On Mon, Oct 28, 2013 at 11:17:08AM +0100, Remco wrote: > After the upgrade to 5.4 I found httpd staying inactive on my test box. > > It turned out mod_auth_kerb was missing some symbols:
The right fix is to re-add spnego to gssapi which got removed a bit to quickly when robert stripped down kerberos. I have a diff for it... I will resend it later this week. > # /etc/rc.d/httpd -d start > doing rc_read_runfile > doing rc_check > httpd > doing rc_pre > doing rc_start > /usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined > symbol 'fix_dce' > /usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined > symbol 'encode_octet_string' > /usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined > symbol 'copy_octet_string' > /usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined > symbol 'free_octet_string' > /usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined > symbol 'decode_octet_string' > /usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined > symbol 'copy_oid' > /usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined > symbol 'decode_oid' > /usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined > symbol 'encode_enumerated' > /usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined > symbol 'length_enumerated' > /usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined > symbol 'length_octet_string' > /usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined > symbol 'free_oid' > /usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined > symbol 'decode_enumerated' > /usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined > symbol 'length_len' > /usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined > symbol 'encode_oid' > /usr/sbin/httpd:/usr/lib/apache/modules/mod_auth_kerb.so: undefined > symbol 'length_oid' > Syntax error on line 274 of /var/www/conf/httpd.conf: > Cannot load /usr/lib/apache/modules/mod_auth_kerb.so into server: Cannot load > specified object > doing rc_rm_runfile > (failed) > > The easiest solution for me was disabling mod_auth_kerb since I wasn't using > it anymore, however I decided to take a closer look. > > AFAICT some symbols were removed during the Heimdal update. > > At least fix_dce got "missing" from a recent libasn1: > $ objdump -t /usr/lib/libasn1.so.19.0 | grep fix_dce > 0000000000069930 g F .text 0000000000000023 _heim_fix_dce > compared to an older version: > $ objdump -t /usr/lib/libasn1.so.18.0 | grep fix_dce > 000000000007cc10 g F .text 0000000000000023 fix_dce > > I noticed mod_auth_kerb includes sources for these symbols, so I cooked up a > patch to have them built and included in mod_auth_kerb.so. > > Included patches to configure.in and configure seem to get rid of the missing > symbols problem. I can now start my httpd again, however, lacking a > configuration actually using mod_auth_kerb authentication, I did NOT test if > the actual authentication works ! > > I'm most likely going to remove mod_auth_kerb from my config, so I'm mainly > posting this hoping it's useful to others. > > regards, > Remco > > > configure.in patch: > $OpenBSD$ > --- configure.in.orig Mon Oct 28 09:48:18 2013 > +++ configure.in Mon Oct 28 09:48:28 2013 > @@ -187,18 +187,7 @@ int main(int argc, char** argv) > LDFLAGS="$ac_save_LDFLAGS" > > if test -z "$gssapi_supports_spnego"; then > - if test -n "$have_heimdal"; then SPNEGO_SRCS="\ > - spnegokrb5/asn1_MechType.c \ > - spnegokrb5/asn1_MechTypeList.c \ > - spnegokrb5/asn1_ContextFlags.c \ > - spnegokrb5/asn1_NegTokenInit.c \ > - spnegokrb5/asn1_NegTokenTarg.c \ > - spnegokrb5/init_sec_context.c \ > - spnegokrb5/accept_sec_context.c \ > - spnegokrb5/encapsulate.c \ > - spnegokrb5/decapsulate.c \ > - spnegokrb5/external.c" > - else SPNEGO_SRCS="\ > + SPNEGO_SRCS="\ > spnegokrb5/asn1_MechType.c \ > spnegokrb5/asn1_MechTypeList.c \ > spnegokrb5/asn1_ContextFlags.c \ > @@ -215,7 +204,6 @@ int main(int argc, char** argv) > spnegokrb5/encapsulate.c \ > spnegokrb5/decapsulate.c \ > spnegokrb5/external.c" > - fi > fi > fi > fi > > > configure patch: > $OpenBSD$ > --- configure.orig Wed Nov 22 11:33:58 2006 > +++ configure Mon Oct 28 09:56:28 2013 > @@ -3931,18 +3931,7 @@ fi > LDFLAGS="$ac_save_LDFLAGS" > > if test -z "$gssapi_supports_spnego"; then > - if test -n "$have_heimdal"; then SPNEGO_SRCS="\ > - spnegokrb5/asn1_MechType.c \ > - spnegokrb5/asn1_MechTypeList.c \ > - spnegokrb5/asn1_ContextFlags.c \ > - spnegokrb5/asn1_NegTokenInit.c \ > - spnegokrb5/asn1_NegTokenTarg.c \ > - spnegokrb5/init_sec_context.c \ > - spnegokrb5/accept_sec_context.c \ > - spnegokrb5/encapsulate.c \ > - spnegokrb5/decapsulate.c \ > - spnegokrb5/external.c" > - else SPNEGO_SRCS="\ > + SPNEGO_SRCS="\ > spnegokrb5/asn1_MechType.c \ > spnegokrb5/asn1_MechTypeList.c \ > spnegokrb5/asn1_ContextFlags.c \ > @@ -3959,7 +3948,6 @@ fi > spnegokrb5/encapsulate.c \ > spnegokrb5/decapsulate.c \ > spnegokrb5/external.c" > - fi > fi > fi > fi > -- Antoine
