 @@ #else #include <gssapi/gssapi.h> #endif +#ifdef HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY +#include <gssapi/gssapi_krb5.h> +#endif #ifdef WIN32 # include <winsock2.h> @@ -1271,7 +1274,7 @@ }; int gssapiv2_server_plug_init( -#ifndef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY +#if !defined(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY) && !defined(HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY) const sasl_utils_t *utils __attribute__((unused)), #else const sasl_utils_t *utils, @@ -1281,7 +1284,7 @@ sasl_server_plug_t **pluglist, int *plugcount) { -#ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY +#if defined(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY) || defined(HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY) const char *keytab = NULL; char keytab_path[1024]; unsigned int rl; @@ -1291,7 +1294,7 @@ return SASL_BADVERS; } -#ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY +#if defined(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY) || defined(HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY) /* unfortunately, we don't check for readability of keytab if it's the standard one, since we don't know where it is */ @@ -1314,7 +1317,12 @@ strncpy(keytab_path, keytab, 1024); +#ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY gsskrb5_register_acceptor_identity(keytab_path); +#endif +#ifdef HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY + krb5_gss_register_acceptor_identity(keytab_path); +#endif } #endif --- cyrus-sasl2.git.orig/saslauthd/configure +++ cyrus-sasl2.git/saslauthd/configure @@ -9116,7 +9116,7 @@ cmu_save_LIBS="$LIBS" LIBS="$LIBS $GSSAPIBASE_LIBS" -for ac_func in gsskrb5_register_acceptor_identity +for ac_func in gsskrb5_register_acceptor_identity krb5_gss_regster_acceptor_identity do as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` { $as_echo "$as_me:$LINENO: checking for $ac_func" >&5 --- cyrus-sasl2.git.orig/saslauthd/saslauthd.h.in +++ cyrus-sasl2.git/saslauthd/saslauthd.h.in @@ -59,6 +59,10 @@ */ #undef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY +/* Define to 1 if you have the `krb5_gss_register_acceptor_identity' function. + */ +#undef HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY + /* Define if your GSSAPI implementation defines GSS_C_NT_HOSTBASED_SERVICE */ #undef HAVE_GSS_C_NT_HOSTBASED_SERVICE
signature.asc
(application/pgp-signature, 836 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBCAAGBQJS6m3nAAoJECzXeF7dp7IPG8sP+QG7i5bAJADwao65QFArM1JS AlPtn6lrSEkgE40TlQQ16uP4BCpIJ5XRlP2+O4x7XS6jNUxn7NQ90YB0alxsVOz6 7tpIvCneTJbEU2x1oGVoeB/1AMoOXvfWmia2lZtBibHnQESebE9DCvzypsQpIPw0 nudNC2Z69a0W582dzR48UpKUPeLWCL7VvdYg4fkdttUwY2VrsKTAHQAbr8eosoYk BjD+o9m1Q76cHSpkQHzUMqK8jaYeHzXnZDIt4P7dqSd0YaxzRGObte8arbbhqffj FuM7v5EbeGBbfINxzv0Nf/DNueiMy0MF+XntzHqCRdQygtBfDIcJGfl0OLzDo7tb J90skbGVjavEAMZUC/RQlO5bq/tgLHzvUOBP0e90s76H9e1bZDoXnEiS2ad6tA/j R+9Y8LCOc26FQoHObTSVbt4HxK8W2pcaVW31m9YazY0bQZi9tkPgwCUmtaqBddvS 6rbv4/871wo8hJThojvjV2I/mGCjXAKAXA4H2R4TPsW7idW9JnG7pT8xm5D6Vff2 TbiPVLcFlkDcDHvM5wbi4gXGwP/seBdarzjByo7oR+umQoXSlGih07AF617Gys7a 2yxa0uRNXJ1urlUW4ipQimwt8qO8hVIRaE+fSUJ5L+eiTonWj9sUF+GlBbyFhrT8 FAgPOm6wPYX8s4zze/bH =Q2OL -----END PGP SIGNATURE-----