- rebuild properly when pthread_mutexattr_setrobust_np() is defined but not

declared, such as with recent glibc when _GNU_SOURCE isn't being used
2006-01-20 00:28:41 +00:00 · 2006-01-20 00:28:41 +00:00 · 5bf2d7bd12
commit 5bf2d7bd12
parent a6fb2997f1
2 changed files with 378 additions and 2 deletions
--- a/krb5-1.4.3-kdc_max_dgram_size.patch
+++ b/krb5-1.4.3-kdc_max_dgram_size.patch
@ -0,0 +1,367 @@
+Implement a "max_dgram_size" parameter for realms, which will control when/if
+the server will respond with KRB_ERR_RESPONSE_TOO_BIG errors to requests from
+its clients.
+
+Because the reads settings by using libkadm5's krb5_read_realm_params function,
+its returned structure type needs to be expanded to hold this information,
+which breaks the ABI.
+
+When processing AS or TGS requests, the server needs to keep track of whether
+or not the client is issuing a request over a connected socket so that it
+won't issue RESPONSE_TOO_BIG errors to connected clients.
+
+The lookaside cache also needs to take note of the distinction so that it
+doesn't replay error messages to clients who've switched from using a
+connectionless socket to a connected socket and are sending the same request.
+
+--- krb5-1.4.3/doc/definitions.texinfo	2006-01-05 15:12:12.000000000 -0500
+++ krb5-1.4.3/doc/definitions.texinfo	2006-01-05 15:12:50.000000000 -0500
+@@ -97,6 +97,8 @@
+ @set DefaultKDCRCache krb5kdc_rcache
+ @comment KDCRCACHE
+ @set DefaultRCTmpDirs /var/tmp, /usr/tmp, /var/usr/tmp, and /tmp
+@comment MAX_DGRAM_SIZE
+@set DefaultMaxDgramSize 4096
+ 
+ @ignore
+ the following defaults should be consistent with the numbers set in
+--- krb5-1.4.3/doc/admin.texinfo	2006-01-05 15:13:04.000000000 -0500
+++ krb5-1.4.3/doc/admin.texinfo	2006-01-05 15:14:22.000000000 -0500
+@@ -1264,6 +1264,14 @@
+ valid ticket may be renewed in this realm.  The default value is
+ @value{DefaultMaxRenewableLife}.
+ 
+@itemx max_dgram_size
+(Numeric value.)  Specifies the maximum allowed size for responses to
+client requests which are received over unconnected sockets (usually,
+UDP, as opposed to TCP).  If the response to a request would be larger
+than the specified size, a KRB_ERR_RESPONSE_TOO_BIG error is sent in
+its stead.  The default value is
+@value{DefaultMaxDgramSize}.
+
+ @itemx supported_enctypes
+ List of key:salt strings.  Specifies the default key/salt combinations of
+ principals for this realm.  Any principals created through @code{kadmin}
+--- krb5-1.4.3/src/lib/kadm5/srv/Makefile.in	2004-06-16 21:56:34.000000000 -0400
+++ krb5-1.4.3/src/lib/kadm5/srv/Makefile.in	2006-01-05 15:08:23.000000000 -0500
+@@ -9,8 +9,8 @@
+ ##DOSLIBNAME = libkadm5srv.lib
+ 
+ LIBBASE=kadm5srv
+-LIBMAJOR=5
+-LIBMINOR=1
+LIBMAJOR=6
+LIBMINOR=0
+ STOBJLISTS=../OBJS.ST OBJS.ST
+ 
+ SHLIB_EXPDEPS=\
+--- krb5-1.4.3/src/lib/kadm5/clnt/Makefile.in	2004-06-16 16:18:10.000000000 -0400
+++ krb5-1.4.3/src/lib/kadm5/clnt/Makefile.in	2006-01-05 15:08:23.000000000 -0500
+@@ -5,8 +5,8 @@
+ LOCALINCLUDES = -I$(BUILDTOP)/include/kadm5
+ 
+ LIBBASE=kadm5clnt
+-LIBMAJOR=5
+-LIBMINOR=1
+LIBMAJOR=6
+LIBMINOR=0
+ STOBJLISTS=../OBJS.ST OBJS.ST
+ SHLIB_EXPDEPS=\
+ 	$(TOPLIBD)/libgssrpc$(SHLIBEXT) \
+--- krb5-1.4.3/src/lib/kadm5/alt_prof.c	2004-06-24 16:08:30.000000000 -0400
+++ krb5-1.4.3/src/lib/kadm5/alt_prof.c	2006-01-05 15:08:23.000000000 -0500
+@@ -936,6 +936,13 @@
+ 	krb5_xfree(svalue);
+     }
+ 
+    /* Get the value for the maximum datagram response size */
+    hierarchy[2] = "max_dgram_size";
+    if (!krb5_aprof_get_int32(aprofile, hierarchy, TRUE, &ivalue)) {
+	rparams->realm_max_dgram_size = ivalue;
+	rparams->realm_max_dgram_size_valid = 1;
+    }
+	    
+     hierarchy[2] = "reject_bad_transit";
+     if (!krb5_aprof_get_boolean(aprofile, hierarchy, TRUE, &bvalue)) {
+ 	rparams->realm_reject_bad_transit = bvalue;
+--- krb5-1.4.3/src/kdc/extern.h	2003-06-03 00:32:41.000000000 -0400
+++ krb5-1.4.3/src/kdc/extern.h	2006-01-05 15:08:23.000000000 -0500
+@@ -64,6 +64,7 @@
+     krb5_deltat		realm_maxlife;	/* Maximum ticket life for realm    */
+     krb5_deltat		realm_maxrlife;	/* Maximum renewable life for realm */
+     krb5_boolean	realm_reject_bad_transit; /* Accept unverifiable transited_realm ? */
+    int			realm_max_dgram_size; /* Maximum datagram response size */
+ } kdc_realm_t;
+ 
+ extern kdc_realm_t	**kdc_realmlist;
+@@ -87,6 +88,7 @@
+ #define	dbm_db_name			kdc_active_realm->realm_dbname
+ #define	primary_port			kdc_active_realm->realm_pport
+ #define reject_bad_transit		kdc_active_realm->realm_reject_bad_transit
+#define max_dgram_size			kdc_active_realm->realm_max_dgram_size
+ 
+ /* various externs for KDC */
+ extern krb5_data 	empty_string;	/* an empty string */
+--- krb5-1.4.3/src/lib/kadm5/admin.h	2005-03-22 18:53:59.000000000 -0500
+++ krb5-1.4.3/src/lib/kadm5/admin.h	2006-01-05 15:08:23.000000000 -0500
+@@ -263,6 +263,7 @@
+     krb5_deltat		realm_max_rlife;
+     krb5_timestamp	realm_expiration;
+     krb5_flags		realm_flags;
+    int			realm_max_dgram_size;
+     krb5_key_salt_tuple	*realm_keysalts;
+     unsigned int	realm_reject_bad_transit:1;
+     unsigned int	realm_kadmind_port_valid:1;
+@@ -272,6 +273,7 @@
+     unsigned int	realm_expiration_valid:1;
+     unsigned int	realm_flags_valid:1;
+     unsigned int	realm_reject_bad_transit_valid:1;
+    unsigned int	realm_max_dgram_size_valid:1;
+     krb5_int32		realm_num_keysalts;
+ } krb5_realm_params;
+ 
+--- krb5-1.4.3/src/kdc/do_as_req.c	2005-07-12 16:59:52.000000000 -0400
+++ krb5-1.4.3/src/kdc/do_as_req.c	2006-01-05 15:08:23.000000000 -0500
+@@ -52,7 +52,7 @@
+ /*ARGSUSED*/
+ krb5_error_code
+ process_as_req(krb5_kdc_req *request, const krb5_fulladdr *from,
+-	       krb5_data **response)
+	       krb5_boolean connected, krb5_data **response)
+ {
+     krb5_db_entry client, server;
+     krb5_kdc_rep reply;
+@@ -403,6 +403,13 @@
+ 	status = "ENCODE_KDC_REP";
+ 	goto errout;
+     }
+
+    if (!connected && ((*response)->length > max_dgram_size)) {
+	errcode = KRB5KRB_ERR_RESPONSE_TOO_BIG;
+	krb5_free_data(kdc_context, *response);
+	*response = NULL;
+	goto errout;
+    }
+     
+     /* these parts are left on as a courtesy from krb5_encode_kdc_rep so we
+        can use them in raw form if needed.  But, we don't... */
+--- krb5-1.4.3/src/kdc/dispatch.c	2002-09-10 23:59:27.000000000 -0400
+++ krb5-1.4.3/src/kdc/dispatch.c	2006-01-05 15:08:23.000000000 -0500
+@@ -39,7 +39,8 @@
+ static krb5_int32 last_usec = 0, last_os_random = 0;
+ 
+ krb5_error_code
+-dispatch(krb5_data *pkt, const krb5_fulladdr *from, krb5_data **response)
+dispatch(krb5_data *pkt, const krb5_fulladdr *from, krb5_boolean connected,
+	 krb5_data **response)
+ {
+ 
+     krb5_error_code retval;
+@@ -50,7 +51,7 @@
+ 
+ #ifndef NOCACHE
+     /* try the replay lookaside buffer */
+-    if (kdc_check_lookaside(pkt, from, response)) {
+    if (kdc_check_lookaside(pkt, from, connected, response)) {
+ 	/* a hit! */
+ 	const char *name = 0;
+ 	char buf[46];
+@@ -87,7 +88,7 @@
+     /* try TGS_REQ first; they are more common! */
+ 
+     if (krb5_is_tgs_req(pkt)) {
+-	retval = process_tgs_req(pkt, from, response);
+	retval = process_tgs_req(pkt, from, connected, response);
+     } else if (krb5_is_as_req(pkt)) {
+ 	if (!(retval = decode_krb5_as_req(pkt, &as_req))) {
+ 	    /*
+@@ -95,7 +96,7 @@
+ 	     * pointer.
+ 	     */
+ 	    if (!(retval = setup_server_realm(as_req->server))) {
+-		retval = process_as_req(as_req, from, response);
+		retval = process_as_req(as_req, from, connected, response);
+ 	    }
+ 	    krb5_free_kdc_req(kdc_context, as_req);
+ 	}
+@@ -109,7 +110,7 @@
+ #ifndef NOCACHE
+     /* put the response into the lookaside buffer */
+     if (!retval)
+-	kdc_insert_lookaside(pkt, from, *response);
+	kdc_insert_lookaside(pkt, from, connected, *response);
+ #endif
+ 
+     return retval;
+--- krb5-1.4.3/src/kdc/network.c	2005-07-12 16:59:52.000000000 -0400
+++ krb5-1.4.3/src/kdc/network.c	2006-01-05 15:08:23.000000000 -0500
+@@ -744,7 +744,7 @@
+     faddr.address = &addr;
+     init_addr(&faddr, ss2sa(&saddr));
+     /* this address is in net order */
+-    if ((retval = dispatch(&request, &faddr, &response))) {
+    if ((retval = dispatch(&request, &faddr, FALSE, &response))) {
+ 	com_err(prog, retval, "while dispatching (udp)");
+ 	return;
+     }
+@@ -982,7 +982,7 @@
+ 	    /* have a complete message, and exactly one message */
+ 	    request.length = conn->u.tcp.msglen;
+ 	    request.data = conn->u.tcp.buffer + 4;
+-	    err = dispatch(&request, &conn->u.tcp.faddr,
+	    err = dispatch(&request, &conn->u.tcp.faddr, TRUE,
+ 			   &conn->u.tcp.response);
+ 	    if (err) {
+ 		com_err(prog, err, "while dispatching (tcp)");
+--- krb5-1.4.3/src/kdc/kdc_util.h	2004-09-23 22:19:42.000000000 -0400
+++ krb5-1.4.3/src/kdc/kdc_util.h	2006-01-05 15:08:23.000000000 -0500
+@@ -107,15 +107,18 @@
+ /* do_as_req.c */
+ krb5_error_code process_as_req (krb5_kdc_req *,
+ 					  const krb5_fulladdr *,
+					  krb5_boolean,
+ 					  krb5_data ** );
+ 
+ /* do_tgs_req.c */
+ krb5_error_code process_tgs_req (krb5_data *,
+ 					   const krb5_fulladdr *,
+					   krb5_boolean,
+ 					   krb5_data ** );
+ /* dispatch.c */
+ krb5_error_code dispatch (krb5_data *,
+ 				    const krb5_fulladdr *,
+				    krb5_boolean,
+ 				    krb5_data **);
+ 
+ /* main.c */
+@@ -155,9 +158,9 @@
+     
+ /* replay.c */
+ krb5_boolean kdc_check_lookaside (krb5_data *, const krb5_fulladdr *,
+-					    krb5_data **);
+-void kdc_insert_lookaside (krb5_data *, const krb5_fulladdr *,
+-				     krb5_data *);
+			   krb5_boolean, krb5_data **);
+void kdc_insert_lookaside (krb5_data *, const krb5_fulladdr *, krb5_boolean,
+			   krb5_data *);
+ void kdc_free_lookaside(krb5_context);
+ 
+ /* which way to convert key? */
+--- krb5-1.4.3/src/kdc/replay.c	2003-01-12 08:07:49.000000000 -0500
+++ krb5-1.4.3/src/kdc/replay.c	2006-01-05 15:08:23.000000000 -0500
+@@ -42,6 +42,7 @@
+     krb5_data *req_packet;
+     krb5_data *reply_packet;
+     krb5_address *addr;		/* XXX should these not be pointers? */
+    krb5_boolean connected;
+ } krb5_kdc_replay_ent;
+ 
+ static krb5_kdc_replay_ent root_ptr = {0};
+@@ -62,6 +63,7 @@
+ 		    !memcmp((ptr)->addr->contents,			\
+ 			    from->address->contents,			\
+ 			    from->address->length)&&			\
+		    (ptr->connected == connected) &&		\
+ 		    ((ptr)->db_age == db_age))
+ /* XXX
+    Todo:  quench the size of the queue...
+@@ -72,7 +74,7 @@
+ 
+ krb5_boolean
+ kdc_check_lookaside(krb5_data *inpkt, const krb5_fulladdr *from,
+-		    krb5_data **outpkt)
+		    krb5_boolean connected, krb5_data **outpkt)
+ {
+     krb5_int32 timenow;
+     register krb5_kdc_replay_ent *eptr, *last, *hold;
+@@ -126,7 +128,7 @@
+ 
+ void
+ kdc_insert_lookaside(krb5_data *inpkt, const krb5_fulladdr *from,
+-		     krb5_data *outpkt)
+		     krb5_boolean connected, krb5_data *outpkt)
+ {
+     register krb5_kdc_replay_ent *eptr;    
+     krb5_int32 timenow;
+@@ -142,6 +144,7 @@
+ 	return;
+     eptr->timein = timenow;
+     eptr->db_age = db_age;
+    eptr->connected = connected;
+     /*
+      * This is going to hurt a lot malloc()-wise due to the need to
+      * allocate memory for the krb5_data and krb5_address elements.
+--- krb5-1.4.3/src/kdc/main.c	2004-02-24 16:07:22.000000000 -0500
+++ krb5-1.4.3/src/kdc/main.c	2006-01-05 15:08:23.000000000 -0500
+@@ -231,6 +231,10 @@
+     rdp->realm_maxrlife = (rparams && rparams->realm_max_rlife_valid) ?
+ 	rparams->realm_max_rlife : KRB5_KDB_MAX_RLIFE;
+ 
+    /* Handle maximum datagram response size */
+    rdp->realm_max_dgram_size = (rparams && rparams->realm_max_dgram_size_valid) ?
+	rparams->realm_max_dgram_size : MAX_DGRAM_SIZE;
+
+     if (rparams)
+ 	krb5_free_realm_params(rdp->realm_context, rparams);
+ 
+--- krb5-1.4.3/src/kdc/do_tgs_req.c	2005-07-12 16:59:52.000000000 -0400
+++ krb5-1.4.3/src/kdc/do_tgs_req.c	2006-01-05 15:08:23.000000000 -0500
+@@ -56,7 +56,7 @@
+ /*ARGSUSED*/
+ krb5_error_code
+ process_tgs_req(krb5_data *pkt, const krb5_fulladdr *from,
+-		krb5_data **response)
+		krb5_boolean connected, krb5_data **response)
+ {
+     krb5_keyblock * subkey;
+     krb5_kdc_req *request = 0;
+@@ -630,7 +630,13 @@
+     if (errcode) {
+ 	status = "ENCODE_KDC_REP";
+     } else {
+-	status = "ISSUE";
+	if (!connected && ((*response)->length > max_dgram_size)) {
+	    errcode = KRB5KRB_ERR_RESPONSE_TOO_BIG;
+	    krb5_free_data(kdc_context, *response);
+	    *response = NULL;
+	} else {
+	    status = "ISSUE";
+	}
+     }
+ 
+     memset(ticket_reply.enc_part.ciphertext.data, 0,
+--- krb5-1.4.3/src/config-files/kdc.conf.M	2006-01-05 15:06:30.000000000 -0500
+++ krb5-1.4.3/src/config-files/kdc.conf.M	2006-01-05 15:08:23.000000000 -0500
+@@ -208,6 +208,14 @@
+ .B key type string
+ represents the master key's key type.
+ 
+.IP max_dgram_size
+This
+.B size
+specifes the maximum size for a response which the KDC will provide
+to clients which use datagrams to communicate with it.  Clients whose
+requests require larger responses will instead receive RESPONSE_TOO_BIG
+errors.
+
+ .IP max_life
+ This
+ .B delta time string
+--- krb5-1.4.3/src/include/krb5/adm.h	2002-09-18 16:45:36.000000000 -0400
+++ krb5-1.4.3/src/include/krb5/adm.h	2006-01-05 15:08:23.000000000 -0500
+@@ -208,6 +208,7 @@
+     krb5_deltat		realm_max_rlife;
+     krb5_timestamp	realm_expiration;
+     krb5_flags		realm_flags;
+    krb5_int32		realm_max_dgram_size;
+     krb5_key_salt_tuple	*realm_keysalts;
+     unsigned int	realm_reject_bad_transit:1;
+     unsigned int	realm_kadmind_port_valid:1;
+@@ -217,6 +218,7 @@
+     unsigned int	realm_expiration_valid:1;
+     unsigned int	realm_flags_valid:1;
+     unsigned int	realm_reject_bad_transit_valid:1;
+    unsigned int	realm_max_dgram_size_valid:1;
+     krb5_int32		realm_num_keysalts;
+ } krb5_realm_params;
+ #endif	/* KRB5_ADM_H__ */
--- a/krb5.spec
+++ b/krb5.spec
@ -10,9 +10,9 @@
 Summary: The Kerberos network authentication system.
 Name: krb5
 Version: 1.4.3
-Release: 2
+Release: 3
 # Maybe we should explode from the now-available-to-everybody tarball instead?
-# http://web.mit.edu/kerberos/dist/krb5/1.4/krb5-1.4.2-signed.tar
+# http://web.mit.edu/kerberos/dist/krb5/1.4/krb5-1.4.3-signed.tar
 Source0: krb5-%{version}.tar.gz
 Source1: krb5-%{version}.tar.gz.asc
 Source2: kpropd.init
@ -71,6 +71,8 @@ Patch36: krb5-1.3.3-rcp-markus.patch
 Patch39: krb5-1.4.1-api.patch
 Patch40: krb5-1.4.1-telnet-environ.patch
 Patch41: krb5-1.2.7-login-lpass.patch
+Patch42: krb5-1.4.3-pthread_np.patch
+Patch43: krb5-1.4.3-kdc_max_dgram_size.patch
 License: MIT, freely distributable.
 URL: http://web.mit.edu/kerberos/www/
 Group: System Environment/Libraries
@ -135,6 +137,10 @@ network uses Kerberos, this package should be installed on every
 workstation.

 %changelog
+* Thu Jan 19 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-3
+- rebuild properly when pthread_mutexattr_setrobust_np() is defined but not
+  declared, such as with recent glibc when _GNU_SOURCE isn't being used
+
 * Thu Jan 19 2006 Matthias Clasen <mclasen@redhat.com> 1.4.3-2
 - Use full paths in krb5.sh to avoid path lookups

@ -892,6 +898,9 @@ workstation.
 %patch39 -p1 -b .api
 %patch40 -p1 -b .telnet-environ
 %patch41 -p1 -b .login-lpass
+%patch42 -p1 -b .pthread_np
+# Don't apply this until we hear back from upstream.
+#%patch43 -p1 -b .kdc_max_dgram_size
 cp src/krb524/README README.krb524
 find . -type f -name "*.info-dir" -exec rm -fv "{}" ";"
 gzip doc/*.ps