bugConcurrent Versions System - Bugs: bug #14506, CVS 1.12.12 GSSAPI hang

 
 

bug #14506: CVS 1.12.12 GSSAPI hang

Submitted by:  None
Submitted on:  Mon 12 Sep 2005 02:13:45 AM UTC  
Votes:  55  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Need Info
Privacy: PublicAssigned to: None
Open/Closed: OpenRelease: 
Fixed Release: NoneFixed Feature Release: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Mon 31 Dec 2007 05:13:36 PM UTC, comment #10:

This is still broken (at least under Solaris) in today's HEAD. The minimal changes required to fix it are the replacement of fread/fwrite. Can we plase get these changes merged in? It's been over 3 years... I can generate a minimal diff if that will help (although real GSSAPI support without the krb5 kludges would be a good thing...)

Carson Gaspar <cgaspar>
Sun 02 Oct 2005 05:31:07 PM UTC, comment #9:

Hi Derek,

I submit to bugzilla new version patch. Main goal this version - add simple use regression tests for `gserver'.

1. I add to sanity.sh test `gserver'. This test create "Kerberos 5 sand-box EXAMPLE.COM", and don't needed to Kerberos 5 infrastrukture. May be Your able start this test on yours personal computer;

2. Compile gserver/client for Solaris 9/10;

3. Repair detected bugs.

TODO:
This patch not ideal, but ideal solution need to improve other part of CVS. This need to discussion:

a. Regress test need local user `client'. Because gserver authentication start without root definition, gserver_authenticate_connection() can't use CVSROOT/passwd for user maping. May be add command line option for point of CVSROOT/passwd?

b. May be add documentation for gserver? Informationly I may
add it, but languge :(.

c. Windows ports don't have gserver. Do you need add SSPI to CVS? This medium work - 6-12 weeks.

d. Root command worked without any protection. May be start encryption/indegrity check immediate after authentification by option `-x' and `-a'?

For additional information see patchs for ChangeLog files.

Sorry for my best English.

Serguei E Leontiev <serge3leo>
Wed 21 Sep 2005 07:55:16 AM UTC, comment #8:

unfortunately Solaris don't have kbr5 library and krb5 functions.

I change "Kerberos specific code" to more common case.

P.S.

Solaris 8/9 have default GSS-API mechnism - diffie_hellman_640_0

May be, this fact needed add to documentation?

Serguei E Leontiev <serge3leo>
Tue 20 Sep 2005 07:04:42 PM UTC, comment #7:

I improve main loop of connect_to_gserver ().

But, gserver_authenticate_connection() don't have loop.

For GSS-API implementation by Kerberos this good. If GSS-API used not Kerberos, then server detect error "GSSAPI authentication failed: %s".

For connection with encryption (-x) or authentication (-a) see also bug #14601

Serguei E Leontiev <serge3leo>
Wed 14 Sep 2005 12:54:37 AM UTC, comment #6:

Yes, You may include my ID (Serguei E. Leontiev <lse@CryptoPro.ru>) to ChangeLog.

Serguei E Leontiev <serge3leo>
Wed 14 Sep 2005 12:38:01 AM UTC, comment #5:

I try fist tests current version with `cvs-1.12.12.1-fread.patch' - work fine.

But, I don't undenstand do-loop at gssapi-client.c:104. I don't know how cause two or more iteration by it. It not seems very good.

P.S.

Strongly, two send() may cause delay (double acknovelegment) to TCP communication, if nagle algorithm disabled. By some thing I remove use writev() from patch, because nagle algorithm common use.

Sorry my best English.

Anonymous
Mon 12 Sep 2005 01:56:51 PM UTC, comment #4:

Aside from some nitpicks, your changes to gserver_authenticate_connection look good. Could you include a ChangeLog entry?

From the same patch file, why did you replace a call to send() with a call to writev()? Are you having problems with send? I'd rather not change the call without some other reason or benefit since I don't have a feel for how portable writev() is and I know send() already works on many platforms.

I think your hostname patch is unnecessary after my recent change to fix [bug #14504] (http://savannah.nongnu.org/cgi-bin/viewcvs/cvs/ccvs/src/main.c.diff?r1=1.253&r2=1.254).

Thanks,

Derek Robert Price <dprice>
Project Administrator
Mon 12 Sep 2005 04:10:28 AM UTC, comment #3:

Sorry, I am mistake and test current version before you commit. I try it late (I need some time for connect GSSAPI cvs server machine to `:ext:anoncvs@savannah.nongnu.org:/cvsroot/cvs').

Serguei E Leontiev <serge3leo>
Mon 12 Sep 2005 03:58:30 AM UTC, comment #2:

Probably #14504 correct not complete

:gsx-csp:lse.users 07:53:48 cvs-1.12.12.hostname$ cvs -d :gserver:gsx-csp:/var/cvsroot co mybuild
cvs [checkout aborted]: error from server gsx-csp: cvs [pserver aborted]: can't get canonical hostname for `(null)': Name or service not known

I attachmen two work around patch for 1.12.12:
#14504 - cvs-1.12.12-hostname.patch
#14506 - cvs-1.12.12-fread.patch

I don't undenstand. Do You needed use buf_read_data()/buf_output() in gssapi-client.c:connect_to_gserver() ?

Serguei E Leontiev <serge3leo>
Mon 12 Sep 2005 02:48:59 AM UTC, comment #1:

I can't easily test GSSAPI here. This would be much easier if you could supply a tested patch.

Thanks,

Derek Robert Price <dprice>
Project Administrator
Mon 12 Sep 2005 02:13:45 AM UTC, original submission:

gserver_authenticate_connection() use "obsolets" fread()/fwrite().

Must use buf_read_data()/buf_output() instead.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #3153:  cvs-1.12.12.1-gssapi-solaris.patch added by serge3leo (18KiB - text/plain - patch to improve GSS-API (SuSE 9.3, RHEL4 & Solaris 9 - OK)))
file #3151:  cvs-1.12.12.1-gssapi.patch added by serge3leo (10KiB - text/plain - patch to improve GSS-API (SuSE 9.3 & RHEL4 - OK))
file #3240:  cvs-1.12.12.1-fread.patch added by None (3KiB - text/x-patch)
file #3252:  cvs-1.12.12-hostname.patch added by serge3leo (661B - text/x-patch - Workaround #14504)
file #3251:  cvs-1.12.12-fread.patch added by serge3leo (3KiB - text/x-patch - Workaround #14506)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by cgaspar (Posted a comment)
  • -unavailable- added by cgaspar (Voted in favor of this item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 55 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 13 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 31 Dec 2007 05:11:06 PM UTCcgasparCarbon-Copy-=>Added cgaspar
    Tue 12 Dec 2006 09:40:34 PM UTCdorfsmayCarbon-Copy-=>Added dorfsmay
    Sun 02 Oct 2005 06:02:17 PM UTCserge3leoCarbon-Copy-=>Added serge3leo
    Sun 02 Oct 2005 05:57:35 PM UTCserge3leoCarbon-Copy-=>Added -unavailable-
    Sun 02 Oct 2005 05:31:07 PM UTCserge3leoAttached File-=>Added gssapi-et-all-051002.patch, #3017
    Wed 21 Sep 2005 07:55:17 AM UTCserge3leoAttached File-=>Added cvs-1.12.12.1-gssapi-solaris.patch, #2975
    Tue 20 Sep 2005 07:06:41 PM UTCserge3leoCarbon-Copy-=>Added -unavailable-
    Tue 20 Sep 2005 07:04:42 PM UTCserge3leoAttached File-=>Added cvs-1.12.12.1-gssapi.patch, #2973
    Wed 14 Sep 2005 12:38:01 AM UTCNoneAttached File-=>Added cvs-1.12.12.1-fread.patch, #2950
    Mon 12 Sep 2005 01:56:51 PM UTCdpriceStatusPostponed=>Need Info
    Mon 12 Sep 2005 03:59:30 AM UTCserge3leoAttached File-=>Added cvs-1.12.12-hostname.patch, #2945
    Mon 12 Sep 2005 03:58:31 AM UTCserge3leoAttached File-=>Added cvs-1.12.12-fread.patch, #2944
    Mon 12 Sep 2005 02:48:59 AM UTCdpriceStatusNone=>Postponed

    Back to the top


    Powered by Savane 3.1-cleanup1