With openssh-snap-20040212 the configure.ac when it finds a krb5-config file, does not call the AC_DEFINE(GSSAPI) or AC_CHECK_HEADER(gssapi.h...) This means that GSSAPI and HAVE_GSSAPI_H are not defined, and thus GSSAPI is not built. If I rename the kerberos provided krb5-config file and run configure, the old method of finding the Kerberos lib and include directories is used and OpenSSH builds with the GSSAPI. There is also a seperate issue with the MIT version of krb5-config with finding the location of gssapi.h. Its in thier .../include/gssapi which is not returned by the krb5-config --cflags. I have reported that to MIT as a seperate bug. -- Douglas E. Engert <DEEngert at anl.gov> Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444
Douglas E. Engert wrote:> With openssh-snap-20040212 the configure.ac when it finds a > krb5-config file, does not call the AC_DEFINE(GSSAPI) or > AC_CHECK_HEADER(gssapi.h...) This means that GSSAPI and HAVE_GSSAPI_H > are not defined, and thus GSSAPI is not built.Fair enough. How's this patch?> If I rename the kerberos provided krb5-config file and run configure, > the old method of finding the Kerberos lib and include directories > is used and OpenSSH builds with the GSSAPI. > > There is also a seperate issue with the MIT version of krb5-config with > finding the location of gssapi.h. Its in thier .../include/gssapi which > is not returned by the krb5-config --cflags. I have reported that to MIT as > a seperate bug.I'm wondering what (if anything) configure should do about this. Currently it searches for GSSAPI includes in /path/to/kerberos/include/gssapi. On the other hand, using krb5-config is supposed make things simpler, right :-? -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement. -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: openssh-gssapi-conf.patch Url: http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20040214/49b519fd/attachment.ksh
Darren Tucker wrote:> > Douglas E. Engert wrote: > > More or less, but the new code uses > > CPPFLAGS="$CPPFLAGS ${K5CFLAGS}/gssapi" > > What guarantee is there that K5CFLAGS will contain only > -I/path/to/includes?" What happens if it contains, eg, > "-I/path/to/include -DSOME_FLAG"?By the time MIT releases a new version of krb5-config, they should have gssapi.h in the path so the code in question to test for gssapi.h in the sub directory will not be executed. The Heimdal code (as I understand) does not have this problem, so does not execute this code. If they did changed the krb5-config to add some more flags, but did not fix the gssapi.h not in the path, this code would fail. But I believe that this is their bug, and they will fix it. This is bug 2240. This problem is a moving target, my patch was designed to work with past and future versions of krb5-config.> > > Which uses the output of the krb5-config --cflag i.e. -I/some/location/include > > were as the original uses > > CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi" > > The $KRB5ROOT may not be the same location as the output of krb5-config. > > > > The extra check is only executed if gssapi is not found in the expected place, > > so when MIT fixes krb5-config so it finds the gssapi.h then the > > extra check could be eliminated, and the tests could be combined. > > -- > Darren Tucker (dtucker at zip.com.au) > GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 > Good judgement comes with experience. Unfortunately, the experience > usually comes from bad judgement.-- Douglas E. Engert <DEEngert at anl.gov> Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444