After the upgrade to 5.4 I found httpd staying inactive on my test box.
It turned out mod_auth_kerb was missing some symbols:
# /etc/rc.d/httpd -d start
doing rc_read_runfile
doing rc_check
httpd
doing rc_pre
doing rc_start
/usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined
symbol 'fix_dce'
/usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined
symbol 'encode_octet_string'
/usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined
symbol 'copy_octet_string'
/usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined
symbol 'free_octet_string'
/usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined
symbol 'decode_octet_string'
/usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined
symbol 'copy_oid'
/usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined
symbol 'decode_oid'
/usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined
symbol 'encode_enumerated'
/usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined
symbol 'length_enumerated'
/usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined
symbol 'length_octet_string'
/usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined
symbol 'free_oid'
/usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined
symbol 'decode_enumerated'
/usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined
symbol 'length_len'
/usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined
symbol 'encode_oid'
/usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined
symbol 'length_oid'
Syntax error on line 274 of /var/www/conf/httpd.conf:
Cannot load /usr/lib/apache/modules/mod_auth_kerb.so into server: Cannot load
specified object
doing rc_rm_runfile
(failed)
The easiest solution for me was disabling mod_auth_kerb since I wasn't using
it anymore, however I decided to take a closer look.
AFAICT some symbols were removed during the Heimdal update.
At least fix_dce got "missing" from a recent libasn1:
$ objdump -t /usr/lib/libasn1.so.19.0 | grep fix_dce
0000000000069930 g F .text 0000000000000023 _heim_fix_dce
compared to an older version:
$ objdump -t /usr/lib/libasn1.so.18.0 | grep fix_dce
000000000007cc10 g F .text 0000000000000023 fix_dce
I noticed mod_auth_kerb includes sources for these symbols, so I cooked up a
patch to have them built and included in mod_auth_kerb.so.
Included patches to configure.in and configure seem to get rid of the missing
symbols problem. I can now start my httpd again, however, lacking a
configuration actually using mod_auth_kerb authentication, I did NOT test if
the actual authentication works !
I'm most likely going to remove mod_auth_kerb from my config, so I'm mainly
posting this hoping it's useful to others.
regards,
Remco
configure.in patch:
$OpenBSD$
--- configure.in.orig Mon Oct 28 09:48:18 2013
+++ configure.in Mon Oct 28 09:48:28 2013
@@ -187,18 +187,7 @@ int main(int argc, char** argv)
LDFLAGS="$ac_save_LDFLAGS"
if test -z "$gssapi_supports_spnego"; then
- if test -n "$have_heimdal"; then SPNEGO_SRCS="\
- spnegokrb5/asn1_MechType.c \
- spnegokrb5/asn1_MechTypeList.c \
- spnegokrb5/asn1_ContextFlags.c \
- spnegokrb5/asn1_NegTokenInit.c \
- spnegokrb5/asn1_NegTokenTarg.c \
- spnegokrb5/init_sec_context.c \
- spnegokrb5/accept_sec_context.c \
- spnegokrb5/encapsulate.c \
- spnegokrb5/decapsulate.c \
- spnegokrb5/external.c"
- else SPNEGO_SRCS="\
+ SPNEGO_SRCS="\
spnegokrb5/asn1_MechType.c \
spnegokrb5/asn1_MechTypeList.c \
spnegokrb5/asn1_ContextFlags.c \
@@ -215,7 +204,6 @@ int main(int argc, char** argv)
spnegokrb5/encapsulate.c \
spnegokrb5/decapsulate.c \
spnegokrb5/external.c"
- fi
fi
fi
fi
configure patch:
$OpenBSD$
--- configure.orig Wed Nov 22 11:33:58 2006
+++ configure Mon Oct 28 09:56:28 2013
@@ -3931,18 +3931,7 @@ fi
LDFLAGS="$ac_save_LDFLAGS"
if test -z "$gssapi_supports_spnego"; then
- if test -n "$have_heimdal"; then SPNEGO_SRCS="\
- spnegokrb5/asn1_MechType.c \
- spnegokrb5/asn1_MechTypeList.c \
- spnegokrb5/asn1_ContextFlags.c \
- spnegokrb5/asn1_NegTokenInit.c \
- spnegokrb5/asn1_NegTokenTarg.c \
- spnegokrb5/init_sec_context.c \
- spnegokrb5/accept_sec_context.c \
- spnegokrb5/encapsulate.c \
- spnegokrb5/decapsulate.c \
- spnegokrb5/external.c"
- else SPNEGO_SRCS="\
+ SPNEGO_SRCS="\
spnegokrb5/asn1_MechType.c \
spnegokrb5/asn1_MechTypeList.c \
spnegokrb5/asn1_ContextFlags.c \
@@ -3959,7 +3948,6 @@ fi
spnegokrb5/encapsulate.c \
spnegokrb5/decapsulate.c \
spnegokrb5/external.c"
- fi
fi
fi
fi
