From c06ff65222689c9534bebd7f3aca51e695b4bec7 Mon Sep 17 00:00:00 2001 From: Rmys Date: Fri, 3 Dec 2021 15:24:56 +0300 Subject: [PATCH] cyrus-sasl rebuild --- server/auth/cyrus-sasl/actions.py | 19 ++- ...0006-Enable-autoconf-maintainer-mode.patch | 22 --- .../0011_saslauthd_ac_prog_libtool.patch | 15 -- ...n-t-use-la-files-for-opening-plugins.patch | 153 ------------------ ...er-checking-gss_inquire_sec_context_.patch | 26 --- ...2-Fix-keytab-option-for-MIT-Kerberos.patch | 66 -------- .../cyrus-sasl/files/0025_ld_as_needed.patch | 27 ---- .../0026_drop_krb5support_dependency.patch | 14 -- ...ont_use_la_files_for_opening_plugins.patch | 134 --------------- .../auth/cyrus-sasl/files/CVE-2013-4122.patch | 116 ------------- ...yrus-sasl-2.1.20-saslauthd.conf-path.patch | 20 --- .../files/cyrus-sasl-2.1.21-sizes.patch | 120 -------------- .../files/cyrus-sasl-2.1.22-as-needed.patch | 11 -- .../files/cyrus-sasl-2.1.22-kerberos4.patch | 26 --- .../cyrus-sasl-2.1.22-ldap-timeout.patch | 25 --- .../files/cyrus-sasl-2.1.22-qa.patch | 22 --- .../files/cyrus-sasl-2.1.23-man.patch | 37 ----- .../files/cyrus-sasl-2.1.26-keytab.patch | 36 ----- .../files/cyrus-sasl-2.1.26-no_rpath.patch | 19 --- .../cyrus-sasl-2.1.26-obsolete-macro.patch | 13 -- ...2.1.26-prefer-SCRAM-SHA-1-over-PLAIN.patch | 51 ------ .../files/cyrus-sasl-2.1.26-relro.patch | 59 ------- .../files/cyrus-sasl-2.1.26-size_t.patch | 12 -- .../files/cyrus-sasl-2.1.26-warnings.patch | 74 --------- .../gentoo/cyrus-sasl-2.1.25-auxprop.patch | 16 ++ .../cyrus-sasl-2.1.26-missing-size_t.patch | 13 ++ .../cyrus-sasl-2.1.27-CVE-2019-19906.patch | 20 +++ .../cyrus-sasl-2.1.27-as_needed.patch} | 28 +--- .../cyrus-sasl-2.1.27-autoconf-2.71.patch | 45 ++++++ .../cyrus-sasl-2.1.27-autotools_fixes.patch | 31 ++++ ...yrus-sasl-2.1.27-avoid_pic_overwrite.patch | 17 ++ ...x-gdbm_errno-overlay-from-gdbm_close.patch | 35 ++++ .../cyrus-sasl-2.1.27-doc_build_fix.patch | 11 ++ ...sl-2.1.27-gss_c_nt_hostbased_service.patch | 16 ++ .../gentoo/cyrus-sasl-2.1.27-memmem.patch | 53 ++++++ .../gentoo/cyrus-sasl-2.1.27-slibtool.patch | 18 +++ server/auth/cyrus-sasl/pspec.xml | 43 ++--- 37 files changed, 309 insertions(+), 1154 deletions(-) delete mode 100644 server/auth/cyrus-sasl/files/0006-Enable-autoconf-maintainer-mode.patch delete mode 100644 server/auth/cyrus-sasl/files/0011_saslauthd_ac_prog_libtool.patch delete mode 100644 server/auth/cyrus-sasl/files/0013-Don-t-use-la-files-for-opening-plugins.patch delete mode 100644 server/auth/cyrus-sasl/files/0020-Restore-LIBS-after-checking-gss_inquire_sec_context_.patch delete mode 100644 server/auth/cyrus-sasl/files/0022-Fix-keytab-option-for-MIT-Kerberos.patch delete mode 100644 server/auth/cyrus-sasl/files/0025_ld_as_needed.patch delete mode 100644 server/auth/cyrus-sasl/files/0026_drop_krb5support_dependency.patch delete mode 100644 server/auth/cyrus-sasl/files/0030-dont_use_la_files_for_opening_plugins.patch delete mode 100644 server/auth/cyrus-sasl/files/CVE-2013-4122.patch delete mode 100644 server/auth/cyrus-sasl/files/cyrus-sasl-2.1.20-saslauthd.conf-path.patch delete mode 100644 server/auth/cyrus-sasl/files/cyrus-sasl-2.1.21-sizes.patch delete mode 100644 server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-as-needed.patch delete mode 100644 server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-kerberos4.patch delete mode 100644 server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-ldap-timeout.patch delete mode 100644 server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-qa.patch delete mode 100644 server/auth/cyrus-sasl/files/cyrus-sasl-2.1.23-man.patch delete mode 100644 server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-keytab.patch delete mode 100644 server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-no_rpath.patch delete mode 100644 server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-obsolete-macro.patch delete mode 100644 server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-prefer-SCRAM-SHA-1-over-PLAIN.patch delete mode 100644 server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-relro.patch delete mode 100644 server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-size_t.patch delete mode 100644 server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-warnings.patch create mode 100644 server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.25-auxprop.patch create mode 100644 server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.26-missing-size_t.patch create mode 100644 server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-CVE-2019-19906.patch rename server/auth/cyrus-sasl/files/{0010-Update-required-libraries-when-ld-as-needed-is-used.patch => gentoo/cyrus-sasl-2.1.27-as_needed.patch} (53%) create mode 100644 server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-autoconf-2.71.patch create mode 100644 server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-autotools_fixes.patch create mode 100644 server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-avoid_pic_overwrite.patch create mode 100644 server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-db_gdbm-fix-gdbm_errno-overlay-from-gdbm_close.patch create mode 100644 server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-doc_build_fix.patch create mode 100644 server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-gss_c_nt_hostbased_service.patch create mode 100644 server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-memmem.patch create mode 100644 server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-slibtool.patch diff --git a/server/auth/cyrus-sasl/actions.py b/server/auth/cyrus-sasl/actions.py index dd83e1af16..c685c399aa 100644 --- a/server/auth/cyrus-sasl/actions.py +++ b/server/auth/cyrus-sasl/actions.py @@ -11,24 +11,31 @@ from pisi.actionsapi import shelltools def setup(): pisitools.dosed("libsasl2.pc.in", "libdir = @libdir@", "prefix=/usr\nexec_prefix=${prefix}\nlibdir = @libdir@") - def cleanup(): - for p in ("config.*", "ltconfig", "ltmain.sh", "libtool.m4"): - shelltools.unlink("config/%s" % p) + #def cleanup(): + #for p in ("config.*", "ltconfig", "ltmain.sh", "libtool.m4"): + #shelltools.unlink("config/%s" % p) - cleanup() + #cleanup() #autotools.autoreconf("-vfi --no-recursive -I config -I cmulocal") #shelltools.cd("saslauthd") #cleanup() #autotools.autoreconf("-vi --no-recursive -I config -I ../cmulocal -I ../config") #shelltools.cd("..") - + + shelltools.system("""sed -i -e '/LIB_SQLITE.*-R/s/ -R[^"]*//' \ + configure.ac || die""") + + shelltools.system("sed -i -e 's:AM_CONFIG_HEADER:AC_CONFIG_HEADERS:g' \ + -e 's:AC_CONFIG_MACRO_DIR:AC_CONFIG_MACRO_DIRS:g' \ + configure.ac || die") + shelltools.system("libtoolize -c") shelltools.system("aclocal -I config") shelltools.system("automake -a -c") shelltools.system("autoheader") autotools.autoconf() - pisitools.cflags.add("-fPIC") + pisitools.cflags.add("-fno-strict-aliasing") # Don't disable ldap support to break circular dep. with openldap # As workaround, we remove openldap-client runtime dep. in pspec diff --git a/server/auth/cyrus-sasl/files/0006-Enable-autoconf-maintainer-mode.patch b/server/auth/cyrus-sasl/files/0006-Enable-autoconf-maintainer-mode.patch deleted file mode 100644 index 4f2f65cfe3..0000000000 --- a/server/auth/cyrus-sasl/files/0006-Enable-autoconf-maintainer-mode.patch +++ /dev/null @@ -1,22 +0,0 @@ -From: Debian Cyrus SASL Team - -Date: Thu, 24 Mar 2016 11:35:03 +0100 -Subject: Enable autoconf maintainer mode - ---- - configure.ac | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/configure.ac b/configure.ac -index 388f5d0..b3db52c 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -69,6 +69,8 @@ AC_CANONICAL_TARGET - - AM_INIT_AUTOMAKE([1.11 tar-ustar dist-bzip2 foreign -Wno-portability subdir-objects]) - -+AM_MAINTAINER_MODE -+ - DIRS="" - - AC_ARG_ENABLE(cmulocal, diff --git a/server/auth/cyrus-sasl/files/0011_saslauthd_ac_prog_libtool.patch b/server/auth/cyrus-sasl/files/0011_saslauthd_ac_prog_libtool.patch deleted file mode 100644 index 3805b4857c..0000000000 --- a/server/auth/cyrus-sasl/files/0011_saslauthd_ac_prog_libtool.patch +++ /dev/null @@ -1,15 +0,0 @@ -0011_saslauthd_ac_prog_libtool.dpatch by - -Enable libtool use. - -diff -urNad trunk~/saslauthd/configure.in trunk/saslauthd/configure.in ---- trunk~/saslauthd/configure.in 2006-05-29 22:52:42.000000000 +0300 -+++ trunk/saslauthd/configure.in 2006-11-01 23:41:51.000000000 +0200 -@@ -25,6 +25,7 @@ - AC_PROG_MAKE_SET - AC_PROG_LN_S - AC_PROG_INSTALL -+AC_PROG_LIBTOOL - - dnl Checks for build foo - CMU_C___ATTRIBUTE__ diff --git a/server/auth/cyrus-sasl/files/0013-Don-t-use-la-files-for-opening-plugins.patch b/server/auth/cyrus-sasl/files/0013-Don-t-use-la-files-for-opening-plugins.patch deleted file mode 100644 index d024139557..0000000000 --- a/server/auth/cyrus-sasl/files/0013-Don-t-use-la-files-for-opening-plugins.patch +++ /dev/null @@ -1,153 +0,0 @@ -From: Debian Cyrus SASL Team - -Date: Thu, 24 Mar 2016 11:35:04 +0100 -Subject: Don't use la files for opening plugins - ---- - lib/dlopen.c | 121 ++++------------------------------------------------------- - 1 file changed, 7 insertions(+), 114 deletions(-) - -diff --git a/lib/dlopen.c b/lib/dlopen.c -index 8284cd8..ef90b11 100644 ---- a/lib/dlopen.c -+++ b/lib/dlopen.c -@@ -246,113 +246,6 @@ static int _sasl_plugin_load(char *plugin, void *library, - return result; - } - --/* this returns the file to actually open. -- * out should be a buffer of size PATH_MAX -- * and may be the same as in. */ -- --/* We'll use a static buffer for speed unless someone complains */ --#define MAX_LINE 2048 -- --static int _parse_la(const char *prefix, const char *in, char *out) --{ -- FILE *file; -- size_t length; -- char line[MAX_LINE]; -- char *ntmp = NULL; -- -- if(!in || !out || !prefix || out == in) return SASL_BADPARAM; -- -- /* Set this so we can detect failure */ -- *out = '\0'; -- -- length = strlen(in); -- -- if (strcmp(in + (length - strlen(LA_SUFFIX)), LA_SUFFIX)) { -- if(!strcmp(in + (length - strlen(SO_SUFFIX)),SO_SUFFIX)) { -- /* check for a .la file */ -- if (strlen(prefix) + strlen(in) + strlen(LA_SUFFIX) + 1 >= MAX_LINE) -- return SASL_BADPARAM; -- strcpy(line, prefix); -- strcat(line, in); -- length = strlen(line); -- *(line + (length - strlen(SO_SUFFIX))) = '\0'; -- strcat(line, LA_SUFFIX); -- file = fopen(line, "r"); -- if(file) { -- /* We'll get it on the .la open */ -- fclose(file); -- return SASL_FAIL; -- } -- } -- if (strlen(prefix) + strlen(in) + 1 >= PATH_MAX) -- return SASL_BADPARAM; -- strcpy(out, prefix); -- strcat(out, in); -- return SASL_OK; -- } -- -- if (strlen(prefix) + strlen(in) + 1 >= MAX_LINE) -- return SASL_BADPARAM; -- strcpy(line, prefix); -- strcat(line, in); -- -- file = fopen(line, "r"); -- if(!file) { -- _sasl_log(NULL, SASL_LOG_WARN, -- "unable to open LA file: %s", line); -- return SASL_FAIL; -- } -- -- while(!feof(file)) { -- if(!fgets(line, MAX_LINE, file)) break; -- if(line[strlen(line) - 1] != '\n') { -- _sasl_log(NULL, SASL_LOG_WARN, -- "LA file has too long of a line: %s", in); -- fclose(file); -- return SASL_BUFOVER; -- } -- if(line[0] == '\n' || line[0] == '#') continue; -- if(!strncmp(line, "dlname=", sizeof("dlname=") - 1)) { -- /* We found the line with the name in it */ -- char *end; -- char *start; -- size_t len; -- end = strrchr(line, '\''); -- if(!end) continue; -- start = &line[sizeof("dlname=")-1]; -- len = strlen(start); -- if(len > 3 && start[0] == '\'') { -- ntmp=&start[1]; -- *end='\0'; -- /* Do we have dlname="" ? */ -- if(ntmp == end) { -- _sasl_log(NULL, SASL_LOG_DEBUG, -- "dlname is empty in .la file: %s", in); -- fclose(file); -- return SASL_FAIL; -- } -- strcpy(out, prefix); -- strcat(out, ntmp); -- } -- break; -- } -- } -- if(ferror(file) || feof(file)) { -- _sasl_log(NULL, SASL_LOG_WARN, -- "Error reading .la: %s\n", in); -- fclose(file); -- return SASL_FAIL; -- } -- fclose(file); -- -- if(!(*out)) { -- _sasl_log(NULL, SASL_LOG_WARN, -- "Could not find a dlname line in .la file: %s", in); -- return SASL_FAIL; -- } -- -- return SASL_OK; --} - #endif /* DO_DLOPEN */ - - /* loads a plugin library */ -@@ -506,18 +399,18 @@ int _sasl_load_plugins(const add_plugin_list_t *entrypoints, - if (length + pos>=PATH_MAX) continue; /* too big */ - - if (strcmp(dir->d_name + (length - strlen(SO_SUFFIX)), -- SO_SUFFIX) -- && strcmp(dir->d_name + (length - strlen(LA_SUFFIX)), -- LA_SUFFIX)) -+ SO_SUFFIX)) - continue; - -+ /* We only use .so files for loading plugins */ -+ - memcpy(name,dir->d_name,length); - name[length]='\0'; - -- result = _parse_la(prefix, name, tmp); -- if(result != SASL_OK) -- continue; -- -+ /* Create full name with path */ -+ strncpy(tmp, prefix, PATH_MAX); -+ strncat(tmp, name, PATH_MAX); -+ - /* skip "lib" and cut off suffix -- - this only need be approximate */ - strcpy(plugname, name + 3); diff --git a/server/auth/cyrus-sasl/files/0020-Restore-LIBS-after-checking-gss_inquire_sec_context_.patch b/server/auth/cyrus-sasl/files/0020-Restore-LIBS-after-checking-gss_inquire_sec_context_.patch deleted file mode 100644 index fd82dd70ef..0000000000 --- a/server/auth/cyrus-sasl/files/0020-Restore-LIBS-after-checking-gss_inquire_sec_context_.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 31b68a9438c24fc9e3e52f626462bf514de31757 Mon Sep 17 00:00:00 2001 -From: Ryan Tandy -Date: Mon, 24 Dec 2018 15:07:02 -0800 -Subject: [PATCH] Restore LIBS after checking gss_inquire_sec_context_by_oid - -Fixes: 4b0306dcd76031460246b2dabcb7db766d6b04d8 ---- - m4/sasl2.m4 | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/m4/sasl2.m4 b/m4/sasl2.m4 -index 56e0504a..17f5d081 100644 ---- a/m4/sasl2.m4 -+++ b/m4/sasl2.m4 -@@ -311,9 +311,10 @@ if test "$gssapi" != no; then - [AC_DEFINE(HAVE_GSS_C_SEC_CONTEXT_SASL_SSF,, - [Define if your GSSAPI implementation defines GSS_C_SEC_CONTEXT_SASL_SSF])]) - fi -+ LIBS="$cmu_save_LIBS" -+ - cmu_save_LIBS="$LIBS" - LIBS="$LIBS $GSSAPIBASE_LIBS" -- - AC_MSG_CHECKING([for SPNEGO support in GSSAPI libraries]) - AC_TRY_RUN([ - #ifdef HAVE_GSSAPI_H diff --git a/server/auth/cyrus-sasl/files/0022-Fix-keytab-option-for-MIT-Kerberos.patch b/server/auth/cyrus-sasl/files/0022-Fix-keytab-option-for-MIT-Kerberos.patch deleted file mode 100644 index 316ecd1888..0000000000 --- a/server/auth/cyrus-sasl/files/0022-Fix-keytab-option-for-MIT-Kerberos.patch +++ /dev/null @@ -1,66 +0,0 @@ -From: Debian Cyrus SASL Team - -Date: Thu, 24 Mar 2016 11:35:05 +0100 -Subject: Fix keytab option for MIT Kerberos - ---- - m4/sasl2.m4 | 1 + - plugins/gssapi.c | 11 ++++++++--- - 2 files changed, 9 insertions(+), 3 deletions(-) - -diff --git a/m4/sasl2.m4 b/m4/sasl2.m4 -index 56e0504..a90f7b4 100644 ---- a/m4/sasl2.m4 -+++ b/m4/sasl2.m4 -@@ -282,6 +282,7 @@ if test "$gssapi" != no; then - ]) - fi - fi -+ AC_CHECK_FUNCS(krb5_gss_register_acceptor_identity) - AC_CHECK_FUNCS(gss_decapsulate_token) - AC_CHECK_FUNCS(gss_encapsulate_token) - AC_CHECK_FUNCS(gss_oid_equal) -diff --git a/plugins/gssapi.c b/plugins/gssapi.c -index ff663da..7c69ac2 100644 ---- a/plugins/gssapi.c -+++ b/plugins/gssapi.c -@@ -1545,7 +1545,7 @@ static sasl_server_plug_t gssapi_server_plugins[] = - }; - - int gssapiv2_server_plug_init( --#ifndef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY -+#if !defined(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY) && !defined(HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY) - const sasl_utils_t *utils __attribute__((unused)), - #else - const sasl_utils_t *utils, -@@ -1555,7 +1555,7 @@ int gssapiv2_server_plug_init( - sasl_server_plug_t **pluglist, - int *plugcount) - { --#ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY -+#if defined(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY) || defined(HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY) - const char *keytab = NULL; - char keytab_path[1024]; - unsigned int rl; -@@ -1565,7 +1565,7 @@ int gssapiv2_server_plug_init( - return SASL_BADVERS; - } - --#ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY -+#if defined(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY) || defined(HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY) - /* unfortunately, we don't check for readability of keytab if it's - the standard one, since we don't know where it is */ - -@@ -1587,7 +1587,12 @@ int gssapiv2_server_plug_init( - - strncpy(keytab_path, keytab, 1024); - -+#ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY - gsskrb5_register_acceptor_identity(keytab_path); -+#endif -+#ifdef HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY -+ krb5_gss_register_acceptor_identity(keytab_path); -+#endif - } - #endif - diff --git a/server/auth/cyrus-sasl/files/0025_ld_as_needed.patch b/server/auth/cyrus-sasl/files/0025_ld_as_needed.patch deleted file mode 100644 index 67b48b4a49..0000000000 --- a/server/auth/cyrus-sasl/files/0025_ld_as_needed.patch +++ /dev/null @@ -1,27 +0,0 @@ -Author: Matthias Klose -Desription: Fix FTBFS, add $(SASL_DB_LIB) as dependency to libsasldb, and use -it. ---- a/saslauthd/Makefile.am -+++ b/saslauthd/Makefile.am -@@ -16,7 +16,7 @@ EXTRA_saslauthd_sources = getaddrinfo.c - saslauthd_DEPENDENCIES = saslauthd-main.o @LTLIBOBJS@ - saslauthd_LDADD = @SASL_KRB_LIB@ \ - @GSSAPIBASE_LIBS@ @GSSAPI_LIBS@ @LIB_CRYPT@ @LIB_SIA@ \ -- @LIB_SOCKET@ @SASL_DB_LIB@ @LIB_PAM@ @LDAP_LIBS@ @LTLIBOBJS@ -+ @LIB_SOCKET@ ../sasldb/libsasldb.la @LIB_PAM@ @LDAP_LIBS@ @LTLIBOBJS@ - - testsaslauthd_SOURCES = testsaslauthd.c utils.c - testsaslauthd_LDADD = @LIB_SOCKET@ ---- a/sasldb/Makefile.am -+++ b/sasldb/Makefile.am -@@ -55,8 +55,8 @@ noinst_LIBRARIES = libsasldb.a - - libsasldb_la_SOURCES = allockey.c sasldb.h - EXTRA_libsasldb_la_SOURCES = $(extra_common_sources) --libsasldb_la_DEPENDENCIES = $(SASL_DB_BACKEND) --libsasldb_la_LIBADD = $(SASL_DB_BACKEND) -+libsasldb_la_DEPENDENCIES = $(SASL_DB_BACKEND) $(SASL_DB_LIB) -+libsasldb_la_LIBADD = $(SASL_DB_BACKEND) $(SASL_DB_LIB) - - # Prevent make dist stupidity - libsasldb_a_SOURCES = diff --git a/server/auth/cyrus-sasl/files/0026_drop_krb5support_dependency.patch b/server/auth/cyrus-sasl/files/0026_drop_krb5support_dependency.patch deleted file mode 100644 index cc00867ef0..0000000000 --- a/server/auth/cyrus-sasl/files/0026_drop_krb5support_dependency.patch +++ /dev/null @@ -1,14 +0,0 @@ -Author: Roberto C. Sanchez -Description: Drop gratuitous dependency on krb5support ---- a/cmulocal/sasl2.m4 -+++ b/cmulocal/sasl2.m4 -@@ -112,9 +112,6 @@ if test "$gssapi" != no; then - fi - - if test "$gss_impl" = "auto" -o "$gss_impl" = "mit"; then -- # check for libkrb5support first -- AC_CHECK_LIB(krb5support,krb5int_getspecific,K5SUP=-lkrb5support K5SUPSTATIC=$gssapi_dir/libkrb5support.a,,${LIB_SOCKET}) -- - gss_failed=0 - AC_CHECK_LIB(gssapi_krb5,gss_unwrap,gss_impl="mit",gss_failed=1, - ${GSSAPIBASE_LIBS} -lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err ${K5SUP} ${LIB_SOCKET}) diff --git a/server/auth/cyrus-sasl/files/0030-dont_use_la_files_for_opening_plugins.patch b/server/auth/cyrus-sasl/files/0030-dont_use_la_files_for_opening_plugins.patch deleted file mode 100644 index 14a322496e..0000000000 --- a/server/auth/cyrus-sasl/files/0030-dont_use_la_files_for_opening_plugins.patch +++ /dev/null @@ -1,134 +0,0 @@ ---- a/lib/dlopen.c -+++ b/lib/dlopen.c -@@ -247,105 +247,6 @@ static int _sasl_plugin_load(char *plugi - return result; - } - --/* this returns the file to actually open. -- * out should be a buffer of size PATH_MAX -- * and may be the same as in. */ -- --/* We'll use a static buffer for speed unless someone complains */ --#define MAX_LINE 2048 -- --static int _parse_la(const char *prefix, const char *in, char *out) --{ -- FILE *file; -- size_t length; -- char line[MAX_LINE]; -- char *ntmp = NULL; -- -- if(!in || !out || !prefix || out == in) return SASL_BADPARAM; -- -- /* Set this so we can detect failure */ -- *out = '\0'; -- -- length = strlen(in); -- -- if (strcmp(in + (length - strlen(LA_SUFFIX)), LA_SUFFIX)) { -- if(!strcmp(in + (length - strlen(SO_SUFFIX)),SO_SUFFIX)) { -- /* check for a .la file */ -- strcpy(line, prefix); -- strcat(line, in); -- length = strlen(line); -- *(line + (length - strlen(SO_SUFFIX))) = '\0'; -- strcat(line, LA_SUFFIX); -- file = fopen(line, "r"); -- if(file) { -- /* We'll get it on the .la open */ -- fclose(file); -- return SASL_FAIL; -- } -- } -- strcpy(out, prefix); -- strcat(out, in); -- return SASL_OK; -- } -- -- strcpy(line, prefix); -- strcat(line, in); -- -- file = fopen(line, "r"); -- if(!file) { -- _sasl_log(NULL, SASL_LOG_WARN, -- "unable to open LA file: %s", line); -- return SASL_FAIL; -- } -- -- while(!feof(file)) { -- if(!fgets(line, MAX_LINE, file)) break; -- if(line[strlen(line) - 1] != '\n') { -- _sasl_log(NULL, SASL_LOG_WARN, -- "LA file has too long of a line: %s", in); -- return SASL_BUFOVER; -- } -- if(line[0] == '\n' || line[0] == '#') continue; -- if(!strncmp(line, "dlname=", sizeof("dlname=") - 1)) { -- /* We found the line with the name in it */ -- char *end; -- char *start; -- size_t len; -- end = strrchr(line, '\''); -- if(!end) continue; -- start = &line[sizeof("dlname=")-1]; -- len = strlen(start); -- if(len > 3 && start[0] == '\'') { -- ntmp=&start[1]; -- *end='\0'; -- /* Do we have dlname="" ? */ -- if(ntmp == end) { -- _sasl_log(NULL, SASL_LOG_DEBUG, -- "dlname is empty in .la file: %s", in); -- return SASL_FAIL; -- } -- strcpy(out, prefix); -- strcat(out, ntmp); -- } -- break; -- } -- } -- if(ferror(file) || feof(file)) { -- _sasl_log(NULL, SASL_LOG_WARN, -- "Error reading .la: %s\n", in); -- fclose(file); -- return SASL_FAIL; -- } -- fclose(file); -- -- if(!(*out)) { -- _sasl_log(NULL, SASL_LOG_WARN, -- "Could not find a dlname line in .la file: %s", in); -- return SASL_FAIL; -- } -- -- return SASL_OK; --} - #endif /* DO_DLOPEN */ - - /* loads a plugin library */ -@@ -499,18 +400,18 @@ int _sasl_load_plugins(const add_plugin_ - if (length + pos>=PATH_MAX) continue; /* too big */ - - if (strcmp(dir->d_name + (length - strlen(SO_SUFFIX)), -- SO_SUFFIX) -- && strcmp(dir->d_name + (length - strlen(LA_SUFFIX)), -- LA_SUFFIX)) -+ SO_SUFFIX)) - continue; - -+ /* We only use .so files for loading plugins */ -+ - memcpy(name,dir->d_name,length); - name[length]='\0'; - -- result = _parse_la(prefix, name, tmp); -- if(result != SASL_OK) -- continue; -- -+ /* Create full name with path */ -+ strncpy(tmp, prefix, PATH_MAX); -+ strncat(tmp, name, PATH_MAX); -+ - /* skip "lib" and cut off suffix -- - this only need be approximate */ - strcpy(plugname, name + 3); diff --git a/server/auth/cyrus-sasl/files/CVE-2013-4122.patch b/server/auth/cyrus-sasl/files/CVE-2013-4122.patch deleted file mode 100644 index d6b9800e66..0000000000 --- a/server/auth/cyrus-sasl/files/CVE-2013-4122.patch +++ /dev/null @@ -1,116 +0,0 @@ -From dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d Mon Sep 17 00:00:00 2001 -From: mancha -Date: Thu, 11 Jul 2013 09:08:07 +0000 -Subject: Handle NULL returns from glibc 2.17+ crypt() - -Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL -(w/ NULL return) if the salt violates specifications. Additionally, -on FIPS-140 enabled Linux systems, DES/MD5-encrypted passwords -passed to crypt() fail with EPERM (w/ NULL return). - -When using glibc's crypt(), check return value to avoid a possible -NULL pointer dereference. - -Patch by mancha1@hush.com. ---- -diff --git a/pwcheck/pwcheck_getpwnam.c b/pwcheck/pwcheck_getpwnam.c -index 4b34222..400289c 100644 ---- a/pwcheck/pwcheck_getpwnam.c -+++ b/pwcheck/pwcheck_getpwnam.c -@@ -32,6 +32,7 @@ char *userid; - char *password; - { - char* r; -+ char* crpt_passwd; - struct passwd *pwd; - - pwd = getpwnam(userid); -@@ -41,7 +42,7 @@ char *password; - else if (pwd->pw_passwd[0] == '*') { - r = "Account disabled"; - } -- else if (strcmp(pwd->pw_passwd, crypt(password, pwd->pw_passwd)) != 0) { -+ else if (!(crpt_passwd = crypt(password, pwd->pw_passwd)) || strcmp(pwd->pw_passwd, (const char *)crpt_passwd) != 0) { - r = "Incorrect password"; - } - else { -diff --git a/pwcheck/pwcheck_getspnam.c b/pwcheck/pwcheck_getspnam.c -index 2b11286..6d607bb 100644 ---- a/pwcheck/pwcheck_getspnam.c -+++ b/pwcheck/pwcheck_getspnam.c -@@ -32,13 +32,15 @@ char *userid; - char *password; - { - struct spwd *pwd; -+ char *crpt_passwd; - - pwd = getspnam(userid); - if (!pwd) { - return "Userid not found"; - } - -- if (strcmp(pwd->sp_pwdp, crypt(password, pwd->sp_pwdp)) != 0) { -+ crpt_passwd = crypt(password, pwd->sp_pwdp); -+ if (!crpt_passwd || strcmp(pwd->sp_pwdp, (const char *)crpt_passwd) != 0) { - return "Incorrect password"; - } - else { -diff --git a/saslauthd/auth_getpwent.c b/saslauthd/auth_getpwent.c -index fc8029d..d4ebe54 100644 ---- a/saslauthd/auth_getpwent.c -+++ b/saslauthd/auth_getpwent.c -@@ -77,6 +77,7 @@ auth_getpwent ( - { - /* VARIABLES */ - struct passwd *pw; /* pointer to passwd file entry */ -+ char *crpt_passwd; /* encrypted password */ - int errnum; - /* END VARIABLES */ - -@@ -105,7 +106,8 @@ auth_getpwent ( - } - } - -- if (strcmp(pw->pw_passwd, (const char *)crypt(password, pw->pw_passwd))) { -+ crpt_passwd = crypt(password, pw->pw_passwd); -+ if (!crpt_passwd || strcmp(pw->pw_passwd, (const char *)crpt_passwd)) { - if (flags & VERBOSE) { - syslog(LOG_DEBUG, "DEBUG: auth_getpwent: %s: invalid password", login); - } -diff --git a/saslauthd/auth_shadow.c b/saslauthd/auth_shadow.c -index 677131b..1988afd 100644 ---- a/saslauthd/auth_shadow.c -+++ b/saslauthd/auth_shadow.c -@@ -210,8 +210,8 @@ auth_shadow ( - RETURN("NO Insufficient permission to access NIS authentication database (saslauthd)"); - } - -- cpw = strdup((const char *)crypt(password, sp->sp_pwdp)); -- if (strcmp(sp->sp_pwdp, cpw)) { -+ cpw = crypt(password, sp->sp_pwdp); -+ if (!cpw || strcmp(sp->sp_pwdp, (const char *)cpw)) { - if (flags & VERBOSE) { - /* - * This _should_ reveal the SHADOW_PW_LOCKED prefix to an -@@ -221,10 +221,8 @@ auth_shadow ( - syslog(LOG_DEBUG, "DEBUG: auth_shadow: pw mismatch: '%s' != '%s'", - sp->sp_pwdp, cpw); - } -- free(cpw); - RETURN("NO Incorrect password"); - } -- free(cpw); - - /* - * The following fields will be set to -1 if: -@@ -286,7 +284,7 @@ auth_shadow ( - RETURN("NO Invalid username"); - } - -- if (strcmp(upw->upw_passwd, crypt(password, upw->upw_passwd)) != 0) { -+ if (!(cpw = crypt(password, upw->upw_passwd)) || (strcmp(upw->upw_passwd, (const char *)cpw) != 0)) { - if (flags & VERBOSE) { - syslog(LOG_DEBUG, "auth_shadow: pw mismatch: %s != %s", - password, upw->upw_passwd); --- -cgit v0.9.2 diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.20-saslauthd.conf-path.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.20-saslauthd.conf-path.patch deleted file mode 100644 index 822be9a56d..0000000000 --- a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.20-saslauthd.conf-path.patch +++ /dev/null @@ -1,20 +0,0 @@ ---- cyrus-sasl-2.1.20/saslauthd/saslauthd.mdoc 2005-05-06 16:05:44.000000000 -0400 -+++ cyrus-sasl-2.1.20/saslauthd/saslauthd.mdoc 2005-05-06 16:05:39.000000000 -0400 -@@ -216,7 +216,7 @@ - .Em (All platforms that support OpenLDAP 2.0 or higher) - .Pp - Authenticate against an ldap server. The ldap configuration parameters are --read from /usr/local/etc/saslauthd.conf. The location of this file can be -+read from /etc/saslauthd.conf. The location of this file can be - changed with the -O parameter. See the LDAP_SASLAUTHD file included with the - distribution for the list of available parameters. - .It Li sia -@@ -249,7 +249,7 @@ - .Bl -tag -width "/run/saslauthd/mux" - .It Pa /run/saslauthd/mux - The default communications socket. --.It Pa /usr/local/etc/saslauthd.conf -+.It Pa /etc/saslauthd.conf - The default configuration file for ldap support. - .El - .Sh SEE ALSO diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.21-sizes.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.21-sizes.patch deleted file mode 100644 index 006962bd24..0000000000 --- a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.21-sizes.patch +++ /dev/null @@ -1,120 +0,0 @@ -Prefer types in to our own, because it removes file content -conflicts between 32- and 64-bit architectures. RFEd as #2829. - ---- cyrus-sasl-2.1.21/configure.in 2006-05-16 07:37:52.000000000 -0400 -+++ cyrus-sasl-2.1.21/configure.in 2006-05-16 07:37:52.000000000 -0400 -@@ -1083,6 +1083,10 @@ - AC_HEADER_DIRENT - AC_HEADER_SYS_WAIT - AC_CHECK_HEADERS(des.h dlfcn.h fcntl.h limits.h malloc.h paths.h strings.h sys/file.h sys/time.h syslog.h unistd.h inttypes.h sys/uio.h sys/param.h sysexits.h stdarg.h varargs.h) -+AC_CHECK_TYPES([long long, int8_t, uint8_t, int16_t, uint16_t, int32_t, uint32_t, int64_t, uint64_t],,,[ -+#ifdef HAVE_INTTYPES_H -+#include -+#endif]) - - IPv6_CHECK_SS_FAMILY() - IPv6_CHECK_SA_LEN() ---- cyrus-sasl-2.1.21/include/makemd5.c 2003-02-13 14:55:52.000000000 -0500 -+++ cyrus-sasl-2.1.21/include/makemd5.c 2006-05-16 07:45:08.000000000 -0400 -@@ -82,12 +82,19 @@ - */ - - -+#ifdef HAVE_CONFIG_H -+#include "../config.h" -+#endif - - #include - #include - #include - #include - -+#ifdef HAVE_INTTYPES_H -+#include -+#endif -+ - - static void - my_strupr(char *s) -@@ -122,6 +129,18 @@ - static void - try_signed(FILE *f, int len) - { -+#ifdef HAVE_INT8_T -+ BITSIZE(int8_t); -+#endif -+#ifdef HAVE_INT16_T -+ BITSIZE(int16_t); -+#endif -+#ifdef HAVE_INT32_T -+ BITSIZE(int32_t); -+#endif -+#ifdef HAVE_INT64_T -+ BITSIZE(int64_t); -+#endif - BITSIZE(signed char); - BITSIZE(short); - BITSIZE(int); -@@ -135,6 +154,18 @@ - static void - try_unsigned(FILE *f, int len) - { -+#ifdef HAVE_UINT8_T -+ BITSIZE(uint8_t); -+#endif -+#ifdef HAVE_UINT16_T -+ BITSIZE(uint16_t); -+#endif -+#ifdef HAVE_UINT32_T -+ BITSIZE(uint32_t); -+#endif -+#ifdef HAVE_UINT64_T -+ BITSIZE(uint64_t); -+#endif - BITSIZE(unsigned char); - BITSIZE(unsigned short); - BITSIZE(unsigned int); -@@ -165,6 +196,11 @@ - "/* POINTER defines a generic pointer type */\n" - "typedef unsigned char *POINTER;\n" - "\n" -+#ifdef HAVE_INTTYPES_H -+ "/* We try to define integer types for our use */\n" -+ "#include \n" -+ "\n" -+#endif - ); - return 1; - } -@@ -212,31 +248,15 @@ - - print_pre(f); - --#ifndef HAVE_INT8_T - try_signed (f, 8); --#endif /* HAVE_INT8_T */ --#ifndef HAVE_INT16_T - try_signed (f, 16); --#endif /* HAVE_INT16_T */ --#ifndef HAVE_INT32_T - try_signed (f, 32); --#endif /* HAVE_INT32_T */ --#ifndef HAVE_INT64_T - try_signed (f, 64); --#endif /* HAVE_INT64_T */ - --#ifndef HAVE_U_INT8_T - try_unsigned (f, 8); --#endif /* HAVE_INT8_T */ --#ifndef HAVE_U_INT16_T - try_unsigned (f, 16); --#endif /* HAVE_U_INT16_T */ --#ifndef HAVE_U_INT32_T - try_unsigned (f, 32); --#endif /* HAVE_U_INT32_T */ --#ifndef HAVE_U_INT64_T - try_unsigned (f, 64); --#endif /* HAVE_U_INT64_T */ - - print_post(f); - diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-as-needed.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-as-needed.patch deleted file mode 100644 index 1294cb5077..0000000000 --- a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-as-needed.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- saslauthd/configure.in.orig 2006-05-23 15:53:17.000000000 -0700 -+++ saslauthd/configure.in 2006-05-23 15:53:33.000000000 -0700 -@@ -77,7 +77,7 @@ - AC_DEFINE(AUTH_SASLDB,[],[Include SASLdb Support]) - SASL_DB_PATH_CHECK() - SASL_DB_CHECK() -- SASL_DB_LIB="$SASL_DB_LIB ../sasldb/.libs/libsasldb.al" -+ SASL_DB_LIB="../sasldb/.libs/libsasldb.a $SASL_DB_LIB" - fi - - AC_ARG_ENABLE(httpform, [ --enable-httpform enable HTTP form authentication [[no]] ], diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-kerberos4.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-kerberos4.patch deleted file mode 100644 index 09e23d7bc5..0000000000 --- a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-kerberos4.patch +++ /dev/null @@ -1,26 +0,0 @@ -diff -up cyrus-sasl-2.1.22/config/kerberos_v4.m4.krb4 cyrus-sasl-2.1.22/config/kerberos_v4.m4 ---- cyrus-sasl-2.1.22/config/kerberos_v4.m4.krb4 2005-05-07 06:14:55.000000000 +0200 -+++ cyrus-sasl-2.1.22/config/kerberos_v4.m4 2008-08-14 23:41:26.000000000 +0200 -@@ -102,7 +102,6 @@ AC_DEFUN([SASL_KERBEROS_V4_CHK], [ - if test -n "${cyrus_krbinclude}"; then - CPPFLAGS="$CPPFLAGS -I${cyrus_krbinclude}" - fi -- LDFLAGS="$LDFLAGS -L$krb4/lib" - fi - - if test "$with_des" != no; then -diff -up cyrus-sasl-2.1.22/plugins/kerberos4.c.krb4 cyrus-sasl-2.1.22/plugins/kerberos4.c ---- cyrus-sasl-2.1.22/plugins/kerberos4.c.krb4 2005-01-10 08:08:53.000000000 +0100 -+++ cyrus-sasl-2.1.22/plugins/kerberos4.c 2008-08-14 23:36:33.000000000 +0200 -@@ -49,11 +49,7 @@ - #include - - #ifdef WITH_DES --# ifdef WITH_SSL_DES --# include --# else - # include --# endif /* WITH_SSL_DES */ - #endif /* WITH_DES */ - - #ifdef WIN32 diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-ldap-timeout.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-ldap-timeout.patch deleted file mode 100644 index 82c6c826c1..0000000000 --- a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-ldap-timeout.patch +++ /dev/null @@ -1,25 +0,0 @@ -commit c9447e1c3ffba88783e5d9396b832be82d3c78fc -Author: Kazuo Ito -Date: Wed Dec 10 12:03:29 2008 +0900 - - support for LDAP_OPT_TIMEOUT - - OpenLDAP since 2.4 implements support for this option in ldap_result(), - among other things. - -diff --git a/saslauthd/lak.c b/saslauthd/lak.c -index 803d51f..8714265 100644 ---- a/saslauthd/lak.c -+++ b/saslauthd/lak.c -@@ -833,6 +833,11 @@ static int lak_connect( - syslog(LOG_WARNING|LOG_AUTH, "Unable to set LDAP_OPT_NETWORK_TIMEOUT %d.%d.", lak->conf->timeout.tv_sec, lak->conf->timeout.tv_usec); - } - -+ rc = ldap_set_option(lak->ld, LDAP_OPT_TIMEOUT, &(lak->conf->timeout)); -+ if (rc != LDAP_OPT_SUCCESS) { -+ syslog(LOG_WARNING|LOG_AUTH, "Unable to set LDAP_OPT_TIMEOUT %d.%d.", lak->conf->timeout.tv_sec, lak->conf->timeout.tv_usec); -+ } -+ - rc = ldap_set_option(lak->ld, LDAP_OPT_TIMELIMIT, &(lak->conf->time_limit)); - if (rc != LDAP_OPT_SUCCESS) { - syslog(LOG_WARNING|LOG_AUTH, "Unable to set LDAP_OPT_TIMELIMIT %d.", lak->conf->time_limit); diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-qa.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-qa.patch deleted file mode 100644 index 4f7b04f135..0000000000 --- a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-qa.patch +++ /dev/null @@ -1,22 +0,0 @@ -fix missing prototype warnings - ---- cyrus-sasl-2.1.22/lib/auxprop.c -+++ cyrus-sasl-2.1.22/lib/auxprop.c -@@ -43,6 +43,7 @@ - */ - - #include -+#include - #include - #include - #include ---- cyrus-sasl-2.1.22/pwcheck/pwcheck_getspnam.c -+++ cyrus-sasl-2.1.22/pwcheck/pwcheck_getspnam.c -@@ -24,6 +24,7 @@ OF OR IN CONNECTION WITH THE USE OR PERF - ******************************************************************/ - - #include -+#include - - extern char *crypt(); - diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.23-man.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.23-man.patch deleted file mode 100644 index 5a16187f01..0000000000 --- a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.23-man.patch +++ /dev/null @@ -1,37 +0,0 @@ -diff -up cyrus-sasl-2.1.23/mac/libdes/src/des_crypt.man cyrus-sasl-2.1.23/mac/libdes/src/des_crypt -diff -up cyrus-sasl-2.1.23/mac/libdes/src/des.man cyrus-sasl-2.1.23/mac/libdes/src/des -diff -up cyrus-sasl-2.1.23/man/Makefile.am.man cyrus-sasl-2.1.23/man/Makefile.am ---- cyrus-sasl-2.1.23/man/Makefile.am.man 2010-02-05 10:40:17.000000000 +0100 -+++ cyrus-sasl-2.1.23/man/Makefile.am 2010-02-05 10:40:47.000000000 +0100 -@@ -54,6 +54,6 @@ man_MANS = sasl_authorize_t.3 sasl_done. - sasl_auxprop_getctx.3 sasl_auxprop.3 sasl_idle.3 \ - sasl_errdetail.3 sasl_user_exists.3 sasl_setpass.3 \ - sasl_server_userdb_checkpass_t.3 sasl_server_userdb_setpass_t.3 \ -- sasl_global_listmech.3 sasl_getconfpath_t.3 -+ sasl_global_listmech.3 sasl_getconfpath_t.3 testsaslauthd.8 - - EXTRA_DIST = $(man_MANS) -diff -up cyrus-sasl-2.1.23/man/testsaslauthd.8.man cyrus-sasl-2.1.23/man/testsaslauthd.8 ---- cyrus-sasl-2.1.23/man/testsaslauthd.8.man 2010-02-05 10:40:07.000000000 +0100 -+++ cyrus-sasl-2.1.23/man/testsaslauthd.8 2010-02-05 09:48:43.000000000 +0100 -@@ -0,0 +1,20 @@ -+.\" Hey, EMACS: -*- nroff -*- -+.TH TESTSASLAUTHD 8 "14 October 2006" -+.SH NAME -+testsaslauthd \- test utility for the SASL authentication server -+.SH SYNOPSIS -+.B testsaslauthd -+.RI "[ " \(hyr " " realm " ] [ " \(hys " " servicename " ] [ " \(hyf " " socket " " path " ] [ " \(hyR " " repeatnum " ]" -+.SH DESCRIPTION -+This manual page documents briefly the -+.B testsaslauthd -+command. -+.PP -+.SH SEE ALSO -+.BR saslauthd (8). -+.br -+.SH AUTHOR -+testsaslauthd was written by Carnegie Mellon University. -+.PP -+This manual page was written by Roberto C. Sanchez , -+for the Debian project (but may be used by others). diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-keytab.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-keytab.patch deleted file mode 100644 index 390b5176a4..0000000000 --- a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-keytab.patch +++ /dev/null @@ -1,36 +0,0 @@ -diff --git a/cmulocal/sasl2.m4 b/cmulocal/sasl2.m4 -index 3c2841a..b086b8f 100644 ---- a/cmulocal/sasl2.m4 -+++ b/cmulocal/sasl2.m4 -@@ -269,6 +269,18 @@ if test "$gssapi" != no; then - cmu_save_LIBS="$LIBS" - LIBS="$LIBS $GSSAPIBASE_LIBS" - AC_CHECK_FUNCS(gsskrb5_register_acceptor_identity) -+ if test "$ac_cv_func_gsskrb5_register_acceptor_identity" = no ; then -+ AC_CHECK_HEADERS(gssapi/gssapi_krb5.h) -+ if test "$ac_cv_header_gssapi_gssapi_krb5_h" = "yes"; then -+ AC_CHECK_DECL(gsskrb5_register_acceptor_identity, -+ [AC_DEFINE(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY,1, -+ [Define if your GSSAPI implementation defines gsskrb5_register_acceptor_identity])],, -+ [ -+ AC_INCLUDES_DEFAULT -+ #include -+ ]) -+ fi -+ fi - AC_CHECK_FUNCS(gss_decapsulate_token) - AC_CHECK_FUNCS(gss_encapsulate_token) - AC_CHECK_FUNCS(gss_oid_equal) -diff --git a/plugins/gssapi.c b/plugins/gssapi.c -index 6be9d23..e6fcf46 100644 ---- a/plugins/gssapi.c -+++ b/plugins/gssapi.c -@@ -51,6 +51,8 @@ - #include - #endif - -+#include -+ - #ifdef WIN32 - # include - diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-no_rpath.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-no_rpath.patch deleted file mode 100644 index 7028db6fe7..0000000000 --- a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-no_rpath.patch +++ /dev/null @@ -1,19 +0,0 @@ ---- cmulocal/cyrus.m4~ 2014-01-09 11:31:10.423302394 +0100 -+++ cmulocal/cyrus.m4 2014-01-09 11:31:56.823302243 +0100 -@@ -32,14 +32,5 @@ - dnl runpath initialization - AC_DEFUN([CMU_GUESS_RUNPATH_SWITCH], [ - # CMU GUESS RUNPATH SWITCH -- AC_CACHE_CHECK(for runpath switch, andrew_cv_runpath_switch, [ -- # first, try -R -- SAVE_LDFLAGS="${LDFLAGS}" -- LDFLAGS="-R /usr/lib" -- AC_TRY_LINK([],[],[andrew_cv_runpath_switch="-R"], [ -- LDFLAGS="-Wl,-rpath,/usr/lib" -- AC_TRY_LINK([],[],[andrew_cv_runpath_switch="-Wl,-rpath,"], -- [andrew_cv_runpath_switch="none"]) -- ]) -- LDFLAGS="${SAVE_LDFLAGS}" -- ])]) -+ andrew_runpath_switch="none" -+ ]) diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-obsolete-macro.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-obsolete-macro.patch deleted file mode 100644 index a836d8fb4e..0000000000 --- a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-obsolete-macro.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/configure.in b/configure.in -index e70c99a..60f366c 100644 ---- a/configure.in -+++ b/configure.in -@@ -1416,7 +1416,7 @@ inline static unsigned int sleep(unsigned int seconds) { - #endif /* CONFIG_H */ - ]) - --AM_CONFIG_HEADER(config.h) -+AC_CONFIG_HEADERS(config.h) - - AC_OUTPUT(Makefile - libsasl2.pc diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-prefer-SCRAM-SHA-1-over-PLAIN.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-prefer-SCRAM-SHA-1-over-PLAIN.patch deleted file mode 100644 index af88e81ed8..0000000000 --- a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-prefer-SCRAM-SHA-1-over-PLAIN.patch +++ /dev/null @@ -1,51 +0,0 @@ -commit 26dcfb2d7176b78e70757aa5d01951a28ca217c7 -Author: Alexey Melnikov -Date: Fri Jul 5 16:37:59 2013 +0100 - - Treat SCRAM-SHA-1/DIGEST-MD5 as more secure than PLAIN when selecting the best client side SASL mechanism - - Both SCRAM-SHA-1 & DIGEST-MD5 are lacking SASL_SEC_PASS_CREDENTIALS security - flag, which prevented them from being chosen over PLAIN when PLAIN is selected - as the best mechanism first. For example the problem can be observed when - the server advertises "PLAIN DIGEST-MD5 SCRAM-SHA-1" (PLAIN just has to be - returned before SCRAM/DIGEST.) - - Cyrus SASL bug # 3793 - -diff --git a/lib/client.c b/lib/client.c -index 62dfb0b..31fe346 100644 ---- a/lib/client.c -+++ b/lib/client.c -@@ -658,6 +658,20 @@ _sasl_cbinding_disp(sasl_client_params_t *cparams, - return SASL_OK; - } - -+static int -+_sasl_are_current_security_flags_worse_then_best(unsigned best_security_flags, -+ unsigned current_security_flags) -+{ -+ /* We don't qualify SASL_SEC_PASS_CREDENTIALS as "secure" flag */ -+ best_security_flags &= ~SASL_SEC_PASS_CREDENTIALS; -+ -+ if ((current_security_flags ^ best_security_flags) & best_security_flags) { -+ return 1; -+ } else { -+ return 0; -+ } -+} -+ - /* select a mechanism for a connection - * mechlist -- mechanisms server has available (punctuation ignored) - * secret -- optional secret from previous session -@@ -823,8 +837,9 @@ int sasl_client_start(sasl_conn_t *conn, - */ - - if (bestm && -- ((m->m.plug->security_flags ^ bestm->m.plug->security_flags) & -- bestm->m.plug->security_flags)) { -+ _sasl_are_current_security_flags_worse_then_best( -+ bestm->m.plug->security_flags, -+ m->m.plug->security_flags)) { - break; - } - diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-relro.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-relro.patch deleted file mode 100644 index 3a405f6541..0000000000 --- a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-relro.patch +++ /dev/null @@ -1,59 +0,0 @@ -diff -up cyrus-sasl-2.1.26/lib/Makefile.am.relro cyrus-sasl-2.1.26/lib/Makefile.am ---- cyrus-sasl-2.1.26/lib/Makefile.am.relro 2012-10-12 16:05:48.000000000 +0200 -+++ cyrus-sasl-2.1.26/lib/Makefile.am 2013-02-11 14:18:01.749053772 +0100 -@@ -64,7 +64,7 @@ LIB_DOOR= @LIB_DOOR@ - lib_LTLIBRARIES = libsasl2.la - - libsasl2_la_SOURCES = $(common_sources) $(common_headers) --libsasl2_la_LDFLAGS = -version-info $(sasl_version) -+libsasl2_la_LDFLAGS = -Wl,-z,relro -version-info $(sasl_version) - libsasl2_la_DEPENDENCIES = $(LTLIBOBJS) - libsasl2_la_LIBADD = $(LTLIBOBJS) $(SASL_DL_LIB) $(LIB_SOCKET) $(LIB_DOOR) - -diff -up cyrus-sasl-2.1.26/lib/Makefile.in.relro cyrus-sasl-2.1.26/lib/Makefile.in ---- cyrus-sasl-2.1.26/lib/Makefile.in.relro 2013-11-13 16:55:09.606555125 +0100 -+++ cyrus-sasl-2.1.26/lib/Makefile.in 2013-11-13 16:56:43.331096795 +0100 -@@ -330,7 +330,7 @@ common_headers = saslint.h - common_sources = auxprop.c canonusr.c checkpw.c client.c common.c config.c external.c md5.c saslutil.c server.c seterror.c dlopen.c ../plugins/plugin_common.c - lib_LTLIBRARIES = libsasl2.la - libsasl2_la_SOURCES = $(common_sources) $(common_headers) --libsasl2_la_LDFLAGS = -version-info $(sasl_version) -+libsasl2_la_LDFLAGS = -Wl,-z,relro -version-info $(sasl_version) - libsasl2_la_DEPENDENCIES = $(LTLIBOBJS) - libsasl2_la_LIBADD = $(LTLIBOBJS) $(SASL_DL_LIB) $(LIB_SOCKET) $(LIB_DOOR) - @MACOSX_TRUE@framedir = /Library/Frameworks/SASL2.framework -diff -up cyrus-sasl-2.1.26/plugins/Makefile.am.relro cyrus-sasl-2.1.26/plugins/Makefile.am ---- cyrus-sasl-2.1.26/plugins/Makefile.am.relro 2012-10-12 16:05:48.000000000 +0200 -+++ cyrus-sasl-2.1.26/plugins/Makefile.am 2013-02-11 14:18:01.749053772 +0100 -@@ -50,7 +50,7 @@ - plugin_version = 3:0:0 - - INCLUDES=-I$(top_srcdir)/include -I$(top_srcdir)/lib -I$(top_srcdir)/sasldb -I$(top_builddir)/include --AM_LDFLAGS = -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version) -+AM_LDFLAGS = -Wl,-z,relro -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version) - - COMPAT_OBJS = @LTGETADDRINFOOBJS@ @LTGETNAMEINFOOBJS@ @LTSNPRINTFOBJS@ - -diff -up cyrus-sasl-2.1.26/plugins/Makefile.in.relro cyrus-sasl-2.1.26/plugins/Makefile.in ---- cyrus-sasl-2.1.26/plugins/Makefile.in.relro 2013-11-13 16:57:08.430974081 +0100 -+++ cyrus-sasl-2.1.26/plugins/Makefile.in 2013-11-13 16:57:58.911727846 +0100 -@@ -364,7 +364,7 @@ top_srcdir = @top_srcdir@ - # CURRENT:REVISION:AGE - plugin_version = 3:0:0 - INCLUDES = -I$(top_srcdir)/include -I$(top_srcdir)/lib -I$(top_srcdir)/sasldb -I$(top_builddir)/include --AM_LDFLAGS = -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version) -+AM_LDFLAGS = -Wl,-z,relro -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version) - COMPAT_OBJS = @LTGETADDRINFOOBJS@ @LTGETNAMEINFOOBJS@ @LTSNPRINTFOBJS@ - EXTRA_DIST = makeinit.sh NTMakefile - noinst_SCRIPTS = makeinit.sh -diff -up cyrus-sasl-2.1.26/saslauthd/Makefile.am.relro cyrus-sasl-2.1.26/saslauthd/Makefile.am ---- cyrus-sasl-2.1.26/saslauthd/Makefile.am.relro 2013-02-11 14:18:36.910900647 +0100 -+++ cyrus-sasl-2.1.26/saslauthd/Makefile.am 2013-02-11 14:20:17.336463915 +0100 -@@ -17,6 +17,7 @@ saslauthd_DEPENDENCIES = saslauthd-main. - saslauthd_LDADD = @SASL_KRB_LIB@ \ - @GSSAPIBASE_LIBS@ @GSSAPI_LIBS@ @LIB_CRYPT@ @LIB_SIA@ \ - @LIB_SOCKET@ ../sasldb/libsasldb.la @LIB_PAM@ @LDAP_LIBS@ @LTLIBOBJS@ -+saslauthd_LDFLAGS = -pie -Wl,-z,now - - testsaslauthd_SOURCES = testsaslauthd.c utils.c - testsaslauthd_LDADD = @LIB_SOCKET@ diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-size_t.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-size_t.patch deleted file mode 100644 index cde823835b..0000000000 --- a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-size_t.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up cyrus-sasl-2.1.26/include/sasl.h.size_t cyrus-sasl-2.1.26/include/sasl.h ---- cyrus-sasl-2.1.26/include/sasl.h.size_t 2012-10-12 09:05:48.000000000 -0500 -+++ cyrus-sasl-2.1.26/include/sasl.h 2013-01-31 13:21:04.007739327 -0600 -@@ -223,6 +223,8 @@ extern "C" { - * they must be called before all other SASL functions: - */ - -+#include -+ - /* memory allocation functions which may optionally be replaced: - */ - typedef void *sasl_malloc_t(size_t); diff --git a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-warnings.patch b/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-warnings.patch deleted file mode 100644 index f7127bb0d9..0000000000 --- a/server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-warnings.patch +++ /dev/null @@ -1,74 +0,0 @@ -diff -up cyrus-sasl-2.1.26/lib/server.c.warnings cyrus-sasl-2.1.26/lib/server.c ---- cyrus-sasl-2.1.26/lib/server.c.warnings 2012-10-12 16:05:48.000000000 +0200 -+++ cyrus-sasl-2.1.26/lib/server.c 2012-12-20 17:49:39.620254792 +0100 -@@ -650,7 +650,7 @@ static int load_config(const sasl_callba - goto done; - } - -- snprintf(config_filename, len, "%.*s%c%s.conf", path_len, path_to_config, -+ snprintf(config_filename, len, "%.*s%c%s.conf", (int)path_len, path_to_config, - HIER_DELIMITER, global_callbacks.appname); - - /* Ask the application if it's safe to use this file */ -diff -up cyrus-sasl-2.1.26/plugins/gssapi.c.warnings cyrus-sasl-2.1.26/plugins/gssapi.c ---- cyrus-sasl-2.1.26/plugins/gssapi.c.warnings 2012-01-28 00:31:36.000000000 +0100 -+++ cyrus-sasl-2.1.26/plugins/gssapi.c 2012-12-20 17:49:39.620254792 +0100 -@@ -202,7 +202,8 @@ sasl_gss_seterror_(const sasl_utils_t *u - OM_uint32 msg_ctx; - int ret; - char *out = NULL; -- size_t len, curlen = 0; -+ size_t len; -+ unsigned curlen = 0; - const char prefix[] = "GSSAPI Error: "; - - if (!utils) return SASL_OK; -diff -up cyrus-sasl-2.1.26/plugins/ldapdb.c.warnings cyrus-sasl-2.1.26/plugins/ldapdb.c ---- cyrus-sasl-2.1.26/plugins/ldapdb.c.warnings 2012-01-28 00:31:36.000000000 +0100 -+++ cyrus-sasl-2.1.26/plugins/ldapdb.c 2012-12-20 17:49:39.621254788 +0100 -@@ -22,6 +22,7 @@ - - #include "plugin_common.h" - -+#define LDAP_DEPRECATED 1 - #include - - static char ldapdb[] = "ldapdb"; -diff -up cyrus-sasl-2.1.26/plugins/plugin_common.c.warnings cyrus-sasl-2.1.26/plugins/plugin_common.c ---- cyrus-sasl-2.1.26/plugins/plugin_common.c.warnings 2013-09-03 14:40:35.181455452 +0200 -+++ cyrus-sasl-2.1.26/plugins/plugin_common.c 2013-09-03 14:40:38.320441024 +0200 -@@ -94,7 +94,7 @@ static void sockaddr_unmapped( - if (!IN6_IS_ADDR_V4MAPPED((&sin6->sin6_addr))) - return; - sin4 = (struct sockaddr_in *)sa; -- addr = *(uint32_t *)&sin6->sin6_addr.s6_addr[12]; -+ addr = *(uint32_t *)&sin6->sin6_addr.s6_addr32[3]; - port = sin6->sin6_port; - memset(sin4, 0, sizeof(struct sockaddr_in)); - sin4->sin_addr.s_addr = addr; -diff -up cyrus-sasl-2.1.26/saslauthd/auth_httpform.c.warnings cyrus-sasl-2.1.26/saslauthd/auth_httpform.c ---- cyrus-sasl-2.1.26/saslauthd/auth_httpform.c.warnings 2012-10-12 16:05:48.000000000 +0200 -+++ cyrus-sasl-2.1.26/saslauthd/auth_httpform.c 2013-09-03 14:39:25.411776109 +0200 -@@ -574,7 +574,7 @@ auth_httpform ( - "Content-Type: application/x-www-form-urlencoded" CRLF - "Content-Length: %d" TWO_CRLF - "%s", -- r_uri, r_host, r_port, strlen(req), req); -+ r_uri, r_host, r_port, (int)strlen(req), req); - - if (flags & VERBOSE) { - syslog(LOG_DEBUG, "auth_httpform: sending %s %s %s", -diff -up cyrus-sasl-2.1.26/saslauthd/auth_shadow.c.warnings cyrus-sasl-2.1.26/saslauthd/auth_shadow.c ---- cyrus-sasl-2.1.26/saslauthd/auth_shadow.c.warnings 2012-10-12 16:05:48.000000000 +0200 -+++ cyrus-sasl-2.1.26/saslauthd/auth_shadow.c 2012-12-20 17:49:39.621254788 +0100 -@@ -70,6 +70,10 @@ - # include - # endif /* ! HAVE_GETUSERPW */ - -+# ifdef HAVE_CRYPT_H -+# include -+# endif -+ - # include "auth_shadow.h" - # include "globals.h" - /* END PUBLIC DEPENDENCIES */ diff --git a/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.25-auxprop.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.25-auxprop.patch new file mode 100644 index 0000000000..a9dd1476d2 --- /dev/null +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.25-auxprop.patch @@ -0,0 +1,16 @@ +https://bugzilla.cyrusimap.org/show_bug.cgi?id=3590 +https://bugs.gentoo.org/show_bug.cgi?id=392761 + +--- cyrus-sasl-2.1.25/lib/auxprop.c~ 2011-10-20 17:33:46.423015318 +0200 ++++ cyrus-sasl-2.1.25/lib/auxprop.c 2011-10-20 17:48:49.336348654 +0200 +@@ -971,6 +971,10 @@ + } + + if(!found) { ++ /* compatibility with <= 2.1.23, ignore the lack of auxrop plugin */ ++ if (!plist) ++ result = SASL_OK; ++ else + _sasl_log(sparams->utils->conn, SASL_LOG_DEBUG, + "could not find auxprop plugin, was searching for '%s'", + plist ? plist : "[all]"); diff --git a/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.26-missing-size_t.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.26-missing-size_t.patch new file mode 100644 index 0000000000..0177b52567 --- /dev/null +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.26-missing-size_t.patch @@ -0,0 +1,13 @@ +Gentoo bug #458790 +--- a/include/sasl.h ++++ b/include/sasl.h +@@ -121,6 +121,9 @@ + #ifndef SASL_H + #define SASL_H 1 + ++/* stddef.h to get size_t defined */ ++#include ++ + /* Keep in sync with win32/common.mak */ + #define SASL_VERSION_MAJOR 2 + #define SASL_VERSION_MINOR 1 diff --git a/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-CVE-2019-19906.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-CVE-2019-19906.patch new file mode 100644 index 0000000000..82b9e1fb6d --- /dev/null +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-CVE-2019-19906.patch @@ -0,0 +1,20 @@ +Description: CVE-2019-19906: Off-by-one in _sasl_add_string function +Origin: vendor +Bug: https://github.com/cyrusimap/cyrus-sasl/issues/587 +Bug-Debian: https://bugs.debian.org/947043 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-19906 +Author: Stephan Zeisberg +Reviewed-by: Salvatore Bonaccorso +Last-Update: 2019-12-19 + +--- a/lib/common.c ++++ b/lib/common.c +@@ -190,7 +190,7 @@ int _sasl_add_string(char **out, size_t + + if (add==NULL) add = "(null)"; + +- addlen=strlen(add); /* only compute once */ ++ addlen=strlen(add)+1; /* only compute once */ + if (_buf_alloc(out, alloclen, (*outlen)+addlen)!=SASL_OK) + return SASL_NOMEM; + diff --git a/server/auth/cyrus-sasl/files/0010-Update-required-libraries-when-ld-as-needed-is-used.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-as_needed.patch similarity index 53% rename from server/auth/cyrus-sasl/files/0010-Update-required-libraries-when-ld-as-needed-is-used.patch rename to server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-as_needed.patch index d1457ee691..7cd9e151fb 100644 --- a/server/auth/cyrus-sasl/files/0010-Update-required-libraries-when-ld-as-needed-is-used.patch +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-as_needed.patch @@ -1,19 +1,9 @@ -From: Debian Cyrus SASL Team - -Date: Thu, 24 Mar 2016 11:35:04 +0100 -Subject: Update required libraries when ld --as-needed is used - +Author: Matthias Klose +Desription: Fix FTBFS, add $(SASL_DB_LIB) as dependency to libsasldb, and use it. ---- - saslauthd/Makefile.am | 2 +- - sasldb/Makefile.am | 4 ++-- - 2 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/saslauthd/Makefile.am b/saslauthd/Makefile.am -index 864b29b..4cf3a3d 100644 ---- a/saslauthd/Makefile.am -+++ b/saslauthd/Makefile.am -@@ -25,7 +25,7 @@ EXTRA_saslauthd_sources = getaddrinfo.c getnameinfo.c +--- cyrus-sasl-2.1.27/saslauthd/Makefile.am ++++ cyrus-sasl-2.1.27/saslauthd/Makefile.am +@@ -25,7 +25,7 @@ saslauthd_DEPENDENCIES = saslauthd-main.o $(LTLIBOBJS_FULL) saslauthd_LDADD = @SASL_KRB_LIB@ \ @GSSAPIBASE_LIBS@ @LIB_CRYPT@ @LIB_SIA@ \ @@ -22,11 +12,9 @@ index 864b29b..4cf3a3d 100644 testsaslauthd_SOURCES = testsaslauthd.c utils.c testsaslauthd_LDADD = @LIB_SOCKET@ -diff --git a/sasldb/Makefile.am b/sasldb/Makefile.am -index 497ee25..a27645f 100644 ---- a/sasldb/Makefile.am -+++ b/sasldb/Makefile.am -@@ -54,6 +54,6 @@ noinst_LTLIBRARIES = libsasldb.la +--- cyrus-sasl-2.1.27/sasldb/Makefile.am ++++ cyrus-sasl-2.1.27/sasldb/Makefile.am +@@ -54,6 +54,6 @@ libsasldb_la_SOURCES = allockey.c sasldb.h EXTRA_libsasldb_la_SOURCES = $(extra_common_sources) diff --git a/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-autoconf-2.71.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-autoconf-2.71.patch new file mode 100644 index 0000000000..b346cd7e50 --- /dev/null +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-autoconf-2.71.patch @@ -0,0 +1,45 @@ +https://bugs.gentoo.org/825342 + +commit 5664c3f535289ce9efb513a2897991b5c436bb44 +Author: Pavel Raiskup +Date: Thu Apr 1 17:26:28 2021 +0200 + + configure.ac: properly quote macro arguments + + Autoconf 2.70+ is more picky about the quotation (even though with + previous versions the arguments should have been quoted, too). When we + don't quote macros inside the AC_CACHE_VAL macro - some of the Autoconf + initialization is wrongly ordered in ./configure script and we keep + seeing bugs like: + + ./configure: line 2165: ac_fn_c_try_run: command not found + + Original report: https://bugzilla.redhat.com/1943013 + + Signed-off-by: Pavel Raiskup + +--- a/configure.ac ++++ b/configure.ac +@@ -213,7 +213,8 @@ if test $sasl_cv_uscore = yes; then + AC_MSG_CHECKING(whether dlsym adds the underscore for us) + cmu_save_LIBS="$LIBS" + LIBS="$LIBS $SASL_DL_LIB" +- AC_CACHE_VAL(sasl_cv_dlsym_adds_uscore,AC_TRY_RUN( [ ++ AC_CACHE_VAL([sasl_cv_dlsym_adds_uscore], ++ [AC_TRY_RUN([ + #include + #include + #include +@@ -221,9 +222,9 @@ void foo() { int i=0;} + int main() { void *self, *ptr1, *ptr2; self=dlopen(NULL,RTLD_LAZY); + if(self) { ptr1=dlsym(self,"foo"); ptr2=dlsym(self,"_foo"); + if(ptr1 && !ptr2) exit(0); } exit(1); } +-], [sasl_cv_dlsym_adds_uscore=yes], sasl_cv_dlsym_adds_uscore=no +- AC_DEFINE(DLSYM_NEEDS_UNDERSCORE, [], [Do we need a leading _ for dlsym?]), +- AC_MSG_WARN(cross-compiler, we'll do our best))) ++], [sasl_cv_dlsym_adds_uscore=yes], [sasl_cv_dlsym_adds_uscore=no ++ AC_DEFINE(DLSYM_NEEDS_UNDERSCORE, [], [Do we need a leading _ for dlsym?])], ++ [AC_MSG_WARN(cross-compiler, we'll do our best)])]) + LIBS="$cmu_save_LIBS" + AC_MSG_RESULT($sasl_cv_dlsym_adds_uscore) + diff --git a/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-autotools_fixes.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-autotools_fixes.patch new file mode 100644 index 0000000000..2ce971efc5 --- /dev/null +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-autotools_fixes.patch @@ -0,0 +1,31 @@ +--- cyrus-sasl-2.1.27/configure.ac ++++ cyrus-sasl-2.1.27/configure.ac +@@ -44,6 +44,8 @@ + + AC_PREREQ(2.63) + ++AC_CONFIG_MACRO_DIR([config]) ++ + dnl + dnl REMINDER: When changing the version number here, please also update + dnl the values in win32/include/config.h and include/sasl.h as well. +--- cyrus-sasl-2.1.27/Makefile.am ++++ cyrus-sasl-2.1.27/Makefile.am +@@ -44,6 +44,8 @@ + # + ################################################################ + ++ACLOCAL_AMFLAGS = -I config ++ + if SASLAUTHD + SAD = saslauthd + else +--- cyrus-sasl-2.1.27/saslauthd/Makefile.am ++++ cyrus-sasl-2.1.27/saslauthd/Makefile.am +@@ -1,4 +1,6 @@ + AUTOMAKE_OPTIONS = 1.7 ++ACLOCAL_AMFLAGS = -I ../config ++ + sbin_PROGRAMS = saslauthd testsaslauthd + EXTRA_PROGRAMS = saslcache + diff --git a/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-avoid_pic_overwrite.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-avoid_pic_overwrite.patch new file mode 100644 index 0000000000..c331039e2f --- /dev/null +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-avoid_pic_overwrite.patch @@ -0,0 +1,17 @@ +Author: Fabian Fagerholm +Description: This patch makes sure the non-PIC version of libsasldb.a, which +is created out of non-PIC objects, is not going to overwrite the PIC version, +which is created out of PIC objects. The PIC version is placed in .libs, and +the non-PIC version in the current directory. This ensures that both non-PIC +and PIC versions are available in the correct locations. +--- cyrus-sasl-2.1.27/lib/Makefile.am ++++ cyrus-sasl-2.1.27/lib/Makefile.am +@@ -98,7 +98,7 @@ + + libsasl2.a: libsasl2.la $(SASL_STATIC_OBJS) + @echo adding static plugins and dependencies +- $(AR) cru .libs/$@ $(SASL_STATIC_OBJS) ++ $(AR) cru $@ $(SASL_STATIC_OBJS) + @for i in ./libsasl2.la ../common/libplugin_common.la ../sasldb/libsasldb.la ../plugins/lib*.la; do \ + if test ! -f $$i; then continue; fi; . $$i; \ + for j in $$dependency_libs foo; do \ diff --git a/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-db_gdbm-fix-gdbm_errno-overlay-from-gdbm_close.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-db_gdbm-fix-gdbm_errno-overlay-from-gdbm_close.patch new file mode 100644 index 0000000000..f1e3ae9850 --- /dev/null +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-db_gdbm-fix-gdbm_errno-overlay-from-gdbm_close.patch @@ -0,0 +1,35 @@ +From af48f6fec9a7b6374d4153c5db894d4a1f349645 Mon Sep 17 00:00:00 2001 +Message-Id: +From: Jonas Jelten +Date: Sat, 2 Feb 2019 20:53:37 +0100 +Subject: [PATCH] db_gdbm: fix gdbm_errno overlay from gdbm_close + +`gdbm_close` also sets gdbm_errno since version 1.17. +This leads to a problem in `libsasl` as the `gdbm_close` incovation overlays +the `gdbm_errno` value which is then later used for the error handling. + +Signed-off-by: Martin Kletzander +--- + sasldb/db_gdbm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sasldb/db_gdbm.c b/sasldb/db_gdbm.c +index ee56a6bf8516..c908808e04a1 100644 +--- a/sasldb/db_gdbm.c ++++ b/sasldb/db_gdbm.c +@@ -107,9 +107,11 @@ int _sasldb_getdata(const sasl_utils_t *utils, + gkey.dptr = key; + gkey.dsize = key_len; + gvalue = gdbm_fetch(db, gkey); ++ int fetch_errno = gdbm_errno; ++ + gdbm_close(db); + if (! gvalue.dptr) { +- if (gdbm_errno == GDBM_ITEM_NOT_FOUND) { ++ if (fetch_errno == GDBM_ITEM_NOT_FOUND) { + utils->seterror(conn, SASL_NOLOG, + "user: %s@%s property: %s not found in %s", + authid, realm, propName, path); +-- +2.33.1 + diff --git a/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-doc_build_fix.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-doc_build_fix.patch new file mode 100644 index 0000000000..bdd02f7796 --- /dev/null +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-doc_build_fix.patch @@ -0,0 +1,11 @@ +--- cyrus-sasl-2.1.27/docsrc/exts/sphinxlocal/writers/manpage.py ++++ cyrus-sasl-2.1.27/docsrc/exts/sphinxlocal/writers/manpage.py +@@ -23,7 +23,7 @@ + from sphinx import addnodes + from sphinx.locale import admonitionlabels, _ + from sphinx.util.osutil import ustrftime +-from sphinx.util.compat import docutils_version ++#from sphinx.util.compat import docutils_version + + class CyrusManualPageWriter(ManualPageWriter): + diff --git a/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-gss_c_nt_hostbased_service.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-gss_c_nt_hostbased_service.patch new file mode 100644 index 0000000000..c585cb158e --- /dev/null +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-gss_c_nt_hostbased_service.patch @@ -0,0 +1,16 @@ +Gentoo bug #389349 +--- cyrus-sasl-2.1.27/m4/sasl2.m4 ++++ cyrus-sasl-2.1.27/m4/sasl2.m4 +@@ -220,7 +220,11 @@ + [AC_WARN([Cybersafe define not found])]) + + elif test "$ac_cv_header_gssapi_h" = "yes"; then +- AC_EGREP_HEADER(GSS_C_NT_HOSTBASED_SERVICE, gssapi.h, ++ AC_EGREP_CPP(hostbased_service_gss_nt_yes, gssapi.h, ++ [#include ++ #ifdef GSS_C_NT_HOSTBASED_SERVICE ++ hostbased_service_gss_nt_yes ++ #endif], + [AC_DEFINE(HAVE_GSS_C_NT_HOSTBASED_SERVICE,, + [Define if your GSSAPI implementation defines GSS_C_NT_HOSTBASED_SERVICE])]) + elif test "$ac_cv_header_gssapi_gssapi_h"; then diff --git a/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-memmem.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-memmem.patch new file mode 100644 index 0000000000..158529dcb5 --- /dev/null +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-memmem.patch @@ -0,0 +1,53 @@ +auth_rimap: provide naive memmem implementation if missing + +read_response uses memmem, which is not available on e.g. Solaris 10 + +Bug: https://github.com/cyrusimap/cyrus-sasl/pull/551 +Signed-off-by: Fabian Groffen + +--- a/saslauthd/auth_rimap.c ++++ b/saslauthd/auth_rimap.c +@@ -367,6 +367,32 @@ + /* END FUNCTION: process_login_reply */ + + ++#ifndef HAVE_MEMMEM ++static void *memmem( ++ const void *big, size_t big_len, ++ const void *little, size_t little_len) ++{ ++ const char *bp = (const char *)big; ++ const char *lp = (const char *)little; ++ size_t l; ++ ++ if (big_len < little_len || little_len == 0 || big_len == 0) ++ return NULL; ++ ++ while (big_len > 0) { ++ for (l = 0; l < little_len; l++) { ++ if (bp[l] != lp[l]) ++ break; ++ } ++ if (l == little_len) ++ return (void *)bp; ++ bp++; ++ } ++ ++ return NULL; ++} ++#endif ++ + static int read_response(int s, char *rbuf, int buflen, const char *tag) + { + int rc = 0; +--- a/configure.ac ++++ b/configure.ac +@@ -1292,7 +1292,7 @@ + + #AC_FUNC_MEMCMP + #AC_FUNC_VPRINTF +-AC_CHECK_FUNCS(gethostname getdomainname getpwnam getspnam gettimeofday inet_aton memcpy mkdir select socket strchr strdup strerror strspn strstr strtol jrand48 getpassphrase asprintf strlcat strlcpy) ++AC_CHECK_FUNCS(gethostname getdomainname getpwnam getspnam gettimeofday inet_aton memcpy memmem mkdir select socket strchr strdup strerror strspn strstr strtol jrand48 getpassphrase asprintf strlcat strlcpy) + + if test $ac_cv_func_getspnam = yes; then + AC_MSG_CHECKING(if getpwnam_r/getspnam_r take 5 arguments) diff --git a/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-slibtool.patch b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-slibtool.patch new file mode 100644 index 0000000000..81198cb87f --- /dev/null +++ b/server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-slibtool.patch @@ -0,0 +1,18 @@ +https://github.com/cyrusimap/cyrus-sasl/pull/623 +https://bugs.gentoo.org/775875 + +From 5b8075eeba8d0334573689450b07610c176a2618 Mon Sep 17 00:00:00 2001 +From: orbea +Date: Wed, 9 Sep 2020 07:29:38 -0700 +Subject: [PATCH] common: Define the missing crypto_compat_version version. + +--- a/common/Makefile.am ++++ b/common/Makefile.am +@@ -46,6 +46,7 @@ + # See + # CURRENT:REVISION:AGE + plugin_common_version = 3:0:0 ++crypto_compat_version = 0:0:0 + + AM_CPPFLAGS=-fPIC -I$(top_srcdir)/include -I$(top_builddir)/include + diff --git a/server/auth/cyrus-sasl/pspec.xml b/server/auth/cyrus-sasl/pspec.xml index adb8cb5b78..e20225722a 100644 --- a/server/auth/cyrus-sasl/pspec.xml +++ b/server/auth/cyrus-sasl/pspec.xml @@ -21,38 +21,21 @@ e2fsprogs-devel openssl-devel groff - openldap-server + openldap-server - - - - 0006-Enable-autoconf-maintainer-mode.patch - 0010-Update-required-libraries-when-ld-as-needed-is-used.patch - 0013-Don-t-use-la-files-for-opening-plugins.patch - 0020-Restore-LIBS-after-checking-gss_inquire_sec_context_.patch - 0022-Fix-keytab-option-for-MIT-Kerberos.patch - - cyrus-sasl-2.1.20-saslauthd.conf-path.patch - cyrus-sasl-2.1.22-ldap-timeout.patch + gentoo/cyrus-sasl-2.1.25-auxprop.patch + gentoo/cyrus-sasl-2.1.26-missing-size_t.patch + gentoo/cyrus-sasl-2.1.27-CVE-2019-19906.patch + gentoo/cyrus-sasl-2.1.27-as_needed.patch + gentoo/cyrus-sasl-2.1.27-autoconf-2.71.patch + gentoo/cyrus-sasl-2.1.27-autotools_fixes.patch + gentoo/cyrus-sasl-2.1.27-avoid_pic_overwrite.patch + gentoo/cyrus-sasl-2.1.27-db_gdbm-fix-gdbm_errno-overlay-from-gdbm_close.patch + gentoo/cyrus-sasl-2.1.27-doc_build_fix.patch + gentoo/cyrus-sasl-2.1.27-gss_c_nt_hostbased_service.patch + gentoo/cyrus-sasl-2.1.27-memmem.patch + gentoo/cyrus-sasl-2.1.27-slibtool.patch