#

# Make MIT Kerberos use Solaris RPC and RPCSEC_GSS instead of libgssrpc.

#

# MIT Kerberos bundles the RPC and RPCSEC_GSS implementation with the

# source in separate libgssrpc library. The RPC implementation is based on

# an ancient SUN donated code. It is inferior to the RPC implementation in 

# Solaris libc in features and possibly in performance too. Also introducing

# a duplicate implementation would not be wise.

#

# The patch modifies MIT code to use the standard RPC and RPCSEC_GSS in Solaris.

#

# Specifically:

#    - it modifies the Makefiles not to build libgssrpc and not to link with it

#    - related to above, it strips libgssrpc from krb5-config

#    - moves xdr_alloc.c out of libgssrpc and fixes it for 64-bit

#    - includes correct headers - rpc/rpc.h instead of gssrpc/rpc.h

#    - modifies net-server code to support TI-RPC (transport independent, XTI)

#    - implement kadmin protocol and incr. prop. using Solaris RPCSEC_GSS

#    - reverts MIT modification to iprop, that were needed for RPC differences

#    - server side support for RPCSEC_GSS base changepw protocol

#    - recognize sunw_dbprop_* config options for backward compatibility

#    - defines several functions to locate servers (admin, cpw, kiprop,...)

#    - updates generated dependencies for kadm_host_srv_names.so to build

#    - defines xdr_u_int32 and xdr_int32

#

# This patch is Solaris specific and is not intended for upstream contribution.

# In the future MIT might provide support for system native RPC implementation.

# Patch source: in-house

#

diff -pur old/src/build-tools/krb5-config.in new/src/build-tools/krb5-config.in

--- old/src/build-tools/krb5-config.in

+++ new/src/build-tools/krb5-config.in

@@ -97,9 +97,6 @@ while test $# != 0; do

 	gssapi)

 	    library=gssapi

 	    ;;

-	gssrpc)

-	    library=gssrpc

-	    ;;

 	kadm-client)

 	    library=kadm_client

 	    ;;

@@ -142,7 +139,6 @@ if test -n "$do_help"; then

     echo "Libraries:"

     echo "        krb5              Kerberos 5 application"

     echo "        gssapi            GSSAPI application with Kerberos 5 bindings"

-    echo "        gssrpc            GSSAPI RPC application"

     echo "        kadm-client       Kadmin client"

     echo "        kadm-server       Kadmin server"

     echo "        kdb               Application that accesses the kerberos database"

@@ -232,17 +228,10 @@ if test -n "$do_libs"; then

     if test $library = 'kadm_server'; then

 	lib_flags="$lib_flags -lkadm5srv_mit -lkdb5 $KDB5_DB_LIB"

-	library=gssrpc

     fi

     if test $library = 'kadm_client'; then

 	lib_flags="$lib_flags -lkadm5clnt_mit"

-	library=gssrpc

-    fi

-

-    if test $library = 'gssrpc'; then

-	lib_flags="$lib_flags -lgssrpc"

-	library=gssapi

     fi

     if test $library = 'gssapi'; then

diff -pur old/src/config/pre.in new/src/config/pre.in

--- old/src/config/pre.in

+++ new/src/config/pre.in

@@ -317,7 +317,7 @@ KDB5_PLUGIN_LIBS = @KDB5_PLUGIN_LIBS@

 KADMCLNT_DEPLIB	= $(TOPLIBD)/libkadm5clnt_mit$(DEPLIBEXT)

 KADMSRV_DEPLIB	= $(TOPLIBD)/libkadm5srv_mit$(DEPLIBEXT)

 KDB5_DEPLIB	= $(TOPLIBD)/libkdb5$(DEPLIBEXT)

-GSSRPC_DEPLIB	= $(TOPLIBD)/libgssrpc$(DEPLIBEXT)

+GSSRPC_DEPLIB	= # empty

 GSS_DEPLIB	= $(TOPLIBD)/libgssapi_krb5$(DEPLIBEXT)

 KRB5_DEPLIB	= $(TOPLIBD)/libkrb5$(DEPLIBEXT)

 CRYPTO_DEPLIB	= $(TOPLIBD)/libk5crypto$(DEPLIBEXT)

@@ -398,7 +398,7 @@ KRB5_BASE_LIBS	= $(KRB5_LIB) $(K5CRYPTO_

 KDB5_LIBS	= $(KDB5_LIB) $(GSSRPC_LIBS)

 GSS_LIBS	= $(GSS_KRB5_LIB)

 # needs fixing if ever used on Mac OS X!

-GSSRPC_LIBS	= -lgssrpc $(GSS_LIBS)

+GSSRPC_LIBS	=  $(GSS_LIBS)

 KADM_COMM_LIBS	= $(GSSRPC_LIBS)

 # need fixing if ever used on Mac OS X!

 KADMSRV_LIBS	= -lkadm5srv_mit $(HESIOD_LIBS) $(KDB5_LIBS) $(KADM_COMM_LIBS)

diff -pur old/src/include/iprop.h new/src/include/iprop.h

--- old/src/include/iprop.h

+++ new/src/include/iprop.h

@@ -6,8 +6,7 @@

 #ifndef _IPROP_H_RPCGEN

 #define _IPROP_H_RPCGEN

-#include <gssrpc/rpc.h>

-

+#include <rpc/rpc.h>

 #ifdef __cplusplus

 extern "C" {

diff -pur old/src/include/k5-int.h new/src/include/k5-int.h

--- old/src/include/k5-int.h

+++ new/src/include/k5-int.h

@@ -217,11 +217,14 @@ typedef unsigned char   u_char;

 #define KRB5_CONF_HTTP_ANCHORS                 "http_anchors"

 #define KRB5_CONF_IGNORE_ACCEPTOR_HOSTNAME     "ignore_acceptor_hostname"

 #define KRB5_CONF_IPROP_ENABLE                 "iprop_enable"

+#define KRB5_CONF_SUNW_DBPROP_ENABLE           "sunw_dbprop_enable"

 #define KRB5_CONF_IPROP_LOGFILE                "iprop_logfile"

 #define KRB5_CONF_IPROP_MASTER_ULOGSIZE        "iprop_master_ulogsize"

+#define KRB5_CONF_SUNW_DBPROP_MASTER_ULOGSIZE  "sunw_dbprop_master_ulogsize"

 #define KRB5_CONF_IPROP_PORT                   "iprop_port"

 #define KRB5_CONF_IPROP_RESYNC_TIMEOUT         "iprop_resync_timeout"

 #define KRB5_CONF_IPROP_SLAVE_POLL             "iprop_slave_poll"

+#define KRB5_CONF_SUNW_DBPROP_SLAVE_POLL       "sunw_dbprop_slave_poll"

 #define KRB5_CONF_K5LOGIN_AUTHORITATIVE        "k5login_authoritative"

 #define KRB5_CONF_K5LOGIN_DIRECTORY            "k5login_directory"

 #define KRB5_CONF_KADMIND_PORT                 "kadmind_port"

diff -pur old/src/kadmin/dbutil/kadm5_create.c new/src/kadmin/dbutil/kadm5_create.c

--- old/src/kadmin/dbutil/kadm5_create.c

+++ new/src/kadmin/dbutil/kadm5_create.c

@@ -158,11 +158,20 @@ static int add_admin_princs(void *handle

                                      ADMIN_LIFETIME)))

         goto clean_and_exit;

+    if ((ret = add_admin_sname_princ(handle, context,

+                       KADM5_CHANGEPW_HOST_SERVICE, realm,

+                       KRB5_KDB_DISALLOW_TGT_BASED | KRB5_KDB_PWCHANGE_SERVICE,

+                       ADMIN_LIFETIME)))

+        goto clean_and_exit;

+

+/* kadmin/admin unusable with Solaris rpcsec_gss */

+#if 0

     if ((ret = add_admin_princ(handle, context,

                                KADM5_ADMIN_SERVICE, realm,

                                KRB5_KDB_DISALLOW_TGT_BASED,

                                ADMIN_LIFETIME)))

         goto clean_and_exit;

+#endif

     if ((ret = add_admin_princ(handle, context,

                                KADM5_CHANGEPW_SERVICE, realm,

diff -pur old/src/kadmin/server/ipropd_svc.c new/src/kadmin/server/ipropd_svc.c

--- old/src/kadmin/server/ipropd_svc.c

+++ new/src/kadmin/server/ipropd_svc.c

@@ -134,6 +134,8 @@ iprop_get_updates_1_svc(kdb_last_t *arg,

     kadm5_server_handle_t handle = global_server_handle;

     char *client_name = 0, *service_name = 0;

     char obuf[256] = {0};

+    gss_name_t name = NULL;

+    OM_uint32 min_stat;

     /* default return code */

     ret.ret = UPDATE_ERROR;

@@ -172,8 +174,14 @@ iprop_get_updates_1_svc(kdb_last_t *arg,

     DPRINT("%s: clprinc=`%s'\n\tsvcprinc=`%s'\n", whoami, client_name,

 	   service_name);

+    if (!(name = rqst2name(rqstp))) {

+        krb5_klog_syslog(LOG_ERR,

+                         _("%s: Couldn't obtain client's name"),

+                         whoami);

+        goto out;

+    }

     if (!kadm5int_acl_check(handle->context,

-			    rqst2name(rqstp),

+			    name,

 			    ACL_IPROP,

 			    NULL,

 			    NULL)) {

@@ -221,6 +229,8 @@ out:

 	debprret(whoami, ret.ret, ret.lastentry.last_sno);

     free(client_name);

     free(service_name);

+    if (name)

+        gss_release_name(&min_stat, &name);

     return (&ret);

 }

@@ -251,6 +261,18 @@ ipropx_resync(uint32_t vers, struct svc_

     int pret, fret;

     FILE *p;

     kadm5_server_handle_t handle = global_server_handle;

+    /*

+     * The following two definitions are dead code in upstream krb5.

+     *

+     * OM_uint32 min_stat;

+     * gss_name_t name = NULL;

+     *

+     * They come from initial Sun donation of iprop.

+     * For Solaris specific RPC implementation we need them back.

+     * If upstream removes the dead code, hopefuly placing this comment

+     * in this place will result in an easy-to-debug patch error,

+     * rather then failure to compile.

+     */

     OM_uint32 min_stat;

     gss_name_t name = NULL;

     char *client_name = NULL, *service_name = NULL;

@@ -301,8 +323,14 @@ ipropx_resync(uint32_t vers, struct svc_

     DPRINT("%s: clprinc=`%s'\n\tsvcprinc=`%s'\n",

 	    whoami, client_name, service_name);

+    if (!(name = rqst2name(rqstp))) {

+        krb5_klog_syslog(LOG_ERR,

+                         _("%s: Couldn't obtain client's name"),

+                         whoami);

+        goto out;

+    }

     if (!kadm5int_acl_check(handle->context,

-			    rqst2name(rqstp),

+			    name,

 			    ACL_IPROP,

 			    NULL,

 			    NULL)) {

@@ -449,6 +477,7 @@ iprop_full_resync_ext_1_svc(uint32_t *ar

     return ipropx_resync(*argp, rqstp);

 }

+#if 0

 static int

 check_iprop_rpcsec_auth(struct svc_req *rqstp)

 {

@@ -521,6 +550,7 @@ fail_name:

      gss_release_name(&min_stat, &name);

      return success;

 }

+#endif

 void

 krb5_iprop_prog_1(struct svc_req *rqstp,

@@ -534,6 +564,7 @@ krb5_iprop_prog_1(struct svc_req *rqstp,

     char *(*local)(/* union XXX *, struct svc_req * */);

     char *whoami = "krb5_iprop_prog_1";

+#if 0

     if (!check_iprop_rpcsec_auth(rqstp)) {

 	krb5_klog_syslog(LOG_ERR, _("authentication attempt failed: %s, RPC "

 				    "authentication flavor %d"),

@@ -542,6 +573,7 @@ krb5_iprop_prog_1(struct svc_req *rqstp,

 	svcerr_weakauth(transp);

 	return;

     }

+#endif

     switch (rqstp->rq_proc) {

     case NULLPROC:

diff -pur old/src/kadmin/server/kadm_rpc_svc.c new/src/kadmin/server/kadm_rpc_svc.c

--- old/src/kadmin/server/kadm_rpc_svc.c

+++ new/src/kadmin/server/kadm_rpc_svc.c

@@ -5,7 +5,7 @@

  */

 #include <k5-int.h>

-#include <gssrpc/rpc.h>

+#include <rpc/rpc.h>

 #include <gssapi/gssapi_krb5.h> /* for gss_nt_krb5_name */

 #include <syslog.h>

 #include <kadm5/kadm_rpc.h>

@@ -63,8 +63,7 @@ void kadm_1(rqstp, transp)

      bool_t (*xdr_argument)(), (*xdr_result)();

      char *(*local)();

-     if (rqstp->rq_cred.oa_flavor != AUTH_GSSAPI &&

-	 !check_rpcsec_auth(rqstp)) {

+     if (rqstp->rq_cred.oa_flavor != RPCSEC_GSS) {

 	  krb5_klog_syslog(LOG_ERR, "Authentication attempt failed: %s, "

 			   "RPC authentication flavor %d",

 			   client_addr(rqstp->rq_xprt),

@@ -246,6 +245,8 @@ void kadm_1(rqstp, transp)

      return;

 }

+#if 0

+

 static int

 check_rpcsec_auth(struct svc_req *rqstp)

 {

@@ -337,3 +338,4 @@ gss_to_krb5_name_1(struct svc_req *rqstp

      free(str);

      return success;

 }

+#endif

diff -pur old/src/kadmin/server/ovsec_kadmd.c new/src/kadmin/server/ovsec_kadmd.c

--- old/src/kadmin/server/ovsec_kadmd.c

+++ new/src/kadmin/server/ovsec_kadmd.c

@@ -45,10 +45,9 @@

 #include <unistd.h>

 #include <netinet/in.h>

 #include <netdb.h>

-#include <gssrpc/rpc.h>

+#include <rpc/rpc.h>

 #include <gssapi/gssapi.h>

 #include "gssapiP_krb5.h" /* for kg_get_context */

-#include <gssrpc/auth_gssapi.h>

 #include <kadm5/admin.h>

 #include <kadm5/kadm_rpc.h>

 #include <kadm5/server_acl.h>

@@ -57,6 +56,8 @@

 #include <string.h>

 #include "kadm5/server_internal.h" /* XXX for kadm5_server_handle_t */

 #include <kdb_log.h>

+#include <rpc/rpcsec_gss.h>

+#include <kadm5/kadm_rpc.h>

 #include "misc.h"

@@ -347,19 +348,20 @@ main(int argc, char *argv[])

     OM_uint32 minor_status;

     gss_buffer_desc in_buf;

     gss_OID nt_krb5_name_oid = (gss_OID)GSS_KRB5_NT_PRINCIPAL_NAME;

-    auth_gssapi_name names[4];

+    char *names[4];

     kadm5_config_params params;

     verto_ctx *vctx;

     const char *pid_file = NULL;

     char **db_args = NULL, **tmpargs;

     int ret, i, db_args_size = 0, strong_random = 1, proponly = 0;

+    char **tmp_srv_names;

+    krb5_principal princ;

+    char *pos;

     setlocale(LC_ALL, "");

     setvbuf(stderr, NULL, _IONBF, 0);

-    names[0].name = names[1].name = names[2].name = names[3].name = NULL;

-    names[0].type = names[1].type = names[2].type = names[3].type =

-        nt_krb5_name_oid;

+    names[0] = names[1] = names[2] = names[3] = NULL;

     progname = (strrchr(argv[0], '/') != NULL) ? strrchr(argv[0], '/') + 1 :

         argv[0];

@@ -463,28 +465,88 @@ main(int argc, char *argv[])

     if (!(params.mask & KADM5_CONFIG_ACL_FILE))

         fail_to_start(0, _("Missing required ACL file configuration"));

-    ret = setup_loop(proponly, &vctx);

+    ret = kadm5_get_adm_host_srv_names(context, params.realm, &tmp_srv_names);

     if (ret)

-        fail_to_start(ret, _("initializing network"));

+        fail_to_start(ret, _("building GSSAPI auth names"));

+    names[0] = strdup(tmp_srv_names[0]);

+    if (names[0] == NULL)

+        fail_to_start(ENOMEM, _("copying GSSAPI auth names"));

+    free_srv_names(tmp_srv_names);

+    tmp_srv_names = NULL;

-    names[0].name = build_princ_name(KADM5_ADMIN_SERVICE, params.realm);

-    names[1].name = build_princ_name(KADM5_CHANGEPW_SERVICE, params.realm);

-    if (names[0].name == NULL || names[1].name == NULL)

-        fail_to_start(0, _("Cannot build GSSAPI auth names"));

+    ret = kadm5_get_cpw_host_srv_names(context, params.realm, &tmp_srv_names);

+    if (ret)

+        fail_to_start(ret, _("building GSSAPI auth names"));

+    names[1] = strdup(tmp_srv_names[0]);

+    if (names[1] == NULL)

+        fail_to_start(ENOMEM, _("copying GSSAPI auth names"));

+    free_srv_names(tmp_srv_names);

+    tmp_srv_names = NULL;

+

+    if (params.iprop_enabled == TRUE) {

+        ret = kadm5_get_kiprop_host_srv_names(context, params.realm,

+                                              &tmp_srv_names);

+        if (ret)

+            fail_to_start(ret, _("building GSSAPI auth names"));

+        names[2] = strdup(tmp_srv_names[0]);

+        if (names[2] == NULL)

+            fail_to_start(ENOMEM, _("copying GSSAPI auth names"));

+        free_srv_names(tmp_srv_names);

+        tmp_srv_names = NULL;

+

+        /*

+         * For hierarchical incremental propagation we need kadmind

+         * on slave KDCs to register local hostbased kiprop service principal,

+         * not the one for admin server. For least surprise on upgrade we

+         * register both.

+         */

+        ret = krb5_sname_to_principal(context, NULL, KADM5_KIPROP_HOST_SERVICE,

+                                      KRB5_NT_SRV_HST, &princ);

+        if (ret)

+            fail_to_start(ret, _("building GSSAPI auth names"));

+        ret = krb5_unparse_name(context, princ, &names[3]);

+        if (ret)

+            fail_to_start(ret, _("building GSSAPI auth names"));

+        if ((pos = strchr(names[3], '@')) != NULL)

+            *pos = '\0';

+        if ((pos = strchr(names[3], '/')) != NULL)

+            *pos = '@';

+    }

     ret = setup_kdb_keytab();

     if (ret)

         fail_to_start(0, _("Cannot set up KDB keytab"));

-

+#if 0

     if (svcauth_gssapi_set_names(names, 2) == FALSE)

         fail_to_start(0, _("Cannot set GSSAPI authentication names"));

+#endif

+    if (!rpc_gss_set_svc_name(names[0], "kerberos_v5", 0, KADM, KADMVERS))

+        fail_to_start(0, _("Cannot set GSSAPI authentication names"));

+    if (!rpc_gss_set_svc_name(names[1], "kerberos_v5", 0, KADM, KADMVERS))

+        fail_to_start(0, _("Cannot set GSSAPI authentication names"));

+    if (params.iprop_enabled == TRUE) {

+        if (!rpc_gss_set_svc_name(names[2], "kerberos_v5", 0,

+                                  KRB5_IPROP_PROG, KRB5_IPROP_VERS))

+            fail_to_start(0, _("Cannot set GSSAPI authentication names"));

+        if (strcmp(names[2], names[3])){

+            if (!rpc_gss_set_svc_name(names[3], "kerberos_v5", 0,

+                                      KRB5_IPROP_PROG, KRB5_IPROP_VERS))

+                fail_to_start(0, _("Cannot set GSSAPI authentication names"));

+

+        }

+    }

     /* if set_names succeeded, this will too */

-    in_buf.value = names[1].name;

-    in_buf.length = strlen(names[1].name) + 1;

+    in_buf.value = names[1];

+    in_buf.length = strlen(names[1]);

     (void)gss_import_name(&minor_status, &in_buf, nt_krb5_name_oid,

                           &gss_changepw_name);

+    ret = setup_loop(proponly, &vctx);

+    if (ret)

+        fail_to_start(ret, _("initializing network"));

+

+#if 0

     svcauth_gssapi_set_log_badauth2_func(log_badauth, NULL);

     svcauth_gssapi_set_log_badverf_func(log_badverf, NULL);

     svcauth_gssapi_set_log_miscerr_func(log_miscerr, NULL);

@@ -495,6 +557,7 @@ main(int argc, char *argv[])

     if (svcauth_gss_set_svc_name(GSS_C_NO_NAME) != TRUE)

         fail_to_start(0, _("Cannot initialize GSSAPI service name"));

+#endif

     ret = kadm5int_acl_init(context, 0, params.acl_file);

     if (ret)

@@ -535,14 +598,16 @@ main(int argc, char *argv[])

     krb5_klog_syslog(LOG_INFO, _("finished, exiting"));

     /* Clean up memory, etc */

+#if 0

     svcauth_gssapi_unset_names();

+#endif

     kadm5_destroy(global_server_handle);

     loop_free(vctx);

     kadm5int_acl_finish(context, 0);

     (void)gss_release_name(&minor_status, &gss_changepw_name);

     (void)gss_release_name(&minor_status, &gss_oldchangepw_name);

     for (i = 0; i < 4; i++)

-        free(names[i].name);

+        free(names[i]);

     krb5_klog_close(context);

     krb5_free_context(context);

diff -pur old/src/kadmin/server/server_stubs.c new/src/kadmin/server/server_stubs.c

--- old/src/kadmin/server/server_stubs.c

+++ new/src/kadmin/server/server_stubs.c

@@ -21,10 +21,10 @@ extern gss_name_t

 extern gss_name_t                       gss_oldchangepw_name;

 extern void *                           global_server_handle;

-#define CHANGEPW_SERVICE(rqstp)                                         \

-    (cmp_gss_names_rel_1(acceptor_name(rqstp->rq_svccred), gss_changepw_name) | \

-     (gss_oldchangepw_name &&                                           \

-      cmp_gss_names_rel_1(acceptor_name(rqstp->rq_svccred),             \

+#define CHANGEPW_SERVICE(rqstp)                                     \

+    (cmp_gss_names_rel_1(acceptor_name(rqstp), gss_changepw_name) | \

+     (gss_oldchangepw_name &&                                       \

+      cmp_gss_names_rel_1(acceptor_name(rqstp),                     \

                           gss_oldchangepw_name)))

@@ -33,7 +33,7 @@ static int gss_to_krb5_name(kadm5_server

 static int gss_name_to_string(gss_name_t gss_name, gss_buffer_desc *str);

-static gss_name_t acceptor_name(gss_ctx_id_t context);

+static gss_name_t acceptor_name(struct svc_req *rqstp);

 gss_name_t rqst2name(struct svc_req *rqstp);

@@ -107,6 +107,8 @@ static kadm5_ret_t new_server_handle(krb

                                      *out_handle)

 {

     kadm5_server_handle_t handle;

+    gss_name_t name = NULL;

+    OM_uint32 min_stat;

     *out_handle = NULL;

@@ -117,13 +119,18 @@ static kadm5_ret_t new_server_handle(krb

     *handle = *(kadm5_server_handle_t)global_server_handle;

     handle->api_version = api_version;

-    if (! gss_to_krb5_name(handle, rqst2name(rqstp),

-                           &handle->current_caller)) {

+    if (!(name = rqst2name(rqstp))) {

+        free(handle);

+        return KADM5_FAILURE;

+    }

+    if (! gss_to_krb5_name(handle, name, &handle->current_caller)) {

         free(handle);

+        gss_release_name(&min_stat, &name);

         return KADM5_FAILURE;

     }

     *out_handle = handle;

+    gss_release_name(&min_stat, &name);

     return 0;

 }

@@ -182,38 +189,54 @@ int setup_gss_names(struct svc_req *rqst

                     gss_buffer_desc *client_name,

                     gss_buffer_desc *server_name)

 {

-    OM_uint32 maj_stat, min_stat;

-    gss_name_t server_gss_name;

+    OM_uint32 min_stat;

+    gss_name_t name = NULL;

+    rpc_gss_rawcred_t *raw_cred;

-    if (gss_name_to_string(rqst2name(rqstp), client_name) != 0)

+    if (!(name = rqst2name(rqstp))) {

         return -1;

-    maj_stat = gss_inquire_context(&min_stat, rqstp->rq_svccred, NULL,