Backport from RT#7682

- pull up changes to allow GSSAPI modules to provide more functions (RT#7682, #986564/#986565)

3 files changed, 85 insertions, 1 deletions

diff --git a/krb5-1.11-gss-methods1.patch b/krb5-1.11-gss-methods1.patch
new file mode 100644
index 0000000..ad7b07f
--- /dev/null
+++ b/krb5-1.11-gss-methods1.patch
@@ -0,0 +1,38 @@
+commit ee53a887bead08ec1354de3e74659da537f87515
+Author: Simo Sorce <simo@redhat.com>
+Date:   Sat Jul 20 13:19:19 2013 -0400
+
+    Load cred store functions from GSS modules
+    
+    When the credential store feature was implement the related functions
+    were added to struct gss_config, but the initialization function that
+    dynamically loads modules was not changed to see if the plugin being
+    loaded provided such functions.
+    
+    This will allow non-builtin mechanism and interposer mechanism to
+    implement custom credential store extensions if they wish.
+    
+    ticket: 7682
+
+diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c
+index f5b8b15..70cc4ee 100644
+--- a/src/lib/gssapi/mechglue/g_initialize.c
++++ b/src/lib/gssapi/mechglue/g_initialize.c
+@@ -680,6 +680,8 @@ build_dynamicMech(void *dl, const gss_OID mech_type)
+         GSS_ADD_DYNAMIC_METHOD_NOLOOP(dl, mech, gss_inquire_mech_for_saslname);
+         /* RFC 5587 */
+         GSS_ADD_DYNAMIC_METHOD_NOLOOP(dl, mech, gss_inquire_attrs_for_mech);
++	GSS_ADD_DYNAMIC_METHOD(dl, mech, gss_acquire_cred_from);
++	GSS_ADD_DYNAMIC_METHOD(dl, mech, gss_store_cred_into);
+ 	GSS_ADD_DYNAMIC_METHOD(dl, mech, gssspi_acquire_cred_with_password);
+ 	GSS_ADD_DYNAMIC_METHOD(dl, mech, gssspi_import_sec_context_by_mech);
+ 	GSS_ADD_DYNAMIC_METHOD(dl, mech, gssspi_import_name_by_mech);
+@@ -778,6 +780,8 @@ build_interMech(void *dl, const gss_OID mech_type)
+ 	RESOLVE_GSSI_SYMBOL(dl, mech, gss, _inquire_mech_for_saslname);
+ 	/* RFC 5587 */
+ 	RESOLVE_GSSI_SYMBOL(dl, mech, gss, _inquire_attrs_for_mech);
++	RESOLVE_GSSI_SYMBOL(dl, mech, gss, _acquire_cred_from);
++	RESOLVE_GSSI_SYMBOL(dl, mech, gss, _store_cred_into);
+ 	RESOLVE_GSSI_SYMBOL(dl, mech, gssspi, _acquire_cred_with_password);
+ 	RESOLVE_GSSI_SYMBOL(dl, mech, gssspi, _import_sec_context_by_mech);
+ 	RESOLVE_GSSI_SYMBOL(dl, mech, gssspi, _import_name_by_mech);
diff --git a/krb5-1.11-gss-methods2.patch b/krb5-1.11-gss-methods2.patch
new file mode 100644
index 0000000..6d6e620
--- /dev/null
+++ b/krb5-1.11-gss-methods2.patch
@@ -0,0 +1,38 @@
+commit 744d6f873393b6bbd12e1c1884738676a089fa65
+Author: Simo Sorce <simo@redhat.com>
+Date:   Sat Jul 20 13:20:43 2013 -0400
+
+    Load import/export cred functions from GSS modules
+    
+    When the import/export credential feature was implement the related
+    functions were added to struct gss_config, but the initialization
+    function that dynamically loads modules was not changed to see if
+    the plugin being loaded provided such functions.
+    
+    This will allow non-builtin mechanism and interposer mechanism to
+    implement custom import/export credential extensions if they wish.
+    
+    ticket: 7682
+
+diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c
+index 70cc4ee..48a825e 100644
+--- a/src/lib/gssapi/mechglue/g_initialize.c
++++ b/src/lib/gssapi/mechglue/g_initialize.c
+@@ -683,6 +683,8 @@ build_dynamicMech(void *dl, const gss_OID mech_type)
+ 	GSS_ADD_DYNAMIC_METHOD(dl, mech, gss_acquire_cred_from);
+ 	GSS_ADD_DYNAMIC_METHOD(dl, mech, gss_store_cred_into);
+ 	GSS_ADD_DYNAMIC_METHOD(dl, mech, gssspi_acquire_cred_with_password);
++	GSS_ADD_DYNAMIC_METHOD(dl, mech, gss_export_cred);
++	GSS_ADD_DYNAMIC_METHOD(dl, mech, gss_import_cred);
+ 	GSS_ADD_DYNAMIC_METHOD(dl, mech, gssspi_import_sec_context_by_mech);
+ 	GSS_ADD_DYNAMIC_METHOD(dl, mech, gssspi_import_name_by_mech);
+ 	GSS_ADD_DYNAMIC_METHOD(dl, mech, gssspi_import_cred_by_mech);
+@@ -783,6 +785,8 @@ build_interMech(void *dl, const gss_OID mech_type)
+ 	RESOLVE_GSSI_SYMBOL(dl, mech, gss, _acquire_cred_from);
+ 	RESOLVE_GSSI_SYMBOL(dl, mech, gss, _store_cred_into);
+ 	RESOLVE_GSSI_SYMBOL(dl, mech, gssspi, _acquire_cred_with_password);
++	RESOLVE_GSSI_SYMBOL(dl, mech, gss, _export_cred);
++	RESOLVE_GSSI_SYMBOL(dl, mech, gss, _import_cred);
+ 	RESOLVE_GSSI_SYMBOL(dl, mech, gssspi, _import_sec_context_by_mech);
+ 	RESOLVE_GSSI_SYMBOL(dl, mech, gssspi, _import_name_by_mech);
+ 	RESOLVE_GSSI_SYMBOL(dl, mech, gssspi, _import_cred_by_mech);
diff --git a/krb5.spec b/krb5.spec
index ff92bdb..3dc8ea9 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -30,7 +30,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.11.3
-Release: 4%{?dist}
+Release: 5%{?dist}
 # Maybe we should explode from the now-available-to-everybody tarball instead?
 # http://web.mit.edu/kerberos/dist/krb5/1.11/krb5-1.11.3-signed.tar
 Source0: krb5-%{version}.tar.gz
@@ -90,6 +90,8 @@ Patch128: krb5-master-test_no_pmap.patch
 Patch129: krb5-1.11-run_user_0.patch
 Patch130: krb5-master-init_referral.patch
 Patch131: krb5-1.11.3-skew3.patch
+Patch132: krb5-1.11-gss-methods1.patch
+Patch133: krb5-1.11-gss-methods2.patch 
 
 # Patches for otp plugin backport
 Patch201: krb5-1.11.2-keycheck.patch
@@ -317,6 +319,8 @@ ln -s NOTICE LICENSE
 %patch129 -p1 -b .run_user_0
 %patch130 -p1 -b .init_referral
 %patch131 -p1 -b .skew3
+%patch132 -p1 -b .gss-methods1
+%patch133 -p1 -b .gss-methods2
 
 %patch201 -p1 -b .keycheck
 %patch202 -p1 -b .otp
@@ -864,6 +868,10 @@ exit 0
 %{_sbindir}/uuserver
 
 %changelog
+* Mon Jul 22 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.3-5
+- pull up changes to allow GSSAPI modules to provide more functions
+  (RT#7682, #986564/#986565)
+
 * Fri Jul 19 2013 Nalin Dahyabhai <nalin@redhat.com> 1.11.3-4
 - use (a bundled, for now, copy of) nss_wrapper to let us run some of the
   self-tests at build-time in more places than we could previously (#978756)