Don't build PKINIT ASN.1 support code if not building PKINIT plugin

If --disable-pkinit is given at configure time, don't build the PKINIT
plugin.

If the PKINIT plugin is not going to be built, define DISABLE_PKINIT.

If DISABLE_PKINIT is defined, don't build the PKINIT-related ASN.1
encoding and decoding routines, and fill their slots in the accessor
function table with null pointers.

Tweak the accessor table initialization to use conditionally-varying
macros rather than conditionally selecting between two blocks of
invocations of fixed macros.

ticket: new

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@20652 dc483132-0cff-0310-8789-dd5450dbe970

4 files changed, 74 insertions, 51 deletions

diff --git a/src/configure.in b/src/configure.in
index bba5a2dd4..b29082320 100644
--- a/src/configure.in
+++ b/src/configure.in
@@ -925,18 +925,26 @@ changequote([, ])
 AC_SUBST(PASS)
 
 dnl for pkinit
-AC_CACHE_CHECK(for a recent enough OpenSSL, k5_cv_openssl_version_okay,
+AC_ARG_ENABLE([pkinit],
+[  --disable-pkinit        disable PKINIT plugin support],,
+enable_pkinit=yes)
+if test "$enable_pkinit" = yes; then
+  AC_CACHE_CHECK(for a recent enough OpenSSL, k5_cv_openssl_version_okay,
 [AC_COMPILE_IFELSE([#include <openssl/opensslv.h>
 #if OPENSSL_VERSION_NUMBER < 0x00908000L
 # error openssl is too old, need 0.9.8
 #endif
 int i = 1;
 ], k5_cv_openssl_version_okay=yes, k5_cv_openssl_version_okay=no)])
-old_LIBS="$LIBS"
-AC_CHECK_LIB(crypto, PKCS7_get_signer_info)
-LIBS="$old_LIBS"
-if test "$k5_cv_openssl_version_okay" = yes; then
+  old_LIBS="$LIBS"
+  AC_CHECK_LIB(crypto, PKCS7_get_signer_info)
+  LIBS="$old_LIBS"
+fi
+if test "$k5_cv_openssl_version_okay" = yes && test "$enable_pkinit" = yes; then
   K5_GEN_MAKEFILE(plugins/preauth/pkinit)
+else
+  AC_DEFINE([DISABLE_PKINIT], 1, [Define to disable PKINIT plugin support])
+  AC_MSG_NOTICE([Disabling PKINIT support.])
 fi
 
 dnl for lib/apputils
diff --git a/src/lib/krb5/asn.1/asn1_k_decode.c b/src/lib/krb5/asn.1/asn1_k_decode.c
index 10d0a05f8..213bb3b1e 100644
--- a/src/lib/krb5/asn.1/asn1_k_decode.c
+++ b/src/lib/krb5/asn.1/asn1_k_decode.c
@@ -1185,6 +1185,7 @@ asn1_error_code asn1_decode_predicted_sam_response(asn1buf *buf, krb5_predicted_
   cleanup();
 }
 
+#ifndef DISABLE_PKINIT
 /* PKINIT */
 
 asn1_error_code asn1_decode_external_principal_identifier(asn1buf *buf, krb5_external_principal_identifier *val)
@@ -1589,3 +1590,4 @@ asn1_error_code asn1_decode_typed_data(asn1buf *buf, krb5_typed_data *val)
   }
   cleanup();
 }
+#endif /* DISABLE_PKINIT */
diff --git a/src/lib/krb5/asn.1/asn1_k_encode.c b/src/lib/krb5/asn.1/asn1_k_encode.c
index 4869ea732..4cd9f0572 100644
--- a/src/lib/krb5/asn.1/asn1_k_encode.c
+++ b/src/lib/krb5/asn.1/asn1_k_encode.c
@@ -1,7 +1,7 @@
 /*
  * src/lib/krb5/asn.1/asn1_k_encode.c
  * 
- * Copyright 1994 by the Massachusetts Institute of Technology.
+ * Copyright 1994, 2008 by the Massachusetts Institute of Technology.
  * All Rights Reserved.
  *
  * Export of this software from the United States of America may
@@ -1004,6 +1004,7 @@ asn1_error_code asn1_encode_krb_saved_safe_body(asn1buf *buf, const krb5_data *b
   return 0;
 }
 
+#ifndef DISABLE_PKINIT
 /*
  * PKINIT
  */
@@ -1393,3 +1394,4 @@ asn1_error_code asn1_encode_typed_data(asn1buf *buf, const krb5_typed_data *val,
   asn1_makeseq();
   asn1_cleanup();
 }
+#endif /* DISABLE_PKINIT */
diff --git a/src/lib/krb5/os/accessor.c b/src/lib/krb5/os/accessor.c
index d4637699c..cd345ff56 100644
--- a/src/lib/krb5/os/accessor.c
+++ b/src/lib/krb5/os/accessor.c
@@ -1,7 +1,7 @@
 /*
  * lib/krb5/os/accessor.c
  *
- * Copyright 1990 by the Massachusetts Institute of Technology.
+ * Copyright 1990, 2008 by the Massachusetts Institute of Technology.
  * All Rights Reserved.
  *
  * Export of this software from the United States of America may
@@ -57,59 +57,70 @@ krb5int_accessor(krb5int_access *internals, krb5_int32 version)
 	    S (arcfour_enc_provider, &krb5int_enc_arcfour),
 	    S (sendto_udp, &krb5int_sendto),
 	    S (add_host_to_list, krb5int_add_host_to_list),
+
 #ifdef KRB5_DNS_LOOKUP
-	    S (make_srv_query_realm, krb5int_make_srv_query_realm),
-	    S (free_srv_dns_data, krb5int_free_srv_dns_data),
-	    S (use_dns_kdc, _krb5_use_dns_kdc),
-#else
-	    S (make_srv_query_realm, 0),
-	    S (free_srv_dns_data, 0),
-	    S (use_dns_kdc, 0),
+#define SC(FIELD, VAL)	S(FIELD, VAL)
+#else /* disable */
+#define SC(FIELD, VAL)	S(FIELD, 0)
 #endif
+	    SC (make_srv_query_realm, krb5int_make_srv_query_realm),
+	    SC (free_srv_dns_data, krb5int_free_srv_dns_data),
+	    SC (use_dns_kdc, _krb5_use_dns_kdc),
+#undef SC
+
 #ifdef KRB5_KRB4_COMPAT
-	    S (krb_life_to_time, krb5int_krb_life_to_time),
-	    S (krb_time_to_life, krb5int_krb_time_to_life),
-	    S (krb524_encode_v4tkt, krb5int_encode_v4tkt),
-#else
-	    S (krb_life_to_time, 0),
-	    S (krb_time_to_life, 0),
-	    S (krb524_encode_v4tkt, 0),
+#define SC(FIELD, VAL)	S(FIELD, VAL)
+#else /* disable */
+#define SC(FIELD, VAL)	S(FIELD, 0)
 #endif
+	    SC (krb_life_to_time, krb5int_krb_life_to_time),
+	    SC (krb_time_to_life, krb5int_krb_time_to_life),
+	    SC (krb524_encode_v4tkt, krb5int_encode_v4tkt),
+#undef SC
+
 	    S (krb5int_c_mandatory_cksumtype, krb5int_c_mandatory_cksumtype),
 	    S (krb5_ser_pack_int64, krb5_ser_pack_int64),
 	    S (krb5_ser_unpack_int64, krb5_ser_unpack_int64),
 	    S (asn1_ldap_encode_sequence_of_keys, krb5int_ldap_encode_sequence_of_keys),
 	    S (asn1_ldap_decode_sequence_of_keys, krb5int_ldap_decode_sequence_of_keys),
-	    S (encode_krb5_pa_pk_as_req, encode_krb5_pa_pk_as_req),
-	    S (encode_krb5_pa_pk_as_req_draft9, encode_krb5_pa_pk_as_req_draft9),
-            S (encode_krb5_pa_pk_as_rep, encode_krb5_pa_pk_as_rep),
-	    S (encode_krb5_pa_pk_as_rep_draft9, encode_krb5_pa_pk_as_rep_draft9),
-	    S (encode_krb5_auth_pack, encode_krb5_auth_pack),
-	    S (encode_krb5_auth_pack_draft9, encode_krb5_auth_pack_draft9),
-	    S (encode_krb5_kdc_dh_key_info, encode_krb5_kdc_dh_key_info),
-	    S (encode_krb5_reply_key_pack, encode_krb5_reply_key_pack),
-	    S (encode_krb5_reply_key_pack_draft9, encode_krb5_reply_key_pack_draft9),
-	    S (encode_krb5_typed_data, encode_krb5_typed_data),
-	    S (encode_krb5_td_trusted_certifiers, encode_krb5_td_trusted_certifiers),
-	    S (encode_krb5_td_dh_parameters, encode_krb5_td_dh_parameters),
-	    S (decode_krb5_pa_pk_as_req, decode_krb5_pa_pk_as_req),
-	    S (decode_krb5_pa_pk_as_req_draft9, decode_krb5_pa_pk_as_req_draft9),
-	    S (decode_krb5_pa_pk_as_rep, decode_krb5_pa_pk_as_rep),
-	    S (decode_krb5_pa_pk_as_rep_draft9, decode_krb5_pa_pk_as_rep_draft9),
-	    S (decode_krb5_auth_pack, decode_krb5_auth_pack),
-	    S (decode_krb5_auth_pack_draft9, decode_krb5_auth_pack_draft9),
-	    S (decode_krb5_kdc_dh_key_info, decode_krb5_kdc_dh_key_info),
-	    S (decode_krb5_principal_name, decode_krb5_principal_name),
-	    S (decode_krb5_reply_key_pack, decode_krb5_reply_key_pack),
-	    S (decode_krb5_reply_key_pack_draft9, decode_krb5_reply_key_pack_draft9),
-	    S (decode_krb5_typed_data, decode_krb5_typed_data),
-	    S (decode_krb5_td_trusted_certifiers, decode_krb5_td_trusted_certifiers),
-	    S (decode_krb5_td_dh_parameters, decode_krb5_td_dh_parameters),
-	    S (decode_krb5_as_req, decode_krb5_as_req),
-	    S (encode_krb5_kdc_req_body, encode_krb5_kdc_req_body),
-	    S (krb5_free_kdc_req, krb5_free_kdc_req),
-	    S (krb5int_set_prompt_types, krb5int_set_prompt_types),
-	    S (encode_krb5_authdata_elt, encode_krb5_authdata_elt),
+
+#ifndef DISABLE_PKINIT
+#define SC(FIELD, VAL)	S(FIELD, VAL)
+#else /* disable */
+#define SC(FIELD, VAL)	S(FIELD, 0)
+#endif
+	    SC (encode_krb5_pa_pk_as_req, encode_krb5_pa_pk_as_req),
+	    SC (encode_krb5_pa_pk_as_req_draft9, encode_krb5_pa_pk_as_req_draft9),
+            SC (encode_krb5_pa_pk_as_rep, encode_krb5_pa_pk_as_rep),
+	    SC (encode_krb5_pa_pk_as_rep_draft9, encode_krb5_pa_pk_as_rep_draft9),
+	    SC (encode_krb5_auth_pack, encode_krb5_auth_pack),
+	    SC (encode_krb5_auth_pack_draft9, encode_krb5_auth_pack_draft9),
+	    SC (encode_krb5_kdc_dh_key_info, encode_krb5_kdc_dh_key_info),
+	    SC (encode_krb5_reply_key_pack, encode_krb5_reply_key_pack),
+	    SC (encode_krb5_reply_key_pack_draft9, encode_krb5_reply_key_pack_draft9),
+	    SC (encode_krb5_typed_data, encode_krb5_typed_data),
+	    SC (encode_krb5_td_trusted_certifiers, encode_krb5_td_trusted_certifiers),
+	    SC (encode_krb5_td_dh_parameters, encode_krb5_td_dh_parameters),
+	    SC (decode_krb5_pa_pk_as_req, decode_krb5_pa_pk_as_req),
+	    SC (decode_krb5_pa_pk_as_req_draft9, decode_krb5_pa_pk_as_req_draft9),
+	    SC (decode_krb5_pa_pk_as_rep, decode_krb5_pa_pk_as_rep),
+	    SC (decode_krb5_pa_pk_as_rep_draft9, decode_krb5_pa_pk_as_rep_draft9),
+	    SC (decode_krb5_auth_pack, decode_krb5_auth_pack),
+	    SC (decode_krb5_auth_pack_draft9, decode_krb5_auth_pack_draft9),
+	    SC (decode_krb5_kdc_dh_key_info, decode_krb5_kdc_dh_key_info),
+	    SC (decode_krb5_principal_name, decode_krb5_principal_name),
+	    SC (decode_krb5_reply_key_pack, decode_krb5_reply_key_pack),
+	    SC (decode_krb5_reply_key_pack_draft9, decode_krb5_reply_key_pack_draft9),
+	    SC (decode_krb5_typed_data, decode_krb5_typed_data),
+	    SC (decode_krb5_td_trusted_certifiers, decode_krb5_td_trusted_certifiers),
+	    SC (decode_krb5_td_dh_parameters, decode_krb5_td_dh_parameters),
+	    SC (decode_krb5_as_req, decode_krb5_as_req),
+	    SC (encode_krb5_kdc_req_body, encode_krb5_kdc_req_body),
+	    SC (krb5_free_kdc_req, krb5_free_kdc_req),
+	    SC (krb5int_set_prompt_types, krb5int_set_prompt_types),
+	    SC (encode_krb5_authdata_elt, encode_krb5_authdata_elt),
+#undef SC
+
 #if DESIGNATED_INITIALIZERS
 	};
 #else