Submitted By: Mario Fetka (mario dot fetka at gmail dot com) Date: 2013-11-21 Initial Package Version: 1.2.4 Origin: http://cvs.pld-linux.org/cgi-bin/viewvc.cgi/cvs/packages/nfs-utils/nfs-utils-heimdal.patch?view=log Upstream Status: unknown Description: Add proper Heimdal support diff -Naur nfs-utils-1.2.9.orig/aclocal/kerberos5.m4 nfs-utils-1.2.9/aclocal/kerberos5.m4 --- nfs-utils-1.2.9.orig/aclocal/kerberos5.m4 2013-11-21 09:15:13.833824277 +0000 +++ nfs-utils-1.2.9/aclocal/kerberos5.m4 2013-11-21 09:46:48.325139877 +0000 @@ -31,16 +31,16 @@ fi if test "$K5CONFIG" != ""; then KRBCFLAGS=`$K5CONFIG --cflags` - KRBLIBS=`$K5CONFIG --libs` + KRBLIBS=`$K5CONFIG --libs gssapi` GSSKRB_CFLAGS=`$K5CONFIG --cflags gssapi` GSSKRB_LIBS=`$K5CONFIG --libs gssapi` - K5VERS=`$K5CONFIG --version | head -n 1 | awk '{split($(4),v,"."); if (v@<:@"3"@:>@ == "") v@<:@"3"@:>@ = "0"; print v@<:@"1"@:>@v@<:@"2"@:>@v@<:@"3"@:>@ }'` AC_DEFINE_UNQUOTED(KRB5_VERSION, $K5VERS, [Define this as the Kerberos version number]) if test -f $dir/include/gssapi/gssapi_krb5.h -a \ \( -f $dir/lib/libgssapi_krb5.a -o \ -f $dir/lib64/libgssapi_krb5.a -o \ -f $dir/lib64/libgssapi_krb5.so -o \ -f $dir/lib/libgssapi_krb5.so \) ; then + K5VERS=`$K5CONFIG --version | head -n 1 | awk '{split($(4),v,"."); if (v@<:@"3"@:>@ == "") v@<:@"3"@:>@ = "0"; print v@<:@"1"@:>@v@<:@"2"@:>@v@<:@"3"@:>@ }'` AC_DEFINE(HAVE_KRB5, 1, [Define this if you have MIT Kerberos libraries]) KRBDIR="$dir" dnl If we are using MIT K5 1.3.1 and before, we *MUST* use the @@ -58,7 +58,11 @@ dnl of Heimdal Kerberos on SuSe elif test \( -f $dir/include/heim_err.h -o\ -f $dir/include/heimdal/heim_err.h \) -a \ - -f $dir/lib/libroken.a; then + \( -f $dir/lib/libroken.a -o \ + -f $dir/lib64/libroken.a -o \ + -f $dir/lib64/libroken.so -o \ + -f $dir/lib/libroken.so \) ; then + K5VERS=`$K5CONFIG --version | head -n 1 | awk '{split($(2),v,"."); if (v@<:@"3"@:>@ == "") v@<:@"3"@:>@ = "0"; print v@<:@"1"@:>@v@<:@"2"@:>@v@<:@"3"@:>@ }'` AC_DEFINE(HAVE_HEIMDAL, 1, [Define this if you have Heimdal Kerberos libraries]) KRBDIR="$dir" gssapi_lib=gssapi diff -Naur nfs-utils-1.2.9.orig/aclocal/rpcsec_vers.m4 nfs-utils-1.2.9/aclocal/rpcsec_vers.m4 --- nfs-utils-1.2.9.orig/aclocal/rpcsec_vers.m4 2013-11-21 09:15:13.833824277 +0000 +++ nfs-utils-1.2.9/aclocal/rpcsec_vers.m4 2013-11-21 09:22:55.731049767 +0000 @@ -4,8 +4,11 @@ AC_ARG_WITH([gssglue], [AC_HELP_STRING([--with-gssglue], [Use libgssglue for GSS support])]) if test x"$with_gssglue" = x"yes"; then - PKG_CHECK_MODULES([GSSGLUE], [libgssglue >= 0.3]) - AC_CHECK_LIB([gssglue], [gss_set_allowable_enctypes]) + dnl libgssglue is needed only for MIT Kerberos + if test "$gssapi_lib" = gssapi_krb5; then + PKG_CHECK_MODULES([GSSGLUE], [libgssglue >= 0.3]) + AC_CHECK_LIB([gssglue], [gss_set_allowable_enctypes]) + fi fi dnl TI-RPC replaces librpcsecgss diff -Naur nfs-utils-1.2.9.orig/utils/gssd/context_lucid.c nfs-utils-1.2.9/utils/gssd/context_lucid.c --- nfs-utils-1.2.9.orig/utils/gssd/context_lucid.c 2013-11-21 09:15:13.830824315 +0000 +++ nfs-utils-1.2.9/utils/gssd/context_lucid.c 2013-11-21 09:51:19.942744189 +0000 @@ -266,8 +266,13 @@ int retcode = 0; printerr(2, "DEBUG: %s: lucid version!\n", __FUNCTION__); +#ifdef HAVE_HEIMDAL + maj_stat = gss_krb5_export_lucid_sec_context(&min_stat, &ctx, + 1, &return_ctx); +#else maj_stat = gss_export_lucid_sec_context(&min_stat, ctx, 1, &return_ctx); +#endif if (maj_stat != GSS_S_COMPLETE) { pgsserr("gss_export_lucid_sec_context", maj_stat, min_stat, &krb5oid); @@ -302,7 +307,11 @@ else retcode = prepare_krb5_rfc4121_buffer(lctx, buf, endtime); +#ifdef HAVE_HEIMDAL + maj_stat = gss_krb5_free_lucid_sec_context(&min_stat, return_ctx); +#else maj_stat = gss_free_lucid_sec_context(&min_stat, ctx, return_ctx); +#endif if (maj_stat != GSS_S_COMPLETE) { pgsserr("gss_free_lucid_sec_context", maj_stat, min_stat, &krb5oid); diff -Naur nfs-utils-1.2.9.orig/utils/gssd/krb5_util.c nfs-utils-1.2.9/utils/gssd/krb5_util.c --- nfs-utils-1.2.9.orig/utils/gssd/krb5_util.c 2013-11-21 09:15:13.829824327 +0000 +++ nfs-utils-1.2.9/utils/gssd/krb5_util.c 2013-11-21 09:58:13.211577618 +0000 @@ -115,7 +115,7 @@ #include #include #include -#ifdef USE_PRIVATE_KRB5_FUNCTIONS +#ifdef HAVE_HEIMDAL #include #endif #include @@ -970,9 +970,37 @@ { krb5_error_code ret; krb5_creds creds; - krb5_cc_cursor cur; int found = 0; +#ifdef HAVE_HEIMDAL + krb5_creds pattern; + krb5_const_realm client_realm; + + krb5_cc_clear_mcred(&pattern); + + client_realm = krb5_principal_get_realm (context, principal); + + ret = krb5_make_principal (context, &pattern.server, + client_realm, KRB5_TGS_NAME, client_realm, + NULL); + if (ret) + krb5_err (context, 1, ret, "krb5_make_principal"); + pattern.client = principal; + + ret = krb5_cc_retrieve_cred (context, ccache, 0, &pattern, &creds); + krb5_free_principal (context, pattern.server); + if (ret) { + if (ret == KRB5_CC_END) + return 1; + krb5_err (context, 1, ret, "krb5_cc_retrieve_cred"); + } + + found = creds.times.endtime > time(NULL); + + krb5_free_cred_contents (context, &creds); +#else + krb5_cc_cursor cur; + ret = krb5_cc_start_seq_get(context, ccache, &cur); if (ret) return 0; @@ -992,7 +1020,7 @@ krb5_free_cred_contents(context, &creds); } krb5_cc_end_seq_get(context, ccache, &cur); - +#endif return found; } @@ -1038,6 +1066,9 @@ } krb5_free_principal(context, principal); err_princ: +#ifdef HAVE_HEIMDAL +#define KRB5_TC_OPENCLOSE 0x00000001 +#endif krb5_cc_set_flags(context, ccache, KRB5_TC_OPENCLOSE); krb5_cc_close(context, ccache); err_cache: @@ -1452,12 +1483,21 @@ * If we failed for any reason to produce global * list of supported enctypes, use local default here. */ +#ifdef HAVE_HEIMDAL + if (krb5_enctypes == NULL || limit_to_legacy_enctypes) + maj_stat = gss_krb5_set_allowable_enctypes(&min_stat, credh, + num_enctypes, enctypes); + else + maj_stat = gss_krb5_set_allowable_enctypes(&min_stat, credh, + num_krb5_enctypes, krb5_enctypes); +#else if (krb5_enctypes == NULL || limit_to_legacy_enctypes) maj_stat = gss_set_allowable_enctypes(&min_stat, sec->cred, &krb5oid, num_enctypes, enctypes); else maj_stat = gss_set_allowable_enctypes(&min_stat, sec->cred, &krb5oid, num_krb5_enctypes, krb5_enctypes); +#endif if (maj_stat != GSS_S_COMPLETE) { pgsserr("gss_set_allowable_enctypes", diff -Naur nfs-utils-1.2.9.orig/utils/gssd/svcgssd_krb5.c nfs-utils-1.2.9/utils/gssd/svcgssd_krb5.c --- nfs-utils-1.2.9.orig/utils/gssd/svcgssd_krb5.c 2013-11-21 09:15:13.830824315 +0000 +++ nfs-utils-1.2.9/utils/gssd/svcgssd_krb5.c 2013-11-21 09:59:25.854669454 +0000 @@ -217,8 +217,13 @@ "enctypes from defaults\n", __func__, num_enctypes); } +#ifdef HAVE_HEIMDAL + maj_stat = gss_krb5_set_allowable_enctypes(&min_stat, gssd_creds, + num_enctypes, enctypes); +#else maj_stat = gss_set_allowable_enctypes(&min_stat, gssd_creds, &krb5oid, num_enctypes, enctypes); +#endif if (maj_stat != GSS_S_COMPLETE) { printerr(1, "WARNING: gss_set_allowable_enctypes failed\n"); pgsserr("svcgssd_limit_krb5_enctypes: gss_set_allowable_enctypes",