gssapi,krb5: Replace libgssapi with the MIT version
ClosedPublic
Actions

Authored by cy on Jul 31 2025, 8:04 PM.

Details

Reviewers

emaste
jrm
imp
bjk
glebius
kib
des
brooks
rmacklem
ivy

Group Reviewers

krb5

Commits

rGe26259f48afe: gssapi,krb5: Replace libgssapi with the MIT version

Summary

lib/libgssapi is based on Heimdal. As on Linux systems, the MIT
libgssapi_krb5 replaces it. With both gssapi libraries and header files
installed results in broken buildworld (gssd) and ports that will not
build without modifications to support the MIT gssapi in an alternate
location.

73ed0c7992fd removed the MIT GSSAPI headers from /usr/include. Apps using
MIT KRB5 gssapi functions and structures will fail to build without this
patch.

This should have been implmented with 7e35117eb07f.

Fixes: 7e35117eb07f, 73ed0c7992fd

Test Plan

Running here.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Event Timeline

cy created this revision.Jul 31 2025, 8:04 PM

Herald added a subscriber: bdrewery. · View Herald TranscriptJul 31 2025, 8:04 PM

cy requested review of this revision.Jul 31 2025, 8:04 PM

cy added a reviewer: des.

I am not conversant with the userspace builds/Makefile
stuff, so I have removed myself from the review.

I will note that there is a bunch of work to be done
(and I am in-progress on it) to the gssd to make it and
the KGSSAPI stuff work.
(At this point, I can't say if the above will fix the library
build problems. I know it is currently broken for the
gss_krb5_export_lucid_sec_context(), which does work
when I link the gssd to the libraries in /usr/local/lib
installed via "pkg install krb5".

Ok, I do not think the MIT library should be called libgssapi,
but in a different subdirectory.
MIT calls it libgssapi_krb5 and that is what it should still
be called, imho.
(libgssapi should only refer to the Heimdal one and should
never be referenced anywhere in the Makefiles unless it is
under ".if ${MK_MITKRB5} == "no".

At least that is my opinion.

Then doing a find/grep for all occurrences of libgssapi in /usr/src
and fixing them should be easy.
Note that the Makefile in /usr/src/lib needs to be fixed for MK_GSSAPI.

If I misunderstood what this patch is doing, sorry about that.
I do not know the Makefile/build setup (which was why I resigned
as a reviewer).

i do not understand libgssapi enough to review this, but i am somewhat concerned about rick's comments: in upstream, is this library called libgssapi or libgssapi_krb5? if the latter, why do we need to rename it?

ivy added a reviewer: krb5.Aug 3 2025, 7:50 PM

In D51661#1181074, @rmacklem wrote:

Ok, I do not think the MIT library should be called libgssapi,
but in a different subdirectory.
be called, imho.
(libgssapi should only refer to the Heimdal one and should
never be referenced anywhere in the Makefiles unless it is
under ".if ${MK_MITKRB5} == "no".

We could, and probably should, remove libgssapi.so. The Linux systems I've worked with have libgssapi_krb5.so but no libgssapi.so. This patch tries to do both. But I see your point. Just remove libgssapi.so.

MIT calls it libgssapi_krb5 and that is what it should still

The problem is that lib/gssapi does not include functions provided by MIT's gssapi. This results in buildworld failures and will also result in ports build failures due to the hybrid gssapi in base.

At least that is my opinion.

This is certainly valid. I've been thinking the same this weekend. Remove libgssapi.so and replace it with libgssapi_krb5.so like Red Hat Linux does.

Then doing a find/grep for all occurrences of libgssapi in /usr/src
and fixing them should be easy.
Note that the Makefile in /usr/src/lib needs to be fixed for MK_GSSAPI.

If I misunderstood what this patch is doing, sorry about that.
I do not know the Makefile/build setup (which was why I resigned
as a reviewer).

This patch replaces /usr/src/lib/libgssapi with the MIT libgssapi_krb5. It creates a symlink of libgssapi.so pointing to libgssapi_krb5.so. For convenience. But, we should probably simply remove libgssapi.so (/usr/src/lib/libgssapi) entirely.

As of 73ed0c7992fd this patch is now required because /usr/src/lib/libgssapi (libgssapi.so) has no knowledge of MIT KRB5. Apps that wish to build against MIT KRB5 using its gssapi, i.e. gssd and ports, will fail.

cy mentioned this in D51733: gssd.c: Add support for new lucid upcalls for MIT Kerberos.Aug 5 2025, 6:26 AM

cy mentioned this in D51731: kgssapi: Fix the kgssapi so that it can use MIT Kerberos.

Now that we are not symlinking libgssapi.so to libgssapi_krb5.so removing libgssapi.so entirely, the ssh Makefiles required adjustment.

Cy reports that the gssd works when this patch plus mine
are applied. That is good news. Thanks Cy.

I will test it once this patch is committed and a new snapshot
using it is generated.

In D51661#1181290, @ivy wrote:

i do not understand libgssapi enough to review this, but i am somewhat concerned about rick's comments: in upstream, is this library called libgssapi or libgssapi_krb5? if the latter, why do we need to rename it?

Upstream library is called libgssapi_krb5.so. The symlink is for convenience only. The hybrid /usr/src/lib/libgssapi and MIT KRB5's libgssapi_krb5 conflict with each other.

In D51661#1181823, @rmacklem wrote:

Cy reports that the gssd works when this patch plus mine
are applied. That is good news. Thanks Cy.

I will test it once this patch is committed and a new snapshot
using it is generated.

I had to remove the bitrot from my systems I used as a POC a long time ago (decades) when I implemented MIT KRB5 at $JOB-1. Some departments used short hostnames so I created a workaround for them, testing it here at home first. I never removed the workarounds here, until now. Works great!

fluffy added a subscriber: fluffy.Aug 6 2025, 6:54 AM

This revision was not accepted when it landed; it landed in state Needs Review.Aug 16 2025, 4:23 PM

Closed by commit rGe26259f48afe: gssapi,krb5: Replace libgssapi with the MIT version (authored by cy). · Explain Why

This revision was automatically updated to reflect the committed changes.

cy added a commit: rGe26259f48afe: gssapi,krb5: Replace libgssapi with the MIT version.