From owner-freebsd-current@FreeBSD.ORG Tue Mar 10 11:41:40 2009 Return-Path: Delivered-To: current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 2BA7F10656CE for ; Tue, 10 Mar 2009 11:41:40 +0000 (UTC) (envelope-from kostikbel@gmail.com) Received: from mail.terabit.net.ua (mail.terabit.net.ua [195.137.202.147]) by mx1.freebsd.org (Postfix) with ESMTP id B5ABA8FC0C for ; Tue, 10 Mar 2009 11:41:39 +0000 (UTC) (envelope-from kostikbel@gmail.com) Received: from skuns.zoral.com.ua ([91.193.166.194] helo=mail.zoral.com.ua) by mail.terabit.net.ua with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63 (FreeBSD)) (envelope-from ) id 1Lh0L1-000ILj-Ul; Tue, 10 Mar 2009 13:41:35 +0200 Received: from deviant.kiev.zoral.com.ua (root@deviant.kiev.zoral.com.ua [10.1.1.148]) by mail.zoral.com.ua (8.14.2/8.14.2) with ESMTP id n2ABfWIa080695 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 10 Mar 2009 13:41:32 +0200 (EET) (envelope-from kostikbel@gmail.com) Received: from deviant.kiev.zoral.com.ua (kostik@localhost [127.0.0.1]) by deviant.kiev.zoral.com.ua (8.14.3/8.14.3) with ESMTP id n2ABfW8I035625; Tue, 10 Mar 2009 13:41:32 +0200 (EET) (envelope-from kostikbel@gmail.com) Received: (from kostik@localhost) by deviant.kiev.zoral.com.ua (8.14.3/8.14.3/Submit) id n2ABfWQc035624; Tue, 10 Mar 2009 13:41:32 +0200 (EET) (envelope-from kostikbel@gmail.com) X-Authentication-Warning: deviant.kiev.zoral.com.ua: kostik set sender to kostikbel@gmail.com using -f Date: Tue, 10 Mar 2009 13:41:32 +0200 From: Kostik Belousov To: Doug Rabson Message-ID: <20090310114131.GD41617@deviant.kiev.zoral.com.ua> References: <49A69B74.1080201@sdf.lonestar.org> <49A97F2E.3030005@sdf.lonestar.org> <20090306213531.G60465@beagle.kn.op.dlr.de> <20090306211650.GD41617@deviant.kiev.zoral.com.ua> <20090306222433.GF41617@deviant.kiev.zoral.com.ua> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="c6PtJzCbsDFohpLX" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.2.3i X-Virus-Scanned: ClamAV version 0.94.2, clamav-milter version 0.94.2 on skuns.kiev.zoral.com.ua X-Virus-Status: Clean X-Spam-Status: No, score=-4.4 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_00 autolearn=ham version=3.2.5 X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on skuns.kiev.zoral.com.ua X-Virus-Scanned: mail.terabit.net.ua 1Lh0L1-000ILj-Ul f572459886c07b5904bac23124d3a3e9 X-Terabit: YES Cc: tmclaugh@sdf.lonestar.org, Hartmut Brandt , kazakov@gmail.com, current@freebsd.org Subject: Re: problem with nss_ldap X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Mar 2009 11:41:40 -0000 --c6PtJzCbsDFohpLX Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Mar 10, 2009 at 10:38:51AM +0000, Doug Rabson wrote: >=20 > On 6 Mar 2009, at 22:24, Kostik Belousov wrote: >=20 > >On Fri, Mar 06, 2009 at 05:00:49PM -0500, tmclaugh@sdf.lonestar.org =20 > >wrote: > >>>On Fri, Mar 06, 2009 at 09:39:31PM +0100, Hartmut Brandt wrote: > >>>> > >>>>Hi Tom, > >>>> > >>>>On Sat, 28 Feb 2009, Tom McLaughlin wrote: > >>>> > >>>>TM>Tom McLaughlin wrote: > >>>>TM>> Harti Brandt wrote: > >>>>TM>> > On Sun, 18 Jan 2009, Hartmut.Brandt@dlr.de wrote: > >>>>TM> > >>>>TM>> > > Both create entries in /var/log/messages like: > >>>>TM>> > > > >>>>TM>> > > Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI Error: > >>>>Miscellaneous > >>>>TM>> > > failure (see > >>>>TM>> > > > >>>>text)???????????????=20 > >>>>ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ > >>>>TM>Z > >>>>TM>> Z > >>>>TM>> > ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ > >>>>TM>> > > Jan 18 20:00:02 knopdnsimu13f kernel: ZZZZZZZZZZZZZZZZ > >>>>TM>> > > > >>>>TM>> > > I've tried to figure out in which of the dozens of layered > >>>>libraries > >>>>TM>> > > (gss, sasl, ssl, ......) this error is generated but did =20 > >>>>not > >>>>find > >>>>TM>> > > anything. > >>>>TM>> > > > >>>>TM>> > > This is on amd64, krb5 enabled in pam, gssapi disabled in > >>>>sshd_config > >>>>TM>> > > (as I said, this worked before). > >>>>TM>> > So to answer my own mail: I made a link from the kerberos =20 > >>>>ticket > >>>>file > >>>>TM>> > which contains the host ticket (and is specified in > >>>>nss_ldap.conf) to > >>>>TM>> > /tmp/krb5cc_0. I've no idea why this is suddenly necessary, > >>>>though. > >>>>TM>> > >>>>TM>> There may be an issue with the env method used in nss_ldap to > >>>>change the > >>>>TM>> credentials cache. My mind is fuzzy but I do recall a similar > >>>>issue but > >>>>TM>> don't remember the exact cause or case. nss_ldap has a second > >>>>configurable > >>>>TM>> ccname method which when I submitted the original patch I =20 > >>>>intended > >>>>to > >>>>TM>> switch to once we had a newer heimdal. Once I get nss_ldap =20 > >>>>working > >>>>on my > >>>>TM>> box I intend to submit another patch. > >>>>TM>> > >>>>TM>> tom > >>>>TM> > >>>>TM>Hi Harti (CC maintainer), > >>>>TM> > >>>>TM>Can you try the attached patch for nss_ldap? This should =20 > >>>>cause the > >>>>host > >>>>TM>ticket to work correctly on -CURRENT. It's "my box approved". > >>>> > >>>>Does not work. I rebuilt my system with today's sources to be sure, > >>>>removed my patches to the two library makefiles and rebuilt =20 > >>>>nss_ldap > >>>>with > >>>>your patch. I get: > >>>> > >>>># ls -l > >>>>dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol > >>>>"GSS_C_NT_HOSTBASED_SERVICE" > >>>>/libexec/ld-elf.so.1: /usr/lib/libgssapi_krb5.so.10: Undefined =20 > >>>>symbol > >>>>"gss_oid_equal" > >>>> > >>>>Basically on everything I enter. Luckily vi still works :-) > >>>> > >>>>I saw that the configuration script claims not to find > >>>>gss_krb5_ccache_name in -lgssapi or -lgssapi_krb5. This is =20 > >>>>because the > >>>>test program for -lgssapi_krb5 links only to gssapi_krb5 but not to > >>>>gssapi > >>>>and so gets a lot of errors. I fixed this by adding gssapi, but the > >>>>final > >>>>result was the same. > >>> > >>>It seems that this is because libgssapi_krb5, libgssapi_spnego > >>>and several other heimdal shared libraries are not linked against > >>>libgssapi. > >>> > >>> > >> > >>As I understand it libgssapi_krb5 and libgssapi_spnego are not =20 > >>supposed to > >>be linked against libgssapi. They're supposed to be just plugins. > > > >These objects reference symbols from libgssapi. The libgssapi or =20 > >nss_ldap > >are dlopened without RTLD_GLOBAL flag, and libgssapi-provided symbols > >are not available. As I understand, nss module must be not loaded with > >RTLD_GLOBAL. > > > >Our binutils in base are old. Newer ld has a switch --no-allow-shlib-=20 > >undefined > >that fails the link if shared library has undefined references. I find > >it useful to catch and fix this kind of errors. >=20 >=20 > The real problem is that nss_ldap should not link with libgssapi_krb5 =20 > directly. This library is a plugin for the mechanism-independant =20 > libgssapi and can not be used standalone. The nss_ldap module should =20 > link to libgssapi and that will handle loading libgssapi_krb5 as =20 > necessary. >=20 I think this is a different problem, and it does not invalidates the requirement for each dso to be linked against all required dso's that provide symbols referenced by the first one. --c6PtJzCbsDFohpLX Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (FreeBSD) iEYEARECAAYFAkm2UesACgkQC3+MBN1Mb4jGLQCeLitgzFnqpBuvQ6K8w1mvlwj0 QrQAoJcKe1id1Fuw2MPJMdzA5+voEr1o =H5fc -----END PGP SIGNATURE----- --c6PtJzCbsDFohpLX--