Pisilinux/core
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mit-kerberos move core libtirpc

Browse Source
This commit is contained in:
Rmys
2021-06-09 15:28:03 +03:00
parent 9a70061634
commit 025046d1f2
14 changed files with 747 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pisi-index.xml
+105
View File
@@ -20613,6 +20613,111 @@
</Update>
</History>
</SpecFile>
<SpecFile>
<Source>
<Name>mit-kerberos</Name>
<Homepage>http://web.mit.edu/kerberos/www/</Homepage>
<Packager>
<Name>PisiLinux Community</Name>
<Email>admins@pisilinux.org</Email>
</Packager>
<License>as-is</License>
<IsA>library</IsA>
<IsA>app:console</IsA>
<PartOf>system.base</PartOf>
<Summary xml:lang="en">MIT Kerberos Library</Summary>
<Summary xml:lang="tr">MIT Kerberos kütüphanesi</Summary>
<Description xml:lang="en">Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.</Description>
<Description xml:lang="tr">Kerberos bir ağ doğrulama protokolüdür. Sunucu/istemci uygulamalarında, gizli anahtar kriptoloji teknolojisini kullanarak, güçlü bir doğrulama sağlar.</Description>
<Archive type="targz" sha1sum="0c404b081db9c996c581f636ce450ee28778f338" name="krb5-1.17.tar.gz">http://web.mit.edu/kerberos/dist/krb5/1.17/krb5-1.17.tar.gz</Archive>
<BuildDependencies>
<Dependency>python3</Dependency>
<Dependency>keyutils</Dependency>
<Dependency>openssl-devel</Dependency>
<Dependency>e2fsprogs-devel</Dependency>
</BuildDependencies>
<Patches>
<Patch level="0">krb5-config_LDFLAGS.patch</Patch>
<Patch level="0">rebuild-configure-scripts.patch</Patch>
</Patches>
<SourceURI>system/base/mit-kerberos/pspec.xml</SourceURI>
</Source>
<Package>
<Name>mit-kerberos</Name>
<RuntimeDependencies>
<Dependency>keyutils</Dependency>
<Dependency>openssl</Dependency>
<Dependency>e2fsprogs</Dependency>
</RuntimeDependencies>
<Files>
<Path fileType="config">/etc</Path>
<Path fileType="data">/run/krb5kdc</Path>
<Path fileType="header">/usr/include</Path>
<Path fileType="executable">/usr/bin</Path>
<Path fileType="executable">/usr/sbin</Path>
<Path fileType="library">/usr/lib</Path>
<Path fileType="data">/usr/share</Path>
<Path fileType="data">/var/lib</Path>
<Path fileType="info">/usr/share/info</Path>
<Path fileType="man">/usr/share/man</Path>
</Files>
<AdditionalFiles>
<AdditionalFile target="/etc/krb5.conf" permission="0644" owner="root">krb5.conf</AdditionalFile>
<AdditionalFile target="/etc/kdc.conf" permission="0644" owner="root">kdc.conf</AdditionalFile>
</AdditionalFiles>
</Package>
<History>
<Update release="7">
<Date>2020-11-07</Date>
<Version>1.17</Version>
<Comment>Version bump</Comment>
<Name>Mustafa Cinasal</Name>
<Email>muscnsl@gmail.com</Email>
</Update>
<Update release="6">
<Date>2020-01-08</Date>
<Version>1.17</Version>
<Comment>Version bump</Comment>
<Name>Mustafa Cinasal</Name>
<Email>muscnsl@gmail.com</Email>
</Update>
<Update release="5">
<Date>2018-12-31</Date>
<Version>1.16</Version>
<Comment>Version bump</Comment>
<Name>Pisi Linux Community</Name>
<Email>admin@pisilinux.org</Email>
</Update>
<Update release="4">
<Date>2018-07-26</Date>
<Version>1.15</Version>
<Comment>Rebuild</Comment>
<Name>Pisi Linux Community</Name>
<Email>admin@pisilinux.org</Email>
</Update>
<Update release="3">
<Date>2017-02-17</Date>
<Version>1.15</Version>
<Comment>Version Bump</Comment>
<Name>Pisi Linux Community</Name>
<Email>admin@pisilinux.org</Email>
</Update>
<Update release="2">
<Date>2016-06-08</Date>
<Version>1.13.1</Version>
<Comment>Release Bump</Comment>
<Name>Pisi Linux Community</Name>
<Email>admin@pisilinux.org</Email>
</Update>
<Update release="1">
<Date>2015-04-23</Date>
<Version>1.13.1</Version>
<Comment>First release</Comment>
<Name>Ertuğrul Erata</Name>
<Email>ertugrulerata@gmail.com</Email>
</Update>
</History>
</SpecFile>
<SpecFile>
<Source>
<Name>python-psutil</Name>
pisi-index.xml.sha1sum
+1 -1
View File
@@ -1 +1 @@
9f3260bafb46ce0f9434b1a023a2605e5fe030e8
a71b4a64dd680dd4a8cd0e4db9282aaf7eaba865
pisi-index.xml.xz
BIN
View File
Binary file not shown.
pisi-index.xml.xz.sha1sum
+1 -1
View File
@@ -1 +1 @@
695fcc54ae376aeb2735dc81f6d7a59360c5df9e
df67cc8fe9658daf77235cf340b5501c9bf0ab91
system/base/mit-kerberos/actions.py
+87
View File
@@ -0,0 +1,87 @@
#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Licensed under the GNU General Public License, version 3.
# See the file http://www.gnu.org/licenses/gpl.txt
from pisi.actionsapi import get
from pisi.actionsapi import autotools
from pisi.actionsapi import pisitools
from pisi.actionsapi import shelltools
pisitools.flags.add("-fPIC -fno-strict-aliasing -fno-strict-overflow -fstack-protector-all")
pisitools.cxxflags.add("-I/usr/include/et")
def rename_man_pages():
manpages = ["appl/bsd/klogind.M",
"appl/bsd/kshd.M",
"appl/sample/sserver/sserver.M",
"appl/telnet/telnetd/telnetd.8",
"appl/gssftp/ftpd/ftpd.M",
"config-files/kdc.conf.M",
"config-files/krb5.conf.M",
"kadmin/cli/kadmin.M",
"slave/kpropd.M",
"slave/kprop.M"]
for manpage in manpages:
shelltools.move(manpage, "%s.in" % manpage)
def setup():
shelltools.cd("src")
shelltools.system("sed -i -e 's/^YYSTYPE yylval/&={0}/' lib/krb5/krb/deltat.c")
pisitools.dosed("util/ac_check_krb5.m4", "(KRB5ROOT=\/usr)\/local", r"\1")
#autotools.autoreconf("-fi")
# Fix pthread linking
#pisitools.dosed("configure", "-lthread", "-lpthread")
#pisitools.dosed("configure", "-pthread", "-lpthread")
autotools.configure("--localstatedir=/var/lib \
--without-tcl \
--without-hesiod \
--enable-shared \
--enable-kdc-lookaside-cache \
--without-system-verto \
--disable-rpath \
--with-system-et \
--with-system-ss \
--enable-dns-for-realm")
# Fix krb5-config script to remove rpaths and CFLAGS
#pisitools.dosed("krb5-config", "^CC_LINK=.*", "CC_LINK='$(CC) $(PROG_LIBPATH)'")
# Fix unused dependency
pisitools.dosed("config/shlib.conf"," -shared ", " -Wl,--as-needed -shared ")
def build():
autotools.make("-C src/")
# def check():
# check failed
# autotools.make("-C src/ -j1 check")
# import tempfile
# import shutil
# tmpdir = tempfile.mkdtemp(prefix='pisitest')
# autotools.make("-C src/ check TMPDIR=%s -j1" % tmpdir)
# shutil.rmtree("rm -rf %s" % tmpdir)
def install():
pisitools.dodoc("NOTICE", "README")
shelltools.cd("src")
autotools.rawInstall("DESTDIR=%s" % get.installDIR())
# Install additional headers
for d in ("kadm5", "krb5"):
pisitools.insinto("/usr/include/%s" % d, "include/%s/*.h" % d)
# Add "k" prefix to some apps and manpages to resolve conflicts
#for app in ["telnetd", "ftpd"]:
# pisitools.rename("/usr/share/man/man8/%s.8" % app, "k%s.8" % app)
# pisitools.rename("/usr/sbin/%s" % app, "k%s" % app)
#for app in ["rcp", "rsh", "telnet", "ftp", "rlogin"]:
# pisitools.rename("/usr/share/man/man1/%s.1" % app, "k%s.1" % app)
# pisitools.rename("/usr/bin/%s" % app, "k%s" % app)
# Remove examples
pisitools.removeDir("/usr/share/examples")
system/base/mit-kerberos/files/CVE-2018-5729-5730.patch
+297
View File
@@ -0,0 +1,297 @@
diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c
index 2420f2c2be..a59a65e8f6 100644
--- a/src/lib/kadm5/srv/svr_principal.c
+++ b/src/lib/kadm5/srv/svr_principal.c
@@ -330,6 +330,13 @@ kadm5_create_principal_3(void *server_handle,
return KADM5_BAD_MASK;
if((mask & ~ALL_PRINC_MASK))
return KADM5_BAD_MASK;
+ if (mask & KADM5_TL_DATA) {
+ for (tl_data_tail = entry->tl_data; tl_data_tail != NULL;
+ tl_data_tail = tl_data_tail->tl_data_next) {
+ if (tl_data_tail->tl_data_type < 256)
+ return KADM5_BAD_TL_TYPE;
+ }
+ }
/*
* Check to see if the principal exists
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
index 535a1f309e..8b8420faa9 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
+++ b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
@@ -141,7 +141,7 @@ extern int set_ldap_error (krb5_context ctx, int st, int op);
#define UNSTORE16_INT(ptr, val) (val = load_16_be(ptr))
#define UNSTORE32_INT(ptr, val) (val = load_32_be(ptr))
-#define KDB_TL_USER_INFO 0x7ffe
+#define KDB_TL_USER_INFO 0xff
#define KDB_TL_PRINCTYPE 0x01
#define KDB_TL_PRINCCOUNT 0x02
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
index 88a1704950..b7c9212cb2 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
@@ -651,6 +651,107 @@ update_ldap_mod_auth_ind(krb5_context context, krb5_db_entry *entry,
return ret;
}
+static krb5_error_code
+check_dn_in_container(krb5_context context, const char *dn,
+ char *const *subtrees, unsigned int ntrees)
+{
+ unsigned int i;
+ size_t dnlen = strlen(dn), stlen;
+
+ for (i = 0; i < ntrees; i++) {
+ if (subtrees[i] == NULL || *subtrees[i] == '\0')
+ return 0;
+ stlen = strlen(subtrees[i]);
+ if (dnlen >= stlen &&
+ strcasecmp(dn + dnlen - stlen, subtrees[i]) == 0 &&
+ (dnlen == stlen || dn[dnlen - stlen - 1] == ','))
+ return 0;
+ }
+
+ k5_setmsg(context, EINVAL, _("DN is out of the realm subtree"));
+ return EINVAL;
+}
+
+static krb5_error_code
+check_dn_exists(krb5_context context,
+ krb5_ldap_server_handle *ldap_server_handle,
+ const char *dn, krb5_boolean nonkrb_only)
+{
+ krb5_error_code st = 0, tempst;
+ krb5_ldap_context *ldap_context = context->dal_handle->db_context;
+ LDAP *ld = ldap_server_handle->ldap_handle;
+ LDAPMessage *result = NULL, *ent;
+ char *attrs[] = { "krbticketpolicyreference", "krbprincipalname", NULL };
+ char **values;
+
+ LDAP_SEARCH_1(dn, LDAP_SCOPE_BASE, 0, attrs, IGNORE_STATUS);
+ if (st != LDAP_SUCCESS)
+ return set_ldap_error(context, st, OP_SEARCH);
+
+ ent = ldap_first_entry(ld, result);
+ CHECK_NULL(ent);
+
+ values = ldap_get_values(ld, ent, "krbticketpolicyreference");
+ if (values != NULL)
+ ldap_value_free(values);
+
+ values = ldap_get_values(ld, ent, "krbprincipalname");
+ if (values != NULL) {
+ ldap_value_free(values);
+ if (nonkrb_only) {
+ st = EINVAL;
+ k5_setmsg(context, st, _("ldap object is already kerberized"));
+ goto cleanup;
+ }
+ }
+
+cleanup:
+ ldap_msgfree(result);
+ return st;
+}
+
+static krb5_error_code
+validate_xargs(krb5_context context,
+ krb5_ldap_server_handle *ldap_server_handle,
+ const xargs_t *xargs, const char *standalone_dn,
+ char *const *subtrees, unsigned int ntrees)
+{
+ krb5_error_code st;
+
+ if (xargs->dn != NULL) {
+ /* The supplied dn must be within a realm container. */
+ st = check_dn_in_container(context, xargs->dn, subtrees, ntrees);
+ if (st)
+ return st;
+ /* The supplied dn must exist without Kerberos attributes. */
+ st = check_dn_exists(context, ldap_server_handle, xargs->dn, TRUE);
+ if (st)
+ return st;
+ }
+
+ if (xargs->linkdn != NULL) {
+ /* The supplied linkdn must be within a realm container. */
+ st = check_dn_in_container(context, xargs->linkdn, subtrees, ntrees);
+ if (st)
+ return st;
+ /* The supplied linkdn must exist. */
+ st = check_dn_exists(context, ldap_server_handle, xargs->linkdn,
+ FALSE);
+ if (st)
+ return st;
+ }
+
+ if (xargs->containerdn != NULL && standalone_dn != NULL) {
+ /* standalone_dn (likely composed using containerdn) must be within a
+ * container. */
+ st = check_dn_in_container(context, standalone_dn, subtrees, ntrees);
+ if (st)
+ return st;
+ }
+
+ return 0;
+}
+
krb5_error_code
krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
char **db_args)
@@ -662,12 +763,12 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
LDAPMessage *result=NULL, *ent=NULL;
char **subtreelist = NULL;
char *user=NULL, *subtree=NULL, *principal_dn=NULL;
- char **values=NULL, *strval[10]={NULL}, errbuf[1024];
+ char *strval[10]={NULL}, errbuf[1024];
char *filtuser=NULL;
struct berval **bersecretkey=NULL;
LDAPMod **mods=NULL;
krb5_boolean create_standalone=FALSE;
- krb5_boolean krb_identity_exists=FALSE, establish_links=FALSE;
+ krb5_boolean establish_links=FALSE;
char *standalone_principal_dn=NULL;
krb5_tl_data *tl_data=NULL;
krb5_key_data **keys=NULL;
@@ -860,24 +961,6 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
* any of the subtrees
*/
if (xargs.dn_from_kbd == TRUE) {
- /* make sure the DN falls in the subtree */
- int dnlen=0, subtreelen=0;
- char *dn=NULL;
- krb5_boolean outofsubtree=TRUE;
-
- if (xargs.dn != NULL) {
- dn = xargs.dn;
- } else if (xargs.linkdn != NULL) {
- dn = xargs.linkdn;
- } else if (standalone_principal_dn != NULL) {
- /*
- * Even though the standalone_principal_dn is constructed
- * within this function, there is the containerdn input
- * from the user that can become part of the it.
- */
- dn = standalone_principal_dn;
- }
-
/* Get the current subtree list if we haven't already done so. */
if (subtreelist == NULL) {
st = krb5_get_subtree_info(ldap_context, &subtreelist, &ntrees);
@@ -885,81 +968,10 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
goto cleanup;
}
- for (tre=0; tre<ntrees; ++tre) {
- if (subtreelist[tre] == NULL || strlen(subtreelist[tre]) == 0) {
- outofsubtree = FALSE;
- break;
- } else {
- dnlen = strlen (dn);
- subtreelen = strlen(subtreelist[tre]);
- if ((dnlen >= subtreelen) && (strcasecmp((dn + dnlen - subtreelen), subtreelist[tre]) == 0)) {
- outofsubtree = FALSE;
- break;
- }
- }
- }
-
- if (outofsubtree == TRUE) {
- st = EINVAL;
- k5_setmsg(context, st, _("DN is out of the realm subtree"));
+ st = validate_xargs(context, ldap_server_handle, &xargs,
+ standalone_principal_dn, subtreelist, ntrees);
+ if (st)
goto cleanup;
- }
-
- /*
- * dn value will be set either by dn, linkdn or the standalone_principal_dn
- * In the first 2 cases, the dn should be existing and in the last case we
- * are supposed to create the ldap object. so the below should not be
- * executed for the last case.
- */
-
- if (standalone_principal_dn == NULL) {
- /*
- * If the ldap object is missing, this results in an error.
- */
-
- /*
- * Search for krbprincipalname attribute here.
- * This is to find if a kerberos identity is already present
- * on the ldap object, in which case adding a kerberos identity
- * on the ldap object should result in an error.
- */
- char *attributes[]={"krbticketpolicyreference", "krbprincipalname", NULL};
-
- ldap_msgfree(result);
- result = NULL;
- LDAP_SEARCH_1(dn, LDAP_SCOPE_BASE, 0, attributes, IGNORE_STATUS);
- if (st == LDAP_SUCCESS) {
- ent = ldap_first_entry(ld, result);
- if (ent != NULL) {
- if ((values=ldap_get_values(ld, ent, "krbticketpolicyreference")) != NULL) {
- ldap_value_free(values);
- }
-
- if ((values=ldap_get_values(ld, ent, "krbprincipalname")) != NULL) {
- krb_identity_exists = TRUE;
- ldap_value_free(values);
- }
- }
- } else {
- st = set_ldap_error(context, st, OP_SEARCH);
- goto cleanup;
- }
- }
- }
-
- /*
- * If xargs.dn is set then the request is to add a
- * kerberos principal on a ldap object, but if
- * there is one already on the ldap object this
- * should result in an error.
- */
-
- if (xargs.dn != NULL && krb_identity_exists == TRUE) {
- st = EINVAL;
- snprintf(errbuf, sizeof(errbuf),
- _("ldap object is already kerberized"));
- k5_setmsg(context, st, "%s", errbuf);
- goto cleanup;
}
if (xargs.linkdn != NULL) {
diff --git a/src/tests/t_kdb.py b/src/tests/t_kdb.py
index 217f2cdc3b..6e563b1032 100755
--- a/src/tests/t_kdb.py
+++ b/src/tests/t_kdb.py
@@ -203,6 +203,12 @@ def ldap_add(dn, objectclass, attrs=[]):
# in the test LDAP server.
realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=cn=krb5', 'princ1'],
expected_code=1, expected_msg='DN is out of the realm subtree')
+# Check that the DN container check is a hierarchy test, not a simple
+# suffix match (CVE-2018-5730). We expect this operation to fail
+# either way (because "xcn" isn't a valid DN tag) but the container
+# check should happen before the DN is parsed.
+realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=xcn=t1,cn=krb5', 'princ1'],
+ expected_code=1, expected_msg='DN is out of the realm subtree')
realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=cn=t2,cn=krb5', 'princ1'])
realm.run([kadminl, 'getprinc', 'princ1'], expected_msg='Principal: princ1')
realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=cn=t2,cn=krb5', 'again'],
@@ -226,6 +232,11 @@ def ldap_add(dn, objectclass, attrs=[]):
'princ3'])
realm.run([kadminl, 'modprinc', '-x', 'containerdn=cn=t2,cn=krb5', 'princ3'],
expected_code=1, expected_msg='containerdn option not supported')
+# Verify that containerdn is checked when linkdn is also supplied
+# (CVE-2018-5730).
+realm.run([kadminl, 'ank', '-randkey', '-x', 'containerdn=cn=krb5',
+ '-x', 'linkdn=cn=t2,cn=krb5', 'princ4'], expected_code=1,
+ expected_msg='DN is out of the realm subtree')
# Create and modify a ticket policy.
kldaputil(['create_policy', '-maxtktlife', '3hour', '-maxrenewlife', '6hour',
system/base/mit-kerberos/files/fix-python-detection.patch
+15
View File
@@ -0,0 +1,15 @@
--- configure.in.orig 2014-01-16 02:44:15.000000000 +0200
+++ src/configure.in 2014-05-17 17:05:05.317924895 +0300
@@ -1206,9 +1206,9 @@
# default, so it's not a big deal that it isn't very good. We should
# use python-config instead.
PYTHON_LIB=
-AC_CHECK_HEADERS(Python.h python2.3/Python.h python2.5/Python.h)
-AC_CHECK_LIB(python2.3,main,[PYTHON_LIB=-lpython2.3],
- AC_CHECK_LIB(python2.5,main,[PYTHON_LIB=-lpython2.5]))
+AC_CHECK_HEADERS(Python.h python2.5/Python.h python2.7/Python.h)
+AC_CHECK_LIB(python2.5,main,[PYTHON_LIB=-lpython2.5],
+ AC_CHECK_LIB(python2.7,main,[PYTHON_LIB=-lpython2.7]))
AC_SUBST(PYTHON_LIB)
system/base/mit-kerberos/files/kdc.conf
+16
View File
@@ -0,0 +1,16 @@
[kdcdefaults]
kdc_ports = 88,750
[realms]
EXAMPLE.COM = {
database_name = /etc/krb5kdc/principal
admin_keytab = /etc/krb5kdc/kadm5.keytab
acl_file = /etc/krb5kdc/kadm5.acl
dict_file = /etc/krb5kdc/kadm5.dict
key_stash_file = /etc/krb5kdc/.k5.EXAMPLE.COM
kadmind_port = 749
max_life = 10h 0m 0s
max_renewable_life = 7d 0h 0m 0s
master_key_type = des3-hmac-sha1
supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal
}
system/base/mit-kerberos/files/krb5-config_LDFLAGS.patch
+11
View File
@@ -0,0 +1,11 @@
--- src/build-tools/krb5-config.in.orig 2014-01-16 02:44:15.000000000 +0200
+++ src/build-tools/krb5-config.in 2014-05-17 17:00:42.624580187 +0300
@@ -221,7 +221,7 @@
-e 's#\$(PROG_RPATH)#'$libdir'#' \
-e 's#\$(PROG_LIBPATH)#'$libdirarg'#' \
-e 's#\$(RPATH_FLAG)#'"$RPATH_FLAG"'#' \
- -e 's#\$(LDFLAGS)#'"$LDFLAGS"'#' \
+ -e 's#\$(LDFLAGS)##' \
-e 's#\$(PTHREAD_CFLAGS)#'"$PTHREAD_CFLAGS"'#' \
-e 's#\$(CFLAGS)##'`
system/base/mit-kerberos/files/krb5.conf
+25
View File
@@ -0,0 +1,25 @@
[libdefaults]
ticket_lifetime = 600
default_realm = EXAMPLE.COM
default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc
default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc
[realms]
EXAMPLE.COM = {
kdc = kerberos.example.com:88
kdc = kerberos2.example.com:88
admin_server = kerberos.example.com:749
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
[kdc]
profile = /etc/krb5kdc/kdc.conf
[logging]
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log
default = FILE:/var/log/krb5lib.log
system/base/mit-kerberos/files/mit-krb5-1.12_uninitialized.patch
+55
View File
@@ -0,0 +1,55 @@
--- a/src/slave/kprop.c
+++ b/src/slave/kprop.c
@@ -91,7 +91,7 @@ main(argc, argv)
int argc;
char **argv;
{
- int fd, database_fd, database_size;
+ int fd = -1, database_fd, database_size;
krb5_error_code retval;
krb5_context context;
krb5_creds *my_creds;
--- a/src/kadmin/ktutil/ktutil_funcs.c
+++ b/src/kadmin/ktutil/ktutil_funcs.c
@@ -64,7 +64,7 @@
krb5_kt_list *list;
int idx;
{
- krb5_kt_list lp, prev;
+ krb5_kt_list lp, prev = NULL;
int i;
for (lp = *list, i = 1; lp; prev = lp, lp = lp->next, i++) {
--- a/src/lib/kadm5/alt_prof.c
+++ b/src/lib/kadm5/alt_prof.c
@@ -164,7 +164,7 @@
char **values;
char *valp;
int idx;
- krb5_boolean val;
+ krb5_boolean val = 0;
kret = krb5_aprof_getvals (acontext, hierarchy, &values);
if (kret)
--- a/src/util/profile/prof_init.c
+++ b/src/util/profile/prof_init.c
@@ -255,7 +255,7 @@ copy_vtable_profile(profile_t profile, profile_t *ret_new_profile)
{
errcode_t err;
void *cbdata;
- profile_t new_profile;
+ profile_t new_profile = NULL;
*ret_new_profile = NULL;
--- a/src/tests/asn.1/trval.c 2013-04-12 12:51:36.000000000 -0500
+++ b/src/tests/asn.1/trval.c 2013-05-24 04:31:14.077036380 -0500
@@ -404,7 +404,7 @@
{
int n;
int r = 0;
- int rlen2;
+ int rlen2 = 0;
int rlent;
int save_appl;
system/base/mit-kerberos/files/rebuild-configure-scripts.patch
+12
View File
@@ -0,0 +1,12 @@
--- /dev/null 2009-10-20 19:31:44.183325514 +0300
+++ src/rebuild-configure-scripts.sh 2009-10-22 10:37:14.583117034 +0300
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+top=`pwd`
+for configurein in `find -name configure.in -type f` ; do
+ pushd `dirname $configurein`
+ grep -q A._CONFIG_HEADER configure.in && autoheader -I "$top"
+ autoconf -I "$top"
+ popd
+done
system/base/mit-kerberos/pspec.xml
+114
View File
@@ -0,0 +1,114 @@
<?xml version="1.0" ?>
<!DOCTYPE PISI SYSTEM "http://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
<PISI>
<Source>
<Name>mit-kerberos</Name>
<Homepage>http://web.mit.edu/kerberos/www/</Homepage>
<Packager>
<Name>PisiLinux Community</Name>
<Email>admins@pisilinux.org</Email>
</Packager>
<License>as-is</License>
<IsA>library</IsA>
<IsA>app:console</IsA>
<Summary>MIT Kerberos Library</Summary>
<Description>Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.</Description>
<Archive sha1sum="0c404b081db9c996c581f636ce450ee28778f338" type="targz">http://web.mit.edu/kerberos/dist/krb5/1.17/krb5-1.17.tar.gz</Archive>
<BuildDependencies>
<Dependency>python3</Dependency>
<Dependency>keyutils</Dependency>
<Dependency>openssl-devel</Dependency>
<Dependency>e2fsprogs-devel</Dependency>
<!-- FIXME: openldap-client requires mit-kerberos too -->
<!-- disable for now for the circular dep
<Dependency>openldap-client</Dependency>
-->
</BuildDependencies>
<Patches>
<Patch level="0">krb5-config_LDFLAGS.patch</Patch>
<!--<Patch level="1">mit-krb5-1.12_uninitialized.patch</Patch> -->
<Patch level="0">rebuild-configure-scripts.patch</Patch>
<!--Patch level="1">CVE-2018-5729-5730.patch</Patch-->
</Patches>
</Source>
<Package>
<Name>mit-kerberos</Name>
<RuntimeDependencies>
<Dependency>keyutils</Dependency>
<Dependency>openssl</Dependency>
<Dependency>e2fsprogs</Dependency>
<!-- FIXME: This introduces a circular dep
<Dependency>openldap-client</Dependency>
-->
</RuntimeDependencies>
<Files>
<Path fileType="config">/etc</Path>
<Path fileType="data">/run/krb5kdc</Path>
<Path fileType="header">/usr/include</Path>
<Path fileType="executable">/usr/bin</Path>
<Path fileType="executable">/usr/sbin</Path>
<Path fileType="library">/usr/lib</Path>
<Path fileType="data">/usr/share</Path>
<Path fileType="data">/var/lib</Path>
<Path fileType="info">/usr/share/info</Path>
<Path fileType="man">/usr/share/man</Path>
</Files>
<AdditionalFiles>
<AdditionalFile owner="root" permission="0644" target="/etc/krb5.conf">krb5.conf</AdditionalFile>
<AdditionalFile owner="root" permission="0644" target="/etc/kdc.conf">kdc.conf</AdditionalFile>
</AdditionalFiles>
</Package>
<History>
<Update release="7">
<Date>2020-11-07</Date>
<Version>1.17</Version>
<Comment>Version bump</Comment>
<Name>Mustafa Cinasal</Name>
<Email>muscnsl@gmail.com</Email>
</Update>
<Update release="6">
<Date>2020-01-08</Date>
<Version>1.17</Version>
<Comment>Version bump</Comment>
<Name>Mustafa Cinasal</Name>
<Email>muscnsl@gmail.com</Email>
</Update>
<Update release="5">
<Date>2018-12-31</Date>
<Version>1.16</Version>
<Comment>Version bump</Comment>
<Name>Pisi Linux Community</Name>
<Email>admin@pisilinux.org</Email>
</Update>
<Update release="4">
<Date>2018-07-26</Date>
<Version>1.15</Version>
<Comment>Rebuild</Comment>
<Name>Pisi Linux Community</Name>
<Email>admin@pisilinux.org</Email>
</Update>
<Update release="3">
<Date>2017-02-17</Date>
<Version>1.15</Version>
<Comment>Version Bump</Comment>
<Name>Pisi Linux Community</Name>
<Email>admin@pisilinux.org</Email>
</Update>
<Update release="2">
<Date>2016-06-08</Date>
<Version>1.13.1</Version>
<Comment>Release Bump</Comment>
<Name>Pisi Linux Community</Name>
<Email>admin@pisilinux.org</Email>
</Update>
<Update release="1">
<Date>2015-04-23</Date>
<Version>1.13.1</Version>
<Comment>First release</Comment>
<Name>Ertuğrul Erata</Name>
<Email>ertugrulerata@gmail.com</Email>
</Update>
</History>
</PISI>
system/base/mit-kerberos/translations.xml
+8
View File
@@ -0,0 +1,8 @@
<?xml version="1.0" ?>
<PISI>
<Source>
<Name>mit-kerberos</Name>
<Summary xml:lang="tr">MIT Kerberos kütüphanesi</Summary>
<Description xml:lang="tr">Kerberos bir ağ doğrulama protokolüdür. Sunucu/istemci uygulamalarında, gizli anahtar kriptoloji teknolojisini kullanarak, güçlü bir doğrulama sağlar.</Description>
</Source>
</PISI>