From: Viktor Szakats <commit@vsz.me>
Date: Fri, 10 Oct 2025 01:09:16 +0000 (+0200)
Subject: kerberos: bump minimum to 1.3 (2003-07-08), drop legacy logic
X-Git-Tag: rc-8_17_0-1~15
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0855f3070931c57c27180c48f7ada0336be977fc;p=thirdparty%2Fcurl.git

kerberos: bump minimum to 1.3 (2003-07-08), drop legacy logic

Previous minimum was: 1.2.4 (2002-02-28)

- assume `gssapi/gssapi.h` header for MIT Kerberos.

  Drop logic detecting this header, and drop alternate logic including
  a bare "gssapi.h". Bare `gssapi.h` is Heimdal-specific. MIT Kerberos
  added support for it for Heimdal compatibility on 2006-11-09,
  redirecting to `gssapi/gssapi.h`. MIT Kerberos supported the latter
  header in the 1990s already.

  Ref: 40e1a016f92903c731f07325bc1f9c6416ae1ac3 (2008-03-06)
  Ref: https://github.com/krb5/krb5/commit/d11935200186040132e05e2beaaba20a770ee3ef (2006-11-09)

- configure.ac: stop using `HAVE_GSSAPI_GSSAPI_H`.

  Added in 2010 to support "ancient distros such as RHEL-3" where
  `gssapi/gssapi_krb5.h` did not include `gssapi/gssapi.h`.

  MIT Kerberos includes it since commit:
  https://github.com/krb5/krb5/commit/d9e959edfa8da7cab3bde96c9c4ca39beaf8db69 (2003-03-06)
  Released in 1.3 (2003-07-08).

  Bump minimum required version to avoid this issue.

  Reverts cca192e58f9ed7c4b33c1c991f69ff830c58b38f (2010-04-16)

Ref: https://web.mit.edu/kerberos/dist/historic.html
Ref: https://sources.debian.org/src/krb5/

Closes #18992
---

diff --git a/.github/scripts/cmp-config.pl b/.github/scripts/cmp-config.pl
index 4284fcaee7..3ad0570e28 100755
--- a/.github/scripts/cmp-config.pl
+++ b/.github/scripts/cmp-config.pl
@@ -46,6 +46,7 @@ my %remove = (
     '#define HAVE_BROTLI_DECODE_H 1' => 1,
     '#define HAVE_DLFCN_H 1' => 1,
     '#define HAVE_GSSAPI_GSSAPI_GENERIC_H 1' => 1,
+    '#define HAVE_GSSAPI_GSSAPI_H 1' => 1,
     '#define HAVE_GSSAPI_GSSAPI_KRB5_H 1' => 1,
     '#define HAVE_INTTYPES_H 1' => 1,
     '#define HAVE_LDAP_H 1' => 1,
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 387dd57dc2..b48b045284 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1442,11 +1442,6 @@ if(CURL_USE_GSSAPI)
 
     if(GSS_FLAVOUR STREQUAL "GNU")
       set(HAVE_GSSGNU 1)
-    else()  # MIT
-      cmake_push_check_state()
-      list(APPEND CMAKE_REQUIRED_INCLUDES "${GSS_INCLUDE_DIRS}")
-      check_include_file("gssapi/gssapi.h" HAVE_GSSAPI_GSSAPI_H)
-      cmake_pop_check_state()
     endif()
   else()
     message(WARNING "GSSAPI has been requested, but no supporting libraries found. Skipping.")
diff --git a/configure.ac b/configure.ac
index c8843b5b46..0880552cfb 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1841,17 +1841,10 @@ if test x"$want_gss" = xyes; then
     ],
     [
       dnl not found, check for MIT
-      AC_CHECK_HEADERS([gssapi/gssapi.h], [], [not_mit=1])
       AC_CHECK_HEADERS(
-        [gssapi/gssapi_generic.h gssapi/gssapi_krb5.h],
+        [gssapi/gssapi.h gssapi/gssapi_generic.h gssapi/gssapi_krb5.h],
         [],
-        [not_mit=1],
-        [
-          AC_INCLUDES_DEFAULT
-          #ifdef HAVE_GSSAPI_GSSAPI_H
-          #include <gssapi/gssapi.h>
-          #endif
-        ])
+        [not_mit=1])
       if test "x$not_mit" = "x1"; then
         dnl MIT not found
         AC_MSG_ERROR([MIT or GNU GSS library required, but not found])
diff --git a/docs/INTERNALS.md b/docs/INTERNALS.md
index 3ad1b3e8c2..b6b00e924a 100644
--- a/docs/INTERNALS.md
+++ b/docs/INTERNALS.md
@@ -35,7 +35,7 @@ versions of libs and build tools.
  - libidn2      2.0.0
  - wolfSSL      3.4.6
  - OpenLDAP     2.0
- - MIT Kerberos 1.2.4
+ - MIT Kerberos 1.3
  - nghttp2      1.15.0
 
 ## Build tools
diff --git a/lib/curl_config.h.cmake b/lib/curl_config.h.cmake
index 3f0bcf22ee..be6fe4176e 100644
--- a/lib/curl_config.h.cmake
+++ b/lib/curl_config.h.cmake
@@ -315,9 +315,6 @@
 /* if you have the gssapi libraries */
 #cmakedefine HAVE_GSSAPI 1
 
-/* Define to 1 if you have the <gssapi/gssapi.h> header file. */
-#cmakedefine HAVE_GSSAPI_GSSAPI_H 1
-
 /* if you have the GNU gssapi libraries */
 #cmakedefine HAVE_GSSGNU 1
 
diff --git a/lib/urldata.h b/lib/urldata.h
index cdf028853e..b6b8f6f8fe 100644
--- a/lib/urldata.h
+++ b/lib/urldata.h
@@ -190,10 +190,8 @@ typedef CURLcode (Curl_recv)(struct Curl_easy *data,   /* transfer */
 #ifdef HAVE_GSSAPI
 # ifdef HAVE_GSSGNU
 #  include <gss.h>
-# elif defined HAVE_GSSAPI_GSSAPI_H
-#  include <gssapi/gssapi.h>
 # else
-#  include <gssapi.h>
+#  include <gssapi/gssapi.h>
 # endif
 #endif
 
diff --git a/lib/vauth/vauth.h b/lib/vauth/vauth.h
index 26e5adc628..9a33ca0c23 100644
--- a/lib/vauth/vauth.h
+++ b/lib/vauth/vauth.h
@@ -236,10 +236,8 @@ CURLcode Curl_auth_create_xoauth_bearer_message(const char *user,
 #ifdef HAVE_GSSAPI
 # ifdef HAVE_GSSGNU
 #  include <gss.h>
-# elif defined HAVE_GSSAPI_GSSAPI_H
-#  include <gssapi/gssapi.h>
 # else
-#  include <gssapi.h>
+#  include <gssapi/gssapi.h>
 # endif
 #endif