Skip to content

Commit 6932241

Browse files
bjoribjori
committed
CDRIVER-2170 Refactor Cyrus-SASL & Bootstrap RFC compliant GSS-API support
1 parent 9982861 commit 6932241

25 files changed

+1107
-671
lines changed

‎CMakeLists.txt

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ set (ENABLE_SSL AUTO CACHE STRING
1111

1212
set (ENABLE_SASL AUTO CACHE STRING
1313
"Enable SASL authentication (Kerberos).\ Options are \"CYRUS\" to use Cyrus
14-
SASL, \"SSPI\" to use Windows Native SSPI, \"AUTO\",\ or \"OFF\". These
15-
options are case-sensitive.")
14+
SASL, \"SSPI\" to use Windows Native SSPI, \"GSSAPI\" to use macOS Native GSS,
15+
\"AUTO\",\ or \"OFF\". These options are case-sensitive.")
1616
option(ENABLE_TESTS "Build MongoDB C Driver tests." ON)
1717
option(ENABLE_EXAMPLES "Build MongoDB C Driver examples." ON)
1818
option(ENABLE_AUTOMATIC_INIT_AND_CLEANUP "Enable automatic init and cleanup (GCC only)" ON)
@@ -164,16 +164,18 @@ if (NOT MONGOC_HAVE_ASN1_STRING_GET0_DATA)
164164
endif ()
165165

166166
if (NOT (ENABLE_SASL STREQUAL CYRUS
167+
OR ENABLE_SASL STREQUAL GSSAPI
167168
OR ENABLE_SASL STREQUAL SSPI
168169
OR ENABLE_SASL STREQUAL AUTO
169170
OR ENABLE_SASL STREQUAL OFF))
170171
message (FATAL_ERROR
171-
"ENABLE_SASL option must be CYRUS, SSPI, AUTO, or OFF")
172+
"ENABLE_SASL option must be CYRUS, GSSAPI, SSPI, AUTO, or OFF")
172173
endif()
173174

174175
# Defaults.
175176
set (MONGOC_ENABLE_SASL 0)
176177
set (MONGOC_ENABLE_SASL_CYRUS 0)
178+
set (MONGOC_ENABLE_SASL_GSSAPI 0)
177179
set (MONGOC_ENABLE_SASL_SSPI 0)
178180
set (MONGOC_HAVE_SASL_CLIENT_DONE 0)
179181

@@ -189,6 +191,9 @@ if (NOT ENABLE_SASL STREQUAL OFF)
189191
elseif ((ENABLE_SASL STREQUAL SSPI OR ENABLE_SASL STREQUAL AUTO) AND WIN32)
190192
set (MONGOC_ENABLE_SASL 1)
191193
set (MONGOC_ENABLE_SASL_SSPI 1)
194+
elseif ((ENABLE_SASL STREQUAL GSSAPI OR ENABLE_SASL STREQUAL AUTO) AND DARWIN)
195+
set (MONGOC_ENABLE_SASL 1)
196+
set (MONGOC_ENABLE_SASL_GSSAPI 1)
192197
endif ()
193198
else ()
194199
set (MONGOC_ENABLE_SASL 0)
@@ -498,15 +503,26 @@ endif () # ENABLE_SSL
498503

499504
if (MONGOC_ENABLE_SASL)
500505
set (SOURCES ${SOURCES} ${SOURCE_DIR}/src/mongoc/mongoc-cluster-sasl.c)
506+
set (SOURCES ${SOURCES} ${SOURCE_DIR}/src/mongoc/mongoc-sasl.c)
501507
if (MONGOC_ENABLE_SASL_CYRUS)
502508
message (STATUS "Compiling against Cyrus SASL")
503-
set (SOURCES ${SOURCES} ${SOURCE_DIR}/src/mongoc/mongoc-sasl.c)
509+
set (SOURCES ${SOURCES} ${SOURCE_DIR}/src/mongoc/mongoc-cluster-cyrus.c)
510+
set (SOURCES ${SOURCES} ${SOURCE_DIR}/src/mongoc/mongoc-cyrus.c)
504511
include_directories(${SASL_INCLUDE_DIRS})
505512
elseif (MONGOC_ENABLE_SASL_SSPI)
506513
message (STATUS "Compiling against Windows SSPI")
507514
set (SOURCES ${SOURCES} ${SOURCE_DIR}/src/mongoc/mongoc-cluster-sspi.c)
508515
set (SOURCES ${SOURCES} ${SOURCE_DIR}/src/mongoc/mongoc-sspi.c)
509516
set (SASL_LIBS secur32.lib crypt32.lib Shlwapi.lib)
517+
elseif (MONGOC_ENABLE_SASL_GSSAPI)
518+
set (SOURCES ${SOURCES} ${SOURCE_DIR}/src/mongoc/mongoc-cluster-gssapi.c)
519+
set (SOURCES ${SOURCES} ${SOURCE_DIR}/src/mongoc/mongoc-gssapi.c)
520+
if (APPLE)
521+
message (STATUS "Compiling against macOS GSS")
522+
set (LIBS ${LIBS} -framework GSS)
523+
else ()
524+
message (FATAL_ERROR "gssapi missing krb5-config support in cmake")
525+
endif()
510526
endif()
511527
else()
512528
message (STATUS "SASL disabled")
@@ -649,7 +665,7 @@ endif()
649665

650666
if (MONGOC_ENABLE_SASL)
651667
set(test-libmongoc-sources ${test-libmongoc-sources}
652-
${SOURCE_DIR}/tests/test-sasl.c
668+
${SOURCE_DIR}/tests/test-cyrus.c
653669
)
654670
endif ()
655671

‎build/autotools/CheckSasl.m4

Lines changed: 77 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -7,33 +7,67 @@ AC_ARG_ENABLE([sasl],
77
sasl_mode=no
88

99
AS_IF([test "$enable_sasl" != "no"],[
10-
PKG_CHECK_MODULES(SASL, [libsasl2], [sasl_mode=sasl2], [
11-
AS_IF([test "$enable_sasl" != "no"],[
12-
AC_CHECK_LIB([sasl2],[sasl_client_init],[have_sasl2_lib=yes],[have_sasl2_lib=no])
13-
AC_CHECK_LIB([sasl],[sasl_client_init],[have_sasl_lib=yes],[have_sasl_lib=no])
14-
if test "$have_sasl_lib" = "no" -a "$have_sasl2_lib" = "no" -a "$enable_sasl" = "yes" ; then
15-
AC_MSG_ERROR([You must install the Cyrus SASL libraries and development headers to enable SASL support.])
16-
fi
10+
AS_IF(
11+
[test "$enable_sasl" = "gssapi"],
12+
[
13+
sasl_mode=gssapi
14+
AS_IF(
15+
[test "$os_darwin" = "yes"],
16+
[SASL_LIBS="-framework GSS"],
17+
[
18+
AC_CHECK_HEADERS(
19+
[gssapi/gssapi.h],
20+
[have_gssapi_headers=yes],
21+
[have_gssapi_headers=no]
22+
)
23+
PKG_CHECK_MODULES(KRB5_GSSAPI,
24+
[krb5-gssapi],
25+
[have_krb5_gssapi=yes],
26+
[have_krb5_gssapi=no]
27+
)
28+
if test "$have_gssapi_headers" = "no" -o "$have_krb5_gssapi" = "no"; then
29+
AC_MSG_ERROR([You must install the krb5 libraries and development headers to enable GSSAPI support.])
30+
fi
31+
SASL_CFLAGS=$KRB5_GSSAPI_CFLAGS
32+
SASL_LIBS=$KRB5_GSSAPI_LIBS
33+
]
34+
)
35+
],
36+
[
37+
PKG_CHECK_MODULES(SASL,
38+
[libsasl2],
39+
[sasl_mode=sasl2],
40+
[
41+
AS_IF([test "$enable_sasl" != "no"],
42+
[
43+
AC_CHECK_LIB([sasl2],[sasl_client_init],[have_sasl2_lib=yes],[have_sasl2_lib=no])
44+
AC_CHECK_LIB([sasl],[sasl_client_init],[have_sasl_lib=yes],[have_sasl_lib=no])
45+
if test "$have_sasl_lib" = "no" -a "$have_sasl2_lib" = "no" -a "$enable_sasl" = "yes" ; then
46+
AC_MSG_ERROR([You must install the Cyrus SASL libraries and development headers to enable SASL support.])
47+
fi
1748
18-
old_CFLAGS=$CFLAGS
19-
CFLAGS=$SASL_CFLAGS
20-
AC_CHECK_HEADER([sasl/sasl.h],[have_sasl_headers=yes],[have_sasl_headers=no])
21-
if test "$have_sasl_headers" = "no" -a "$enable_sasl" = "yes" ; then
22-
AC_MSG_ERROR([You must install the Cyrus SASL development headers to enable SASL support.])
23-
fi
24-
CFLAGS=$old_CFLAGS
49+
old_CFLAGS=$CFLAGS
50+
CFLAGS=$SASL_CFLAGS
51+
AC_CHECK_HEADER([sasl/sasl.h],[have_sasl_headers=yes],[have_sasl_headers=no])
52+
if test "$have_sasl_headers" = "no" -a "$enable_sasl" = "yes" ; then
53+
AC_MSG_ERROR([You must install the Cyrus SASL development headers to enable SASL support.])
54+
fi
55+
CFLAGS=$old_CFLAGS
2556
26-
if test "$have_sasl_headers" -a "$have_sasl2_lib" = "yes" ; then
27-
sasl_mode=sasl2
28-
SASL_LIBS=-lsasl2
29-
fi
57+
if test "$have_sasl_headers" -a "$have_sasl2_lib" = "yes" ; then
58+
sasl_mode=sasl2
59+
SASL_LIBS=-lsasl2
60+
fi
3061
31-
if test "$have_sasl_headers" -a "$have_sasl_lib" = "yes" ; then
32-
sasl_mode=sasl
33-
SASL_LIBS=-lsasl
34-
fi
35-
])
36-
])
62+
if test "$have_sasl_headers" -a "$have_sasl_lib" = "yes" ; then
63+
sasl_mode=sasl
64+
SASL_LIBS=-lsasl
65+
fi
66+
])
67+
]
68+
)
69+
]
70+
)
3771
])
3872

3973
if test "$enable_sasl" = "auto" -a "$sasl_mode" != "no"; then
@@ -48,28 +82,38 @@ if test "$enable_sasl" = "auto" -a "$sasl_mode" != "no"; then
4882
fi
4983

5084
AM_CONDITIONAL([ENABLE_SASL], [test "$sasl_mode" != "no"])
85+
AM_CONDITIONAL([ENABLE_SASL_GSSAPI], [test "$sasl_mode" = "gssapi"])
86+
AM_CONDITIONAL([ENABLE_SASL_CYRUS], [test "$sasl_mode" = "sasl" -o "$sasl_mode" = "sasl2"])
87+
AM_CONDITIONAL([ENABLE_SASL_SSPI], false)
88+
5189
AC_SUBST(SASL_CFLAGS)
5290
AC_SUBST(SASL_LIBS)
5391

5492
dnl Let mongoc-config.h.in know about SASL status.
5593
if test "$sasl_mode" != "no" ; then
5694
AC_SUBST(MONGOC_ENABLE_SASL, 1)
57-
AC_SUBST(MONGOC_ENABLE_SASL_CYRUS, 1)
5895
AC_SUBST(MONGOC_ENABLE_SASL_SSPI, 0)
59-
60-
AC_CHECK_LIB([sasl2],[sasl_client_done],
61-
[have_sasl_client_done=yes],
62-
[have_sasl_client_done=no])
63-
64-
if test "$have_sasl_client_done" = "yes" ; then
65-
AC_SUBST(MONGOC_HAVE_SASL_CLIENT_DONE, 1)
66-
else
96+
if test "$sasl_mode" = "gssapi" ; then
97+
AC_SUBST(MONGOC_ENABLE_SASL_GSSAPI, 1)
98+
AC_SUBST(MONGOC_ENABLE_SASL_CYRUS, 0)
6799
AC_SUBST(MONGOC_HAVE_SASL_CLIENT_DONE, 0)
100+
else
101+
AC_SUBST(MONGOC_ENABLE_SASL_GSSAPI, 0)
102+
AC_SUBST(MONGOC_ENABLE_SASL_CYRUS, 1)
103+
AC_CHECK_LIB([sasl2],[sasl_client_done],
104+
[have_sasl_client_done=yes],
105+
[have_sasl_client_done=no])
106+
if test "$have_sasl_client_done" = "yes" ; then
107+
AC_SUBST(MONGOC_HAVE_SASL_CLIENT_DONE, 1)
108+
else
109+
AC_SUBST(MONGOC_HAVE_SASL_CLIENT_DONE, 0)
110+
fi
68111
fi
69112

70113
else
71114
AC_SUBST(MONGOC_ENABLE_SASL, 0)
72115
AC_SUBST(MONGOC_ENABLE_SASL_CYRUS, 0)
116+
AC_SUBST(MONGOC_ENABLE_SASL_GSSAPI, 0)
73117
AC_SUBST(MONGOC_ENABLE_SASL_SSPI, 0)
74118
AC_SUBST(MONGOC_HAVE_SASL_CLIENT_DONE, 0)
75119
fi

‎examples/parse_handshake_cfg.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import sys
22

3-
# Should be in EXACT same order as from mongoc-handshake-private.h.
3+
# Should be in EXACT same order as from src/mongoc/mongoc-handshake-private.h.
44
# The values are implicit (so we assume 1st entry is 1 << 0,
55
# second entry is 1 << 1 and so on).
66
MD_FLAGS = [
@@ -25,6 +25,7 @@
2525
"MONGOC_MD_FLAG_ENABLE_COMPRESSION",
2626
"MONGOC_MD_FLAG_ENABLE_COMPRESSION_SNAPPY",
2727
"MONGOC_MD_FLAG_ENABLE_COMPRESSION_ZLIB",
28+
"MONGOC_MD_FLAG_ENABLE_SASL_GSSAPI",
2829
]
2930

3031
def main():

‎src/mongoc/Makefile.am

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ NOINST_H_FILES = \
7272
src/mongoc/mongoc-client-private.h \
7373
src/mongoc/mongoc-cluster-private.h \
7474
src/mongoc/mongoc-cluster-sasl-private.h \
75+
src/mongoc/mongoc-cluster-cyrus-private.h \
7576
src/mongoc/mongoc-cluster-sspi-private.h \
7677
src/mongoc/mongoc-collection-private.h \
7778
src/mongoc/mongoc-counters-private.h \
@@ -102,6 +103,8 @@ NOINST_H_FILES = \
102103
src/mongoc/mongoc-read-concern-private.h \
103104
src/mongoc/mongoc-read-prefs-private.h \
104105
src/mongoc/mongoc-rpc-private.h \
106+
src/mongoc/mongoc-cyrus-private.h \
107+
src/mongoc/mongoc-cluster-sspi-private.h \
105108
src/mongoc/mongoc-sasl-private.h \
106109
src/mongoc/mongoc-sspi-private.h \
107110
src/mongoc/mongoc-scram-private.h \
@@ -161,7 +164,6 @@ MONGOC_SOURCES_SHARED += \
161164
src/mongoc/mongoc-client.c \
162165
src/mongoc/mongoc-client-pool.c \
163166
src/mongoc/mongoc-cluster.c \
164-
src/mongoc/mongoc-cluster-sspi.c \
165167
src/mongoc/mongoc-collection.c \
166168
src/mongoc/mongoc-compression.c \
167169
src/mongoc/mongoc-counters.c \
@@ -193,7 +195,6 @@ MONGOC_SOURCES_SHARED += \
193195
src/mongoc/mongoc-server-stream.c \
194196
src/mongoc/mongoc-set.c \
195197
src/mongoc/mongoc-socket.c \
196-
src/mongoc/mongoc-sspi.c \
197198
src/mongoc/mongoc-stream.c \
198199
src/mongoc/mongoc-stream-buffered.c \
199200
src/mongoc/mongoc-stream-file.c \
@@ -263,6 +264,20 @@ if ENABLE_SASL
263264
MONGOC_SOURCES_SHARED += src/mongoc/mongoc-cluster-sasl.c
264265
MONGOC_SOURCES_SHARED += src/mongoc/mongoc-sasl.c
265266
endif
267+
if ENABLE_SASL_CYRUS
268+
MONGOC_SOURCES_SHARED += src/mongoc/mongoc-cluster-cyrus.c
269+
MONGOC_SOURCES_SHARED += src/mongoc/mongoc-cyrus.c
270+
endif
271+
272+
if ENABLE_SASL_SSPI
273+
MONGOC_SOURCES_SHARED += src/mongoc/mongoc-cluster-sspi.c
274+
MONGOC_SOURCES_SHARED += src/mongoc/mongoc-sspi.c
275+
endif
276+
277+
if ENABLE_SASL_GSSAPI
278+
MONGOC_SOURCES_SHARED += src/mongoc/mongoc-cluster-gssapi.c
279+
MONGOC_SOURCES_SHARED += src/mongoc/mongoc-gssapi.c
280+
endif
266281

267282
EXTRA_DIST += $(MONGOC_DEF_FILES) $(NOINST_H_FILES)
268283

‎src/mongoc/mongoc-cluster-cyrus-private.h

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
/*
2+
* Copyright 2017 MongoDB, Inc.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
#ifndef MONGOC_CLUSTER_CYRUS_PRIVATE_H
18+
#define MONGOC_CLUSTER_CYRUS_PRIVATE_H
19+
20+
#if !defined(MONGOC_COMPILATION)
21+
#error "Only <mongoc.h> can be included directly."
22+
#endif
23+
24+
#include "mongoc-config.h"
25+
#include "mongoc-cluster-private.h"
26+
#include <bson.h>
27+
28+
bool
29+
_mongoc_cluster_auth_node_cyrus (mongoc_cluster_t *cluster,
30+
mongoc_stream_t *stream,
31+
const char *hostname,
32+
bson_error_t *error);
33+
#endif /* MONGOC_CLUSTER_CYRUS_PRIVATE_H */

0 commit comments

Comments
 (0)