Pisilinux/main
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cyrus-sasl ver. bump

Browse Source
This commit is contained in:
Rmys
2022-12-06 13:39:54 +03:00
parent 1ef96cc545
commit 23c09aa902
5 changed files with 292 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-fix-configure-time-check.patch
+50
View File
@@ -0,0 +1,50 @@
https://github.com/cyrusimap/cyrus-sasl/pull/709
From 399625c3413c313e93432d0f5907350722b861c7 Mon Sep 17 00:00:00 2001
From: Sam James <sam@gentoo.org>
Date: Wed, 23 Feb 2022 00:45:15 +0000
Subject: [PATCH] Fix <time.h> check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
We're conditionally including based on HAVE_TIME_H in a bunch of places,
but we're not actually checking for time.h, so that's never going to be defined.
While at it, add in a missing include in the cram plugin.
This fixes a bunch of implicit declaration warnings:
```
* cyrus-sasl-2.1.28/lib/saslutil.c:280:3: warning: implicit declaration of function ‘time’ [-Wimplicit-function-declaration]
* cyrus-sasl-2.1.28/lib/saslutil.c:364:41: warning: implicit declaration of function ‘clock’ [-Wimplicit-function-declaration]
* cyrus-sasl-2.1.28/plugins/cram.c:132:7: warning: implicit declaration of function ‘time’ [-Wimplicit-function-declaration]
* cyrus-sasl-2.1.28/lib/saslutil.c:280:3: warning: implicit declaration of function ‘time’ [-Wimplicit-function-declaration]
* cyrus-sasl-2.1.28/lib/saslutil.c:364:41: warning: implicit declaration of function ‘clock’ [-Wimplicit-function-declaration]
* cyrus-sasl-2.1.28/plugins/cram.c:132:7: warning: implicit declaration of function ‘time’ [-Wimplicit-function-declaration]
```
Signed-off-by: Sam James <sam@gentoo.org>
--- a/configure.ac
+++ b/configure.ac
@@ -1290,7 +1290,7 @@ AC_CHECK_HEADERS_ONCE([sys/time.h])
AC_HEADER_DIRENT
AC_HEADER_SYS_WAIT
-AC_CHECK_HEADERS(crypt.h des.h dlfcn.h fcntl.h limits.h malloc.h paths.h strings.h sys/file.h sys/time.h syslog.h unistd.h inttypes.h sys/uio.h sys/param.h sysexits.h stdarg.h varargs.h krb5.h)
+AC_CHECK_HEADERS(crypt.h des.h dlfcn.h fcntl.h limits.h malloc.h paths.h strings.h sys/file.h sys/time.h syslog.h time.h unistd.h inttypes.h sys/uio.h sys/param.h sysexits.h stdarg.h varargs.h krb5.h)
IPv6_CHECK_SS_FAMILY()
IPv6_CHECK_SA_LEN()
--- a/plugins/cram.c
+++ b/plugins/cram.c
@@ -53,6 +53,10 @@
#endif
#include <fcntl.h>
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
+
#include <sasl.h>
#include <saslplug.h>
#include <saslutil.h>
server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-gdbm-errno-redux.patch
+21
View File
@@ -0,0 +1,21 @@
https://github.com/cyrusimap/cyrus-sasl/commit/92be047033d56c29473223c44985592b1290a701
From 92be047033d56c29473223c44985592b1290a701 Mon Sep 17 00:00:00 2001
From: Quanah Gibson-Mount <quanah@symas.com>
Date: Tue, 3 May 2022 16:31:37 +0000
Subject: [PATCH] Fix earlier #554 commit to use fetch_errno instead of
gdbm_errno
Signed-off-by: Quanah Gibson-Mount <quanah@symas.com>
--- a/sasldb/db_gdbm.c
+++ b/sasldb/db_gdbm.c
@@ -119,7 +119,7 @@ int _sasldb_getdata(const sasl_utils_t *utils,
} else {
utils->seterror(conn, 0,
"Couldn't fetch entry from %s: gdbm_errno=%d",
- path, gdbm_errno);
+ path, fetch_errno);
result = SASL_FAIL;
}
goto cleanup;
server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-openssl3.patch
+183
View File
@@ -0,0 +1,183 @@
https://github.com/cyrusimap/cyrus-sasl/commit/887dbc0435056ec58ee48c4d803f110ade1e4c39
https://github.com/cyrusimap/cyrus-sasl/commit/dfaa62392e7caecc6ecf0097b4d73738ec4fc0a8
https://github.com/cyrusimap/cyrus-sasl/commit/c2bd3afbca57f176d8c650670ce371444bb7fcc0.
From 887dbc0435056ec58ee48c4d803f110ade1e4c39 Mon Sep 17 00:00:00 2001
From: Simo Sorce <simo@redhat.com>
Date: Mon, 21 Jun 2021 14:24:18 -0400
Subject: [PATCH] Gracefully handle failed initializations
In OpenSSL 3.0 these algorithms have been moved to the legacy provider
which is not enabled by default. This means allocation can and do fail.
Handle failed allocations by returning an actual error instead of
crashing later with a NULL context.
Signed-off-by: Simo Sorce <simo@redhat.com>
--- a/plugins/digestmd5.c
+++ b/plugins/digestmd5.c
@@ -254,6 +254,7 @@ typedef struct context {
decode_context_t decode_context;
/* if privacy mode is used use these functions for encode and decode */
+ char *cipher_name;
cipher_function_t *cipher_enc;
cipher_function_t *cipher_dec;
cipher_init_t *cipher_init;
@@ -2818,6 +2819,7 @@ static int digestmd5_server_mech_step2(server_context_t *stext,
}
if (cptr->name) {
+ text->cipher_name = cptr->name;
text->cipher_enc = cptr->cipher_enc;
text->cipher_dec = cptr->cipher_dec;
text->cipher_init = cptr->cipher_init;
@@ -2961,7 +2963,10 @@ static int digestmd5_server_mech_step2(server_context_t *stext,
if (text->cipher_init) {
if (text->cipher_init(text, enckey, deckey) != SASL_OK) {
sparams->utils->seterror(sparams->utils->conn, 0,
- "couldn't init cipher");
+ "couldn't init cipher '%s'",
+ text->cipher_name);
+ result = SASL_FAIL;
+ goto FreeAllMem;
}
}
}
@@ -3512,6 +3517,7 @@ static int make_client_response(context_t *text,
oparams->mech_ssf = ctext->cipher->ssf;
nbits = ctext->cipher->n;
+ text->cipher_name = ctext->cipher->name;
text->cipher_enc = ctext->cipher->cipher_enc;
text->cipher_dec = ctext->cipher->cipher_dec;
text->cipher_free = ctext->cipher->cipher_free;
@@ -3736,7 +3742,13 @@ static int make_client_response(context_t *text,
/* initialize cipher if need be */
if (text->cipher_init) {
- text->cipher_init(text, enckey, deckey);
+ if (text->cipher_init(text, enckey, deckey) != SASL_OK) {
+ params->utils->seterror(params->utils->conn, 0,
+ "internal error: failed to init cipher '%s'",
+ text->cipher_name);
+ result = SASL_FAIL;
+ goto FreeAllocatedMem;
+ }
}
}
From dfaa62392e7caecc6ecf0097b4d73738ec4fc0a8 Mon Sep 17 00:00:00 2001
From: Simo Sorce <simo@redhat.com>
Date: Wed, 21 Jul 2021 06:05:45 -0400
Subject: [PATCH] Catch errors from EVP_Digest* functions
In OpenSSL 3.0 digest init can fail simply because a legacy provider is
not loaded of FIPS mode is active and the digest is not allowed.
If the errors are not handled the application may crash later trying to
access uninitialized contexts.
Signed-off-by: Simo Sorce <simo@redhat.com>
--- a/saslauthd/lak.c
+++ b/saslauthd/lak.c
@@ -1806,18 +1806,36 @@ static int lak_check_hashed(
return rc;
}
- EVP_DigestInit(mdctx, md);
- EVP_DigestUpdate(mdctx, passwd, strlen(passwd));
+ rc = EVP_DigestInit(mdctx, md);
+ if (rc != 1) {
+ rc = LAK_FAIL;
+ goto done;
+ }
+ rc = EVP_DigestUpdate(mdctx, passwd, strlen(passwd));
+ if (rc != 1) {
+ rc = LAK_FAIL;
+ goto done;
+ }
if (hrock->salted) {
- EVP_DigestUpdate(mdctx, &cred[EVP_MD_size(md)],
- clen - EVP_MD_size(md));
+ rc = EVP_DigestUpdate(mdctx, &cred[EVP_MD_size(md)],
+ clen - EVP_MD_size(md));
+ if (rc != 1) {
+ rc = LAK_FAIL;
+ goto done;
+ }
+ }
+ rc = EVP_DigestFinal(mdctx, digest, NULL);
+ if (rc != 1) {
+ rc = LAK_FAIL;
+ goto done;
}
- EVP_DigestFinal(mdctx, digest, NULL);
- EVP_MD_CTX_free(mdctx);
rc = memcmp((char *)cred, (char *)digest, EVP_MD_size(md));
+ rc = rc ? LAK_INVALID_PASSWORD : LAK_OK;
+done:
+ EVP_MD_CTX_free(mdctx);
free(cred);
- return rc ? LAK_INVALID_PASSWORD : LAK_OK;
+ return rc;
}
#endif /* HAVE_OPENSSL */
From c2bd3afbca57f176d8c650670ce371444bb7fcc0 Mon Sep 17 00:00:00 2001
From: Simo Sorce <simo@redhat.com>
Date: Wed, 21 Jul 2021 07:07:24 -0400
Subject: [PATCH] Add a HMAC wrapper for deprecated function
HMAC() is deprecated since 1.0, add a wrapper used when compiling
against OpenSSL 3.0+ so that we slowly move away from deprecated
functions.
Signed-off-by: Simo Sorce <simo@redhat.com>
--- a/plugins/scram.c
+++ b/plugins/scram.c
@@ -65,7 +65,9 @@
#include <openssl/sha.h>
#include <openssl/evp.h>
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
#include <openssl/hmac.h>
+#endif
/***************************** Common Section *****************************/
@@ -289,6 +291,32 @@ print_hash (const char * func, const char * hash, size_t hash_size)
}
#endif
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+
+/* Decalre as void given functions never use the result */
+void *HMAC(const EVP_MD *evp_md, const void *key, int key_len,
+ const unsigned char *data, size_t data_len,
+ unsigned char *md, unsigned int *md_len)
+{
+ const char *digest;
+ size_t digest_size;
+ size_t out_len;
+ void *ret = NULL;
+
+ digest = EVP_MD_get0_name(evp_md);
+ if (digest == NULL) {
+ return NULL;
+ }
+ digest_size = EVP_MD_size(evp_md);
+
+ ret = EVP_Q_mac(NULL, "hmac", NULL, digest, NULL, key, key_len,
+ data, data_len, md, digest_size, &out_len);
+ if (ret != NULL) {
+ *md_len = (unsigned int)out_len;
+ }
+ return ret;
+}
+#endif
/* The result variable need to point to a buffer big enough for the [SHA-*] hash */
static void
server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.28-static-build.patch
+27
View File
@@ -0,0 +1,27 @@
https://github.com/cyrusimap/cyrus-sasl/commit/bca0a6dd3bb3d38040753ac412945ce704818863
From bca0a6dd3bb3d38040753ac412945ce704818863 Mon Sep 17 00:00:00 2001
From: Bastian Germann <bage@debian.org>
Date: Thu, 24 Mar 2016 11:35:03 +0100
Subject: [PATCH] Don't overwrite PIC objects with non-PIC variant
This patch makes sure the non-PIC version of libsasldb.a, which
is created out of non-PIC objects, is not going to overwrite the PIC version,
which is created out of PIC objects. The PIC version is placed in .libs, and
the non-PIC version in the current directory. This ensures that both non-PIC
and PIC versions are available in the correct locations.
Originally-by: Fabian Fagerholm <fabbe@debian.org>
Signed-off-by: Bastian Germann <bage@debian.org>
--- a/lib/Makefile.am
+++ b/lib/Makefile.am
@@ -99,7 +99,7 @@ endif
libsasl2.a: libsasl2.la $(SASL_STATIC_OBJS)
@echo adding static plugins and dependencies
- $(AR) cru .libs/$@ $(SASL_STATIC_OBJS)
+ $(AR) cru $@ $(SASL_STATIC_OBJS)
@for i in ./libsasl2.la ../common/libplugin_common.la ../sasldb/libsasldb.la ../plugins/lib*.la; do \
if test ! -f $$i; then continue; fi; . $$i; \
for j in $$dependency_libs foo; do \
server/auth/cyrus-sasl/pspec.xml
+11 -10
View File
@@ -13,7 +13,7 @@
<IsA>service</IsA> <IsA>service</IsA>
<Summary>The Cyrus SASL (Simple Authentication and Security Layer)</Summary> <Summary>The Cyrus SASL (Simple Authentication and Security Layer)</Summary>
<Description>cyrus-sasl is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions.</Description> <Description>cyrus-sasl is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions.</Description>
<Archive sha1sum="fbfe6f298b0d2efcdab6a40bf47e16d003ae5dc6" type="targz">https://github.com/cyrusimap/cyrus-sasl/releases/download/cyrus-sasl-2.1.27/cyrus-sasl-2.1.27.tar.gz</Archive> <Archive sha1sum="c96d2ccd891904ce0118fdfcdfbd47e37a1e7543" type="targz">https://github.com/cyrusimap/cyrus-sasl/releases/download/cyrus-sasl-2.1.28/cyrus-sasl-2.1.28.tar.gz</Archive>
<BuildDependencies> <BuildDependencies>
<Dependency>mit-kerberos-devel</Dependency> <Dependency>mit-kerberos-devel</Dependency>
<Dependency>pam-devel</Dependency> <Dependency>pam-devel</Dependency>
@@ -26,16 +26,10 @@
<Patches> <Patches>
<Patch level="1">gentoo/cyrus-sasl-2.1.25-auxprop.patch</Patch> <Patch level="1">gentoo/cyrus-sasl-2.1.25-auxprop.patch</Patch>
<Patch level="1">gentoo/cyrus-sasl-2.1.26-missing-size_t.patch</Patch> <Patch level="1">gentoo/cyrus-sasl-2.1.26-missing-size_t.patch</Patch>
<Patch level="1">gentoo/cyrus-sasl-2.1.27-CVE-2019-19906.patch</Patch>
<Patch level="1">gentoo/cyrus-sasl-2.1.27-as_needed.patch</Patch>
<Patch level="1">gentoo/cyrus-sasl-2.1.27-autoconf-2.71.patch</Patch>
<Patch level="1">gentoo/cyrus-sasl-2.1.27-autotools_fixes.patch</Patch>
<Patch level="1">gentoo/cyrus-sasl-2.1.27-avoid_pic_overwrite.patch</Patch>
<Patch level="1">gentoo/cyrus-sasl-2.1.27-db_gdbm-fix-gdbm_errno-overlay-from-gdbm_close.patch</Patch>
<Patch level="1">gentoo/cyrus-sasl-2.1.27-doc_build_fix.patch</Patch>
<Patch level="1">gentoo/cyrus-sasl-2.1.27-gss_c_nt_hostbased_service.patch</Patch> <Patch level="1">gentoo/cyrus-sasl-2.1.27-gss_c_nt_hostbased_service.patch</Patch>
<Patch level="1">gentoo/cyrus-sasl-2.1.27-memmem.patch</Patch> <Patch level="1">gentoo/cyrus-sasl-2.1.28-fix-configure-time-check.patch</Patch>
<Patch level="1">gentoo/cyrus-sasl-2.1.27-slibtool.patch</Patch> <Patch level="1">gentoo/cyrus-sasl-2.1.28-gdbm-errno-redux.patch</Patch>
<Patch level="1">gentoo/cyrus-sasl-2.1.28-static-build.patch</Patch>
</Patches> </Patches>
</Source> </Source>
@@ -85,6 +79,13 @@
</Package> </Package>
<History> <History>
<Update release="9">
<Date>2022-12-06</Date>
<Version>2.1.28</Version>
<Comment>Version bump.</Comment>
<Name>Mustafa Cinasal</Name>
<Email>muscnsl@gmail.com</Email>
</Update>
<Update release="8"> <Update release="8">
<Date>2021-11-06</Date> <Date>2021-11-06</Date>
<Version>2.1.27</Version> <Version>2.1.27</Version>