Pisilinux/main
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cyrus-sasl rebuild

Browse Source
This commit is contained in:
Rmys
2021-12-03 15:24:56 +03:00
parent 065664bdaf
commit c06ff65222
37 changed files with 309 additions and 1154 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/auth/cyrus-sasl/actions.py
+13 -6
View File
@@ -11,24 +11,31 @@ from pisi.actionsapi import shelltools
def setup(): def setup():
pisitools.dosed("libsasl2.pc.in", "libdir = @libdir@", "prefix=/usr\nexec_prefix=${prefix}\nlibdir = @libdir@") pisitools.dosed("libsasl2.pc.in", "libdir = @libdir@", "prefix=/usr\nexec_prefix=${prefix}\nlibdir = @libdir@")
def cleanup(): #def cleanup():
for p in ("config.*", "ltconfig", "ltmain.sh", "libtool.m4"): #for p in ("config.*", "ltconfig", "ltmain.sh", "libtool.m4"):
shelltools.unlink("config/%s" % p) #shelltools.unlink("config/%s" % p)
cleanup() #cleanup()
#autotools.autoreconf("-vfi --no-recursive -I config -I cmulocal") #autotools.autoreconf("-vfi --no-recursive -I config -I cmulocal")
#shelltools.cd("saslauthd") #shelltools.cd("saslauthd")
#cleanup() #cleanup()
#autotools.autoreconf("-vi --no-recursive -I config -I ../cmulocal -I ../config") #autotools.autoreconf("-vi --no-recursive -I config -I ../cmulocal -I ../config")
#shelltools.cd("..") #shelltools.cd("..")
shelltools.system("""sed -i -e '/LIB_SQLITE.*-R/s/ -R[^"]*//' \
configure.ac || die""")
shelltools.system("sed -i -e 's:AM_CONFIG_HEADER:AC_CONFIG_HEADERS:g' \
-e 's:AC_CONFIG_MACRO_DIR:AC_CONFIG_MACRO_DIRS:g' \
configure.ac || die")
shelltools.system("libtoolize -c") shelltools.system("libtoolize -c")
shelltools.system("aclocal -I config") shelltools.system("aclocal -I config")
shelltools.system("automake -a -c") shelltools.system("automake -a -c")
shelltools.system("autoheader") shelltools.system("autoheader")
autotools.autoconf() autotools.autoconf()
pisitools.cflags.add("-fPIC") pisitools.cflags.add("-fno-strict-aliasing")
# Don't disable ldap support to break circular dep. with openldap # Don't disable ldap support to break circular dep. with openldap
# As workaround, we remove openldap-client runtime dep. in pspec # As workaround, we remove openldap-client runtime dep. in pspec
server/auth/cyrus-sasl/files/0006-Enable-autoconf-maintainer-mode.patch
-22
View File
@@ -1,22 +0,0 @@
From: Debian Cyrus SASL Team
<pkg-cyrus-sasl2-debian-devel@lists.alioth.debian.org>
Date: Thu, 24 Mar 2016 11:35:03 +0100
Subject: Enable autoconf maintainer mode
---
configure.ac | 2 ++
1 file changed, 2 insertions(+)
diff --git a/configure.ac b/configure.ac
index 388f5d0..b3db52c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -69,6 +69,8 @@ AC_CANONICAL_TARGET
AM_INIT_AUTOMAKE([1.11 tar-ustar dist-bzip2 foreign -Wno-portability subdir-objects])
+AM_MAINTAINER_MODE
+
DIRS=""
AC_ARG_ENABLE(cmulocal,
server/auth/cyrus-sasl/files/0011_saslauthd_ac_prog_libtool.patch
-15
View File
@@ -1,15 +0,0 @@
0011_saslauthd_ac_prog_libtool.dpatch by <fabbe@debian.org>
Enable libtool use.
diff -urNad trunk~/saslauthd/configure.in trunk/saslauthd/configure.in
--- trunk~/saslauthd/configure.in 2006-05-29 22:52:42.000000000 +0300
+++ trunk/saslauthd/configure.in 2006-11-01 23:41:51.000000000 +0200
@@ -25,6 +25,7 @@
AC_PROG_MAKE_SET
AC_PROG_LN_S
AC_PROG_INSTALL
+AC_PROG_LIBTOOL
dnl Checks for build foo
CMU_C___ATTRIBUTE__
server/auth/cyrus-sasl/files/0013-Don-t-use-la-files-for-opening-plugins.patch
-153
View File
@@ -1,153 +0,0 @@
From: Debian Cyrus SASL Team
<pkg-cyrus-sasl2-debian-devel@lists.alioth.debian.org>
Date: Thu, 24 Mar 2016 11:35:04 +0100
Subject: Don't use la files for opening plugins
---
lib/dlopen.c | 121 ++++-------------------------------------------------------
1 file changed, 7 insertions(+), 114 deletions(-)
diff --git a/lib/dlopen.c b/lib/dlopen.c
index 8284cd8..ef90b11 100644
--- a/lib/dlopen.c
+++ b/lib/dlopen.c
@@ -246,113 +246,6 @@ static int _sasl_plugin_load(char *plugin, void *library,
return result;
}
-/* this returns the file to actually open.
- * out should be a buffer of size PATH_MAX
- * and may be the same as in. */
-
-/* We'll use a static buffer for speed unless someone complains */
-#define MAX_LINE 2048
-
-static int _parse_la(const char *prefix, const char *in, char *out)
-{
- FILE *file;
- size_t length;
- char line[MAX_LINE];
- char *ntmp = NULL;
-
- if(!in || !out || !prefix || out == in) return SASL_BADPARAM;
-
- /* Set this so we can detect failure */
- *out = '\0';
-
- length = strlen(in);
-
- if (strcmp(in + (length - strlen(LA_SUFFIX)), LA_SUFFIX)) {
- if(!strcmp(in + (length - strlen(SO_SUFFIX)),SO_SUFFIX)) {
- /* check for a .la file */
- if (strlen(prefix) + strlen(in) + strlen(LA_SUFFIX) + 1 >= MAX_LINE)
- return SASL_BADPARAM;
- strcpy(line, prefix);
- strcat(line, in);
- length = strlen(line);
- *(line + (length - strlen(SO_SUFFIX))) = '\0';
- strcat(line, LA_SUFFIX);
- file = fopen(line, "r");
- if(file) {
- /* We'll get it on the .la open */
- fclose(file);
- return SASL_FAIL;
- }
- }
- if (strlen(prefix) + strlen(in) + 1 >= PATH_MAX)
- return SASL_BADPARAM;
- strcpy(out, prefix);
- strcat(out, in);
- return SASL_OK;
- }
-
- if (strlen(prefix) + strlen(in) + 1 >= MAX_LINE)
- return SASL_BADPARAM;
- strcpy(line, prefix);
- strcat(line, in);
-
- file = fopen(line, "r");
- if(!file) {
- _sasl_log(NULL, SASL_LOG_WARN,
- "unable to open LA file: %s", line);
- return SASL_FAIL;
- }
-
- while(!feof(file)) {
- if(!fgets(line, MAX_LINE, file)) break;
- if(line[strlen(line) - 1] != '\n') {
- _sasl_log(NULL, SASL_LOG_WARN,
- "LA file has too long of a line: %s", in);
- fclose(file);
- return SASL_BUFOVER;
- }
- if(line[0] == '\n' || line[0] == '#') continue;
- if(!strncmp(line, "dlname=", sizeof("dlname=") - 1)) {
- /* We found the line with the name in it */
- char *end;
- char *start;
- size_t len;
- end = strrchr(line, '\'');
- if(!end) continue;
- start = &line[sizeof("dlname=")-1];
- len = strlen(start);
- if(len > 3 && start[0] == '\'') {
- ntmp=&start[1];
- *end='\0';
- /* Do we have dlname="" ? */
- if(ntmp == end) {
- _sasl_log(NULL, SASL_LOG_DEBUG,
- "dlname is empty in .la file: %s", in);
- fclose(file);
- return SASL_FAIL;
- }
- strcpy(out, prefix);
- strcat(out, ntmp);
- }
- break;
- }
- }
- if(ferror(file) || feof(file)) {
- _sasl_log(NULL, SASL_LOG_WARN,
- "Error reading .la: %s\n", in);
- fclose(file);
- return SASL_FAIL;
- }
- fclose(file);
-
- if(!(*out)) {
- _sasl_log(NULL, SASL_LOG_WARN,
- "Could not find a dlname line in .la file: %s", in);
- return SASL_FAIL;
- }
-
- return SASL_OK;
-}
#endif /* DO_DLOPEN */
/* loads a plugin library */
@@ -506,18 +399,18 @@ int _sasl_load_plugins(const add_plugin_list_t *entrypoints,
if (length + pos>=PATH_MAX) continue; /* too big */
if (strcmp(dir->d_name + (length - strlen(SO_SUFFIX)),
- SO_SUFFIX)
- && strcmp(dir->d_name + (length - strlen(LA_SUFFIX)),
- LA_SUFFIX))
+ SO_SUFFIX))
continue;
+ /* We only use .so files for loading plugins */
+
memcpy(name,dir->d_name,length);
name[length]='\0';
- result = _parse_la(prefix, name, tmp);
- if(result != SASL_OK)
- continue;
-
+ /* Create full name with path */
+ strncpy(tmp, prefix, PATH_MAX);
+ strncat(tmp, name, PATH_MAX);
+
/* skip "lib" and cut off suffix --
this only need be approximate */
strcpy(plugname, name + 3);
server/auth/cyrus-sasl/files/0020-Restore-LIBS-after-checking-gss_inquire_sec_context_.patch
-26
View File
@@ -1,26 +0,0 @@
From 31b68a9438c24fc9e3e52f626462bf514de31757 Mon Sep 17 00:00:00 2001
From: Ryan Tandy <ryan@nardis.ca>
Date: Mon, 24 Dec 2018 15:07:02 -0800
Subject: [PATCH] Restore LIBS after checking gss_inquire_sec_context_by_oid
Fixes: 4b0306dcd76031460246b2dabcb7db766d6b04d8
---
m4/sasl2.m4 | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/m4/sasl2.m4 b/m4/sasl2.m4
index 56e0504a..17f5d081 100644
--- a/m4/sasl2.m4
+++ b/m4/sasl2.m4
@@ -311,9 +311,10 @@ if test "$gssapi" != no; then
[AC_DEFINE(HAVE_GSS_C_SEC_CONTEXT_SASL_SSF,,
[Define if your GSSAPI implementation defines GSS_C_SEC_CONTEXT_SASL_SSF])])
fi
+ LIBS="$cmu_save_LIBS"
+
cmu_save_LIBS="$LIBS"
LIBS="$LIBS $GSSAPIBASE_LIBS"
-
AC_MSG_CHECKING([for SPNEGO support in GSSAPI libraries])
AC_TRY_RUN([
#ifdef HAVE_GSSAPI_H
server/auth/cyrus-sasl/files/0022-Fix-keytab-option-for-MIT-Kerberos.patch
-66
View File
@@ -1,66 +0,0 @@
From: Debian Cyrus SASL Team
<pkg-cyrus-sasl2-debian-devel@lists.alioth.debian.org>
Date: Thu, 24 Mar 2016 11:35:05 +0100
Subject: Fix keytab option for MIT Kerberos
---
m4/sasl2.m4 | 1 +
plugins/gssapi.c | 11 ++++++++---
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/m4/sasl2.m4 b/m4/sasl2.m4
index 56e0504..a90f7b4 100644
--- a/m4/sasl2.m4
+++ b/m4/sasl2.m4
@@ -282,6 +282,7 @@ if test "$gssapi" != no; then
])
fi
fi
+ AC_CHECK_FUNCS(krb5_gss_register_acceptor_identity)
AC_CHECK_FUNCS(gss_decapsulate_token)
AC_CHECK_FUNCS(gss_encapsulate_token)
AC_CHECK_FUNCS(gss_oid_equal)
diff --git a/plugins/gssapi.c b/plugins/gssapi.c
index ff663da..7c69ac2 100644
--- a/plugins/gssapi.c
+++ b/plugins/gssapi.c
@@ -1545,7 +1545,7 @@ static sasl_server_plug_t gssapi_server_plugins[] =
};
int gssapiv2_server_plug_init(
-#ifndef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY
+#if !defined(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY) && !defined(HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY)
const sasl_utils_t *utils __attribute__((unused)),
#else
const sasl_utils_t *utils,
@@ -1555,7 +1555,7 @@ int gssapiv2_server_plug_init(
sasl_server_plug_t **pluglist,
int *plugcount)
{
-#ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY
+#if defined(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY) || defined(HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY)
const char *keytab = NULL;
char keytab_path[1024];
unsigned int rl;
@@ -1565,7 +1565,7 @@ int gssapiv2_server_plug_init(
return SASL_BADVERS;
}
-#ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY
+#if defined(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY) || defined(HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY)
/* unfortunately, we don't check for readability of keytab if it's
the standard one, since we don't know where it is */
@@ -1587,7 +1587,12 @@ int gssapiv2_server_plug_init(
strncpy(keytab_path, keytab, 1024);
+#ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY
gsskrb5_register_acceptor_identity(keytab_path);
+#endif
+#ifdef HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY
+ krb5_gss_register_acceptor_identity(keytab_path);
+#endif
}
#endif
server/auth/cyrus-sasl/files/0025_ld_as_needed.patch
-27
View File
@@ -1,27 +0,0 @@
Author: Matthias Klose <doko@ubuntu.com>
Desription: Fix FTBFS, add $(SASL_DB_LIB) as dependency to libsasldb, and use
it.
--- a/saslauthd/Makefile.am
+++ b/saslauthd/Makefile.am
@@ -16,7 +16,7 @@ EXTRA_saslauthd_sources = getaddrinfo.c
saslauthd_DEPENDENCIES = saslauthd-main.o @LTLIBOBJS@
saslauthd_LDADD = @SASL_KRB_LIB@ \
@GSSAPIBASE_LIBS@ @GSSAPI_LIBS@ @LIB_CRYPT@ @LIB_SIA@ \
- @LIB_SOCKET@ @SASL_DB_LIB@ @LIB_PAM@ @LDAP_LIBS@ @LTLIBOBJS@
+ @LIB_SOCKET@ ../sasldb/libsasldb.la @LIB_PAM@ @LDAP_LIBS@ @LTLIBOBJS@
testsaslauthd_SOURCES = testsaslauthd.c utils.c
testsaslauthd_LDADD = @LIB_SOCKET@
--- a/sasldb/Makefile.am
+++ b/sasldb/Makefile.am
@@ -55,8 +55,8 @@ noinst_LIBRARIES = libsasldb.a
libsasldb_la_SOURCES = allockey.c sasldb.h
EXTRA_libsasldb_la_SOURCES = $(extra_common_sources)
-libsasldb_la_DEPENDENCIES = $(SASL_DB_BACKEND)
-libsasldb_la_LIBADD = $(SASL_DB_BACKEND)
+libsasldb_la_DEPENDENCIES = $(SASL_DB_BACKEND) $(SASL_DB_LIB)
+libsasldb_la_LIBADD = $(SASL_DB_BACKEND) $(SASL_DB_LIB)
# Prevent make dist stupidity
libsasldb_a_SOURCES =
server/auth/cyrus-sasl/files/0026_drop_krb5support_dependency.patch
-14
View File
@@ -1,14 +0,0 @@
Author: Roberto C. Sanchez <roberto@connexer.com>
Description: Drop gratuitous dependency on krb5support
--- a/cmulocal/sasl2.m4
+++ b/cmulocal/sasl2.m4
@@ -112,9 +112,6 @@ if test "$gssapi" != no; then
fi
if test "$gss_impl" = "auto" -o "$gss_impl" = "mit"; then
- # check for libkrb5support first
- AC_CHECK_LIB(krb5support,krb5int_getspecific,K5SUP=-lkrb5support K5SUPSTATIC=$gssapi_dir/libkrb5support.a,,${LIB_SOCKET})
-
gss_failed=0
AC_CHECK_LIB(gssapi_krb5,gss_unwrap,gss_impl="mit",gss_failed=1,
${GSSAPIBASE_LIBS} -lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err ${K5SUP} ${LIB_SOCKET})
server/auth/cyrus-sasl/files/0030-dont_use_la_files_for_opening_plugins.patch
-134
View File
@@ -1,134 +0,0 @@
--- a/lib/dlopen.c
+++ b/lib/dlopen.c
@@ -247,105 +247,6 @@ static int _sasl_plugin_load(char *plugi
return result;
}
-/* this returns the file to actually open.
- * out should be a buffer of size PATH_MAX
- * and may be the same as in. */
-
-/* We'll use a static buffer for speed unless someone complains */
-#define MAX_LINE 2048
-
-static int _parse_la(const char *prefix, const char *in, char *out)
-{
- FILE *file;
- size_t length;
- char line[MAX_LINE];
- char *ntmp = NULL;
-
- if(!in || !out || !prefix || out == in) return SASL_BADPARAM;
-
- /* Set this so we can detect failure */
- *out = '\0';
-
- length = strlen(in);
-
- if (strcmp(in + (length - strlen(LA_SUFFIX)), LA_SUFFIX)) {
- if(!strcmp(in + (length - strlen(SO_SUFFIX)),SO_SUFFIX)) {
- /* check for a .la file */
- strcpy(line, prefix);
- strcat(line, in);
- length = strlen(line);
- *(line + (length - strlen(SO_SUFFIX))) = '\0';
- strcat(line, LA_SUFFIX);
- file = fopen(line, "r");
- if(file) {
- /* We'll get it on the .la open */
- fclose(file);
- return SASL_FAIL;
- }
- }
- strcpy(out, prefix);
- strcat(out, in);
- return SASL_OK;
- }
-
- strcpy(line, prefix);
- strcat(line, in);
-
- file = fopen(line, "r");
- if(!file) {
- _sasl_log(NULL, SASL_LOG_WARN,
- "unable to open LA file: %s", line);
- return SASL_FAIL;
- }
-
- while(!feof(file)) {
- if(!fgets(line, MAX_LINE, file)) break;
- if(line[strlen(line) - 1] != '\n') {
- _sasl_log(NULL, SASL_LOG_WARN,
- "LA file has too long of a line: %s", in);
- return SASL_BUFOVER;
- }
- if(line[0] == '\n' || line[0] == '#') continue;
- if(!strncmp(line, "dlname=", sizeof("dlname=") - 1)) {
- /* We found the line with the name in it */
- char *end;
- char *start;
- size_t len;
- end = strrchr(line, '\'');
- if(!end) continue;
- start = &line[sizeof("dlname=")-1];
- len = strlen(start);
- if(len > 3 && start[0] == '\'') {
- ntmp=&start[1];
- *end='\0';
- /* Do we have dlname="" ? */
- if(ntmp == end) {
- _sasl_log(NULL, SASL_LOG_DEBUG,
- "dlname is empty in .la file: %s", in);
- return SASL_FAIL;
- }
- strcpy(out, prefix);
- strcat(out, ntmp);
- }
- break;
- }
- }
- if(ferror(file) || feof(file)) {
- _sasl_log(NULL, SASL_LOG_WARN,
- "Error reading .la: %s\n", in);
- fclose(file);
- return SASL_FAIL;
- }
- fclose(file);
-
- if(!(*out)) {
- _sasl_log(NULL, SASL_LOG_WARN,
- "Could not find a dlname line in .la file: %s", in);
- return SASL_FAIL;
- }
-
- return SASL_OK;
-}
#endif /* DO_DLOPEN */
/* loads a plugin library */
@@ -499,18 +400,18 @@ int _sasl_load_plugins(const add_plugin_
if (length + pos>=PATH_MAX) continue; /* too big */
if (strcmp(dir->d_name + (length - strlen(SO_SUFFIX)),
- SO_SUFFIX)
- && strcmp(dir->d_name + (length - strlen(LA_SUFFIX)),
- LA_SUFFIX))
+ SO_SUFFIX))
continue;
+ /* We only use .so files for loading plugins */
+
memcpy(name,dir->d_name,length);
name[length]='\0';
- result = _parse_la(prefix, name, tmp);
- if(result != SASL_OK)
- continue;
-
+ /* Create full name with path */
+ strncpy(tmp, prefix, PATH_MAX);
+ strncat(tmp, name, PATH_MAX);
+
/* skip "lib" and cut off suffix --
this only need be approximate */
strcpy(plugname, name + 3);
server/auth/cyrus-sasl/files/CVE-2013-4122.patch
-116
View File
@@ -1,116 +0,0 @@
From dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d Mon Sep 17 00:00:00 2001
From: mancha <mancha1@hush.com>
Date: Thu, 11 Jul 2013 09:08:07 +0000
Subject: Handle NULL returns from glibc 2.17+ crypt()
Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL
(w/ NULL return) if the salt violates specifications. Additionally,
on FIPS-140 enabled Linux systems, DES/MD5-encrypted passwords
passed to crypt() fail with EPERM (w/ NULL return).
When using glibc's crypt(), check return value to avoid a possible
NULL pointer dereference.
Patch by mancha1@hush.com.
---
diff --git a/pwcheck/pwcheck_getpwnam.c b/pwcheck/pwcheck_getpwnam.c
index 4b34222..400289c 100644
--- a/pwcheck/pwcheck_getpwnam.c
+++ b/pwcheck/pwcheck_getpwnam.c
@@ -32,6 +32,7 @@ char *userid;
char *password;
{
char* r;
+ char* crpt_passwd;
struct passwd *pwd;
pwd = getpwnam(userid);
@@ -41,7 +42,7 @@ char *password;
else if (pwd->pw_passwd[0] == '*') {
r = "Account disabled";
}
- else if (strcmp(pwd->pw_passwd, crypt(password, pwd->pw_passwd)) != 0) {
+ else if (!(crpt_passwd = crypt(password, pwd->pw_passwd)) || strcmp(pwd->pw_passwd, (const char *)crpt_passwd) != 0) {
r = "Incorrect password";
}
else {
diff --git a/pwcheck/pwcheck_getspnam.c b/pwcheck/pwcheck_getspnam.c
index 2b11286..6d607bb 100644
--- a/pwcheck/pwcheck_getspnam.c
+++ b/pwcheck/pwcheck_getspnam.c
@@ -32,13 +32,15 @@ char *userid;
char *password;
{
struct spwd *pwd;
+ char *crpt_passwd;
pwd = getspnam(userid);
if (!pwd) {
return "Userid not found";
}
- if (strcmp(pwd->sp_pwdp, crypt(password, pwd->sp_pwdp)) != 0) {
+ crpt_passwd = crypt(password, pwd->sp_pwdp);
+ if (!crpt_passwd || strcmp(pwd->sp_pwdp, (const char *)crpt_passwd) != 0) {
return "Incorrect password";
}
else {
diff --git a/saslauthd/auth_getpwent.c b/saslauthd/auth_getpwent.c
index fc8029d..d4ebe54 100644
--- a/saslauthd/auth_getpwent.c
+++ b/saslauthd/auth_getpwent.c
@@ -77,6 +77,7 @@ auth_getpwent (
{
/* VARIABLES */
struct passwd *pw; /* pointer to passwd file entry */
+ char *crpt_passwd; /* encrypted password */
int errnum;
/* END VARIABLES */
@@ -105,7 +106,8 @@ auth_getpwent (
}
}
- if (strcmp(pw->pw_passwd, (const char *)crypt(password, pw->pw_passwd))) {
+ crpt_passwd = crypt(password, pw->pw_passwd);
+ if (!crpt_passwd || strcmp(pw->pw_passwd, (const char *)crpt_passwd)) {
if (flags & VERBOSE) {
syslog(LOG_DEBUG, "DEBUG: auth_getpwent: %s: invalid password", login);
}
diff --git a/saslauthd/auth_shadow.c b/saslauthd/auth_shadow.c
index 677131b..1988afd 100644
--- a/saslauthd/auth_shadow.c
+++ b/saslauthd/auth_shadow.c
@@ -210,8 +210,8 @@ auth_shadow (
RETURN("NO Insufficient permission to access NIS authentication database (saslauthd)");
}
- cpw = strdup((const char *)crypt(password, sp->sp_pwdp));
- if (strcmp(sp->sp_pwdp, cpw)) {
+ cpw = crypt(password, sp->sp_pwdp);
+ if (!cpw || strcmp(sp->sp_pwdp, (const char *)cpw)) {
if (flags & VERBOSE) {
/*
* This _should_ reveal the SHADOW_PW_LOCKED prefix to an
@@ -221,10 +221,8 @@ auth_shadow (
syslog(LOG_DEBUG, "DEBUG: auth_shadow: pw mismatch: '%s' != '%s'",
sp->sp_pwdp, cpw);
}
- free(cpw);
RETURN("NO Incorrect password");
}
- free(cpw);
/*
* The following fields will be set to -1 if:
@@ -286,7 +284,7 @@ auth_shadow (
RETURN("NO Invalid username");
}
- if (strcmp(upw->upw_passwd, crypt(password, upw->upw_passwd)) != 0) {
+ if (!(cpw = crypt(password, upw->upw_passwd)) || (strcmp(upw->upw_passwd, (const char *)cpw) != 0)) {
if (flags & VERBOSE) {
syslog(LOG_DEBUG, "auth_shadow: pw mismatch: %s != %s",
password, upw->upw_passwd);
--
cgit v0.9.2
server/auth/cyrus-sasl/files/cyrus-sasl-2.1.20-saslauthd.conf-path.patch
-20
View File
@@ -1,20 +0,0 @@
--- cyrus-sasl-2.1.20/saslauthd/saslauthd.mdoc 2005-05-06 16:05:44.000000000 -0400
+++ cyrus-sasl-2.1.20/saslauthd/saslauthd.mdoc 2005-05-06 16:05:39.000000000 -0400
@@ -216,7 +216,7 @@
.Em (All platforms that support OpenLDAP 2.0 or higher)
.Pp
Authenticate against an ldap server. The ldap configuration parameters are
-read from /usr/local/etc/saslauthd.conf. The location of this file can be
+read from /etc/saslauthd.conf. The location of this file can be
changed with the -O parameter. See the LDAP_SASLAUTHD file included with the
distribution for the list of available parameters.
.It Li sia
@@ -249,7 +249,7 @@
.Bl -tag -width "/run/saslauthd/mux"
.It Pa /run/saslauthd/mux
The default communications socket.
-.It Pa /usr/local/etc/saslauthd.conf
+.It Pa /etc/saslauthd.conf
The default configuration file for ldap support.
.El
.Sh SEE ALSO
server/auth/cyrus-sasl/files/cyrus-sasl-2.1.21-sizes.patch
-120
View File
@@ -1,120 +0,0 @@
Prefer types in <inttypes.h> to our own, because it removes file content
conflicts between 32- and 64-bit architectures. RFEd as #2829.
--- cyrus-sasl-2.1.21/configure.in 2006-05-16 07:37:52.000000000 -0400
+++ cyrus-sasl-2.1.21/configure.in 2006-05-16 07:37:52.000000000 -0400
@@ -1083,6 +1083,10 @@
AC_HEADER_DIRENT
AC_HEADER_SYS_WAIT
AC_CHECK_HEADERS(des.h dlfcn.h fcntl.h limits.h malloc.h paths.h strings.h sys/file.h sys/time.h syslog.h unistd.h inttypes.h sys/uio.h sys/param.h sysexits.h stdarg.h varargs.h)
+AC_CHECK_TYPES([long long, int8_t, uint8_t, int16_t, uint16_t, int32_t, uint32_t, int64_t, uint64_t],,,[
+#ifdef HAVE_INTTYPES_H
+#include <inttypes.h>
+#endif])
IPv6_CHECK_SS_FAMILY()
IPv6_CHECK_SA_LEN()
--- cyrus-sasl-2.1.21/include/makemd5.c 2003-02-13 14:55:52.000000000 -0500
+++ cyrus-sasl-2.1.21/include/makemd5.c 2006-05-16 07:45:08.000000000 -0400
@@ -82,12 +82,19 @@
*/
+#ifdef HAVE_CONFIG_H
+#include "../config.h"
+#endif
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <ctype.h>
+#ifdef HAVE_INTTYPES_H
+#include <inttypes.h>
+#endif
+
static void
my_strupr(char *s)
@@ -122,6 +129,18 @@
static void
try_signed(FILE *f, int len)
{
+#ifdef HAVE_INT8_T
+ BITSIZE(int8_t);
+#endif
+#ifdef HAVE_INT16_T
+ BITSIZE(int16_t);
+#endif
+#ifdef HAVE_INT32_T
+ BITSIZE(int32_t);
+#endif
+#ifdef HAVE_INT64_T
+ BITSIZE(int64_t);
+#endif
BITSIZE(signed char);
BITSIZE(short);
BITSIZE(int);
@@ -135,6 +154,18 @@
static void
try_unsigned(FILE *f, int len)
{
+#ifdef HAVE_UINT8_T
+ BITSIZE(uint8_t);
+#endif
+#ifdef HAVE_UINT16_T
+ BITSIZE(uint16_t);
+#endif
+#ifdef HAVE_UINT32_T
+ BITSIZE(uint32_t);
+#endif
+#ifdef HAVE_UINT64_T
+ BITSIZE(uint64_t);
+#endif
BITSIZE(unsigned char);
BITSIZE(unsigned short);
BITSIZE(unsigned int);
@@ -165,6 +196,11 @@
"/* POINTER defines a generic pointer type */\n"
"typedef unsigned char *POINTER;\n"
"\n"
+#ifdef HAVE_INTTYPES_H
+ "/* We try to define integer types for our use */\n"
+ "#include <inttypes.h>\n"
+ "\n"
+#endif
);
return 1;
}
@@ -212,31 +248,15 @@
print_pre(f);
-#ifndef HAVE_INT8_T
try_signed (f, 8);
-#endif /* HAVE_INT8_T */
-#ifndef HAVE_INT16_T
try_signed (f, 16);
-#endif /* HAVE_INT16_T */
-#ifndef HAVE_INT32_T
try_signed (f, 32);
-#endif /* HAVE_INT32_T */
-#ifndef HAVE_INT64_T
try_signed (f, 64);
-#endif /* HAVE_INT64_T */
-#ifndef HAVE_U_INT8_T
try_unsigned (f, 8);
-#endif /* HAVE_INT8_T */
-#ifndef HAVE_U_INT16_T
try_unsigned (f, 16);
-#endif /* HAVE_U_INT16_T */
-#ifndef HAVE_U_INT32_T
try_unsigned (f, 32);
-#endif /* HAVE_U_INT32_T */
-#ifndef HAVE_U_INT64_T
try_unsigned (f, 64);
-#endif /* HAVE_U_INT64_T */
print_post(f);
server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-as-needed.patch
-11
View File
@@ -1,11 +0,0 @@
--- saslauthd/configure.in.orig 2006-05-23 15:53:17.000000000 -0700
+++ saslauthd/configure.in 2006-05-23 15:53:33.000000000 -0700
@@ -77,7 +77,7 @@
AC_DEFINE(AUTH_SASLDB,[],[Include SASLdb Support])
SASL_DB_PATH_CHECK()
SASL_DB_CHECK()
- SASL_DB_LIB="$SASL_DB_LIB ../sasldb/.libs/libsasldb.al"
+ SASL_DB_LIB="../sasldb/.libs/libsasldb.a $SASL_DB_LIB"
fi
AC_ARG_ENABLE(httpform, [ --enable-httpform enable HTTP form authentication [[no]] ],
server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-kerberos4.patch
-26
View File
@@ -1,26 +0,0 @@
diff -up cyrus-sasl-2.1.22/config/kerberos_v4.m4.krb4 cyrus-sasl-2.1.22/config/kerberos_v4.m4
--- cyrus-sasl-2.1.22/config/kerberos_v4.m4.krb4 2005-05-07 06:14:55.000000000 +0200
+++ cyrus-sasl-2.1.22/config/kerberos_v4.m4 2008-08-14 23:41:26.000000000 +0200
@@ -102,7 +102,6 @@ AC_DEFUN([SASL_KERBEROS_V4_CHK], [
if test -n "${cyrus_krbinclude}"; then
CPPFLAGS="$CPPFLAGS -I${cyrus_krbinclude}"
fi
- LDFLAGS="$LDFLAGS -L$krb4/lib"
fi
if test "$with_des" != no; then
diff -up cyrus-sasl-2.1.22/plugins/kerberos4.c.krb4 cyrus-sasl-2.1.22/plugins/kerberos4.c
--- cyrus-sasl-2.1.22/plugins/kerberos4.c.krb4 2005-01-10 08:08:53.000000000 +0100
+++ cyrus-sasl-2.1.22/plugins/kerberos4.c 2008-08-14 23:36:33.000000000 +0200
@@ -49,11 +49,7 @@
#include <krb.h>
#ifdef WITH_DES
-# ifdef WITH_SSL_DES
-# include <openssl/des.h>
-# else
# include <des.h>
-# endif /* WITH_SSL_DES */
#endif /* WITH_DES */
#ifdef WIN32
server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-ldap-timeout.patch
-25
View File
@@ -1,25 +0,0 @@
commit c9447e1c3ffba88783e5d9396b832be82d3c78fc
Author: Kazuo Ito <ito.kazuo@oss.ntt.co.jp>
Date: Wed Dec 10 12:03:29 2008 +0900
support for LDAP_OPT_TIMEOUT
OpenLDAP since 2.4 implements support for this option in ldap_result(),
among other things.
diff --git a/saslauthd/lak.c b/saslauthd/lak.c
index 803d51f..8714265 100644
--- a/saslauthd/lak.c
+++ b/saslauthd/lak.c
@@ -833,6 +833,11 @@ static int lak_connect(
syslog(LOG_WARNING|LOG_AUTH, "Unable to set LDAP_OPT_NETWORK_TIMEOUT %d.%d.", lak->conf->timeout.tv_sec, lak->conf->timeout.tv_usec);
}
+ rc = ldap_set_option(lak->ld, LDAP_OPT_TIMEOUT, &(lak->conf->timeout));
+ if (rc != LDAP_OPT_SUCCESS) {
+ syslog(LOG_WARNING|LOG_AUTH, "Unable to set LDAP_OPT_TIMEOUT %d.%d.", lak->conf->timeout.tv_sec, lak->conf->timeout.tv_usec);
+ }
+
rc = ldap_set_option(lak->ld, LDAP_OPT_TIMELIMIT, &(lak->conf->time_limit));
if (rc != LDAP_OPT_SUCCESS) {
syslog(LOG_WARNING|LOG_AUTH, "Unable to set LDAP_OPT_TIMELIMIT %d.", lak->conf->time_limit);
server/auth/cyrus-sasl/files/cyrus-sasl-2.1.22-qa.patch
-22
View File
@@ -1,22 +0,0 @@
fix missing prototype warnings
--- cyrus-sasl-2.1.22/lib/auxprop.c
+++ cyrus-sasl-2.1.22/lib/auxprop.c
@@ -43,6 +43,7 @@
*/
#include <config.h>
+#include <stdio.h>
#include <sasl.h>
#include <prop.h>
#include <ctype.h>
--- cyrus-sasl-2.1.22/pwcheck/pwcheck_getspnam.c
+++ cyrus-sasl-2.1.22/pwcheck/pwcheck_getspnam.c
@@ -24,6 +24,7 @@ OF OR IN CONNECTION WITH THE USE OR PERF
******************************************************************/
#include <shadow.h>
+#include <string.h>
extern char *crypt();
server/auth/cyrus-sasl/files/cyrus-sasl-2.1.23-man.patch
-37
View File
@@ -1,37 +0,0 @@
diff -up cyrus-sasl-2.1.23/mac/libdes/src/des_crypt.man cyrus-sasl-2.1.23/mac/libdes/src/des_crypt
diff -up cyrus-sasl-2.1.23/mac/libdes/src/des.man cyrus-sasl-2.1.23/mac/libdes/src/des
diff -up cyrus-sasl-2.1.23/man/Makefile.am.man cyrus-sasl-2.1.23/man/Makefile.am
--- cyrus-sasl-2.1.23/man/Makefile.am.man 2010-02-05 10:40:17.000000000 +0100
+++ cyrus-sasl-2.1.23/man/Makefile.am 2010-02-05 10:40:47.000000000 +0100
@@ -54,6 +54,6 @@ man_MANS = sasl_authorize_t.3 sasl_done.
sasl_auxprop_getctx.3 sasl_auxprop.3 sasl_idle.3 \
sasl_errdetail.3 sasl_user_exists.3 sasl_setpass.3 \
sasl_server_userdb_checkpass_t.3 sasl_server_userdb_setpass_t.3 \
- sasl_global_listmech.3 sasl_getconfpath_t.3
+ sasl_global_listmech.3 sasl_getconfpath_t.3 testsaslauthd.8
EXTRA_DIST = $(man_MANS)
diff -up cyrus-sasl-2.1.23/man/testsaslauthd.8.man cyrus-sasl-2.1.23/man/testsaslauthd.8
--- cyrus-sasl-2.1.23/man/testsaslauthd.8.man 2010-02-05 10:40:07.000000000 +0100
+++ cyrus-sasl-2.1.23/man/testsaslauthd.8 2010-02-05 09:48:43.000000000 +0100
@@ -0,0 +1,20 @@
+.\" Hey, EMACS: -*- nroff -*-
+.TH TESTSASLAUTHD 8 "14 October 2006"
+.SH NAME
+testsaslauthd \- test utility for the SASL authentication server
+.SH SYNOPSIS
+.B testsaslauthd
+.RI "[ " \(hyr " " realm " ] [ " \(hys " " servicename " ] [ " \(hyf " " socket " " path " ] [ " \(hyR " " repeatnum " ]"
+.SH DESCRIPTION
+This manual page documents briefly the
+.B testsaslauthd
+command.
+.PP
+.SH SEE ALSO
+.BR saslauthd (8).
+.br
+.SH AUTHOR
+testsaslauthd was written by Carnegie Mellon University.
+.PP
+This manual page was written by Roberto C. Sanchez <roberto@connexer.com>,
+for the Debian project (but may be used by others).
server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-keytab.patch
-36
View File
@@ -1,36 +0,0 @@
diff --git a/cmulocal/sasl2.m4 b/cmulocal/sasl2.m4
index 3c2841a..b086b8f 100644
--- a/cmulocal/sasl2.m4
+++ b/cmulocal/sasl2.m4
@@ -269,6 +269,18 @@ if test "$gssapi" != no; then
cmu_save_LIBS="$LIBS"
LIBS="$LIBS $GSSAPIBASE_LIBS"
AC_CHECK_FUNCS(gsskrb5_register_acceptor_identity)
+ if test "$ac_cv_func_gsskrb5_register_acceptor_identity" = no ; then
+ AC_CHECK_HEADERS(gssapi/gssapi_krb5.h)
+ if test "$ac_cv_header_gssapi_gssapi_krb5_h" = "yes"; then
+ AC_CHECK_DECL(gsskrb5_register_acceptor_identity,
+ [AC_DEFINE(HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY,1,
+ [Define if your GSSAPI implementation defines gsskrb5_register_acceptor_identity])],,
+ [
+ AC_INCLUDES_DEFAULT
+ #include <gssapi/gssapi_krb5.h>
+ ])
+ fi
+ fi
AC_CHECK_FUNCS(gss_decapsulate_token)
AC_CHECK_FUNCS(gss_encapsulate_token)
AC_CHECK_FUNCS(gss_oid_equal)
diff --git a/plugins/gssapi.c b/plugins/gssapi.c
index 6be9d23..e6fcf46 100644
--- a/plugins/gssapi.c
+++ b/plugins/gssapi.c
@@ -51,6 +51,8 @@
#include <gssapi/gssapi.h>
#endif
+#include <gssapi/gssapi_krb5.h>
+
#ifdef WIN32
# include <winsock2.h>
server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-no_rpath.patch
-19
View File
@@ -1,19 +0,0 @@
--- cmulocal/cyrus.m4~ 2014-01-09 11:31:10.423302394 +0100
+++ cmulocal/cyrus.m4 2014-01-09 11:31:56.823302243 +0100
@@ -32,14 +32,5 @@
dnl runpath initialization
AC_DEFUN([CMU_GUESS_RUNPATH_SWITCH], [
# CMU GUESS RUNPATH SWITCH
- AC_CACHE_CHECK(for runpath switch, andrew_cv_runpath_switch, [
- # first, try -R
- SAVE_LDFLAGS="${LDFLAGS}"
- LDFLAGS="-R /usr/lib"
- AC_TRY_LINK([],[],[andrew_cv_runpath_switch="-R"], [
- LDFLAGS="-Wl,-rpath,/usr/lib"
- AC_TRY_LINK([],[],[andrew_cv_runpath_switch="-Wl,-rpath,"],
- [andrew_cv_runpath_switch="none"])
- ])
- LDFLAGS="${SAVE_LDFLAGS}"
- ])])
+ andrew_runpath_switch="none"
+ ])
server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-obsolete-macro.patch
-13
View File
@@ -1,13 +0,0 @@
diff --git a/configure.in b/configure.in
index e70c99a..60f366c 100644
--- a/configure.in
+++ b/configure.in
@@ -1416,7 +1416,7 @@ inline static unsigned int sleep(unsigned int seconds) {
#endif /* CONFIG_H */
])
-AM_CONFIG_HEADER(config.h)
+AC_CONFIG_HEADERS(config.h)
AC_OUTPUT(Makefile
libsasl2.pc
server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-prefer-SCRAM-SHA-1-over-PLAIN.patch
-51
View File
@@ -1,51 +0,0 @@
commit 26dcfb2d7176b78e70757aa5d01951a28ca217c7
Author: Alexey Melnikov <alexey.melnikov@isode.com>
Date: Fri Jul 5 16:37:59 2013 +0100
Treat SCRAM-SHA-1/DIGEST-MD5 as more secure than PLAIN when selecting the best client side SASL mechanism
Both SCRAM-SHA-1 & DIGEST-MD5 are lacking SASL_SEC_PASS_CREDENTIALS security
flag, which prevented them from being chosen over PLAIN when PLAIN is selected
as the best mechanism first. For example the problem can be observed when
the server advertises "PLAIN DIGEST-MD5 SCRAM-SHA-1" (PLAIN just has to be
returned before SCRAM/DIGEST.)
Cyrus SASL bug # 3793
diff --git a/lib/client.c b/lib/client.c
index 62dfb0b..31fe346 100644
--- a/lib/client.c
+++ b/lib/client.c
@@ -658,6 +658,20 @@ _sasl_cbinding_disp(sasl_client_params_t *cparams,
return SASL_OK;
}
+static int
+_sasl_are_current_security_flags_worse_then_best(unsigned best_security_flags,
+ unsigned current_security_flags)
+{
+ /* We don't qualify SASL_SEC_PASS_CREDENTIALS as "secure" flag */
+ best_security_flags &= ~SASL_SEC_PASS_CREDENTIALS;
+
+ if ((current_security_flags ^ best_security_flags) & best_security_flags) {
+ return 1;
+ } else {
+ return 0;
+ }
+}
+
/* select a mechanism for a connection
* mechlist -- mechanisms server has available (punctuation ignored)
* secret -- optional secret from previous session
@@ -823,8 +837,9 @@ int sasl_client_start(sasl_conn_t *conn,
*/
if (bestm &&
- ((m->m.plug->security_flags ^ bestm->m.plug->security_flags) &
- bestm->m.plug->security_flags)) {
+ _sasl_are_current_security_flags_worse_then_best(
+ bestm->m.plug->security_flags,
+ m->m.plug->security_flags)) {
break;
}
server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-relro.patch
-59
View File
@@ -1,59 +0,0 @@
diff -up cyrus-sasl-2.1.26/lib/Makefile.am.relro cyrus-sasl-2.1.26/lib/Makefile.am
--- cyrus-sasl-2.1.26/lib/Makefile.am.relro 2012-10-12 16:05:48.000000000 +0200
+++ cyrus-sasl-2.1.26/lib/Makefile.am 2013-02-11 14:18:01.749053772 +0100
@@ -64,7 +64,7 @@ LIB_DOOR= @LIB_DOOR@
lib_LTLIBRARIES = libsasl2.la
libsasl2_la_SOURCES = $(common_sources) $(common_headers)
-libsasl2_la_LDFLAGS = -version-info $(sasl_version)
+libsasl2_la_LDFLAGS = -Wl,-z,relro -version-info $(sasl_version)
libsasl2_la_DEPENDENCIES = $(LTLIBOBJS)
libsasl2_la_LIBADD = $(LTLIBOBJS) $(SASL_DL_LIB) $(LIB_SOCKET) $(LIB_DOOR)
diff -up cyrus-sasl-2.1.26/lib/Makefile.in.relro cyrus-sasl-2.1.26/lib/Makefile.in
--- cyrus-sasl-2.1.26/lib/Makefile.in.relro 2013-11-13 16:55:09.606555125 +0100
+++ cyrus-sasl-2.1.26/lib/Makefile.in 2013-11-13 16:56:43.331096795 +0100
@@ -330,7 +330,7 @@ common_headers = saslint.h
common_sources = auxprop.c canonusr.c checkpw.c client.c common.c config.c external.c md5.c saslutil.c server.c seterror.c dlopen.c ../plugins/plugin_common.c
lib_LTLIBRARIES = libsasl2.la
libsasl2_la_SOURCES = $(common_sources) $(common_headers)
-libsasl2_la_LDFLAGS = -version-info $(sasl_version)
+libsasl2_la_LDFLAGS = -Wl,-z,relro -version-info $(sasl_version)
libsasl2_la_DEPENDENCIES = $(LTLIBOBJS)
libsasl2_la_LIBADD = $(LTLIBOBJS) $(SASL_DL_LIB) $(LIB_SOCKET) $(LIB_DOOR)
@MACOSX_TRUE@framedir = /Library/Frameworks/SASL2.framework
diff -up cyrus-sasl-2.1.26/plugins/Makefile.am.relro cyrus-sasl-2.1.26/plugins/Makefile.am
--- cyrus-sasl-2.1.26/plugins/Makefile.am.relro 2012-10-12 16:05:48.000000000 +0200
+++ cyrus-sasl-2.1.26/plugins/Makefile.am 2013-02-11 14:18:01.749053772 +0100
@@ -50,7 +50,7 @@
plugin_version = 3:0:0
INCLUDES=-I$(top_srcdir)/include -I$(top_srcdir)/lib -I$(top_srcdir)/sasldb -I$(top_builddir)/include
-AM_LDFLAGS = -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version)
+AM_LDFLAGS = -Wl,-z,relro -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version)
COMPAT_OBJS = @LTGETADDRINFOOBJS@ @LTGETNAMEINFOOBJS@ @LTSNPRINTFOBJS@
diff -up cyrus-sasl-2.1.26/plugins/Makefile.in.relro cyrus-sasl-2.1.26/plugins/Makefile.in
--- cyrus-sasl-2.1.26/plugins/Makefile.in.relro 2013-11-13 16:57:08.430974081 +0100
+++ cyrus-sasl-2.1.26/plugins/Makefile.in 2013-11-13 16:57:58.911727846 +0100
@@ -364,7 +364,7 @@ top_srcdir = @top_srcdir@
# CURRENT:REVISION:AGE
plugin_version = 3:0:0
INCLUDES = -I$(top_srcdir)/include -I$(top_srcdir)/lib -I$(top_srcdir)/sasldb -I$(top_builddir)/include
-AM_LDFLAGS = -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version)
+AM_LDFLAGS = -Wl,-z,relro -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version)
COMPAT_OBJS = @LTGETADDRINFOOBJS@ @LTGETNAMEINFOOBJS@ @LTSNPRINTFOBJS@
EXTRA_DIST = makeinit.sh NTMakefile
noinst_SCRIPTS = makeinit.sh
diff -up cyrus-sasl-2.1.26/saslauthd/Makefile.am.relro cyrus-sasl-2.1.26/saslauthd/Makefile.am
--- cyrus-sasl-2.1.26/saslauthd/Makefile.am.relro 2013-02-11 14:18:36.910900647 +0100
+++ cyrus-sasl-2.1.26/saslauthd/Makefile.am 2013-02-11 14:20:17.336463915 +0100
@@ -17,6 +17,7 @@ saslauthd_DEPENDENCIES = saslauthd-main.
saslauthd_LDADD = @SASL_KRB_LIB@ \
@GSSAPIBASE_LIBS@ @GSSAPI_LIBS@ @LIB_CRYPT@ @LIB_SIA@ \
@LIB_SOCKET@ ../sasldb/libsasldb.la @LIB_PAM@ @LDAP_LIBS@ @LTLIBOBJS@
+saslauthd_LDFLAGS = -pie -Wl,-z,now
testsaslauthd_SOURCES = testsaslauthd.c utils.c
testsaslauthd_LDADD = @LIB_SOCKET@
server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-size_t.patch
-12
View File
@@ -1,12 +0,0 @@
diff -up cyrus-sasl-2.1.26/include/sasl.h.size_t cyrus-sasl-2.1.26/include/sasl.h
--- cyrus-sasl-2.1.26/include/sasl.h.size_t 2012-10-12 09:05:48.000000000 -0500
+++ cyrus-sasl-2.1.26/include/sasl.h 2013-01-31 13:21:04.007739327 -0600
@@ -223,6 +223,8 @@ extern "C" {
* they must be called before all other SASL functions:
*/
+#include <sys/types.h>
+
/* memory allocation functions which may optionally be replaced:
*/
typedef void *sasl_malloc_t(size_t);
server/auth/cyrus-sasl/files/cyrus-sasl-2.1.26-warnings.patch
-74
View File
@@ -1,74 +0,0 @@
diff -up cyrus-sasl-2.1.26/lib/server.c.warnings cyrus-sasl-2.1.26/lib/server.c
--- cyrus-sasl-2.1.26/lib/server.c.warnings 2012-10-12 16:05:48.000000000 +0200
+++ cyrus-sasl-2.1.26/lib/server.c 2012-12-20 17:49:39.620254792 +0100
@@ -650,7 +650,7 @@ static int load_config(const sasl_callba
goto done;
}
- snprintf(config_filename, len, "%.*s%c%s.conf", path_len, path_to_config,
+ snprintf(config_filename, len, "%.*s%c%s.conf", (int)path_len, path_to_config,
HIER_DELIMITER, global_callbacks.appname);
/* Ask the application if it's safe to use this file */
diff -up cyrus-sasl-2.1.26/plugins/gssapi.c.warnings cyrus-sasl-2.1.26/plugins/gssapi.c
--- cyrus-sasl-2.1.26/plugins/gssapi.c.warnings 2012-01-28 00:31:36.000000000 +0100
+++ cyrus-sasl-2.1.26/plugins/gssapi.c 2012-12-20 17:49:39.620254792 +0100
@@ -202,7 +202,8 @@ sasl_gss_seterror_(const sasl_utils_t *u
OM_uint32 msg_ctx;
int ret;
char *out = NULL;
- size_t len, curlen = 0;
+ size_t len;
+ unsigned curlen = 0;
const char prefix[] = "GSSAPI Error: ";
if (!utils) return SASL_OK;
diff -up cyrus-sasl-2.1.26/plugins/ldapdb.c.warnings cyrus-sasl-2.1.26/plugins/ldapdb.c
--- cyrus-sasl-2.1.26/plugins/ldapdb.c.warnings 2012-01-28 00:31:36.000000000 +0100
+++ cyrus-sasl-2.1.26/plugins/ldapdb.c 2012-12-20 17:49:39.621254788 +0100
@@ -22,6 +22,7 @@
#include "plugin_common.h"
+#define LDAP_DEPRECATED 1
#include <ldap.h>
static char ldapdb[] = "ldapdb";
diff -up cyrus-sasl-2.1.26/plugins/plugin_common.c.warnings cyrus-sasl-2.1.26/plugins/plugin_common.c
--- cyrus-sasl-2.1.26/plugins/plugin_common.c.warnings 2013-09-03 14:40:35.181455452 +0200
+++ cyrus-sasl-2.1.26/plugins/plugin_common.c 2013-09-03 14:40:38.320441024 +0200
@@ -94,7 +94,7 @@ static void sockaddr_unmapped(
if (!IN6_IS_ADDR_V4MAPPED((&sin6->sin6_addr)))
return;
sin4 = (struct sockaddr_in *)sa;
- addr = *(uint32_t *)&sin6->sin6_addr.s6_addr[12];
+ addr = *(uint32_t *)&sin6->sin6_addr.s6_addr32[3];
port = sin6->sin6_port;
memset(sin4, 0, sizeof(struct sockaddr_in));
sin4->sin_addr.s_addr = addr;
diff -up cyrus-sasl-2.1.26/saslauthd/auth_httpform.c.warnings cyrus-sasl-2.1.26/saslauthd/auth_httpform.c
--- cyrus-sasl-2.1.26/saslauthd/auth_httpform.c.warnings 2012-10-12 16:05:48.000000000 +0200
+++ cyrus-sasl-2.1.26/saslauthd/auth_httpform.c 2013-09-03 14:39:25.411776109 +0200
@@ -574,7 +574,7 @@ auth_httpform (
"Content-Type: application/x-www-form-urlencoded" CRLF
"Content-Length: %d" TWO_CRLF
"%s",
- r_uri, r_host, r_port, strlen(req), req);
+ r_uri, r_host, r_port, (int)strlen(req), req);
if (flags & VERBOSE) {
syslog(LOG_DEBUG, "auth_httpform: sending %s %s %s",
diff -up cyrus-sasl-2.1.26/saslauthd/auth_shadow.c.warnings cyrus-sasl-2.1.26/saslauthd/auth_shadow.c
--- cyrus-sasl-2.1.26/saslauthd/auth_shadow.c.warnings 2012-10-12 16:05:48.000000000 +0200
+++ cyrus-sasl-2.1.26/saslauthd/auth_shadow.c 2012-12-20 17:49:39.621254788 +0100
@@ -70,6 +70,10 @@
# include <shadow.h>
# endif /* ! HAVE_GETUSERPW */
+# ifdef HAVE_CRYPT_H
+# include <crypt.h>
+# endif
+
# include "auth_shadow.h"
# include "globals.h"
/* END PUBLIC DEPENDENCIES */
server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.25-auxprop.patch
+16
View File
@@ -0,0 +1,16 @@
https://bugzilla.cyrusimap.org/show_bug.cgi?id=3590
https://bugs.gentoo.org/show_bug.cgi?id=392761
--- cyrus-sasl-2.1.25/lib/auxprop.c~ 2011-10-20 17:33:46.423015318 +0200
+++ cyrus-sasl-2.1.25/lib/auxprop.c 2011-10-20 17:48:49.336348654 +0200
@@ -971,6 +971,10 @@
}
if(!found) {
+ /* compatibility with <= 2.1.23, ignore the lack of auxrop plugin */
+ if (!plist)
+ result = SASL_OK;
+ else
_sasl_log(sparams->utils->conn, SASL_LOG_DEBUG,
"could not find auxprop plugin, was searching for '%s'",
plist ? plist : "[all]");
server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.26-missing-size_t.patch
+13
View File
@@ -0,0 +1,13 @@
Gentoo bug #458790
--- a/include/sasl.h
+++ b/include/sasl.h
@@ -121,6 +121,9 @@
#ifndef SASL_H
#define SASL_H 1
+/* stddef.h to get size_t defined */
+#include <stddef.h>
+
/* Keep in sync with win32/common.mak */
#define SASL_VERSION_MAJOR 2
#define SASL_VERSION_MINOR 1
server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-CVE-2019-19906.patch
+20
View File
@@ -0,0 +1,20 @@
Description: CVE-2019-19906: Off-by-one in _sasl_add_string function
Origin: vendor
Bug: https://github.com/cyrusimap/cyrus-sasl/issues/587
Bug-Debian: https://bugs.debian.org/947043
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-19906
Author: Stephan Zeisberg <stephan@srlabs.de>
Reviewed-by: Salvatore Bonaccorso <carnil@debian.org>
Last-Update: 2019-12-19
--- a/lib/common.c
+++ b/lib/common.c
@@ -190,7 +190,7 @@ int _sasl_add_string(char **out, size_t
if (add==NULL) add = "(null)";
- addlen=strlen(add); /* only compute once */
+ addlen=strlen(add)+1; /* only compute once */
if (_buf_alloc(out, alloclen, (*outlen)+addlen)!=SASL_OK)
return SASL_NOMEM;
server/auth/cyrus-sasl/files/0010-Update-required-libraries-when-ld-as-needed-is-used.patch → server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-as_needed.patch
+8 -20
View File
@@ -1,19 +1,9 @@
From: Debian Cyrus SASL Team Author: Matthias Klose <doko@ubuntu.com>
<pkg-cyrus-sasl2-debian-devel@lists.alioth.debian.org> Desription: Fix FTBFS, add $(SASL_DB_LIB) as dependency to libsasldb, and use
Date: Thu, 24 Mar 2016 11:35:04 +0100
Subject: Update required libraries when ld --as-needed is used
it. it.
--- --- cyrus-sasl-2.1.27/saslauthd/Makefile.am
saslauthd/Makefile.am | 2 +- +++ cyrus-sasl-2.1.27/saslauthd/Makefile.am
sasldb/Makefile.am | 4 ++-- @@ -25,7 +25,7 @@
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/saslauthd/Makefile.am b/saslauthd/Makefile.am
index 864b29b..4cf3a3d 100644
--- a/saslauthd/Makefile.am
+++ b/saslauthd/Makefile.am
@@ -25,7 +25,7 @@ EXTRA_saslauthd_sources = getaddrinfo.c getnameinfo.c
saslauthd_DEPENDENCIES = saslauthd-main.o $(LTLIBOBJS_FULL) saslauthd_DEPENDENCIES = saslauthd-main.o $(LTLIBOBJS_FULL)
saslauthd_LDADD = @SASL_KRB_LIB@ \ saslauthd_LDADD = @SASL_KRB_LIB@ \
@GSSAPIBASE_LIBS@ @LIB_CRYPT@ @LIB_SIA@ \ @GSSAPIBASE_LIBS@ @LIB_CRYPT@ @LIB_SIA@ \
@@ -22,11 +12,9 @@ index 864b29b..4cf3a3d 100644
testsaslauthd_SOURCES = testsaslauthd.c utils.c testsaslauthd_SOURCES = testsaslauthd.c utils.c
testsaslauthd_LDADD = @LIB_SOCKET@ testsaslauthd_LDADD = @LIB_SOCKET@
diff --git a/sasldb/Makefile.am b/sasldb/Makefile.am --- cyrus-sasl-2.1.27/sasldb/Makefile.am
index 497ee25..a27645f 100644 +++ cyrus-sasl-2.1.27/sasldb/Makefile.am
--- a/sasldb/Makefile.am @@ -54,6 +54,6 @@
+++ b/sasldb/Makefile.am
@@ -54,6 +54,6 @@ noinst_LTLIBRARIES = libsasldb.la
libsasldb_la_SOURCES = allockey.c sasldb.h libsasldb_la_SOURCES = allockey.c sasldb.h
EXTRA_libsasldb_la_SOURCES = $(extra_common_sources) EXTRA_libsasldb_la_SOURCES = $(extra_common_sources)
server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-autoconf-2.71.patch
+45
View File
@@ -0,0 +1,45 @@
https://bugs.gentoo.org/825342
commit 5664c3f535289ce9efb513a2897991b5c436bb44
Author: Pavel Raiskup <praiskup@redhat.com>
Date: Thu Apr 1 17:26:28 2021 +0200
configure.ac: properly quote macro arguments
Autoconf 2.70+ is more picky about the quotation (even though with
previous versions the arguments should have been quoted, too). When we
don't quote macros inside the AC_CACHE_VAL macro - some of the Autoconf
initialization is wrongly ordered in ./configure script and we keep
seeing bugs like:
./configure: line 2165: ac_fn_c_try_run: command not found
Original report: https://bugzilla.redhat.com/1943013
Signed-off-by: Pavel Raiskup <praiskup@redhat.com>
--- a/configure.ac
+++ b/configure.ac
@@ -213,7 +213,8 @@ if test $sasl_cv_uscore = yes; then
AC_MSG_CHECKING(whether dlsym adds the underscore for us)
cmu_save_LIBS="$LIBS"
LIBS="$LIBS $SASL_DL_LIB"
- AC_CACHE_VAL(sasl_cv_dlsym_adds_uscore,AC_TRY_RUN( [
+ AC_CACHE_VAL([sasl_cv_dlsym_adds_uscore],
+ [AC_TRY_RUN([
#include <dlfcn.h>
#include <stdio.h>
#include <stdlib.h>
@@ -221,9 +222,9 @@ void foo() { int i=0;}
int main() { void *self, *ptr1, *ptr2; self=dlopen(NULL,RTLD_LAZY);
if(self) { ptr1=dlsym(self,"foo"); ptr2=dlsym(self,"_foo");
if(ptr1 && !ptr2) exit(0); } exit(1); }
-], [sasl_cv_dlsym_adds_uscore=yes], sasl_cv_dlsym_adds_uscore=no
- AC_DEFINE(DLSYM_NEEDS_UNDERSCORE, [], [Do we need a leading _ for dlsym?]),
- AC_MSG_WARN(cross-compiler, we'll do our best)))
+], [sasl_cv_dlsym_adds_uscore=yes], [sasl_cv_dlsym_adds_uscore=no
+ AC_DEFINE(DLSYM_NEEDS_UNDERSCORE, [], [Do we need a leading _ for dlsym?])],
+ [AC_MSG_WARN(cross-compiler, we'll do our best)])])
LIBS="$cmu_save_LIBS"
AC_MSG_RESULT($sasl_cv_dlsym_adds_uscore)
server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-autotools_fixes.patch
+31
View File
@@ -0,0 +1,31 @@
--- cyrus-sasl-2.1.27/configure.ac
+++ cyrus-sasl-2.1.27/configure.ac
@@ -44,6 +44,8 @@
AC_PREREQ(2.63)
+AC_CONFIG_MACRO_DIR([config])
+
dnl
dnl REMINDER: When changing the version number here, please also update
dnl the values in win32/include/config.h and include/sasl.h as well.
--- cyrus-sasl-2.1.27/Makefile.am
+++ cyrus-sasl-2.1.27/Makefile.am
@@ -44,6 +44,8 @@
#
################################################################
+ACLOCAL_AMFLAGS = -I config
+
if SASLAUTHD
SAD = saslauthd
else
--- cyrus-sasl-2.1.27/saslauthd/Makefile.am
+++ cyrus-sasl-2.1.27/saslauthd/Makefile.am
@@ -1,4 +1,6 @@
AUTOMAKE_OPTIONS = 1.7
+ACLOCAL_AMFLAGS = -I ../config
+
sbin_PROGRAMS = saslauthd testsaslauthd
EXTRA_PROGRAMS = saslcache
server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-avoid_pic_overwrite.patch
+17
View File
@@ -0,0 +1,17 @@
Author: Fabian Fagerholm <fabbe@debian.org>
Description: This patch makes sure the non-PIC version of libsasldb.a, which
is created out of non-PIC objects, is not going to overwrite the PIC version,
which is created out of PIC objects. The PIC version is placed in .libs, and
the non-PIC version in the current directory. This ensures that both non-PIC
and PIC versions are available in the correct locations.
--- cyrus-sasl-2.1.27/lib/Makefile.am
+++ cyrus-sasl-2.1.27/lib/Makefile.am
@@ -98,7 +98,7 @@
libsasl2.a: libsasl2.la $(SASL_STATIC_OBJS)
@echo adding static plugins and dependencies
- $(AR) cru .libs/$@ $(SASL_STATIC_OBJS)
+ $(AR) cru $@ $(SASL_STATIC_OBJS)
@for i in ./libsasl2.la ../common/libplugin_common.la ../sasldb/libsasldb.la ../plugins/lib*.la; do \
if test ! -f $$i; then continue; fi; . $$i; \
for j in $$dependency_libs foo; do \
server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-db_gdbm-fix-gdbm_errno-overlay-from-gdbm_close.patch
+35
View File
@@ -0,0 +1,35 @@
From af48f6fec9a7b6374d4153c5db894d4a1f349645 Mon Sep 17 00:00:00 2001
Message-Id: <af48f6fec9a7b6374d4153c5db894d4a1f349645.1635327406.git.mkletzan@redhat.com>
From: Jonas Jelten <jj@sft.mx>
Date: Sat, 2 Feb 2019 20:53:37 +0100
Subject: [PATCH] db_gdbm: fix gdbm_errno overlay from gdbm_close
`gdbm_close` also sets gdbm_errno since version 1.17.
This leads to a problem in `libsasl` as the `gdbm_close` incovation overlays
the `gdbm_errno` value which is then later used for the error handling.
Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
---
sasldb/db_gdbm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sasldb/db_gdbm.c b/sasldb/db_gdbm.c
index ee56a6bf8516..c908808e04a1 100644
--- a/sasldb/db_gdbm.c
+++ b/sasldb/db_gdbm.c
@@ -107,9 +107,11 @@ int _sasldb_getdata(const sasl_utils_t *utils,
gkey.dptr = key;
gkey.dsize = key_len;
gvalue = gdbm_fetch(db, gkey);
+ int fetch_errno = gdbm_errno;
+
gdbm_close(db);
if (! gvalue.dptr) {
- if (gdbm_errno == GDBM_ITEM_NOT_FOUND) {
+ if (fetch_errno == GDBM_ITEM_NOT_FOUND) {
utils->seterror(conn, SASL_NOLOG,
"user: %s@%s property: %s not found in %s",
authid, realm, propName, path);
--
2.33.1
server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-doc_build_fix.patch
+11
View File
@@ -0,0 +1,11 @@
--- cyrus-sasl-2.1.27/docsrc/exts/sphinxlocal/writers/manpage.py
+++ cyrus-sasl-2.1.27/docsrc/exts/sphinxlocal/writers/manpage.py
@@ -23,7 +23,7 @@
from sphinx import addnodes
from sphinx.locale import admonitionlabels, _
from sphinx.util.osutil import ustrftime
-from sphinx.util.compat import docutils_version
+#from sphinx.util.compat import docutils_version
class CyrusManualPageWriter(ManualPageWriter):
server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-gss_c_nt_hostbased_service.patch
+16
View File
@@ -0,0 +1,16 @@
Gentoo bug #389349
--- cyrus-sasl-2.1.27/m4/sasl2.m4
+++ cyrus-sasl-2.1.27/m4/sasl2.m4
@@ -220,7 +220,11 @@
[AC_WARN([Cybersafe define not found])])
elif test "$ac_cv_header_gssapi_h" = "yes"; then
- AC_EGREP_HEADER(GSS_C_NT_HOSTBASED_SERVICE, gssapi.h,
+ AC_EGREP_CPP(hostbased_service_gss_nt_yes, gssapi.h,
+ [#include <gssapi.h>
+ #ifdef GSS_C_NT_HOSTBASED_SERVICE
+ hostbased_service_gss_nt_yes
+ #endif],
[AC_DEFINE(HAVE_GSS_C_NT_HOSTBASED_SERVICE,,
[Define if your GSSAPI implementation defines GSS_C_NT_HOSTBASED_SERVICE])])
elif test "$ac_cv_header_gssapi_gssapi_h"; then
server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-memmem.patch
+53
View File
@@ -0,0 +1,53 @@
auth_rimap: provide naive memmem implementation if missing
read_response uses memmem, which is not available on e.g. Solaris 10
Bug: https://github.com/cyrusimap/cyrus-sasl/pull/551
Signed-off-by: Fabian Groffen <grobian@gentoo.org>
--- a/saslauthd/auth_rimap.c
+++ b/saslauthd/auth_rimap.c
@@ -367,6 +367,32 @@
/* END FUNCTION: process_login_reply */
+#ifndef HAVE_MEMMEM
+static void *memmem(
+ const void *big, size_t big_len,
+ const void *little, size_t little_len)
+{
+ const char *bp = (const char *)big;
+ const char *lp = (const char *)little;
+ size_t l;
+
+ if (big_len < little_len || little_len == 0 || big_len == 0)
+ return NULL;
+
+ while (big_len > 0) {
+ for (l = 0; l < little_len; l++) {
+ if (bp[l] != lp[l])
+ break;
+ }
+ if (l == little_len)
+ return (void *)bp;
+ bp++;
+ }
+
+ return NULL;
+}
+#endif
+
static int read_response(int s, char *rbuf, int buflen, const char *tag)
{
int rc = 0;
--- a/configure.ac
+++ b/configure.ac
@@ -1292,7 +1292,7 @@
#AC_FUNC_MEMCMP
#AC_FUNC_VPRINTF
-AC_CHECK_FUNCS(gethostname getdomainname getpwnam getspnam gettimeofday inet_aton memcpy mkdir select socket strchr strdup strerror strspn strstr strtol jrand48 getpassphrase asprintf strlcat strlcpy)
+AC_CHECK_FUNCS(gethostname getdomainname getpwnam getspnam gettimeofday inet_aton memcpy memmem mkdir select socket strchr strdup strerror strspn strstr strtol jrand48 getpassphrase asprintf strlcat strlcpy)
if test $ac_cv_func_getspnam = yes; then
AC_MSG_CHECKING(if getpwnam_r/getspnam_r take 5 arguments)
server/auth/cyrus-sasl/files/gentoo/cyrus-sasl-2.1.27-slibtool.patch
+18
View File
@@ -0,0 +1,18 @@
https://github.com/cyrusimap/cyrus-sasl/pull/623
https://bugs.gentoo.org/775875
From 5b8075eeba8d0334573689450b07610c176a2618 Mon Sep 17 00:00:00 2001
From: orbea <orbea@riseup.net>
Date: Wed, 9 Sep 2020 07:29:38 -0700
Subject: [PATCH] common: Define the missing crypto_compat_version version.
--- a/common/Makefile.am
+++ b/common/Makefile.am
@@ -46,6 +46,7 @@
# See <http://www.gnu.org/software/libtool/manual/libtool.html#Versioning>
# CURRENT:REVISION:AGE
plugin_common_version = 3:0:0
+crypto_compat_version = 0:0:0
AM_CPPFLAGS=-fPIC -I$(top_srcdir)/include -I$(top_builddir)/include
server/auth/cyrus-sasl/pspec.xml
+13 -30
View File
@@ -21,38 +21,21 @@
<Dependency>e2fsprogs-devel</Dependency> <Dependency>e2fsprogs-devel</Dependency>
<Dependency>openssl-devel</Dependency> <Dependency>openssl-devel</Dependency>
<Dependency>groff</Dependency> <Dependency>groff</Dependency>
<Dependency>openldap-server</Dependency> <Dependency>openldap-server</Dependency>
</BuildDependencies> </BuildDependencies>
<Patches> <Patches>
<!--Patch level="1">fix-linkage.patch</Patch--> <Patch level="1">gentoo/cyrus-sasl-2.1.25-auxprop.patch</Patch>
<!-- <Patch level="1">CVE-2013-4122.patch</Patch> <Patch level="1">gentoo/cyrus-sasl-2.1.26-missing-size_t.patch</Patch>
<Patch level="1">0011_saslauthd_ac_prog_libtool.patch</Patch> <Patch level="1">gentoo/cyrus-sasl-2.1.27-CVE-2019-19906.patch</Patch>
<Patch level="1">0025_ld_as_needed.patch</Patch> <Patch level="1">gentoo/cyrus-sasl-2.1.27-as_needed.patch</Patch>
<Patch level="1">0026_drop_krb5support_dependency.patch</Patch> <Patch level="1">gentoo/cyrus-sasl-2.1.27-autoconf-2.71.patch</Patch>
<Patch level="1">0030-dont_use_la_files_for_opening_plugins.patch</Patch> <Patch level="1">gentoo/cyrus-sasl-2.1.27-autotools_fixes.patch</Patch>
<Patch level="1">gentoo/cyrus-sasl-2.1.27-avoid_pic_overwrite.patch</Patch>
<Patch level="1">cyrus-sasl-2.1.21-sizes.patch</Patch> <Patch level="1">gentoo/cyrus-sasl-2.1.27-db_gdbm-fix-gdbm_errno-overlay-from-gdbm_close.patch</Patch>
<Patch level="0">cyrus-sasl-2.1.22-as-needed.patch</Patch> <Patch level="1">gentoo/cyrus-sasl-2.1.27-doc_build_fix.patch</Patch>
<Patch level="1">cyrus-sasl-2.1.22-qa.patch</Patch> <Patch level="1">gentoo/cyrus-sasl-2.1.27-gss_c_nt_hostbased_service.patch</Patch>
<Patch level="1">cyrus-sasl-2.1.22-kerberos4.patch</Patch> <Patch level="1">gentoo/cyrus-sasl-2.1.27-memmem.patch</Patch>
<Patch level="1">gentoo/cyrus-sasl-2.1.27-slibtool.patch</Patch>
<Patch level="1">cyrus-sasl-2.1.23-man.patch</Patch>
<Patch level="1">cyrus-sasl-2.1.26-keytab.patch</Patch>
<Patch level="0">cyrus-sasl-2.1.26-no_rpath.patch</Patch>
<Patch level="1">cyrus-sasl-2.1.26-obsolete-macro.patch</Patch>
<Patch level="1">cyrus-sasl-2.1.26-prefer-SCRAM-SHA-1-over-PLAIN.patch</Patch>
<Patch level="1">cyrus-sasl-2.1.26-relro.patch</Patch>
<Patch level="1">cyrus-sasl-2.1.26-size_t.patch</Patch>
<Patch level="1">cyrus-sasl-2.1.26-warnings.patch</Patch>-->
<Patch level="1">0006-Enable-autoconf-maintainer-mode.patch</Patch>
<Patch level="1">0010-Update-required-libraries-when-ld-as-needed-is-used.patch</Patch>
<Patch level="1">0013-Don-t-use-la-files-for-opening-plugins.patch</Patch>
<Patch level="1">0020-Restore-LIBS-after-checking-gss_inquire_sec_context_.patch</Patch>
<Patch level="1">0022-Fix-keytab-option-for-MIT-Kerberos.patch</Patch>
<Patch level="1">cyrus-sasl-2.1.20-saslauthd.conf-path.patch</Patch>
<Patch level="1">cyrus-sasl-2.1.22-ldap-timeout.patch</Patch>
</Patches> </Patches>
</Source> </Source>