Date: Tue, 10 Mar 2009 12:58:30 -0400 From: Tom McLaughlin <tmclaugh@sdf.lonestar.org> To: Doug Rabson <dfr@rabson.org> Cc: Kostik Belousov <kostikbel@gmail.com>, Hartmut Brandt <hartmut.brandt@dlr.de>, kazakov@gmail.com, current@freebsd.org Subject: Re: problem with nss_ldap Message-ID: <49B69C36.3010307@sdf.lonestar.org> In-Reply-To: <70D16F57-F7E3-4CDA-BCD5-5D79B566510B@rabson.org> References: <E2F5A6372272F744859F67CB11ABC1110507D4@exbe05.intra.dlr.de> <alpine.BSF.1.10.0901231858510.1173@knopdnsimu13l.kn.op.dlr.de> <49A69B74.1080201@sdf.lonestar.org> <49A97F2E.3030005@sdf.lonestar.org> <20090306213531.G60465@beagle.kn.op.dlr.de> <20090306211650.GD41617@deviant.kiev.zoral.com.ua> <ea4fb05da7fa78720849158fe0fcb840.squirrel@webmail.freeshell.org> <20090306222433.GF41617@deviant.kiev.zoral.com.ua> <FE4696E5-35E2-45BC-893E-F74CCB5A7F05@rabson.org> <20090310114131.GD41617@deviant.kiev.zoral.com.ua> <70D16F57-F7E3-4CDA-BCD5-5D79B566510B@rabson.org>
next in thread | previous in thread | raw e-mail | index | archive | help
This is a multi-part message in MIME format. --------------070509010908020907050708 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Doug Rabson wrote: > On 10 Mar 2009, at 11:41, Kostik Belousov wrote: > >> On Tue, Mar 10, 2009 at 10:38:51AM +0000, Doug Rabson wrote: >>> On 6 Mar 2009, at 22:24, Kostik Belousov wrote: >>> >>>> On Fri, Mar 06, 2009 at 05:00:49PM -0500, tmclaugh@sdf.lonestar.org >>>> wrote: >>>>>> On Fri, Mar 06, 2009 at 09:39:31PM +0100, Hartmut Brandt wrote: >>>>>>> Hi Tom, >>>>>>> >>>>>>> On Sat, 28 Feb 2009, Tom McLaughlin wrote: >>>>>>> >>>>>>> TM>Tom McLaughlin wrote: >>>>>>> TM>> Harti Brandt wrote: >>>>>>> TM>> > On Sun, 18 Jan 2009, Hartmut.Brandt@dlr.de wrote: >>>>>>> TM> >>>>>>> TM>> > > Both create entries in /var/log/messages like: >>>>>>> TM>> > > >>>>>>> TM>> > > Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI Error: >>>>>>> Miscellaneous >>>>>>> TM>> > > failure (see >>>>>>> TM>> > > >>>>>>> text)??????????????? >>>>>>> ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ >>>>>>> TM>Z >>>>>>> TM>> Z >>>>>>> TM>> > ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ >>>>>>> TM>> > > Jan 18 20:00:02 knopdnsimu13f kernel: ZZZZZZZZZZZZZZZZ >>>>>>> TM>> > > >>>>>>> TM>> > > I've tried to figure out in which of the dozens of >>>>>>> layered >>>>>>> libraries >>>>>>> TM>> > > (gss, sasl, ssl, ......) this error is generated but did >>>>>>> not >>>>>>> find >>>>>>> TM>> > > anything. >>>>>>> TM>> > > >>>>>>> TM>> > > This is on amd64, krb5 enabled in pam, gssapi disabled >>>>>>> in >>>>>>> sshd_config >>>>>>> TM>> > > (as I said, this worked before). >>>>>>> TM>> > So to answer my own mail: I made a link from the kerberos >>>>>>> ticket >>>>>>> file >>>>>>> TM>> > which contains the host ticket (and is specified in >>>>>>> nss_ldap.conf) to >>>>>>> TM>> > /tmp/krb5cc_0. I've no idea why this is suddenly >>>>>>> necessary, >>>>>>> though. >>>>>>> TM>> >>>>>>> TM>> There may be an issue with the env method used in nss_ldap >>>>>>> to >>>>>>> change the >>>>>>> TM>> credentials cache. My mind is fuzzy but I do recall a >>>>>>> similar >>>>>>> issue but >>>>>>> TM>> don't remember the exact cause or case. nss_ldap has a >>>>>>> second >>>>>>> configurable >>>>>>> TM>> ccname method which when I submitted the original patch I >>>>>>> intended >>>>>>> to >>>>>>> TM>> switch to once we had a newer heimdal. Once I get nss_ldap >>>>>>> working >>>>>>> on my >>>>>>> TM>> box I intend to submit another patch. >>>>>>> TM>> >>>>>>> TM>> tom >>>>>>> TM> >>>>>>> TM>Hi Harti (CC maintainer), >>>>>>> TM> >>>>>>> TM>Can you try the attached patch for nss_ldap? This should >>>>>>> cause the >>>>>>> host >>>>>>> TM>ticket to work correctly on -CURRENT. It's "my box approved". >>>>>>> >>>>>>> Does not work. I rebuilt my system with today's sources to be >>>>>>> sure, >>>>>>> removed my patches to the two library makefiles and rebuilt >>>>>>> nss_ldap >>>>>>> with >>>>>>> your patch. I get: >>>>>>> >>>>>>> # ls -l >>>>>>> dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol >>>>>>> "GSS_C_NT_HOSTBASED_SERVICE" >>>>>>> /libexec/ld-elf.so.1: /usr/lib/libgssapi_krb5.so.10: Undefined >>>>>>> symbol >>>>>>> "gss_oid_equal" >>>>>>> >>>>>>> Basically on everything I enter. Luckily vi still works :-) >>>>>>> >>>>>>> I saw that the configuration script claims not to find >>>>>>> gss_krb5_ccache_name in -lgssapi or -lgssapi_krb5. This is >>>>>>> because the >>>>>>> test program for -lgssapi_krb5 links only to gssapi_krb5 but >>>>>>> not to >>>>>>> gssapi >>>>>>> and so gets a lot of errors. I fixed this by adding gssapi, but >>>>>>> the >>>>>>> final >>>>>>> result was the same. >>>>>> It seems that this is because libgssapi_krb5, libgssapi_spnego >>>>>> and several other heimdal shared libraries are not linked against >>>>>> libgssapi. >>>>>> >>>>>> >>>>> As I understand it libgssapi_krb5 and libgssapi_spnego are not >>>>> supposed to >>>>> be linked against libgssapi. They're supposed to be just plugins. >>>> These objects reference symbols from libgssapi. The libgssapi or >>>> nss_ldap >>>> are dlopened without RTLD_GLOBAL flag, and libgssapi-provided >>>> symbols >>>> are not available. As I understand, nss module must be not loaded >>>> with >>>> RTLD_GLOBAL. >>>> >>>> Our binutils in base are old. Newer ld has a switch --no-allow- >>>> shlib- >>>> undefined >>>> that fails the link if shared library has undefined references. I >>>> find >>>> it useful to catch and fix this kind of errors. >>> >>> The real problem is that nss_ldap should not link with libgssapi_krb5 >>> directly. This library is a plugin for the mechanism-independant >>> libgssapi and can not be used standalone. The nss_ldap module should >>> link to libgssapi and that will handle loading libgssapi_krb5 as >>> necessary. >>> >> I think this is a different problem, and it does not invalidates the >> requirement for each dso to be linked against all required dso's that >> provide symbols referenced by the first one. > > Perhaps I should have put GSS-API extensions in a different library > from the mechanism implementation. This is actually quite possible > since all the krb5 extensions are wrappers on a more generic GSS-API > extension api. Its probably too hard to do that now. Okay, attached is a patch to nss_ldap. On -CURRENT I have changed the CONFIGURE_ARG to use "--enable-configurable-krb5-ccname-gssapi" instead of "--enable-configurable-krb5-ccname-env" which fixes Harti's initial problem with apps like cron failing. It will also make nss_ldap link against libgssapi and libgssapi_krb5. I still have one lingering issue though at least things work. [tom@freebsd-8-amd64 tom]$ getent passwd tom dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol "GSS_C_NT_HOSTBASED_SERVICE" tom:x:10001:10001:Tom McLaughlin:/home/tom:/bin/sh I am also curious how gssapi in -CURRENT is affecting the ports tree. Are other ports experiencing similar linking issues? How can I go about finding and fixing them? tom -- | tmclaugh at sdf.lonestar.org tmclaugh at FreeBSD.org | | FreeBSD http://www.FreeBSD.org | --------------070509010908020907050708 Content-Type: text/plain; name="nss_ldap-gssapi.diff" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="nss_ldap-gssapi.diff" Index: Makefile =================================================================== RCS file: /ncvs/ports/net/nss_ldap/Makefile,v retrieving revision 1.27 diff -u -r1.27 Makefile --- Makefile 5 Jan 2009 19:04:27 -0000 1.27 +++ Makefile 10 Mar 2009 16:48:16 -0000 @@ -33,11 +33,17 @@ CONFIGURE_ARGS= --with-ldap-conf-file=${PREFIX}/etc/nss_ldap.conf \ --with-ldap-secret-file=${PREFIX}/etc/nss_ldap.secret \ --enable-rfc2307bis \ - --enable-paged-results \ - --enable-configurable-krb5-ccname-env + --enable-paged-results MAN5= nss_ldap.5 +.include <bsd.port.pre.mk> +.if ${OSVERSION} >= 800064 +CONFIGURE_ARGS+=--enable-configurable-krb5-ccname-gssapi +.else +CONFIGURE_ARGS+=--enable-configurable-krb5-ccname-env +.endif + post-extract: ${CP} ${FILESDIR}/bsdnss.c ${WRKSRC} @@ -49,4 +55,4 @@ ${INSTALL_MAN} ${WRKSRC}/${MAN5} ${MAN5PREFIX}/man/man5 ${SED} -e "s,%%PREFIX%%,${PREFIX},g" ${PKGMESSAGE} -.include <bsd.port.mk> +.include <bsd.port.post.mk> Index: files/patch-configure.in =================================================================== RCS file: /ncvs/ports/net/nss_ldap/files/patch-configure.in,v retrieving revision 1.1 diff -u -r1.1 patch-configure.in --- files/patch-configure.in 10 Dec 2008 16:11:25 -0000 1.1 +++ files/patch-configure.in 10 Mar 2009 16:48:16 -0000 @@ -1,5 +1,5 @@ ---- configure.in.orig 2007-10-29 06:30:12.000000000 -0700 -+++ configure.in 2008-09-26 20:38:20.000000000 -0700 +--- configure.in.orig 2008-10-30 16:50:15.000000000 -0400 ++++ configure.in 2009-03-10 12:38:47.778089424 -0400 @@ -96,11 +96,15 @@ linux*) nss_ldap_so_LDFLAGS="-shared -Wl,-Bdynamic -Wl,--version-script,\$(srcdir)/exports.linux" ;; *) nss_ldap_so_LDFLAGS="-shared -Wl,-Bdynamic" ;; @@ -24,3 +24,12 @@ AC_CHECK_HEADERS(irs.h) ;; esac AC_CHECK_HEADERS(thread.h) +@@ -288,7 +291,7 @@ + + AC_CHECK_LIB(gssapi, gss_krb5_ccache_name,[LIBS="-lgssapi $LIBS" found_gssapi_lib=yes],,$LIBS) + if test -z "$found_gssapi_lib"; then +- AC_CHECK_LIB(gssapi_krb5, gss_krb5_ccache_name,[LIBS="-lgssapi_krb5 $LIBS"],,$LIBS) ++ AC_CHECK_LIB(gssapi_krb5, gss_krb5_ccache_name,[LIBS="-lgssapi -lgssapi_krb5 $LIBS"],,-lgssapi $LIBS) + fi + + dnl Following checks probably not strictly necessary. --------------070509010908020907050708--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?49B69C36.3010307>