heimdal
ClosedPublic
Actions

Authored by joneum on Apr 5 2018, 3:05 PM.

Details

Reviewers

tcberner
miwi
brnrd

Commits

rP468031: HTTP_AUTH_KRB5 option is not fully implemented. This patch makes it build with…

Summary

www/nginx's HTTP_AUTH_KRB5 option is not fully implemented. This patch makes it build with security/krb5 and security/heimdal.

Enable the Kerberos selection options, which have been commented out ever since they were first committed

Move these options out of the HTTP_AUTH_KRB5 conditional
- make config now saves the selected option, if any
- the build dependency on the selected Kerberos does now exist in poudriere

Update the patch for the spnego-http-auth-nginx-module config file to use the current GitHub commit from the Makefile

Fix the same patch to not assume that -lgssapi is always there

Force the nginx build system to admit the existence of CPPFLAGS, necessary to build with Heimdal

Diff Detail

Repository

rP FreeBSD ports repository

Lint

No Lint Coverage

Unit

No Test Coverage

Build Status

Buildable 16233
Build 16183: arc lint + arc unit

Event Timeline

joneum created this revision.Apr 5 2018, 3:05 PM

Herald added a subscriber: mat. · View Herald TranscriptApr 5 2018, 3:05 PM

Harbormaster completed remote builds in B15992: Diff 41131.Apr 5 2018, 3:05 PM

This can't use GSSAPI from base?

Also I think you need a OPTIONS_DEFAULT+= to add make sure one is actually used.

www/nginx/Makefile.extmod
87	I understand why you'd put them here, but shouldn't these go with all the other OPTIONS defines?

joneum added inline comments.Apr 6 2018, 4:55 AM

www/nginx/Makefile.extmod
87	I just commented out that here. How would you do that?

brnrd added inline comments.Apr 6 2018, 9:28 PM

www/nginx/Makefile.extmod
87	Drop them in with all of the other `OPTIONS` defines. Probably add a `GSSAPI_HEIMDAL_IMPLIES=` and `GSSAPI_MIT_IMPLIES= HTTP_AUTH_KRB5` and add a check after bsd.port.options.mk that `HTTP_AUTH_KRB5` without either `HEIMDAL` or `MIT` is `BROKEN` Pretty convoluted, all of that...

How do you know it's BROKEN? I'm confused ....

In D14973#315921, @joneum wrote:

How do you know it's BROKEN? I'm confused ....

If you were to enable HTTP_AUTH_KRB5 but don't have a GSSAPI implementation selected, results will be unreliable at best. That's why I'd say that should result in an error message, implemented with BROKEN

In D14973#315921, @joneum wrote:

How do you know it's BROKEN? I'm confused ....

www/nginx/files/extra-patch-spnego-http-auth-nginx-module-config
6	The %%GSSAPILIBS%% will be expanded to hold the libs needed to build this. Probably not smart to remove them. See `Mk/Uses/gssapi.mk` for usage

ngx_addon_name=ngx_http_auth_spnego_module
ngx_feature_libs="%%GSSAPILIBS%%"
ngx_module_incs="%%GSSAPINCDIR%%"

if test -n "$ngx_module_link"; then
    ngx_module_type=HTTP
    ngx_module_name=ngx_http_auth_spnego_module
    ngx_module_srcs="$ngx_addon_dir/ngx_http_auth_spnego_module.c"
    ngx_module_libs="$ngx_feature_libs"
    . auto/module
else
    HTTP_MODULES="$HTTP_MODULES ngx_http_auth_spnego_module"
    NGX_ADDON_SRCS="$NGX_ADDON_SRCS $ngx_addon_dir/ngx_http_auth_spnego_module.c"
    CORE_LIBS="$CORE_LIBS $ngx_feature_libs"
fi

LDFLAGS="-L%%GSSAPILIBDIR%% $LDFLAGS"

You may need to add some more stuff to force the module to link correctly. And add a check that OpenSSL and GSSAPI are both from base _or_ ports (mixing results in runtime issues!)

add new Patch for this Problem.

Harbormaster completed remote builds in B16233: Diff 41681.Apr 20 2018, 9:30 AM

Looking good!
What has been tested?