Re: ANNOUNCE: nfs-utils-1.2.2 released.

[Kevin Coffman <kwc@citi.umich.edu>]

2010/3/9 Lukas Hejtmanek <xhejtman@ics.muni.cz>:
> On Tue, Mar 09, 2010 at 10:18:58AM -0500, Kevin Coffman wrote:
>> I've built nfs-utils with and without =A0--disable-tirpc and don't s=
ee
>> this problem.
>>
>> It could be a bug, but I would think that other [Debian and other]
>> testers would have already hit it.
>>
>> I'm concerned that perhaps your build issues may have somehow
>> introduced a [bad] mix of headers? =A0(i.e. were things built using =
the
>> libgssglue headers, or the Kerberos headers?)
>
> I have both. If I remove gssglue headers, it still faults. If I remov=
e
> kerberos headers, it does not even compile.
>
> I believe, that it has the following problem.
>
> gssd calls gss_acquire_cred, it calls the one from libgssapi_krb5.so.=
2.

I'm confused.  gssd shouldn't be calling any of the Kerberos GSS
functions directly, it should be calling the one in libgssglue, which
should call the mechanism-specific (Kerberos) version.

> This gss_acquire_cred filss in gss_union_cred_t structure.
> gssd calls gss_set_allowable_enctypes which is located in libgss_glue=
=2E
> The libgssglue uses gss_union_cred_t structure.
>
> This happens in limit_krb5_enctypes() in krb5_util.c
>
> Unfortunately, gss_union_cred_t in libgssglue is missing one (first) =
item
> compared to libgssapi_krb5.so.2, thus count is stored instead of mech=
s_array.
> The mechs_array contains value 1 as I have shown. Dereferrencing mean=
s
> segfault.
>
> Btw, do you have HAVE_SET_ALLOWABLE_ENCTYPES ?

Yes.