diff --git a/pisi-index.xml b/pisi-index.xml index d4f0a3e4..cd7fbd57 100644 --- a/pisi-index.xml +++ b/pisi-index.xml @@ -20613,6 +20613,111 @@ + + + mit-kerberos + http://web.mit.edu/kerberos/www/ + + PisiLinux Community + admins@pisilinux.org + + as-is + library + app:console + system.base + MIT Kerberos Library + MIT Kerberos kütüphanesi + Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. + Kerberos bir ağ doğrulama protokolüdür. Sunucu/istemci uygulamalarında, gizli anahtar kriptoloji teknolojisini kullanarak, güçlü bir doğrulama sağlar. + http://web.mit.edu/kerberos/dist/krb5/1.17/krb5-1.17.tar.gz + + python3 + keyutils + openssl-devel + e2fsprogs-devel + + + krb5-config_LDFLAGS.patch + rebuild-configure-scripts.patch + + system/base/mit-kerberos/pspec.xml + + + mit-kerberos + + keyutils + openssl + e2fsprogs + + + /etc + /run/krb5kdc + /usr/include + /usr/bin + /usr/sbin + /usr/lib + /usr/share + /var/lib + /usr/share/info + /usr/share/man + + + krb5.conf + kdc.conf + + + + + 2020-11-07 + 1.17 + Version bump + Mustafa Cinasal + muscnsl@gmail.com + + + 2020-01-08 + 1.17 + Version bump + Mustafa Cinasal + muscnsl@gmail.com + + + 2018-12-31 + 1.16 + Version bump + Pisi Linux Community + admin@pisilinux.org + + + 2018-07-26 + 1.15 + Rebuild + Pisi Linux Community + admin@pisilinux.org + + + 2017-02-17 + 1.15 + Version Bump + Pisi Linux Community + admin@pisilinux.org + + + 2016-06-08 + 1.13.1 + Release Bump + Pisi Linux Community + admin@pisilinux.org + + + 2015-04-23 + 1.13.1 + First release + Ertuğrul Erata + ertugrulerata@gmail.com + + + python-psutil diff --git a/pisi-index.xml.sha1sum b/pisi-index.xml.sha1sum index 7f092159..78fe504a 100644 --- a/pisi-index.xml.sha1sum +++ b/pisi-index.xml.sha1sum @@ -1 +1 @@ -9f3260bafb46ce0f9434b1a023a2605e5fe030e8 \ No newline at end of file +a71b4a64dd680dd4a8cd0e4db9282aaf7eaba865 \ No newline at end of file diff --git a/pisi-index.xml.xz b/pisi-index.xml.xz index 960a8cbe..b0a82f48 100644 Binary files a/pisi-index.xml.xz and b/pisi-index.xml.xz differ diff --git a/pisi-index.xml.xz.sha1sum b/pisi-index.xml.xz.sha1sum index f0c0de42..44b5079c 100644 --- a/pisi-index.xml.xz.sha1sum +++ b/pisi-index.xml.xz.sha1sum @@ -1 +1 @@ -695fcc54ae376aeb2735dc81f6d7a59360c5df9e \ No newline at end of file +df67cc8fe9658daf77235cf340b5501c9bf0ab91 \ No newline at end of file diff --git a/system/base/mit-kerberos/actions.py b/system/base/mit-kerberos/actions.py new file mode 100644 index 00000000..6d45d0c6 --- /dev/null +++ b/system/base/mit-kerberos/actions.py @@ -0,0 +1,87 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Licensed under the GNU General Public License, version 3. +# See the file http://www.gnu.org/licenses/gpl.txt + +from pisi.actionsapi import get +from pisi.actionsapi import autotools +from pisi.actionsapi import pisitools +from pisi.actionsapi import shelltools + +pisitools.flags.add("-fPIC -fno-strict-aliasing -fno-strict-overflow -fstack-protector-all") +pisitools.cxxflags.add("-I/usr/include/et") + +def rename_man_pages(): + manpages = ["appl/bsd/klogind.M", + "appl/bsd/kshd.M", + "appl/sample/sserver/sserver.M", + "appl/telnet/telnetd/telnetd.8", + "appl/gssftp/ftpd/ftpd.M", + "config-files/kdc.conf.M", + "config-files/krb5.conf.M", + "kadmin/cli/kadmin.M", + "slave/kpropd.M", + "slave/kprop.M"] + for manpage in manpages: + shelltools.move(manpage, "%s.in" % manpage) + +def setup(): + shelltools.cd("src") + shelltools.system("sed -i -e 's/^YYSTYPE yylval/&={0}/' lib/krb5/krb/deltat.c") + pisitools.dosed("util/ac_check_krb5.m4", "(KRB5ROOT=\/usr)\/local", r"\1") + + #autotools.autoreconf("-fi") + + # Fix pthread linking + #pisitools.dosed("configure", "-lthread", "-lpthread") + #pisitools.dosed("configure", "-pthread", "-lpthread") + + autotools.configure("--localstatedir=/var/lib \ + --without-tcl \ + --without-hesiod \ + --enable-shared \ + --enable-kdc-lookaside-cache \ + --without-system-verto \ + --disable-rpath \ + --with-system-et \ + --with-system-ss \ + --enable-dns-for-realm") + + # Fix krb5-config script to remove rpaths and CFLAGS + #pisitools.dosed("krb5-config", "^CC_LINK=.*", "CC_LINK='$(CC) $(PROG_LIBPATH)'") + # Fix unused dependency + pisitools.dosed("config/shlib.conf"," -shared ", " -Wl,--as-needed -shared ") + +def build(): + autotools.make("-C src/") + +# def check(): + # check failed + # autotools.make("-C src/ -j1 check") + # import tempfile + # import shutil + # tmpdir = tempfile.mkdtemp(prefix='pisitest') + # autotools.make("-C src/ check TMPDIR=%s -j1" % tmpdir) + # shutil.rmtree("rm -rf %s" % tmpdir) + +def install(): + pisitools.dodoc("NOTICE", "README") + shelltools.cd("src") + autotools.rawInstall("DESTDIR=%s" % get.installDIR()) + + # Install additional headers + for d in ("kadm5", "krb5"): + pisitools.insinto("/usr/include/%s" % d, "include/%s/*.h" % d) + + # Add "k" prefix to some apps and manpages to resolve conflicts + #for app in ["telnetd", "ftpd"]: + # pisitools.rename("/usr/share/man/man8/%s.8" % app, "k%s.8" % app) + # pisitools.rename("/usr/sbin/%s" % app, "k%s" % app) + + #for app in ["rcp", "rsh", "telnet", "ftp", "rlogin"]: + # pisitools.rename("/usr/share/man/man1/%s.1" % app, "k%s.1" % app) + # pisitools.rename("/usr/bin/%s" % app, "k%s" % app) + + # Remove examples + pisitools.removeDir("/usr/share/examples") diff --git a/system/base/mit-kerberos/files/CVE-2018-5729-5730.patch b/system/base/mit-kerberos/files/CVE-2018-5729-5730.patch new file mode 100644 index 00000000..114cfe68 --- /dev/null +++ b/system/base/mit-kerberos/files/CVE-2018-5729-5730.patch @@ -0,0 +1,297 @@ +diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c +index 2420f2c2be..a59a65e8f6 100644 +--- a/src/lib/kadm5/srv/svr_principal.c ++++ b/src/lib/kadm5/srv/svr_principal.c +@@ -330,6 +330,13 @@ kadm5_create_principal_3(void *server_handle, + return KADM5_BAD_MASK; + if((mask & ~ALL_PRINC_MASK)) + return KADM5_BAD_MASK; ++ if (mask & KADM5_TL_DATA) { ++ for (tl_data_tail = entry->tl_data; tl_data_tail != NULL; ++ tl_data_tail = tl_data_tail->tl_data_next) { ++ if (tl_data_tail->tl_data_type < 256) ++ return KADM5_BAD_TL_TYPE; ++ } ++ } + + /* + * Check to see if the principal exists +diff --git a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h +index 535a1f309e..8b8420faa9 100644 +--- a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h ++++ b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h +@@ -141,7 +141,7 @@ extern int set_ldap_error (krb5_context ctx, int st, int op); + #define UNSTORE16_INT(ptr, val) (val = load_16_be(ptr)) + #define UNSTORE32_INT(ptr, val) (val = load_32_be(ptr)) + +-#define KDB_TL_USER_INFO 0x7ffe ++#define KDB_TL_USER_INFO 0xff + + #define KDB_TL_PRINCTYPE 0x01 + #define KDB_TL_PRINCCOUNT 0x02 +diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +index 88a1704950..b7c9212cb2 100644 +--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c ++++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +@@ -651,6 +651,107 @@ update_ldap_mod_auth_ind(krb5_context context, krb5_db_entry *entry, + return ret; + } + ++static krb5_error_code ++check_dn_in_container(krb5_context context, const char *dn, ++ char *const *subtrees, unsigned int ntrees) ++{ ++ unsigned int i; ++ size_t dnlen = strlen(dn), stlen; ++ ++ for (i = 0; i < ntrees; i++) { ++ if (subtrees[i] == NULL || *subtrees[i] == '\0') ++ return 0; ++ stlen = strlen(subtrees[i]); ++ if (dnlen >= stlen && ++ strcasecmp(dn + dnlen - stlen, subtrees[i]) == 0 && ++ (dnlen == stlen || dn[dnlen - stlen - 1] == ',')) ++ return 0; ++ } ++ ++ k5_setmsg(context, EINVAL, _("DN is out of the realm subtree")); ++ return EINVAL; ++} ++ ++static krb5_error_code ++check_dn_exists(krb5_context context, ++ krb5_ldap_server_handle *ldap_server_handle, ++ const char *dn, krb5_boolean nonkrb_only) ++{ ++ krb5_error_code st = 0, tempst; ++ krb5_ldap_context *ldap_context = context->dal_handle->db_context; ++ LDAP *ld = ldap_server_handle->ldap_handle; ++ LDAPMessage *result = NULL, *ent; ++ char *attrs[] = { "krbticketpolicyreference", "krbprincipalname", NULL }; ++ char **values; ++ ++ LDAP_SEARCH_1(dn, LDAP_SCOPE_BASE, 0, attrs, IGNORE_STATUS); ++ if (st != LDAP_SUCCESS) ++ return set_ldap_error(context, st, OP_SEARCH); ++ ++ ent = ldap_first_entry(ld, result); ++ CHECK_NULL(ent); ++ ++ values = ldap_get_values(ld, ent, "krbticketpolicyreference"); ++ if (values != NULL) ++ ldap_value_free(values); ++ ++ values = ldap_get_values(ld, ent, "krbprincipalname"); ++ if (values != NULL) { ++ ldap_value_free(values); ++ if (nonkrb_only) { ++ st = EINVAL; ++ k5_setmsg(context, st, _("ldap object is already kerberized")); ++ goto cleanup; ++ } ++ } ++ ++cleanup: ++ ldap_msgfree(result); ++ return st; ++} ++ ++static krb5_error_code ++validate_xargs(krb5_context context, ++ krb5_ldap_server_handle *ldap_server_handle, ++ const xargs_t *xargs, const char *standalone_dn, ++ char *const *subtrees, unsigned int ntrees) ++{ ++ krb5_error_code st; ++ ++ if (xargs->dn != NULL) { ++ /* The supplied dn must be within a realm container. */ ++ st = check_dn_in_container(context, xargs->dn, subtrees, ntrees); ++ if (st) ++ return st; ++ /* The supplied dn must exist without Kerberos attributes. */ ++ st = check_dn_exists(context, ldap_server_handle, xargs->dn, TRUE); ++ if (st) ++ return st; ++ } ++ ++ if (xargs->linkdn != NULL) { ++ /* The supplied linkdn must be within a realm container. */ ++ st = check_dn_in_container(context, xargs->linkdn, subtrees, ntrees); ++ if (st) ++ return st; ++ /* The supplied linkdn must exist. */ ++ st = check_dn_exists(context, ldap_server_handle, xargs->linkdn, ++ FALSE); ++ if (st) ++ return st; ++ } ++ ++ if (xargs->containerdn != NULL && standalone_dn != NULL) { ++ /* standalone_dn (likely composed using containerdn) must be within a ++ * container. */ ++ st = check_dn_in_container(context, standalone_dn, subtrees, ntrees); ++ if (st) ++ return st; ++ } ++ ++ return 0; ++} ++ + krb5_error_code + krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry, + char **db_args) +@@ -662,12 +763,12 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry, + LDAPMessage *result=NULL, *ent=NULL; + char **subtreelist = NULL; + char *user=NULL, *subtree=NULL, *principal_dn=NULL; +- char **values=NULL, *strval[10]={NULL}, errbuf[1024]; ++ char *strval[10]={NULL}, errbuf[1024]; + char *filtuser=NULL; + struct berval **bersecretkey=NULL; + LDAPMod **mods=NULL; + krb5_boolean create_standalone=FALSE; +- krb5_boolean krb_identity_exists=FALSE, establish_links=FALSE; ++ krb5_boolean establish_links=FALSE; + char *standalone_principal_dn=NULL; + krb5_tl_data *tl_data=NULL; + krb5_key_data **keys=NULL; +@@ -860,24 +961,6 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry, + * any of the subtrees + */ + if (xargs.dn_from_kbd == TRUE) { +- /* make sure the DN falls in the subtree */ +- int dnlen=0, subtreelen=0; +- char *dn=NULL; +- krb5_boolean outofsubtree=TRUE; +- +- if (xargs.dn != NULL) { +- dn = xargs.dn; +- } else if (xargs.linkdn != NULL) { +- dn = xargs.linkdn; +- } else if (standalone_principal_dn != NULL) { +- /* +- * Even though the standalone_principal_dn is constructed +- * within this function, there is the containerdn input +- * from the user that can become part of the it. +- */ +- dn = standalone_principal_dn; +- } +- + /* Get the current subtree list if we haven't already done so. */ + if (subtreelist == NULL) { + st = krb5_get_subtree_info(ldap_context, &subtreelist, &ntrees); +@@ -885,81 +968,10 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry, + goto cleanup; + } + +- for (tre=0; tre= subtreelen) && (strcasecmp((dn + dnlen - subtreelen), subtreelist[tre]) == 0)) { +- outofsubtree = FALSE; +- break; +- } +- } +- } +- +- if (outofsubtree == TRUE) { +- st = EINVAL; +- k5_setmsg(context, st, _("DN is out of the realm subtree")); ++ st = validate_xargs(context, ldap_server_handle, &xargs, ++ standalone_principal_dn, subtreelist, ntrees); ++ if (st) + goto cleanup; +- } +- +- /* +- * dn value will be set either by dn, linkdn or the standalone_principal_dn +- * In the first 2 cases, the dn should be existing and in the last case we +- * are supposed to create the ldap object. so the below should not be +- * executed for the last case. +- */ +- +- if (standalone_principal_dn == NULL) { +- /* +- * If the ldap object is missing, this results in an error. +- */ +- +- /* +- * Search for krbprincipalname attribute here. +- * This is to find if a kerberos identity is already present +- * on the ldap object, in which case adding a kerberos identity +- * on the ldap object should result in an error. +- */ +- char *attributes[]={"krbticketpolicyreference", "krbprincipalname", NULL}; +- +- ldap_msgfree(result); +- result = NULL; +- LDAP_SEARCH_1(dn, LDAP_SCOPE_BASE, 0, attributes, IGNORE_STATUS); +- if (st == LDAP_SUCCESS) { +- ent = ldap_first_entry(ld, result); +- if (ent != NULL) { +- if ((values=ldap_get_values(ld, ent, "krbticketpolicyreference")) != NULL) { +- ldap_value_free(values); +- } +- +- if ((values=ldap_get_values(ld, ent, "krbprincipalname")) != NULL) { +- krb_identity_exists = TRUE; +- ldap_value_free(values); +- } +- } +- } else { +- st = set_ldap_error(context, st, OP_SEARCH); +- goto cleanup; +- } +- } +- } +- +- /* +- * If xargs.dn is set then the request is to add a +- * kerberos principal on a ldap object, but if +- * there is one already on the ldap object this +- * should result in an error. +- */ +- +- if (xargs.dn != NULL && krb_identity_exists == TRUE) { +- st = EINVAL; +- snprintf(errbuf, sizeof(errbuf), +- _("ldap object is already kerberized")); +- k5_setmsg(context, st, "%s", errbuf); +- goto cleanup; + } + + if (xargs.linkdn != NULL) { +diff --git a/src/tests/t_kdb.py b/src/tests/t_kdb.py +index 217f2cdc3b..6e563b1032 100755 +--- a/src/tests/t_kdb.py ++++ b/src/tests/t_kdb.py +@@ -203,6 +203,12 @@ def ldap_add(dn, objectclass, attrs=[]): + # in the test LDAP server. + realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=cn=krb5', 'princ1'], + expected_code=1, expected_msg='DN is out of the realm subtree') ++# Check that the DN container check is a hierarchy test, not a simple ++# suffix match (CVE-2018-5730). We expect this operation to fail ++# either way (because "xcn" isn't a valid DN tag) but the container ++# check should happen before the DN is parsed. ++realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=xcn=t1,cn=krb5', 'princ1'], ++ expected_code=1, expected_msg='DN is out of the realm subtree') + realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=cn=t2,cn=krb5', 'princ1']) + realm.run([kadminl, 'getprinc', 'princ1'], expected_msg='Principal: princ1') + realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=cn=t2,cn=krb5', 'again'], +@@ -226,6 +232,11 @@ def ldap_add(dn, objectclass, attrs=[]): + 'princ3']) + realm.run([kadminl, 'modprinc', '-x', 'containerdn=cn=t2,cn=krb5', 'princ3'], + expected_code=1, expected_msg='containerdn option not supported') ++# Verify that containerdn is checked when linkdn is also supplied ++# (CVE-2018-5730). ++realm.run([kadminl, 'ank', '-randkey', '-x', 'containerdn=cn=krb5', ++ '-x', 'linkdn=cn=t2,cn=krb5', 'princ4'], expected_code=1, ++ expected_msg='DN is out of the realm subtree') + + # Create and modify a ticket policy. + kldaputil(['create_policy', '-maxtktlife', '3hour', '-maxrenewlife', '6hour', diff --git a/system/base/mit-kerberos/files/fix-python-detection.patch b/system/base/mit-kerberos/files/fix-python-detection.patch new file mode 100644 index 00000000..bcccf90b --- /dev/null +++ b/system/base/mit-kerberos/files/fix-python-detection.patch @@ -0,0 +1,15 @@ +--- configure.in.orig 2014-01-16 02:44:15.000000000 +0200 ++++ src/configure.in 2014-05-17 17:05:05.317924895 +0300 +@@ -1206,9 +1206,9 @@ + # default, so it's not a big deal that it isn't very good. We should + # use python-config instead. + PYTHON_LIB= +-AC_CHECK_HEADERS(Python.h python2.3/Python.h python2.5/Python.h) +-AC_CHECK_LIB(python2.3,main,[PYTHON_LIB=-lpython2.3], +- AC_CHECK_LIB(python2.5,main,[PYTHON_LIB=-lpython2.5])) ++AC_CHECK_HEADERS(Python.h python2.5/Python.h python2.7/Python.h) ++AC_CHECK_LIB(python2.5,main,[PYTHON_LIB=-lpython2.5], ++ AC_CHECK_LIB(python2.7,main,[PYTHON_LIB=-lpython2.7])) + AC_SUBST(PYTHON_LIB) + + diff --git a/system/base/mit-kerberos/files/kdc.conf b/system/base/mit-kerberos/files/kdc.conf new file mode 100644 index 00000000..3cf14aaf --- /dev/null +++ b/system/base/mit-kerberos/files/kdc.conf @@ -0,0 +1,16 @@ +[kdcdefaults] + kdc_ports = 88,750 + +[realms] + EXAMPLE.COM = { + database_name = /etc/krb5kdc/principal + admin_keytab = /etc/krb5kdc/kadm5.keytab + acl_file = /etc/krb5kdc/kadm5.acl + dict_file = /etc/krb5kdc/kadm5.dict + key_stash_file = /etc/krb5kdc/.k5.EXAMPLE.COM + kadmind_port = 749 + max_life = 10h 0m 0s + max_renewable_life = 7d 0h 0m 0s + master_key_type = des3-hmac-sha1 + supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal + } diff --git a/system/base/mit-kerberos/files/krb5-config_LDFLAGS.patch b/system/base/mit-kerberos/files/krb5-config_LDFLAGS.patch new file mode 100644 index 00000000..b7b7cd98 --- /dev/null +++ b/system/base/mit-kerberos/files/krb5-config_LDFLAGS.patch @@ -0,0 +1,11 @@ +--- src/build-tools/krb5-config.in.orig 2014-01-16 02:44:15.000000000 +0200 ++++ src/build-tools/krb5-config.in 2014-05-17 17:00:42.624580187 +0300 +@@ -221,7 +221,7 @@ + -e 's#\$(PROG_RPATH)#'$libdir'#' \ + -e 's#\$(PROG_LIBPATH)#'$libdirarg'#' \ + -e 's#\$(RPATH_FLAG)#'"$RPATH_FLAG"'#' \ +- -e 's#\$(LDFLAGS)#'"$LDFLAGS"'#' \ ++ -e 's#\$(LDFLAGS)##' \ + -e 's#\$(PTHREAD_CFLAGS)#'"$PTHREAD_CFLAGS"'#' \ + -e 's#\$(CFLAGS)##'` + diff --git a/system/base/mit-kerberos/files/krb5.conf b/system/base/mit-kerberos/files/krb5.conf new file mode 100644 index 00000000..e68a5ccb --- /dev/null +++ b/system/base/mit-kerberos/files/krb5.conf @@ -0,0 +1,25 @@ +[libdefaults] + ticket_lifetime = 600 + default_realm = EXAMPLE.COM + default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc + default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc + +[realms] + EXAMPLE.COM = { + kdc = kerberos.example.com:88 + kdc = kerberos2.example.com:88 + admin_server = kerberos.example.com:749 + } + +[domain_realm] + .example.com = EXAMPLE.COM + example.com = EXAMPLE.COM + +[kdc] + profile = /etc/krb5kdc/kdc.conf + +[logging] + kdc = FILE:/var/log/krb5kdc.log + admin_server = FILE:/var/log/kadmin.log + default = FILE:/var/log/krb5lib.log + diff --git a/system/base/mit-kerberos/files/mit-krb5-1.12_uninitialized.patch b/system/base/mit-kerberos/files/mit-krb5-1.12_uninitialized.patch new file mode 100644 index 00000000..e779d364 --- /dev/null +++ b/system/base/mit-kerberos/files/mit-krb5-1.12_uninitialized.patch @@ -0,0 +1,55 @@ +--- a/src/slave/kprop.c ++++ b/src/slave/kprop.c +@@ -91,7 +91,7 @@ main(argc, argv) + int argc; + char **argv; + { +- int fd, database_fd, database_size; ++ int fd = -1, database_fd, database_size; + krb5_error_code retval; + krb5_context context; + krb5_creds *my_creds; +--- a/src/kadmin/ktutil/ktutil_funcs.c ++++ b/src/kadmin/ktutil/ktutil_funcs.c +@@ -64,7 +64,7 @@ + krb5_kt_list *list; + int idx; + { +- krb5_kt_list lp, prev; ++ krb5_kt_list lp, prev = NULL; + int i; + + for (lp = *list, i = 1; lp; prev = lp, lp = lp->next, i++) { +--- a/src/lib/kadm5/alt_prof.c ++++ b/src/lib/kadm5/alt_prof.c +@@ -164,7 +164,7 @@ + char **values; + char *valp; + int idx; +- krb5_boolean val; ++ krb5_boolean val = 0; + + kret = krb5_aprof_getvals (acontext, hierarchy, &values); + if (kret) + +--- a/src/util/profile/prof_init.c ++++ b/src/util/profile/prof_init.c +@@ -255,7 +255,7 @@ copy_vtable_profile(profile_t profile, profile_t *ret_new_profile) + { + errcode_t err; + void *cbdata; +- profile_t new_profile; ++ profile_t new_profile = NULL; + + *ret_new_profile = NULL; + +--- a/src/tests/asn.1/trval.c 2013-04-12 12:51:36.000000000 -0500 ++++ b/src/tests/asn.1/trval.c 2013-05-24 04:31:14.077036380 -0500 +@@ -404,7 +404,7 @@ + { + int n; + int r = 0; +- int rlen2; ++ int rlen2 = 0; + int rlent; + int save_appl; \ No newline at end of file diff --git a/system/base/mit-kerberos/files/rebuild-configure-scripts.patch b/system/base/mit-kerberos/files/rebuild-configure-scripts.patch new file mode 100644 index 00000000..36b38118 --- /dev/null +++ b/system/base/mit-kerberos/files/rebuild-configure-scripts.patch @@ -0,0 +1,12 @@ +--- /dev/null 2009-10-20 19:31:44.183325514 +0300 ++++ src/rebuild-configure-scripts.sh 2009-10-22 10:37:14.583117034 +0300 +@@ -0,0 +1,9 @@ ++#!/bin/bash ++ ++top=`pwd` ++for configurein in `find -name configure.in -type f` ; do ++ pushd `dirname $configurein` ++ grep -q A._CONFIG_HEADER configure.in && autoheader -I "$top" ++ autoconf -I "$top" ++ popd ++done diff --git a/system/base/mit-kerberos/pspec.xml b/system/base/mit-kerberos/pspec.xml new file mode 100644 index 00000000..887b196f --- /dev/null +++ b/system/base/mit-kerberos/pspec.xml @@ -0,0 +1,114 @@ + + + + + mit-kerberos + http://web.mit.edu/kerberos/www/ + + PisiLinux Community + admins@pisilinux.org + + as-is + library + app:console + MIT Kerberos Library + Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. + http://web.mit.edu/kerberos/dist/krb5/1.17/krb5-1.17.tar.gz + + python3 + keyutils + openssl-devel + e2fsprogs-devel + + + + + krb5-config_LDFLAGS.patch + + rebuild-configure-scripts.patch + + + + + + mit-kerberos + + keyutils + openssl + e2fsprogs + + + + /etc + /run/krb5kdc + /usr/include + /usr/bin + /usr/sbin + /usr/lib + /usr/share + /var/lib + /usr/share/info + /usr/share/man + + + krb5.conf + kdc.conf + + + + + + 2020-11-07 + 1.17 + Version bump + Mustafa Cinasal + muscnsl@gmail.com + + + 2020-01-08 + 1.17 + Version bump + Mustafa Cinasal + muscnsl@gmail.com + + + 2018-12-31 + 1.16 + Version bump + Pisi Linux Community + admin@pisilinux.org + + + 2018-07-26 + 1.15 + Rebuild + Pisi Linux Community + admin@pisilinux.org + + + 2017-02-17 + 1.15 + Version Bump + Pisi Linux Community + admin@pisilinux.org + + + 2016-06-08 + 1.13.1 + Release Bump + Pisi Linux Community + admin@pisilinux.org + + + 2015-04-23 + 1.13.1 + First release + Ertuğrul Erata + ertugrulerata@gmail.com + + + diff --git a/system/base/mit-kerberos/translations.xml b/system/base/mit-kerberos/translations.xml new file mode 100644 index 00000000..4ead7d53 --- /dev/null +++ b/system/base/mit-kerberos/translations.xml @@ -0,0 +1,8 @@ + + + + mit-kerberos + MIT Kerberos kütüphanesi + Kerberos bir ağ doğrulama protokolüdür. Sunucu/istemci uygulamalarında, gizli anahtar kriptoloji teknolojisini kullanarak, güçlü bir doğrulama sağlar. + +