diff -ur krb4-0.10/NEWS krb4-0.10.1/NEWS --- krb4-0.10/NEWS Thu Jul 8 03:22:36 1999 +++ krb4-0.10.1/NEWS Thu Sep 2 11:00:35 1999 @@ -1,3 +1,12 @@ +Changes in release 0.10.1: + +* Bug fixes: + - krb_get_lrealm now works with zero `n' + - kadmin cosmetic fix + - login now compiles on IRIX < 6.5 + - kxd fix for solaris waitpid breakage, fix for unicos setjob + breakage, better handling of fork failures + Changes in release 0.10: * Some support for Irix 6.5 capabilities diff -ur krb4-0.10/PROBLEMS krb4-0.10.1/PROBLEMS --- krb4-0.10/PROBLEMS Sun Aug 22 15:21:40 1999 +++ krb4-0.10.1/PROBLEMS Mon Sep 6 12:44:33 1999 @@ -68,9 +68,30 @@ `appl/telnet/telnetd/sys_term.c' (and possibily `appl/bsd/forkpty.c'), if used with too much optimization. -There is a bug in AFS version 5.38 for AIX 4.3 that causes the kernel to -panic in some cases. There is a hack for this in `login', but other -programs could be affected also. This seems to be fixed in version 5.55. +Some versions of the `xlc' preprocessor doesn't recognise the +(undocumented) `-qnolm' option. If this option is passed to the +preprocessor (like via the configuration file `/etc/ibmcxx.cfg', +configure will fail. + +The solution is to remove this option from the configuration file, +either globally, or for just the preprocessor: + + $ cp /etc/ibmcxx.cfg /tmp + $ed /tmp/ibmcxx.cfg + 8328 + /nolm + options = -D_AIX,-D_AIX32,-D_AIX41,-D_AIX43,-D_IBMR2,-D_POWER,-bpT:0x10000000,-bpD:0x20000000,-qnolm + s/,-qnolm//p + options = -D_AIX,-D_AIX32,-D_AIX41,-D_AIX43,-D_IBMR2,-D_POWER,-bpT:0x10000000,-bpD:0x20000000 + w + 8321 + q + $ env CC=xlc CPP="xlc -E -F/tmp/ibmcxx.cfg" configure + +There is a bug in AFS 3.4 version 5.38 for AIX 4.3 that causes the +kernel to panic in some cases. There is a hack for this in `login', but +other programs could be affected also. This seems to be fixed in +version 5.55. C2 problems ----------- diff -ur krb4-0.10/appl/bsd/login.c krb4-0.10.1/appl/bsd/login.c --- krb4-0.10/appl/bsd/login.c Thu Aug 19 15:38:31 1999 +++ krb4-0.10.1/appl/bsd/login.c Thu Sep 2 10:55:26 1999 @@ -45,7 +45,7 @@ #include #endif -RCSID("$Id: login.c,v 1.120.2.1 1999/08/19 13:38:31 assar Exp $"); +RCSID("$Id: login.c,v 1.120.2.2 1999/09/02 08:55:26 joda Exp $"); #ifdef OTP #include @@ -754,8 +754,17 @@ /* perhaps work some magic */ if(do_osfc2_magic(pwd->pw_uid)) sleepexit(1); -#ifdef HAVE_SGI_GETCAPABILITYBYNAME - /* XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX */ +#if defined(HAVE_SGI_GETCAPABILITYBYNAME) && defined(HAVE_CAP_SET_PROC) + /* XXX SGI capability hack IRIX 6.x (x >= 0?) has something + called capabilities, that allow you to give away + permissions (such as chown) to specific processes. From 6.5 + this is default on, and the default capability set seems to + not always be the empty set. The problem is that the + runtime linker refuses to do just about anything if the + process has *any* capabilities set, so we have to remove + them here (unless otherwise instructed by /etc/capability). + In IRIX < 6.5, these functions was called sgi_cap_setproc, + etc, but we ignore this fact (it works anyway). */ { struct user_cap *ucap = sgi_getcapabilitybyname(pwd->pw_name); cap_t cap; diff -ur krb4-0.10/appl/kx/kxd.c krb4-0.10.1/appl/kx/kxd.c --- krb4-0.10/appl/kx/kxd.c Sun Jun 20 16:32:03 1999 +++ krb4-0.10.1/appl/kx/kxd.c Thu Sep 2 21:12:09 1999 @@ -38,7 +38,10 @@ #include "kx.h" -RCSID("$Id: kxd.c,v 1.56 1999/06/20 14:32:03 assar Exp $"); +RCSID("$Id: kxd.c,v 1.56.2.2 1999/09/02 19:12:09 assar Exp $"); + +static pid_t wait_on_pid = -1; +static int done = 0; /* * Signal handler that justs waits for the children when they die. @@ -52,6 +55,8 @@ do { pid = waitpid (-1, &status, WNOHANG|WUNTRACED); + if (pid > 0 && pid == wait_on_pid) + done = 1; } while(pid > 0); signal (SIGCHLD, childhandler); SIGRETURN(0); @@ -204,12 +209,9 @@ cleanup (*nsockets, *sockets); fatal (kc, sock, "fork: %s", strerror(errno)); } else if (pid != 0) { - int status; - - while (waitpid (pid, &status, 0) != pid - && !WIFEXITED(status) - && !WIFSIGNALED(status)) - ; + wait_on_pid = pid; + while (!done) + pause (); cleanup (*nsockets, *sockets); exit (0); } @@ -217,7 +219,11 @@ if (setgid (passwd->pw_gid) || initgroups(passwd->pw_name, passwd->pw_gid) || +#ifdef HAVE_GETUDBNAM /* XXX this happens on crays */ + setjob(passwd->pw_uid, 0) == -1 || +#endif setuid(passwd->pw_uid)) { + syslog(LOG_ERR, "setting uid/groups: %m"); fatal (kc, sock, "cannot set uid"); } syslog (LOG_INFO, "from %s(%s): %s -> %s", @@ -363,6 +369,49 @@ fatal (kc, fd, "Permission denied"); } +/* close down the new connection with a reasonable error message */ +static void +close_connection(int fd, const char *message) +{ + char buf[264]; /* max message */ + char *p; + int lsb = 0; + size_t mlen; + + mlen = strlen(message); + if(mlen > 255) + mlen = 255; + + /* read first part of connection packet, to get byte order */ + if(read(fd, buf, 6) != 6) { + close(fd); + return; + } + if(buf[0] == 0x6c) + lsb++; + p = buf; + *p++ = 0; /* failed */ + *p++ = mlen; /* length of message */ + p += 4; /* skip protocol version */ + p += 2; /* skip additional length */ + memcpy(p, message, mlen); /* copy message */ + p += mlen; + while((p - buf) % 4) /* pad to multiple of 4 bytes */ + *p++ = 0; + + /* now fill in length of additional data */ + if(lsb) { + buf[6] = (p - buf - 8) / 4; + buf[7] = 0; + }else{ + buf[6] = 0; + buf[7] = (p - buf - 8) / 4; + } + write(fd, buf, p - buf); + close(fd); +} + + /* * Handle a passive session on `sock' */ @@ -523,7 +572,9 @@ child = fork (); if (child < 0) { syslog (LOG_ERR, "fork: %m"); - return 1; + if(errno != EAGAIN) + return 1; + close_connection(fd, strerror(errno)); } else if (child == 0) { for (i = 0; i < nsockets; ++i) close (sockets[i].fd); @@ -573,7 +624,8 @@ child = fork (); if (child < 0) { syslog (LOG_ERR, "fork: %m"); - return 1; + if (errno != EAGAIN) + return 1; } else if (child == 0) { return doit_conn (kc, sock, sock, flags, 1); } else { @@ -615,6 +667,7 @@ struct getargs args[] = { { "inetd", 'i', arg_negative_flag, &inetd_flag, "Not started from inetd" }, + { "tcp", 't', arg_flag, &tcp_flag, "Use TCP" }, { "port", 'p', arg_string, &port_str, "Use this port", "port" }, { "version", 0, arg_flag, &version_flag }, diff -ur krb4-0.10/configure krb4-0.10.1/configure --- krb4-0.10/configure Sun Aug 22 15:21:23 1999 +++ krb4-0.10.1/configure Mon Sep 6 12:44:25 1999 @@ -1,6 +1,6 @@ #! /bin/sh -# From configure.in Revision: 1.415.2.8 +# From configure.in Revision: 1.415.2.9 @@ -698,7 +698,7 @@ PACKAGE=krb4 -VERSION=0.10 +VERSION=0.10.1 cat >> confdefs.h <&6 echo "configure:6356: checking for $ac_func" >&5 diff -ur krb4-0.10/configure.in krb4-0.10.1/configure.in --- krb4-0.10/configure.in Sun Aug 22 15:14:18 1999 +++ krb4-0.10.1/configure.in Thu Sep 2 10:57:19 1999 @@ -8,7 +8,7 @@ dnl Process this file with autoconf to produce a configure script. dnl -AC_REVISION($Revision: 1.415.2.8 $) +AC_REVISION($Revision: 1.415.2.9 $) AC_INIT(lib/krb/getrealm.c) AC_CONFIG_HEADER(include/config.h) @@ -18,7 +18,7 @@ PACKAGE=krb4 AC_SUBST(PACKAGE)dnl -VERSION=0.10 +VERSION=0.10.1 AC_SUBST(VERSION)dnl AC_DEFINE_UNQUOTED(PACKAGE, "$PACKAGE", [Name of package])dnl AC_DEFINE_UNQUOTED(VERSION, "$VERSION", [Version number of package])dnl @@ -558,7 +558,7 @@ AC_CHECK_FUNCS(setproctitle setregid setresgid setresuid setreuid setsid) AC_CHECK_FUNCS(setutent sigaction sysconf sysctl ttyname ttyslot) AC_CHECK_FUNCS(ulimit uname unlockpt vhangup yp_get_default_domain) -AC_CHECK_FUNCS(on_exit sgi_getcapabilitybyname) +AC_CHECK_FUNCS(on_exit sgi_getcapabilitybyname cap_set_proc) AC_CHECK_GETPWNAM_R_POSIX diff -ur krb4-0.10/doc/kth-krb.info krb4-0.10.1/doc/kth-krb.info --- krb4-0.10/doc/kth-krb.info Sun Aug 22 15:21:39 1999 +++ krb4-0.10.1/doc/kth-krb.info Mon Sep 6 12:44:33 1999 @@ -1,4 +1,4 @@ -This is Info file kth-krb.info, produced by Makeinfo version 1.67 from +This is Info file kth-krb.info, produced by Makeinfo version 1.68 from the input file kth-krb.texi. INFO-DIR-SECTION Kerberos @@ -646,7 +646,7 @@ ---------- Footnotes ---------- -(1) Using lowercase characters in the realm name might break in +(1) Using lowercase characters in the realm name might break in mysterious ways. This really should have been fixed, but has not.  @@ -1580,9 +1580,30 @@ `appl/telnet/telnetd/sys_term.c' (and possibily `appl/bsd/forkpty.c'), if used with too much optimization. -There is a bug in AFS version 5.38 for AIX 4.3 that causes the kernel to -panic in some cases. There is a hack for this in `login', but other -programs could be affected also. This seems to be fixed in version 5.55. +Some versions of the `xlc' preprocessor doesn't recognise the +(undocumented) `-qnolm' option. If this option is passed to the +preprocessor (like via the configuration file `/etc/ibmcxx.cfg', +configure will fail. + +The solution is to remove this option from the configuration file, +either globally, or for just the preprocessor: + + $ cp /etc/ibmcxx.cfg /tmp + $ed /tmp/ibmcxx.cfg + 8328 + /nolm + options = -D_AIX,-D_AIX32,-D_AIX41,-D_AIX43,-D_IBMR2,-D_POWER,-bpT:0x10000000,-bpD:0x20000000,-qnolm + s/,-qnolm//p + options = -D_AIX,-D_AIX32,-D_AIX41,-D_AIX43,-D_IBMR2,-D_POWER,-bpT:0x10000000,-bpD:0x20000000 + w + 8321 + q + $ env CC=xlc CPP="xlc -E -F/tmp/ibmcxx.cfg" configure + +There is a bug in AFS 3.4 version 5.38 for AIX 4.3 that causes the +kernel to panic in some cases. There is a hack for this in `login', but +other programs could be affected also. This seems to be fixed in +version 5.55. C2 problems ----------- @@ -2004,32 +2025,32 @@ Node: How to set up a realm22961 Node: How to set up the kerberos server23545 Node: Choose a realm name24175 -Node: Choose a kerberos server24836 -Node: Install the configuration files25829 -Node: Install the /etc/services31400 -Node: Install the kerberos server31974 -Node: Set up the server32532 -Node: Add a few important principals34917 -Node: Start the server36780 -Node: Try to get tickets37274 -Node: Create initial ACL for the admin server38120 -Node: Start the admin server39081 -Node: Add users to the database39562 -Node: Automate the startup of the servers40639 -Node: Install the client programs40980 -Node: Install the kerberised services42833 -Node: Install a slave kerberos server48149 -Node: Cross-realm functionality51201 -Node: One-Time Passwords53338 -Node: What are one time passwords?53752 -Node: When to use one time passwords?54383 -Node: Configuring OTPs55738 -Node: Resolving frequent problems57891 -Node: Problems compiling Kerberos58195 -Node: Problems with firewalls60917 -Node: Common error messages63580 -Node: Is Kerberos year 2000 safe?67074 -Node: Acknowledgments68044 -Node: Index71163 +Node: Choose a kerberos server24835 +Node: Install the configuration files25828 +Node: Install the /etc/services31399 +Node: Install the kerberos server31973 +Node: Set up the server32531 +Node: Add a few important principals34916 +Node: Start the server36779 +Node: Try to get tickets37273 +Node: Create initial ACL for the admin server38119 +Node: Start the admin server39080 +Node: Add users to the database39561 +Node: Automate the startup of the servers40638 +Node: Install the client programs40979 +Node: Install the kerberised services42832 +Node: Install a slave kerberos server48148 +Node: Cross-realm functionality51200 +Node: One-Time Passwords53337 +Node: What are one time passwords?53751 +Node: When to use one time passwords?54382 +Node: Configuring OTPs55737 +Node: Resolving frequent problems57890 +Node: Problems compiling Kerberos58194 +Node: Problems with firewalls61652 +Node: Common error messages64315 +Node: Is Kerberos year 2000 safe?67809 +Node: Acknowledgments68779 +Node: Index71898  End Tag Table diff -ur krb4-0.10/doc/problems.texi krb4-0.10.1/doc/problems.texi --- krb4-0.10/doc/problems.texi Wed Aug 18 23:12:04 1999 +++ krb4-0.10.1/doc/problems.texi Mon Sep 6 11:11:36 1999 @@ -79,9 +79,32 @@ @file{appl/telnet/telnetd/sys_term.c} (and possibily @file{appl/bsd/forkpty.c}), if used with too much optimization. -There is a bug in AFS version 5.38 for AIX 4.3 that causes the kernel to -panic in some cases. There is a hack for this in @kbd{login}, but other -programs could be affected also. This seems to be fixed in version 5.55. +Some versions of the @kbd{xlc} preprocessor doesn't recognise the +(undocumented) @samp{-qnolm} option. If this option is passed to the +preprocessor (like via the configuration file @file{/etc/ibmcxx.cfg}, +configure will fail. + +The solution is to remove this option from the configuration file, +either globally, or for just the preprocessor: + +@example +$ cp /etc/ibmcxx.cfg /tmp +$ed /tmp/ibmcxx.cfg +8328 +/nolm + options = -D_AIX,-D_AIX32,-D_AIX41,-D_AIX43,-D_IBMR2,-D_POWER,-bpT:0x10000000,-bpD:0x20000000,-qnolm +s/,-qnolm//p + options = -D_AIX,-D_AIX32,-D_AIX41,-D_AIX43,-D_IBMR2,-D_POWER,-bpT:0x10000000,-bpD:0x20000000 +w +8321 +q +$ env CC=xlc CPP="xlc -E -F/tmp/ibmcxx.cfg" configure +@end example + +There is a bug in AFS 3.4 version 5.38 for AIX 4.3 that causes the +kernel to panic in some cases. There is a hack for this in @kbd{login}, +but other programs could be affected also. This seems to be fixed in +version 5.55. @subheading C2 problems diff -ur krb4-0.10/include/config.h.in krb4-0.10.1/include/config.h.in --- krb4-0.10/include/config.h.in Sun Aug 22 15:21:38 1999 +++ krb4-0.10.1/include/config.h.in Mon Sep 6 12:44:32 1999 @@ -71,15 +71,6 @@ /* Define if the X Window System is missing or not being used. */ #undef X_DISPLAY_MISSING -/* Define if you have the XauFileName function. */ -#undef HAVE_XAUFILENAME - -/* Define if you have the XauReadAuth function. */ -#undef HAVE_XAUREADAUTH - -/* Define if you have the XauWriteAuth function. */ -#undef HAVE_XAUWRITEAUTH - /* Define if you have the _getpty function. */ #undef HAVE__GETPTY @@ -101,6 +92,9 @@ /* Define if you have the atexit function. */ #undef HAVE_ATEXIT +/* Define if you have the cap_set_proc function. */ +#undef HAVE_CAP_SET_PROC + /* Define if you have the chown function. */ #undef HAVE_CHOWN @@ -458,6 +452,15 @@ /* Define if you have the writev function. */ #undef HAVE_WRITEV +/* Define if you have the XauFileName function. */ +#undef HAVE_XAUFILENAME + +/* Define if you have the XauReadAuth function. */ +#undef HAVE_XAUREADAUTH + +/* Define if you have the XauWriteAuth function. */ +#undef HAVE_XAUWRITEAUTH + /* Define if you have the yp_get_default_domain function. */ #undef HAVE_YP_GET_DEFAULT_DOMAIN @@ -758,12 +761,6 @@ /* Define if you have the header file. */ #undef HAVE_WAIT_H -/* Define if you have the X11 library (-lX11). */ -#undef HAVE_LIBX11 - -/* Define if you have the Xau library (-lXau). */ -#undef HAVE_LIBXAU - /* Define if you have the c_r library (-lc_r). */ #undef HAVE_LIBC_R @@ -811,6 +808,12 @@ /* Define if you have the util library (-lutil). */ #undef HAVE_LIBUTIL + +/* Define if you have the X11 library (-lX11). */ +#undef HAVE_LIBX11 + +/* Define if you have the Xau library (-lXau). */ +#undef HAVE_LIBXAU /* Name of package */ #undef PACKAGE diff -ur krb4-0.10/kadmin/kadmin.c krb4-0.10.1/kadmin/kadmin.c --- krb4-0.10/kadmin/kadmin.c Wed Jun 2 05:59:33 1999 +++ krb4-0.10.1/kadmin/kadmin.c Thu Sep 2 10:51:59 1999 @@ -31,7 +31,7 @@ #include "getarg.h" #include "parse_time.h" -RCSID("$Id: kadmin.c,v 1.59 1999/06/02 03:59:33 joda Exp $"); +RCSID("$Id: kadmin.c,v 1.59.2.1 1999/09/02 08:51:59 joda Exp $"); static int change_password(int argc, char **argv); static int change_key(int argc, char **argv); @@ -905,7 +905,7 @@ if (status == KADM_SUCCESS) { printf("%s added to database", argv[i]); if (generate_password) - printf ("with password `%s'", pw); + printf (" with password `%s'", pw); printf (".\n"); } else printf("kadm error: %s\n",error_message(status)); diff -ur krb4-0.10/lib/krb/get_krbrlm.c krb4-0.10.1/lib/krb/get_krbrlm.c --- krb4-0.10/lib/krb/get_krbrlm.c Fri Mar 12 19:04:25 1999 +++ krb4-0.10.1/lib/krb/get_krbrlm.c Thu Sep 2 10:51:04 1999 @@ -38,7 +38,7 @@ #include "krb_locl.h" -RCSID("$Id: get_krbrlm.c,v 1.22 1999/03/12 18:04:25 bg Exp $"); +RCSID("$Id: get_krbrlm.c,v 1.22.2.1 1999/09/02 08:51:04 joda Exp $"); /* * krb_get_lrealm takes a pointer to a string, and a number, n. It fills @@ -61,8 +61,10 @@ FILE *f; int ret = KFAILURE; - if (n < 1) + if (n < 0) return KFAILURE; + if(n == 0) + n = 1; f = fopen(fname, "r"); if (f == 0)