Date: Monday, September 26, 2011 @ 18:50:55 Author: stephane Revision: 138529
Support old KDCs (FS#25515); Install aclocal file (FS#25384) Added: krb5/trunk/krb5-1.9.1-canonicalize-fallback.patch Modified: krb5/trunk/PKGBUILD ----------------------------------------+ PKGBUILD | 13 +++++- krb5-1.9.1-canonicalize-fallback.patch | 58 +++++++++++++++++++++++++++++++ 2 files changed, 68 insertions(+), 3 deletions(-) Modified: PKGBUILD =================================================================== --- PKGBUILD 2011-09-26 22:48:37 UTC (rev 138528) +++ PKGBUILD 2011-09-26 22:50:55 UTC (rev 138529) @@ -3,7 +3,7 @@ pkgname=krb5 pkgver=1.9.1 -pkgrel=3 +pkgrel=4 pkgdesc="The Kerberos network authentication system" arch=('i686' 'x86_64') url="http://web.mit.edu/kerberos/" @@ -17,11 +17,13 @@ source=(http://web.mit.edu/kerberos/dist/${pkgname}/1.9/${pkgname}-${pkgver}-signed.tar krb5-kadmind krb5-kdc - krb5-1.9.1-config-script.patch) + krb5-1.9.1-config-script.patch + krb5-1.9.1-canonicalize-fallback.patch) sha1sums=('e23a1795a237521493da9cf3443ac8b98a90c066' '2aa229369079ed1bbb201a1ef72c47bf143f4dbe' '77d2312ecd8bf12a6e72cc8fd871a8ac93b23393' - '7342410760cf44bfa01bb99bb4c49e12496cb46f') + '7342410760cf44bfa01bb99bb4c49e12496cb46f' + '238c268fa6cb42fc7324ab54db9abda5cd77f833') options=('!emptydirs') build() { @@ -39,6 +41,9 @@ # http://anonsvn.mit.edu/viewvc/krb5/trunk/src/krb5-config.in?r1=23662&r2=25236 patch -Np2 -i ${srcdir}/krb5-1.9.1-config-script.patch + # Fix FS#25515 + patch -Np2 -i ${srcdir}/krb5-1.9.1-canonicalize-fallback.patch + export CFLAGS+=" -fPIC -fno-strict-aliasing -fstack-protector-all" export CPPFLAGS+=" -I/usr/include/et" ./configure --prefix=/usr \ @@ -70,5 +75,7 @@ install -m 755 ../../krb5-kdc "${pkgdir}"/etc/rc.d install -m 755 ../../krb5-kadmind "${pkgdir}"/etc/rc.d + install -m 644 util/ac_check_krb5.m4 "${pkgdir}"/usr/share/aclocal + install -Dm644 "${srcdir}"/${pkgname}-${pkgver}/NOTICE "${pkgdir}"/usr/share/licenses/${pkgname}/LICENSE } Added: krb5-1.9.1-canonicalize-fallback.patch =================================================================== --- krb5-1.9.1-canonicalize-fallback.patch (rev 0) +++ krb5-1.9.1-canonicalize-fallback.patch 2011-09-26 22:50:55 UTC (rev 138529) @@ -0,0 +1,58 @@ +diff -Naur krb5-1.9.1.ori/src/lib/krb5/krb/get_creds.c krb5-1.9.1/src/lib/krb5/krb/get_creds.c +--- krb5-1.9.1.ori/src/lib/krb5/krb/get_creds.c 2011-02-09 16:55:36.000000000 -0500 ++++ krb5-1.9.1/src/lib/krb5/krb/get_creds.c 2011-09-26 18:42:01.465190278 -0400 +@@ -470,13 +470,10 @@ + + /***** STATE_REFERRALS *****/ + +-/* +- * Possibly retry a request in the fallback realm after a referral request +- * failure in the local realm. Expects ctx->reply_code to be set to the error +- * from a referral request. +- */ ++/* Possibly try a non-referral request after a referral request failure. ++ * Expects ctx->reply_code to be set to the error from a referral request. */ + static krb5_error_code +-try_fallback_realm(krb5_context context, krb5_tkt_creds_context ctx) ++try_fallback(krb5_context context, krb5_tkt_creds_context ctx) + { + krb5_error_code code; + char **hrealms; +@@ -485,9 +482,10 @@ + if (ctx->referral_count > 1) + return ctx->reply_code; + +- /* Only fall back if the original request used the referral realm. */ ++ /* If the request used a specified realm, make a non-referral request to ++ * that realm (in case it's a KDC which rejects KDC_OPT_CANONICALIZE). */ + if (!krb5_is_referral_realm(&ctx->req_server->realm)) +- return ctx->reply_code; ++ return begin_non_referral(context, ctx); + + if (ctx->server->length < 2) { + /* We need a type/host format principal to find a fallback realm. */ +@@ -500,10 +498,10 @@ + if (code != 0) + return code; + +- /* Give up if the fallback realm isn't any different. */ ++ /* If the fallback realm isn't any different, use the existing TGT. */ + if (data_eq_string(ctx->server->realm, hrealms[0])) { + krb5_free_host_realm(context, hrealms); +- return ctx->reply_code; ++ return begin_non_referral(context, ctx); + } + + /* Rewrite server->realm to be the fallback realm. */ +@@ -540,9 +538,9 @@ + krb5_error_code code; + const krb5_data *referral_realm; + +- /* Possibly retry with the fallback realm on error. */ ++ /* Possibly try a non-referral fallback request on error. */ + if (ctx->reply_code != 0) +- return try_fallback_realm(context, ctx); ++ return try_fallback(context, ctx); + + if (krb5_principal_compare(context, ctx->reply_creds->server, + ctx->server)) {