bind9 @9.8.1: Undefined symbols _krb5_gss_register_acceptor_identity on tiger

[webmaster@…]

Hello,

my 1st time here, so excuse me if the question is dumb :) I did install BIND 9.8.0 correctly some time ago, now I can't upgrade or install from scracth the 9.8.1 release on Tiger. I get the same errors on 2 differents machines.

At the end of the process, the errors are:

• in Terminal window:

  make[2]: *** [named] Error 1
  make[2]: Leaving directory `/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_net_bind9/bind9/work/bind-9.8.1/bin/named'
  make[1]: *** [subdirs] Error 1
  make[1]: Leaving directory `/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_net_bind9/bind9/work/bind-9.8.1/bin'
  make: *** [subdirs] Error 1
  make: Leaving directory `/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_net_bind9/bind9/work/bind-9.8.1'
  shell command " cd "/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_net_bind9/bind9/work/bind-9.8.1" && /usr/bin/make -w all " returned error 2
  Error: Target org.macports.build returned: shell command failed (see log for details)
  Warning: the following items did not execute (for bind9): org.macports.activate org.macports.build org.macports.destroot org.macports.install
  Log for bind9 is at: /opt/local/var/macports/logs/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_net_bind9/bind9/main.log
  Error: Status 1 encountered during processing.
  

• in the main.log :

  :info:build /usr/libexec/gcc/powerpc-apple-darwin8/4.0.1/ld: Undefined symbols:
  :info:build _krb5_gss_register_acceptor_identity
  :info:build collect2: ld returned 1 exit status
  :info:build make[2]: *** [named] Error 1
  :info:build make[2]: Leaving directory `/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_net_bind9/bind9/work/bind-9.8.1/bin/named'
  :info:build make[1]: *** [subdirs] Error 1
  :info:build make[1]: Leaving directory `/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_net_bind9/bind9/work/bind-9.8.1/bin'
  :info:build make: *** [subdirs] Error 1
  :info:build make: Leaving directory `/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_net_bind9/bind9/work/bind-9.8.1'
  :info:build shell command " cd "/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_net_bind9/bind9/work/bind-9.8.1" && /usr/bin/make -w all " returned error 2
  :error:build Target org.macports.build returned: shell command failed (see log for details)
  :debug:build Backtrace: shell command failed (see log for details)
      while executing
  "command_exec build"
      (procedure "portbuild::build_main" line 8)
      invoked from within
  "$procedure $targetname"
  :info:build Warning: the following items did not execute (for bind9): org.macports.activate org.macports.build org.macports.destroot org.macports.install
  

Please tell me what to do :)

Thanx Gabriel

[webmaster@…]

Cc Me!

[danielluke (Daniel J. Luke)]

A couple of things.

• It's difficult (if not impossible) to tell what is going on without the full build log being attached to the bug.
• 10.4 isn't a supported OS any more (and I don't have a 10.4 machine to test on any more), so it's unlikely that I'll be able to produce a patch to fix whatever the problem is.

However, if we can figure it out, I'd be happy to include a patch or whatever is needed to keep the port working on 10.4. From the little bit of log that you included, it looks like the problem has something to do with linking with the kerberos lib(s).

[webmaster@…]

BIND 9.8.1 install error

[webmaster@…]

Replying to dluke@…:

A couple of things.

• It's difficult (if not impossible) to tell what is going on without the full build log being attached to the bug.
• 10.4 isn't a supported OS any more (and I don't have a 10.4 machine to test on any more), so it's unlikely that I'll be able to produce a patch to fix whatever the problem is.

[cut]

Hello,

I attached the log, I hope you can find what's wrong :) The odd thing is that BIND 9.8.0P4 did work.

Thank you!

[webmaster@…]

Hello, do you need any other log to analyse and try to solve the problem?

Gabriel

[danielluke (Daniel J. Luke)]

Do you by any chance have some kerberos libraries installed in /usr/local?

The link line that is failing includes -lgssapi_krb5, which is where that missing symbol (_krb5_gss_register_acceptor_identity) should be found.

On 10.5 (ppc), it's clearly there:

% nm /usr/lib/libgssapi_krb5.dylib | grep _krb5_gss_register_acceptor_identity
200806f4 T _krb5_gss_register_acceptor_identity

Again, since this is an unsupported configuration - most likely you'll need to figure this out and provide a patch (which I will include if you can figure it out).

[webmaster@…]

Replying to dluke@…:

Do you by any chance have some kerberos libraries installed in /usr/local?

Using the same command as you did I get:

9549e018 t _krb5_gss_register_acceptor_identity

Gabriel

[sukh411@…]

Hi Gabriel, did you ever get a resolution to this? I've still got some tiger systems at my job i need to keep patched for various reasons and have run into this exact issue.

thanks, Sukh

[sukh411@…]

Cc Me!

[webmaster@…]

Replying to sukh411@…:

Hi Gabriel, did you ever get a resolution to this? I've still got some tiger systems at my job i need to keep patched for various reasons and have run into this exact issue.

Hi,

sorry for the delay but meanwhile my iMac G5 crashed badly (broken internal SATA interface, now it's working with an external FireWire disk, even if it's freezing sometimes). I really have no clue about how to fix the Bind or Kerberos installation, I'm not a programmer... If someone can explain me how to solve that issue, or need more infos about it, I'll be glad.

Now I'm going to reinstall MacPorts on this fresh HD and see if it works or not.

Gabriel

[macports-20081001@…]

Replying to webmaster@…:

Replying to dluke@…:

Do you by any chance have some kerberos libraries installed in /usr/local?

Using the same command as you did I get:

9549e018 t _krb5_gss_register_acceptor_identity

The lower case 't' indicates that it is a 'local' symbol rather than a global one as in 10.5. Complicating matters, the relevant header (/usr/include/gssapi/gssapi_krb5.h) defines krb5_gss_register_acceptor_identity so nothing fails until link time.

The best fix would be to replace the existing system Kerberos framework with a fixed version, which should be easy in theory since Apple's source for that is on opensource.apple.com, but in practice building from that source is a big headache.

A less ideal fix is to install the kerberos5 port and make bind9 link to it. That fix has this downside:

# port -dvu rdeps kerberos5
The following ports are dependencies of kerberos5 @1.7.2_0:
  bin:gpg:gnupg
    port:libiconv
      port:gperf
    port:gettext
      port:ncurses
      port:expat
    port:readline
    port:zlib
    port:bzip2
    port:libusb-compat
      port:pkgconfig
        path:lib/pkgconfig/glib-2.0.pc:glib2
          bin:xz:xz
          port:libffi
          path:bin/perl:perl5
            port:perl5.12
              port:gdbm
          port:python27
            port:openssl
            port:sqlite3
              port:libedit
            port:db46
            port:python_select
      port:libusb
    port:openldap
      port:tcp_wrappers
      port:cyrus-sasl2
      port:icu

So while it is not hard per se, it drags in all sorts of garbage that you may not need and which take a long time to install. Also: the port is orphaned and uses an obsolete version of krb5, so its isn't actually useful as a general replacement for the even older Tiger implementation.

And beyond that, with a current bind9 on Tiger one also needs to kill off the DLZ dlopen driver, since it won't build on 10.4. The Portfile already does that for 10.5.

So here's a patch for the Portfile, but be aware of the nasty dependency tree:

--- Portfile.orig	2012-05-22 11:00:31.000000000 -0400
+++ Portfile	2012-05-22 19:39:45.000000000 -0400
@@ -52,6 +52,16 @@
 				--enable-threads \
 				--enable-ipv6
 
+platform darwin 8 {
+	# link fails with the DLZ dlopen driver
+	configure.args-append --with-dlopen=no
+	# require and use GSSAPI support in ${prefix}/lib rather than /usr/lib where Tiger has symlinks to its broken Kerberos lib
+	depends_lib-append \
+		port:kerberos5
+	configure.args-append \
+		--with-gssapi=${prefix}
+}
+
 platform darwin 9 {
 	configure.args-append --with-dlopen=no
 }

[danielluke (Daniel J. Luke)]

Maybe the best of a bad set of choices is to just build without GSSAPI support on 10.4?

[danielluke (Daniel J. Luke)]

Replying to dluke@…:

Maybe the best of a bad set of choices is to just build without GSSAPI support on 10.4?

Earlier bind9 releases defaulted to gssapi support being off, so I've gone ahead and committed (r93467) a darwin 8 platform block that should disable gssapi and dlopen.

Can someone with a 10.4/darwin 8 machine please test and verify that this is working now?

Thanks.

[webmaster@…]

Replying to dluke@…:

Replying to dluke@…:

Maybe the best of a bad set of choices is to just build without GSSAPI support on 10.4?

Earlier bind9 releases defaulted to gssapi support being off, so I've gone ahead and committed (r93467) a darwin 8 platform block that should disable gssapi and dlopen.

Can someone with a 10.4/darwin 8 machine please test and verify that this is working now?

Hi,

I still have an old iBook with OSX 10.4 to try...

I did a 'selfupdate' to install the latest macports , then upgrade outdated and it installed correctly the latest Bind 9.9.1 GREAT :)

Where can I send you a beer? :)

Gabriel

ps: Nokian winter tyres are *great* , try them ;)