[18970] in Kerberos_V5_Development
Re: mit-krb5-1.12.1 libressl compatability: autodetect cms
daemon@ATHENA.MIT.EDU (Benjamin Kaduk)
Sun Aug 10 18:28:45 2014
Date: Sun, 10 Aug 2014 18:28:20 -0400 (EDT)
From: Benjamin Kaduk <kaduk@mit.edu>
To: junk4me46806@yahoo.com
In-Reply-To: <1407706708.21534.2@qwerty>
Message-ID: <alpine.GSO.1.10.1408101826480.21571@multics.mit.edu>
MIME-Version: 1.0
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Hi Paul,
On Sun, 10 Aug 2014, junk4me46806@yahoo.com wrote:
> I am performing compatibility testing for libressl portable (the
> openssl fork developed by the openbsd team). http://www.libressl.org
>
> mit-krb5-1.12.1 has a minor and easy to fix incompatibility. libressl
> portable 2.0.5 has cms disabled and reports an OPENSSL_VERSION_NUMBER
> of 0x20000000L. mit-krb5-1.12.1 file plugins/preauth/pkinit/
> pkinit_crypto_openssl.c checks if the version number is > 0x10000000L
> to determine if cms is available. This check erroniously assumes that
> cms is enabled and compilation fails.
>
> I have developed a patch that updates the configure script to check if
> openssl/cms.h is compilable and defines HAVE_OPENSSL_CMS_H if it is. I
> then modified pkinit_crypto_openssl.c to use this flag. The advantage
> of this fix verses more complex version number checks is that it will
> continue to work as expected if libressl ever enables cms or openssl
> ever disables it.
>
> The patch is available on github at:
> http://tinyurl.com/krb5-libressl
>
> The patch has been tested with libressl 2.0.5 and openssl 1.0.1h. It
> compiles with "fallback" cms support with libressl and full cms support
> with openssl.
Please feel free to submit a pull request against krb5/krb5 on github.
I will note from a cursory examination that k5-platform.h already includes
autoconf.h at the top, so the addition of that include to
pkinit_crypto_openssl.c is redundant.
-Ben Kaduk
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
