From 23c09aa90263cb3a35581c7626a6404ceb0a261e Mon Sep 17 00:00:00 2001 From: Rmys Date: Tue, 6 Dec 2022 13:39:54 +0300 Subject: [PATCH] cyrus-sasl ver. bump --- ...sasl-2.1.28-fix-configure-time-check.patch | 50 +++++ .../cyrus-sasl-2.1.28-gdbm-errno-redux.patch | 21 ++ .../gentoo/cyrus-sasl-2.1.28-openssl3.patch | 183 ++++++++++++++++++ .../cyrus-sasl-2.1.28-static-build.patch | 27 +++ server/auth/cyrus-sasl/pspec.xml | 21 +- 5 files changed, 292 insertions(+), 10 deletions(-) create mode 100644 server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-fix-configure-time-check.patch create mode 100644 server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-gdbm-errno-redux.patch create mode 100644 server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-openssl3.patch create mode 100644 server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-static-build.patch diff --git a/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-fix-configure-time-check.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-fix-configure-time-check.patch new file mode 100644 index 0000000000..873dac53fe --- /dev/null +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-fix-configure-time-check.patch @@ -0,0 +1,50 @@ +https://github.com/cyrusimap/cyrus-sasl/pull/709 + +From 399625c3413c313e93432d0f5907350722b861c7 Mon Sep 17 00:00:00 2001 +From: Sam James +Date: Wed, 23 Feb 2022 00:45:15 +0000 +Subject: [PATCH] Fix check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +We're conditionally including based on HAVE_TIME_H in a bunch of places, +but we're not actually checking for time.h, so that's never going to be defined. + +While at it, add in a missing include in the cram plugin. + +This fixes a bunch of implicit declaration warnings: +``` + * cyrus-sasl-2.1.28/lib/saslutil.c:280:3: warning: implicit declaration of function ‘time’ [-Wimplicit-function-declaration] + * cyrus-sasl-2.1.28/lib/saslutil.c:364:41: warning: implicit declaration of function ‘clock’ [-Wimplicit-function-declaration] + * cyrus-sasl-2.1.28/plugins/cram.c:132:7: warning: implicit declaration of function ‘time’ [-Wimplicit-function-declaration] + * cyrus-sasl-2.1.28/lib/saslutil.c:280:3: warning: implicit declaration of function ‘time’ [-Wimplicit-function-declaration] + * cyrus-sasl-2.1.28/lib/saslutil.c:364:41: warning: implicit declaration of function ‘clock’ [-Wimplicit-function-declaration] + * cyrus-sasl-2.1.28/plugins/cram.c:132:7: warning: implicit declaration of function ‘time’ [-Wimplicit-function-declaration] +``` + +Signed-off-by: Sam James +--- a/configure.ac ++++ b/configure.ac +@@ -1290,7 +1290,7 @@ AC_CHECK_HEADERS_ONCE([sys/time.h]) + + AC_HEADER_DIRENT + AC_HEADER_SYS_WAIT +-AC_CHECK_HEADERS(crypt.h des.h dlfcn.h fcntl.h limits.h malloc.h paths.h strings.h sys/file.h sys/time.h syslog.h unistd.h inttypes.h sys/uio.h sys/param.h sysexits.h stdarg.h varargs.h krb5.h) ++AC_CHECK_HEADERS(crypt.h des.h dlfcn.h fcntl.h limits.h malloc.h paths.h strings.h sys/file.h sys/time.h syslog.h time.h unistd.h inttypes.h sys/uio.h sys/param.h sysexits.h stdarg.h varargs.h krb5.h) + + IPv6_CHECK_SS_FAMILY() + IPv6_CHECK_SA_LEN() +--- a/plugins/cram.c ++++ b/plugins/cram.c +@@ -53,6 +53,10 @@ + #endif + #include + ++#ifdef HAVE_TIME_H ++#include ++#endif ++ + #include + #include + #include diff --git a/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-gdbm-errno-redux.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-gdbm-errno-redux.patch new file mode 100644 index 0000000000..d82f4ef9d4 --- /dev/null +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-gdbm-errno-redux.patch @@ -0,0 +1,21 @@ +https://github.com/cyrusimap/cyrus-sasl/commit/92be047033d56c29473223c44985592b1290a701 + +From 92be047033d56c29473223c44985592b1290a701 Mon Sep 17 00:00:00 2001 +From: Quanah Gibson-Mount +Date: Tue, 3 May 2022 16:31:37 +0000 +Subject: [PATCH] Fix earlier #554 commit to use fetch_errno instead of + gdbm_errno + +Signed-off-by: Quanah Gibson-Mount +--- a/sasldb/db_gdbm.c ++++ b/sasldb/db_gdbm.c +@@ -119,7 +119,7 @@ int _sasldb_getdata(const sasl_utils_t *utils, + } else { + utils->seterror(conn, 0, + "Couldn't fetch entry from %s: gdbm_errno=%d", +- path, gdbm_errno); ++ path, fetch_errno); + result = SASL_FAIL; + } + goto cleanup; + diff --git a/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-openssl3.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-openssl3.patch new file mode 100644 index 0000000000..1a515ba952 --- /dev/null +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-openssl3.patch @@ -0,0 +1,183 @@ +https://github.com/cyrusimap/cyrus-sasl/commit/887dbc0435056ec58ee48c4d803f110ade1e4c39 +https://github.com/cyrusimap/cyrus-sasl/commit/dfaa62392e7caecc6ecf0097b4d73738ec4fc0a8 +https://github.com/cyrusimap/cyrus-sasl/commit/c2bd3afbca57f176d8c650670ce371444bb7fcc0. + +From 887dbc0435056ec58ee48c4d803f110ade1e4c39 Mon Sep 17 00:00:00 2001 +From: Simo Sorce +Date: Mon, 21 Jun 2021 14:24:18 -0400 +Subject: [PATCH] Gracefully handle failed initializations + +In OpenSSL 3.0 these algorithms have been moved to the legacy provider +which is not enabled by default. This means allocation can and do fail. +Handle failed allocations by returning an actual error instead of +crashing later with a NULL context. + +Signed-off-by: Simo Sorce +--- a/plugins/digestmd5.c ++++ b/plugins/digestmd5.c +@@ -254,6 +254,7 @@ typedef struct context { + decode_context_t decode_context; + + /* if privacy mode is used use these functions for encode and decode */ ++ char *cipher_name; + cipher_function_t *cipher_enc; + cipher_function_t *cipher_dec; + cipher_init_t *cipher_init; +@@ -2818,6 +2819,7 @@ static int digestmd5_server_mech_step2(server_context_t *stext, + } + + if (cptr->name) { ++ text->cipher_name = cptr->name; + text->cipher_enc = cptr->cipher_enc; + text->cipher_dec = cptr->cipher_dec; + text->cipher_init = cptr->cipher_init; +@@ -2961,7 +2963,10 @@ static int digestmd5_server_mech_step2(server_context_t *stext, + if (text->cipher_init) { + if (text->cipher_init(text, enckey, deckey) != SASL_OK) { + sparams->utils->seterror(sparams->utils->conn, 0, +- "couldn't init cipher"); ++ "couldn't init cipher '%s'", ++ text->cipher_name); ++ result = SASL_FAIL; ++ goto FreeAllMem; + } + } + } +@@ -3512,6 +3517,7 @@ static int make_client_response(context_t *text, + oparams->mech_ssf = ctext->cipher->ssf; + + nbits = ctext->cipher->n; ++ text->cipher_name = ctext->cipher->name; + text->cipher_enc = ctext->cipher->cipher_enc; + text->cipher_dec = ctext->cipher->cipher_dec; + text->cipher_free = ctext->cipher->cipher_free; +@@ -3736,7 +3742,13 @@ static int make_client_response(context_t *text, + + /* initialize cipher if need be */ + if (text->cipher_init) { +- text->cipher_init(text, enckey, deckey); ++ if (text->cipher_init(text, enckey, deckey) != SASL_OK) { ++ params->utils->seterror(params->utils->conn, 0, ++ "internal error: failed to init cipher '%s'", ++ text->cipher_name); ++ result = SASL_FAIL; ++ goto FreeAllocatedMem; ++ } + } + } + + +From dfaa62392e7caecc6ecf0097b4d73738ec4fc0a8 Mon Sep 17 00:00:00 2001 +From: Simo Sorce +Date: Wed, 21 Jul 2021 06:05:45 -0400 +Subject: [PATCH] Catch errors from EVP_Digest* functions + +In OpenSSL 3.0 digest init can fail simply because a legacy provider is +not loaded of FIPS mode is active and the digest is not allowed. +If the errors are not handled the application may crash later trying to +access uninitialized contexts. + +Signed-off-by: Simo Sorce +--- a/saslauthd/lak.c ++++ b/saslauthd/lak.c +@@ -1806,18 +1806,36 @@ static int lak_check_hashed( + return rc; + } + +- EVP_DigestInit(mdctx, md); +- EVP_DigestUpdate(mdctx, passwd, strlen(passwd)); ++ rc = EVP_DigestInit(mdctx, md); ++ if (rc != 1) { ++ rc = LAK_FAIL; ++ goto done; ++ } ++ rc = EVP_DigestUpdate(mdctx, passwd, strlen(passwd)); ++ if (rc != 1) { ++ rc = LAK_FAIL; ++ goto done; ++ } + if (hrock->salted) { +- EVP_DigestUpdate(mdctx, &cred[EVP_MD_size(md)], +- clen - EVP_MD_size(md)); ++ rc = EVP_DigestUpdate(mdctx, &cred[EVP_MD_size(md)], ++ clen - EVP_MD_size(md)); ++ if (rc != 1) { ++ rc = LAK_FAIL; ++ goto done; ++ } ++ } ++ rc = EVP_DigestFinal(mdctx, digest, NULL); ++ if (rc != 1) { ++ rc = LAK_FAIL; ++ goto done; + } +- EVP_DigestFinal(mdctx, digest, NULL); +- EVP_MD_CTX_free(mdctx); + + rc = memcmp((char *)cred, (char *)digest, EVP_MD_size(md)); ++ rc = rc ? LAK_INVALID_PASSWORD : LAK_OK; ++done: ++ EVP_MD_CTX_free(mdctx); + free(cred); +- return rc ? LAK_INVALID_PASSWORD : LAK_OK; ++ return rc; + } + + #endif /* HAVE_OPENSSL */ + +From c2bd3afbca57f176d8c650670ce371444bb7fcc0 Mon Sep 17 00:00:00 2001 +From: Simo Sorce +Date: Wed, 21 Jul 2021 07:07:24 -0400 +Subject: [PATCH] Add a HMAC wrapper for deprecated function + +HMAC() is deprecated since 1.0, add a wrapper used when compiling +against OpenSSL 3.0+ so that we slowly move away from deprecated +functions. + +Signed-off-by: Simo Sorce +--- a/plugins/scram.c ++++ b/plugins/scram.c +@@ -65,7 +65,9 @@ + + #include + #include ++#if OPENSSL_VERSION_NUMBER < 0x30000000L + #include ++#endif + + /***************************** Common Section *****************************/ + +@@ -289,6 +291,32 @@ print_hash (const char * func, const char * hash, size_t hash_size) + } + #endif + ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ ++/* Decalre as void given functions never use the result */ ++void *HMAC(const EVP_MD *evp_md, const void *key, int key_len, ++ const unsigned char *data, size_t data_len, ++ unsigned char *md, unsigned int *md_len) ++{ ++ const char *digest; ++ size_t digest_size; ++ size_t out_len; ++ void *ret = NULL; ++ ++ digest = EVP_MD_get0_name(evp_md); ++ if (digest == NULL) { ++ return NULL; ++ } ++ digest_size = EVP_MD_size(evp_md); ++ ++ ret = EVP_Q_mac(NULL, "hmac", NULL, digest, NULL, key, key_len, ++ data, data_len, md, digest_size, &out_len); ++ if (ret != NULL) { ++ *md_len = (unsigned int)out_len; ++ } ++ return ret; ++} ++#endif + + /* The result variable need to point to a buffer big enough for the [SHA-*] hash */ + static void + diff --git a/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-static-build.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-static-build.patch new file mode 100644 index 0000000000..8b0c20caee --- /dev/null +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-static-build.patch @@ -0,0 +1,27 @@ +https://github.com/cyrusimap/cyrus-sasl/commit/bca0a6dd3bb3d38040753ac412945ce704818863 + +From bca0a6dd3bb3d38040753ac412945ce704818863 Mon Sep 17 00:00:00 2001 +From: Bastian Germann +Date: Thu, 24 Mar 2016 11:35:03 +0100 +Subject: [PATCH] Don't overwrite PIC objects with non-PIC variant + +This patch makes sure the non-PIC version of libsasldb.a, which +is created out of non-PIC objects, is not going to overwrite the PIC version, +which is created out of PIC objects. The PIC version is placed in .libs, and +the non-PIC version in the current directory. This ensures that both non-PIC +and PIC versions are available in the correct locations. + +Originally-by: Fabian Fagerholm +Signed-off-by: Bastian Germann +--- a/lib/Makefile.am ++++ b/lib/Makefile.am +@@ -99,7 +99,7 @@ endif + + libsasl2.a: libsasl2.la $(SASL_STATIC_OBJS) + @echo adding static plugins and dependencies +- $(AR) cru .libs/$@ $(SASL_STATIC_OBJS) ++ $(AR) cru $@ $(SASL_STATIC_OBJS) + @for i in ./libsasl2.la ../common/libplugin_common.la ../sasldb/libsasldb.la ../plugins/lib*.la; do \ + if test ! -f $$i; then continue; fi; . $$i; \ + for j in $$dependency_libs foo; do \ + diff --git a/server/auth/cyrus-sasl/pspec.xml b/server/auth/cyrus-sasl/pspec.xml index e20225722a..e5ebeffb2f 100644 --- a/server/auth/cyrus-sasl/pspec.xml +++ b/server/auth/cyrus-sasl/pspec.xml @@ -13,7 +13,7 @@ service The Cyrus SASL (Simple Authentication and Security Layer) cyrus-sasl is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions. - https://github.com/cyrusimap/cyrus-sasl/releases/download/cyrus-sasl-2.1.27/cyrus-sasl-2.1.27.tar.gz + https://github.com/cyrusimap/cyrus-sasl/releases/download/cyrus-sasl-2.1.28/cyrus-sasl-2.1.28.tar.gz mit-kerberos-devel pam-devel @@ -26,16 +26,10 @@ gentoo/cyrus-sasl-2.1.25-auxprop.patch gentoo/cyrus-sasl-2.1.26-missing-size_t.patch - gentoo/cyrus-sasl-2.1.27-CVE-2019-19906.patch - gentoo/cyrus-sasl-2.1.27-as_needed.patch - gentoo/cyrus-sasl-2.1.27-autoconf-2.71.patch - gentoo/cyrus-sasl-2.1.27-autotools_fixes.patch - gentoo/cyrus-sasl-2.1.27-avoid_pic_overwrite.patch - gentoo/cyrus-sasl-2.1.27-db_gdbm-fix-gdbm_errno-overlay-from-gdbm_close.patch - gentoo/cyrus-sasl-2.1.27-doc_build_fix.patch gentoo/cyrus-sasl-2.1.27-gss_c_nt_hostbased_service.patch - gentoo/cyrus-sasl-2.1.27-memmem.patch - gentoo/cyrus-sasl-2.1.27-slibtool.patch + gentoo/cyrus-sasl-2.1.28-fix-configure-time-check.patch + gentoo/cyrus-sasl-2.1.28-gdbm-errno-redux.patch + gentoo/cyrus-sasl-2.1.28-static-build.patch @@ -85,6 +79,13 @@ + + 2022-12-06 + 2.1.28 + Version bump. + Mustafa Cinasal + muscnsl@gmail.com + 2021-11-06 2.1.27