[18969] in Kerberos_V5_Development
mit-krb5-1.12.1 libressl compatability: autodetect cms
daemon@ATHENA.MIT.EDU (junk4me46806@yahoo.com)
Sun Aug 10 17:38:45 2014
Date: Sun, 10 Aug 2014 17:38:28 -0400
From: junk4me46806@yahoo.com
To: krbdev@mit.edu
Message-Id: <1407706708.21534.2@qwerty>
MIME-Version: 1.0
Content-Disposition: inline
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
I am performing compatibility testing for libressl portable (the
openssl fork developed by the openbsd team). http://www.libressl.org
mit-krb5-1.12.1 has a minor and easy to fix incompatibility. libressl
portable 2.0.5 has cms disabled and reports an OPENSSL_VERSION_NUMBER
of 0x20000000L. mit-krb5-1.12.1 file plugins/preauth/pkinit/
pkinit_crypto_openssl.c checks if the version number is > 0x10000000L
to determine if cms is available. This check erroniously assumes that
cms is enabled and compilation fails.
I have developed a patch that updates the configure script to check if
openssl/cms.h is compilable and defines HAVE_OPENSSL_CMS_H if it is. I
then modified pkinit_crypto_openssl.c to use this flag. The advantage
of this fix verses more complex version number checks is that it will
continue to work as expected if libressl ever enables cms or openssl
ever disables it.
The patch is available on github at:
http://tinyurl.com/krb5-libressl
The patch has been tested with libressl 2.0.5 and openssl 1.0.1h. It
compiles with "fallback" cms support with libressl and full cms support
with openssl.
--
Paul Maurer
junk4me46806@yahoo.com
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
