bugConcurrent Versions System - Bugs: bug #14506, CVS 1.12.12 GSSAPI hang

 
 

bug #14506: CVS 1.12.12 GSSAPI hang

Submitter:  None
Submitted:  Mon 12 Sep 2005 02:13:45 AM UTC
Votes: 55
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Need Info
Privacy:  Public Assigned to:  None
Open/Closed:  Open Release: 
Fixed Release:  None Fixed Feature Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Mon 31 Dec 2007 05:13:36 PM UTC, comment #10: 

This is still broken (at least under Solaris) in today's HEAD. The minimal changes required to fix it are the replacement of fread/fwrite. Can we plase get these changes merged in? It's been over 3 years... I can generate a minimal diff if that will help (although real GSSAPI support without the krb5 kludges would be a good thing...)

 Carson Gaspar <cgaspar>
Sun 02 Oct 2005 05:31:07 PM UTC, comment #9: 

Hi Derek,

I submit to bugzilla new version patch. Main goal this version - add simple use regression tests for `gserver'.

1. I add to sanity.sh test `gserver'. This test create "Kerberos 5 sand-box EXAMPLE.COM", and don't needed to Kerberos 5 infrastrukture. May be Your able start this test on yours personal computer;

2. Compile gserver/client for Solaris 9/10;

3. Repair detected bugs.

TODO:
This patch not ideal, but ideal solution need to improve other part of CVS. This need to discussion:

a. Regress test need local user `client'. Because gserver authentication start without root definition, gserver_authenticate_connection() can't use CVSROOT/passwd for user maping. May be add command line option for point of CVSROOT/passwd?

b. May be add documentation for gserver? Informationly I may
add it, but languge :(.

c. Windows ports don't have gserver. Do you need add SSPI to CVS? This medium work - 6-12 weeks.

d. Root command worked without any protection. May be start encryption/indegrity check immediate after authentification by option `-x' and `-a'?

For additional information see patchs for ChangeLog files.

Sorry for my best English.

Serguei E Leontiev <serge3leo>
Wed 21 Sep 2005 07:55:16 AM UTC, comment #8: 

unfortunately Solaris don't have kbr5 library and krb5 functions.

I change "Kerberos specific code" to more common case.

P.S.

Solaris 8/9 have default GSS-API mechnism - diffie_hellman_640_0

May be, this fact needed add to documentation?

 Serguei E Leontiev <serge3leo>
Tue 20 Sep 2005 07:04:42 PM UTC, comment #7: 

I improve main loop of connect_to_gserver ().

But, gserver_authenticate_connection() don't have loop.

For GSS-API implementation by Kerberos this good. If GSS-API used not Kerberos, then server detect error  "GSSAPI authentication failed: %s".

For connection with encryption (-x) or authentication (-a) see also bug #14601

 Serguei E Leontiev <serge3leo>
Wed 14 Sep 2005 12:54:37 AM UTC, comment #6: 

Yes, You may include my ID (Serguei E. Leontiev <lse@CryptoPro.ru>) to ChangeLog.

 Serguei E Leontiev <serge3leo>
Wed 14 Sep 2005 12:38:01 AM UTC, comment #5: 

I try fist tests current version with `cvs-1.12.12.1-fread.patch' - work fine.

But, I don't undenstand do-loop at gssapi-client.c:104. I don't know how cause two or more iteration by it. It not seems very good.

P.S.

Strongly, two send() may cause delay (double acknovelegment) to TCP communication, if nagle algorithm disabled. By some thing I remove  use writev() from patch, because nagle algorithm common use.

Sorry my best English.

 Anonymous
Mon 12 Sep 2005 01:56:51 PM UTC, comment #4: 

Aside from some nitpicks, your changes to gserver_authenticate_connection look good.  Could you include a ChangeLog entry?

From the same patch file, why did you replace a call to send() with a call to writev()?  Are you having problems with send?  I'd rather not change the call without some other reason or benefit since I don't have a feel for how portable writev() is and I know send() already works on many platforms.

I think your hostname patch is unnecessary after my recent change to fix [bug #14504] (http://savannah.nongnu.org/cgi-bin/viewcvs/cvs/ccvs/src/main.c.diff?r1=1.253&r2=1.254).

Thanks,

 Derek Robert Price <dprice>
Group administrator
Mon 12 Sep 2005 04:10:28 AM UTC, comment #3: 

Sorry, I am mistake and test current version before you commit. I try it late (I need some time for connect GSSAPI cvs server machine to `:ext:anoncvs@savannah.nongnu.org:/cvsroot/cvs').

 Serguei E Leontiev <serge3leo>
Mon 12 Sep 2005 03:58:30 AM UTC, comment #2: 

Probably #14504 correct not complete

:gsx-csp:lse.users 07:53:48 cvs-1.12.12.hostname$ cvs -d :gserver:gsx-csp:/var/cvsroot co mybuild
cvs [checkout aborted]: error from server gsx-csp: cvs [pserver aborted]: can't get canonical hostname for `(null)': Name or service not known

I attachmen two work around patch for 1.12.12:
#14504 - cvs-1.12.12-hostname.patch
#14506 - cvs-1.12.12-fread.patch

I don't undenstand. Do You needed use buf_read_data()/buf_output() in gssapi-client.c:connect_to_gserver() ?

Serguei E Leontiev <serge3leo>
Mon 12 Sep 2005 02:48:59 AM UTC, comment #1: 

I can't easily test GSSAPI here.  This would be much easier if you could supply a tested patch.

Thanks,

 Derek Robert Price <dprice>
Group administrator
Mon 12 Sep 2005 02:13:45 AM UTC, original submission:  

gserver_authenticate_connection() use "obsolets" fread()/fwrite().

Must use buf_read_data()/buf_output() instead.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #2983:  gssapi-et-all-051002.patch added by serge3leo (50KiB - text/x-patch - Patch for bug #14506, bug #14601, bug #14641, bug #14687 )
file #3153:  cvs-1.12.12.1-gssapi-solaris.patch added by serge3leo (18KiB - text/plain - patch to improve GSS-API (SuSE 9.3, RHEL4 & Solaris 9 - OK)))
file #3151:  cvs-1.12.12.1-gssapi.patch added by serge3leo (10KiB - text/plain - patch to improve GSS-API (SuSE 9.3 & RHEL4 - OK))
file #3240:  cvs-1.12.12.1-fread.patch added by None (3KiB - text/x-patch)
file #3252:  cvs-1.12.12-hostname.patch added by serge3leo (661B - text/x-patch - Workaround #14504)
file #3251:  cvs-1.12.12-fread.patch added by serge3leo (3KiB - text/x-patch - Workaround #14506)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by cgaspar (Posted a comment)
  • -email is unavailable- added by cgaspar (Voted in favor of this item)

    •  

    There are 55 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 13 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-12-31 cgaspar Carbon-Copy- Added cgaspar
    2006-12-12 dorfsmay Carbon-Copy- Added dorfsmay
    2005-10-02 serge3leo Carbon-Copy- Added serge3leo
    2005-10-02 serge3leo Carbon-Copy- Added -email is unavailable-
    2005-10-02 serge3leo Attached File- Added gssapi-et-all-051002.patch, #3017
    2005-09-21 serge3leo Attached File- Added cvs-1.12.12.1-gssapi-solaris.patch, #2975
    2005-09-20 serge3leo Carbon-Copy- Added -email is unavailable-
    2005-09-20 serge3leo Attached File- Added cvs-1.12.12.1-gssapi.patch, #2973
    2005-09-14 None Attached File- Added cvs-1.12.12.1-fread.patch, #2950
    2005-09-12 dprice StatusPostponed Need Info
    2005-09-12 serge3leo Attached File- Added cvs-1.12.12-hostname.patch, #2945
    2005-09-12 serge3leo Attached File- Added cvs-1.12.12-fread.patch, #2944
    2005-09-12 dprice StatusNone Postponed

    Back to the top

    Copyright © 2025 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-708e.
    Corresponding source code