From 3b2727bf7532048b83ac134018c749d6d50814fb Mon Sep 17 00:00:00 2001 From: idriskalp Date: Sun, 12 Jan 2020 21:46:28 +0300 Subject: [PATCH] cyrus-sasl 2.1.27 --- server/auth/cyrus-sasl/actions.py | 24 +-- ...0006-Enable-autoconf-maintainer-mode.patch | 22 +++ ...-libraries-when-ld-as-needed-is-used.patch | 37 +++++ ...n-t-use-la-files-for-opening-plugins.patch | 153 ++++++++++++++++++ ...er-checking-gss_inquire_sec_context_.patch | 26 +++ ...2-Fix-keytab-option-for-MIT-Kerberos.patch | 66 ++++++++ server/auth/cyrus-sasl/pspec.xml | 26 ++- 7 files changed, 340 insertions(+), 14 deletions(-) create mode 100644 server/auth/cyrus-sasl/files/0006-Enable-autoconf-maintainer-mode.patch create mode 100644 server/auth/cyrus-sasl/files/0010-Update-required-libraries-when-ld-as-needed-is-used.patch create mode 100644 server/auth/cyrus-sasl/files/0013-Don-t-use-la-files-for-opening-plugins.patch create mode 100644 server/auth/cyrus-sasl/files/0020-Restore-LIBS-after-checking-gss_inquire_sec_context_.patch create mode 100644 server/auth/cyrus-sasl/files/0022-Fix-keytab-option-for-MIT-Kerberos.patch diff --git a/server/auth/cyrus-sasl/actions.py b/server/auth/cyrus-sasl/actions.py index dff49fe666..ad93dd5bff 100644 --- a/server/auth/cyrus-sasl/actions.py +++ b/server/auth/cyrus-sasl/actions.py @@ -16,11 +16,17 @@ def setup(): shelltools.unlink("config/%s" % p) cleanup() - autotools.autoreconf("-vfi --no-recursive -I config -I cmulocal") - shelltools.cd("saslauthd") - cleanup() - autotools.autoreconf("-vi --no-recursive -I config -I ../cmulocal -I ../config") - shelltools.cd("..") + #autotools.autoreconf("-vfi --no-recursive -I config -I cmulocal") + #shelltools.cd("saslauthd") + #cleanup() + #autotools.autoreconf("-vi --no-recursive -I config -I ../cmulocal -I ../config") + #shelltools.cd("..") + + shelltools.system("libtoolize -c") + shelltools.system("aclocal -I config") + shelltools.system("automake -a -c") + shelltools.system("autoheader") + autotools.autoconf() pisitools.cflags.add("-fPIC") @@ -72,8 +78,8 @@ def install(): pisitools.dodir("/etc/sasl2") pisitools.dodir("/run/saslauthd") - for doc in ["AUTHORS", "COPYING", "ChangeLog", "LDAP_SASLAUTHD", "NEWS", "README"]: - pisitools.newdoc("saslauthd/%s" % doc, "saslauthd/%s" % doc) + #for doc in ["AUTHORS", "COPYING", "ChangeLog", "LDAP_SASLAUTHD", "NEWS", "README"]: + #pisitools.newdoc("saslauthd/%s" % doc, "saslauthd/%s" % doc) - pisitools.dohtml("doc/*.html") - pisitools.dodoc("AUTHORS", "COPYING", "ChangeLog", "NEWS", "README", "doc/TODO", "doc/*.txt") + pisitools.dohtml("doc/html/*.html") + pisitools.dodoc("AUTHORS", "COPYING", "ChangeLog", "README") diff --git a/server/auth/cyrus-sasl/files/0006-Enable-autoconf-maintainer-mode.patch b/server/auth/cyrus-sasl/files/0006-Enable-autoconf-maintainer-mode.patch new file mode 100644 index 0000000000..4f2f65cfe3 --- /dev/null +++ b/server/auth/cyrus-sasl/files/0006-Enable-autoconf-maintainer-mode.patch @@ -0,0 +1,22 @@ +From: Debian Cyrus SASL Team + +Date: Thu, 24 Mar 2016 11:35:03 +0100 +Subject: Enable autoconf maintainer mode + +--- + configure.ac | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/configure.ac b/configure.ac +index 388f5d0..b3db52c 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -69,6 +69,8 @@ AC_CANONICAL_TARGET + + AM_INIT_AUTOMAKE([1.11 tar-ustar dist-bzip2 foreign -Wno-portability subdir-objects]) + ++AM_MAINTAINER_MODE ++ + DIRS="" + + AC_ARG_ENABLE(cmulocal, diff --git a/server/auth/cyrus-sasl/files/0010-Update-required-libraries-when-ld-as-needed-is-used.patch b/server/auth/cyrus-sasl/files/0010-Update-required-libraries-when-ld-as-needed-is-used.patch new file mode 100644 index 0000000000..d1457ee691 --- /dev/null +++ b/server/auth/cyrus-sasl/files/0010-Update-required-libraries-when-ld-as-needed-is-used.patch @@ -0,0 +1,37 @@ +From: Debian Cyrus SASL Team + +Date: Thu, 24 Mar 2016 11:35:04 +0100 +Subject: Update required libraries when ld --as-needed is used + +it. +--- + saslauthd/Makefile.am | 2 +- + sasldb/Makefile.am | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/saslauthd/Makefile.am b/saslauthd/Makefile.am +index 864b29b..4cf3a3d 100644 +--- a/saslauthd/Makefile.am ++++ b/saslauthd/Makefile.am +@@ -25,7 +25,7 @@ EXTRA_saslauthd_sources = getaddrinfo.c getnameinfo.c + saslauthd_DEPENDENCIES = saslauthd-main.o $(LTLIBOBJS_FULL) + saslauthd_LDADD = @SASL_KRB_LIB@ \ + @GSSAPIBASE_LIBS@ @LIB_CRYPT@ @LIB_SIA@ \ +- @LIB_SOCKET@ @SASL_DB_LIB@ @LIB_PAM@ @LDAP_LIBS@ $(LTLIBOBJS_FULL) $(CRYPTO_COMPAT_OBJS) $(LIBSASLDB_OBJS) ++ @LIB_SOCKET@ ../sasldb/libsasldb.la @LIB_PAM@ @LDAP_LIBS@ $(LTLIBOBJS_FULL) $(CRYPTO_COMPAT_OBJS) $(LIBSASLDB_OBJS) + + testsaslauthd_SOURCES = testsaslauthd.c utils.c + testsaslauthd_LDADD = @LIB_SOCKET@ +diff --git a/sasldb/Makefile.am b/sasldb/Makefile.am +index 497ee25..a27645f 100644 +--- a/sasldb/Makefile.am ++++ b/sasldb/Makefile.am +@@ -54,6 +54,6 @@ noinst_LTLIBRARIES = libsasldb.la + + libsasldb_la_SOURCES = allockey.c sasldb.h + EXTRA_libsasldb_la_SOURCES = $(extra_common_sources) +-libsasldb_la_DEPENDENCIES = $(SASL_DB_BACKEND) +-libsasldb_la_LIBADD = $(SASL_DB_BACKEND) ++libsasldb_la_DEPENDENCIES = $(SASL_DB_BACKEND) $(SASL_DB_LIB) ++libsasldb_la_LIBADD = $(SASL_DB_BACKEND) $(SASL_DB_LIB) + libsasldb_la_LDFLAGS = -no-undefined diff --git a/server/auth/cyrus-sasl/files/0013-Don-t-use-la-files-for-opening-plugins.patch b/server/auth/cyrus-sasl/files/0013-Don-t-use-la-files-for-opening-plugins.patch new file mode 100644 index 0000000000..d024139557 --- /dev/null +++ b/server/auth/cyrus-sasl/files/0013-Don-t-use-la-files-for-opening-plugins.patch @@ -0,0 +1,153 @@ +From: Debian Cyrus SASL Team + +Date: Thu, 24 Mar 2016 11:35:04 +0100 +Subject: Don't use la files for opening plugins + +--- + lib/dlopen.c | 121 ++++------------------------------------------------------- + 1 file changed, 7 insertions(+), 114 deletions(-) + +diff --git a/lib/dlopen.c b/lib/dlopen.c +index 8284cd8..ef90b11 100644 +--- a/lib/dlopen.c ++++ b/lib/dlopen.c +@@ -246,113 +246,6 @@ static int _sasl_plugin_load(char *plugin, void *library, + return result; + } + +-/* this returns the file to actually open. +- * out should be a buffer of size PATH_MAX +- * and may be the same as in. */ +- +-/* We'll use a static buffer for speed unless someone complains */ +-#define MAX_LINE 2048 +- +-static int _parse_la(const char *prefix, const char *in, char *out) +-{ +- FILE *file; +- size_t length; +- char line[MAX_LINE]; +- char *ntmp = NULL; +- +- if(!in || !out || !prefix || out == in) return SASL_BADPARAM; +- +- /* Set this so we can detect failure */ +- *out = '\0'; +- +- length = strlen(in); +- +- if (strcmp(in + (length - strlen(LA_SUFFIX)), LA_SUFFIX)) { +- if(!strcmp(in + (length - strlen(SO_SUFFIX)),SO_SUFFIX)) { +- /* check for a .la file */ +- if (strlen(prefix) + strlen(in) + strlen(LA_SUFFIX) + 1 >= MAX_LINE) +- return SASL_BADPARAM; +- strcpy(line, prefix); +- strcat(line, in); +- length = strlen(line); +- *(line + (length - strlen(SO_SUFFIX))) = '\0'; +- strcat(line, LA_SUFFIX); +- file = fopen(line, "r"); +- if(file) { +- /* We'll get it on the .la open */ +- fclose(file); +- return SASL_FAIL; +- } +- } +- if (strlen(prefix) + strlen(in) + 1 >= PATH_MAX) +- return SASL_BADPARAM; +- strcpy(out, prefix); +- strcat(out, in); +- return SASL_OK; +- } +- +- if (strlen(prefix) + strlen(in) + 1 >= MAX_LINE) +- return SASL_BADPARAM; +- strcpy(line, prefix); +- strcat(line, in); +- +- file = fopen(line, "r"); +- if(!file) { +- _sasl_log(NULL, SASL_LOG_WARN, +- "unable to open LA file: %s", line); +- return SASL_FAIL; +- } +- +- while(!feof(file)) { +- if(!fgets(line, MAX_LINE, file)) break; +- if(line[strlen(line) - 1] != '\n') { +- _sasl_log(NULL, SASL_LOG_WARN, +- "LA file has too long of a line: %s", in); +- fclose(file); +- return SASL_BUFOVER; +- } +- if(line[0] == '\n' || line[0] == '#') continue; +- if(!strncmp(line, "dlname=", sizeof("dlname=") - 1)) { +- /* We found the line with the name in it */ +- char *end; +- char *start; +- size_t len; +- end = strrchr(line, '\''); +- if(!end) continue; +- start = &line[sizeof("dlname=")-1]; +- len = strlen(start); +- if(len > 3 && start[0] == '\'') { +- ntmp=&start[1]; +- *end='\0'; +- /* Do we have dlname="" ? */ +- if(ntmp == end) { +- _sasl_log(NULL, SASL_LOG_DEBUG, +- "dlname is empty in .la file: %s", in); +- fclose(file); +- return SASL_FAIL; +- } +- strcpy(out, prefix); +- strcat(out, ntmp); +- } +- break; +- } +- } +- if(ferror(file) || feof(file)) { +- _sasl_log(NULL, SASL_LOG_WARN, +- "Error reading .la: %s\n", in); +- fclose(file); +- return SASL_FAIL; +- } +- fclose(file); +- +- if(!(*out)) { +- _sasl_log(NULL, SASL_LOG_WARN, +- "Could not find a dlname line in .la file: %s", in); +- return SASL_FAIL; +- } +- +- return SASL_OK; +-} + #endif /* DO_DLOPEN */ + + /* loads a plugin library */ +@@ -506,18 +399,18 @@ int _sasl_load_plugins(const add_plugin_list_t *entrypoints, + if (length + pos>=PATH_MAX) continue; /* too big */ + + if (strcmp(dir->d_name + (length - strlen(SO_SUFFIX)), +- SO_SUFFIX) +- && strcmp(dir->d_name + (length - strlen(LA_SUFFIX)), +- LA_SUFFIX)) ++ SO_SUFFIX)) + continue; + ++ /* We only use .so files for loading plugins */ ++ + memcpy(name,dir->d_name,length); + name[length]='\0'; + +- result = _parse_la(prefix, name, tmp); +- if(result != SASL_OK) +- continue; +- ++ /* Create full name with path */ ++ strncpy(tmp, prefix, PATH_MAX); ++ strncat(tmp, name, PATH_MAX); ++ + /* skip "lib" and cut off suffix -- + this only need be approximate */ + strcpy(plugname, name + 3); diff --git a/server/auth/cyrus-sasl/files/0020-Restore-LIBS-after-checking-gss_inquire_sec_context_.patch b/server/auth/cyrus-sasl/files/0020-Restore-LIBS-after-checking-gss_inquire_sec_context_.patch new file mode 100644 index 0000000000..fd82dd70ef --- /dev/null +++ b/server/auth/cyrus-sasl/files/0020-Restore-LIBS-after-checking-gss_inquire_sec_context_.patch @@ -0,0 +1,26 @@ +From 31b68a9438c24fc9e3e52f626462bf514de31757 Mon Sep 17 00:00:00 2001 +From: Ryan Tandy +Date: Mon, 24 Dec 2018 15:07:02 -0800 +Subject: [PATCH] Restore LIBS after checking gss_inquire_sec_context_by_oid + +Fixes: 4b0306dcd76031460246b2dabcb7db766d6b04d8 +--- + m4/sasl2.m4 | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/m4/sasl2.m4 b/m4/sasl2.m4 +index 56e0504a..17f5d081 100644 +--- a/m4/sasl2.m4 ++++ b/m4/sasl2.m4 +@@ -311,9 +311,10 @@ if test "$gssapi" != no; then + [AC_DEFINE(HAVE_GSS_C_SEC_CONTEXT_SASL_SSF,, + [Define if your GSSAPI implementation defines GSS_C_SEC_CONTEXT_SASL_SSF])]) + fi ++ LIBS="$cmu_save_LIBS" ++ + cmu_save_LIBS="$LIBS" + LIBS="$LIBS $GSSAPIBASE_LIBS" +- + AC_MSG_CHECKING([for SPNEGO support in GSSAPI libraries]) + AC_TRY_RUN([ + #ifdef HAVE_GSSAPI_H diff --git a/server/auth/cyrus-sasl/files/0022-Fix-keytab-option-for-MIT-Kerberos.patch b/server/auth/cyrus-sasl/files/0022-Fix-keytab-option-for-MIT-Kerberos.patch new file mode 100644 index 0000000000..316ecd1888 --- /dev/null +++ b/server/auth/cyrus-sasl/files/0022-Fix-keytab-option-for-MIT-Kerberos.patch @@ -0,0 +1,66 @@ +From: Debian Cyrus SASL Team + +Date: Thu, 24 Mar 2016 11:35:05 +0100 +Subject: Fix keytab option for MIT Kerberos + +--- + m4/sasl2.m4 | 1 + + plugins/gssapi.c | 11 ++++++++--- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/m4/sasl2.m4 b/m4/sasl2.m4 +index 56e0504..a90f7b4 100644 +--- a/m4/sasl2.m4 ++++ b/m4/sasl2.m4 +@@ -282,6 +282,7 @@ if test "$gssapi" != no; then + ]) + fi + fi ++ AC_CHECK_FUNCS(krb5_gss_register_acceptor_identity) + AC_CHECK_FUNCS(gss_decapsulate_token) + AC_CHECK_FUNCS(gss_encapsulate_token) + AC_CHECK_FUNCS(gss_oid_equal) +diff --git a/plugins/gssapi.c b/plugins/gssapi.c +index ff663da..7c69ac2 100644 +--- a/plugins/gssapi.c ++++ b/plugins/gssapi.c +@@ -1545,7 +1545,7 @@ static sasl_server_plug_t gssapi_server_plugins[] = + }; + + int gssapiv2_server_plug_init( +-#ifndef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY ++#if !defined(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY) && !defined(HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY) + const sasl_utils_t *utils __attribute__((unused)), + #else + const sasl_utils_t *utils, +@@ -1555,7 +1555,7 @@ int gssapiv2_server_plug_init( + sasl_server_plug_t **pluglist, + int *plugcount) + { +-#ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY ++#if defined(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY) || defined(HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY) + const char *keytab = NULL; + char keytab_path[1024]; + unsigned int rl; +@@ -1565,7 +1565,7 @@ int gssapiv2_server_plug_init( + return SASL_BADVERS; + } + +-#ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY ++#if defined(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY) || defined(HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY) + /* unfortunately, we don't check for readability of keytab if it's + the standard one, since we don't know where it is */ + +@@ -1587,7 +1587,12 @@ int gssapiv2_server_plug_init( + + strncpy(keytab_path, keytab, 1024); + ++#ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY + gsskrb5_register_acceptor_identity(keytab_path); ++#endif ++#ifdef HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY ++ krb5_gss_register_acceptor_identity(keytab_path); ++#endif + } + #endif + diff --git a/server/auth/cyrus-sasl/pspec.xml b/server/auth/cyrus-sasl/pspec.xml index 8e36f211e1..c5a5c2bf06 100644 --- a/server/auth/cyrus-sasl/pspec.xml +++ b/server/auth/cyrus-sasl/pspec.xml @@ -13,7 +13,7 @@ service The Cyrus SASL (Simple Authentication and Security Layer) cyrus-sasl is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. To use SASL, a protocol includes a command for identifying and authenticating a user to a server and for optionally negotiating protection of subsequent protocol interactions. - http://cyrusimap.org/releases/cyrus-sasl-2.1.26.tar.gz + http://cyrusimap.org/releases/cyrus-sasl-2.1.27.tar.gz mit-kerberos pam-devel @@ -24,17 +24,17 @@ - CVE-2013-4122.patch + + + 0006-Enable-autoconf-maintainer-mode.patch + 0010-Update-required-libraries-when-ld-as-needed-is-used.patch + 0013-Don-t-use-la-files-for-opening-plugins.patch + 0020-Restore-LIBS-after-checking-gss_inquire_sec_context_.patch + 0022-Fix-keytab-option-for-MIT-Kerberos.patch + + cyrus-sasl-2.1.20-saslauthd.conf-path.patch + cyrus-sasl-2.1.22-ldap-timeout.patch @@ -92,6 +101,13 @@ + + 2020-01-12 + 2.1.27 + Version bump + Idris Kalp + idriskalp@gmail.com + 2018-08-03 2.1.26