From dd8444f6b6283d0285b5b35a68a63d26c8da7659 Mon Sep 17 00:00:00 2001 From: Krzesimir Nowak Date: Tue, 6 Dec 2022 13:15:37 +0100 Subject: [PATCH] app-crypt/mit-krb5: Sync with Gentoo It's from Gentoo commit 02b17c9bb64e147affc4acecaa0ff4151b2329bf. --- .../app-crypt/mit-krb5/Manifest | 3 +- .../mit-krb5-1.20-missing-time-include.patch | 20 +++ .../files/mit-krb5-1.20.1-autoconf-2.72.patch | 31 ++++ .../files/mit-krb5-CVE-2021-37750.patch | 43 ----- .../app-crypt/mit-krb5/metadata.xml | 3 +- .../mit-krb5/mit-krb5-1.19.2-r4.ebuild | 162 ------------------ ....19.3-r2.ebuild => mit-krb5-1.20.1.ebuild} | 30 +--- 7 files changed, 63 insertions(+), 229 deletions(-) create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.20-missing-time-include.patch create mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.20.1-autoconf-2.72.patch delete mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-CVE-2021-37750.patch delete mode 100644 sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.19.2-r4.ebuild rename sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/{mit-krb5-1.19.3-r2.ebuild => mit-krb5-1.20.1.ebuild} (86%) diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest index 4bf3915200..fcb575f401 100644 --- a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest @@ -1,2 +1 @@ -DIST krb5-1.19.2.tar.gz 8741053 BLAKE2B 963722721201e75381c91a2af6e982f569a5b1602beb2d1ded83d35f6f914235a6ed91e5d54f56c97e94921a32ed27c49aded258327966ee13d39485208c38d8 SHA512 b90d6ed0e1e8a87eb5cb2c36d88b823a6a6caabf85e5d419adb8a930f7eea09a5f8491464e7e454cca7ba88be09d19415962fe0036ad2e31fc584f9fc0bbd470 -DIST krb5-1.19.3.tar.gz 8741343 BLAKE2B 79e68237ee82affa85299060c509e303453c0fab965adc6b9ed305ab64a1f73bd51e65df1b3faadc60815cd506ffefaeed535765ca060d393a9141812f85b48a SHA512 18235440d6f7d8a72c5d7ca5cd8c6465e8adf091d85c483225c7b00d64b4688c1c7924cb800c2fc17e590b2709f1a9de48e6ec79f6debd11dcb7d6fa16c6f351 +DIST krb5-1.20.1.tar.gz 8661660 BLAKE2B ead16f8b1aec8bba3776628b74257c9aec891770c1fa6d5c5e66275db5f078ca59c9944cd2b017453b777ce080f8e5a322f735fab77691479cfad7b881b92830 SHA512 6f57479f13f107cd84f30de5c758eb6b9fc59171329c13e5da6073b806755f8d163eb7bd84767ea861ad6458ea0c9eeb00ee044d3bcad01ef136e9888564b6a2 diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.20-missing-time-include.patch b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.20-missing-time-include.patch new file mode 100644 index 0000000000..a8a4956991 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.20-missing-time-include.patch @@ -0,0 +1,20 @@ +https://github.com/krb5/krb5/commit/c3958cec43b598b25484b9805224c56f25f7a755 +https://bugs.gentoo.org/854561 + +From: Greg Hudson +Date: Tue, 29 Mar 2022 16:27:55 -0400 +Subject: [PATCH] Include time.h in kdb.h + +kdb.h uses time_t, and therefore must include to ensure its +definition. Noticed when building t_sort_key_data.c on macOS. +--- a/include/kdb.h ++++ b/include/kdb.h +@@ -65,6 +65,7 @@ + #ifndef KRB5_KDB5__ + #define KRB5_KDB5__ + ++#include + #include + + /* This version will be incremented when incompatible changes are made to the + diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.20.1-autoconf-2.72.patch b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.20.1-autoconf-2.72.patch new file mode 100644 index 0000000000..b55193bcc7 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-1.20.1-autoconf-2.72.patch @@ -0,0 +1,31 @@ +https://github.com/krb5/krb5/commit/d864d740d019fdf2c640460f2aa2760c7fa4d5e9 + +From d864d740d019fdf2c640460f2aa2760c7fa4d5e9 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Thu, 17 Nov 2022 15:01:24 +0100 +Subject: [PATCH] Fix aclocal.m4 syntax error for autoconf 2.72 + +An incorrect closure inside KRB5_AC_INET6 is innocuous with autoconf +versions up to 2.71, but will cause an error at configure time with +the forthcoming autoconf 2.72. + +[ghudson@mit.edu: added more context to commit message] + +ticket: 9077 (new) +tags: pullup +target_version: 1.20-next +target_version: 1.19-next +--- a/aclocal.m4 ++++ b/aclocal.m4 +@@ -409,8 +409,8 @@ else + [[struct sockaddr_in6 in; + AF_INET6; + IN6_IS_ADDR_LINKLOCAL(&in.sin6_addr);]])], +- [krb5_cv_inet6=yes], [krb5_cv_inet6=no])]) +-fi ++ [krb5_cv_inet6=yes], [krb5_cv_inet6=no]) ++fi]) + AC_MSG_RESULT($krb5_cv_inet6) + if test "$krb5_cv_inet6" = no && test "$ac_cv_func_inet_ntop" = yes; then + AC_MSG_CHECKING(for IPv6 compile-time support with -DINET6) + diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-CVE-2021-37750.patch b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-CVE-2021-37750.patch deleted file mode 100644 index 2f4c949e9f..0000000000 --- a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/files/mit-krb5-CVE-2021-37750.patch +++ /dev/null @@ -1,43 +0,0 @@ -From d775c95af7606a51bf79547a94fa52ddd1cb7f49 Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Tue, 3 Aug 2021 01:15:27 -0400 -Subject: [PATCH] Fix KDC null deref on TGS inner body null server - -After the KDC decodes a FAST inner body, it does not check for a null -server. Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this -would typically result in an error from krb5_unparse_name(), but with -the addition of get_local_tgt() it results in a null dereference. Add -a null check. - -Reported by Joseph Sutton of Catalyst. - -CVE-2021-37750: - -In MIT krb5 releases 1.14 and later, an authenticated attacker can -cause a null dereference in the KDC by sending a FAST TGS request with -no server field. - -ticket: 9008 (new) -tags: pullup -target_version: 1.19-next -target_version: 1.18-next ---- - src/kdc/do_tgs_req.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c -index 582e497cc9..32dc65fa8e 100644 ---- a/kdc/do_tgs_req.c -+++ b/kdc/do_tgs_req.c -@@ -204,6 +204,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, - status = "FIND_FAST"; - goto cleanup; - } -+ if (sprinc == NULL) { -+ status = "NULL_SERVER"; -+ errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; -+ goto cleanup; -+ } - - errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server, - &local_tgt, &local_tgt_storage, &local_tgt_key); diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/metadata.xml b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/metadata.xml index af3905a6da..53f75a3481 100644 --- a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/metadata.xml +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/metadata.xml @@ -12,11 +12,12 @@ which depends on kerberos Enable for the keyring ccache using keyutils - Add support for using dev-db/lmdb for lookup tables + Add support for using dev-db/lmdb for lookup tables Enable pkinit support for the initial ticket Enable support for ldap as a database backend cpe:/a:mit:kerberos + krb5/krb5 diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.19.2-r4.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.19.2-r4.ebuild deleted file mode 100644 index a88217f515..0000000000 --- a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.19.2-r4.ebuild +++ /dev/null @@ -1,162 +0,0 @@ -# Copyright 1999-2022 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -PYTHON_COMPAT=( python3_{8..10} ) -inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd toolchain-funcs - -MY_P="${P/mit-}" -P_DIR=$(ver_cut 1-2) -DESCRIPTION="MIT Kerberos V" -HOMEPAGE="https://web.mit.edu/kerberos/www/" -SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz" - -LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )" -SLOT="0" -KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~mips ~ppc ppc64 ~riscv ~s390 sparc x86" -IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux +threads test xinetd" - -# some tests requires network access -RESTRICT="test" - -DEPEND=" - !!app-crypt/heimdal - >=sys-fs/e2fsprogs-1.46.4-r51[${MULTILIB_USEDEP}] - || ( - >=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}] - >=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}] - ) - keyutils? ( >=sys-apps/keyutils-1.5.8:=[${MULTILIB_USEDEP}] ) - lmdb? ( dev-db/lmdb:= ) - nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] ) - openldap? ( >=net-nds/openldap-2.4.38-r1:=[${MULTILIB_USEDEP}] ) - pkinit? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] ) - xinetd? ( sys-apps/xinetd ) - " -BDEPEND=" - ${PYTHON_DEPS} - virtual/yacc - cpu_flags_x86_aes? ( - amd64? ( dev-lang/yasm ) - x86? ( dev-lang/yasm ) - ) - doc? ( virtual/latex-base ) - test? ( - ${PYTHON_DEPS} - dev-lang/tcl:0 - dev-util/dejagnu - dev-util/cmocka - )" -RDEPEND="${DEPEND} - selinux? ( sec-policy/selinux-kerberos )" - -S=${WORKDIR}/${MY_P}/src - -PATCHES=( - "${FILESDIR}/${PN}-1.12_warn_cflags.patch" - "${FILESDIR}/${PN}-config_LDFLAGS-r1.patch" - "${FILESDIR}/${PN}_dont_create_rundir.patch" - "${FILESDIR}/${PN}-1.18.2-krb5-config.patch" - "${FILESDIR}/${PN}-CVE-2021-37750.patch" -) - -MULTILIB_CHOST_TOOLS=( - /usr/bin/krb5-config -) - -src_prepare() { - default - # Make sure we always use the system copies. - rm -rf util/{et,ss,verto} - sed -i 's:^[[:space:]]*util/verto$::' configure.ac || die - - eautoreconf -} - -src_configure() { - # QA - append-flags -fno-strict-aliasing - append-flags -fno-strict-overflow - - multilib-minimal_src_configure -} - -multilib_src_configure() { - ECONF_SOURCE=${S} \ - AR="$(tc-getAR)" \ - WARN_CFLAGS="set" \ - econf \ - $(use_with openldap ldap) \ - "$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \ - $(use_enable nls) \ - $(use_enable pkinit) \ - $(use_enable threads thread-support) \ - $(use_with lmdb) \ - $(use_with keyutils) \ - --without-hesiod \ - --enable-shared \ - --with-system-et \ - --with-system-ss \ - --enable-dns-for-realm \ - --enable-kdc-lookaside-cache \ - --with-system-verto \ - --disable-rpath -} - -multilib_src_compile() { - emake -j1 -} - -multilib_src_test() { - multilib_is_native_abi && emake -j1 check -} - -multilib_src_install() { - emake \ - DESTDIR="${D}" \ - EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \ - install -} - -multilib_src_install_all() { - # default database dir - keepdir /var/lib/krb5kdc - - cd .. - dodoc README - - if use doc; then - dodoc -r doc/html - docinto pdf - dodoc doc/pdf/*.pdf - fi - - newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind - newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc - newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd - newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind - newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc - newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd - - systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service - systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service - systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service - systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service" - systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket - - insinto /etc - newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example - insinto /var/lib/krb5kdc - newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example - - if use openldap ; then - insinto /etc/openldap/schema - doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema" - fi - - if use xinetd ; then - insinto /etc/xinetd.d - newins "${FILESDIR}/kpropd.xinetd" kpropd - fi -} diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.19.3-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.20.1.ebuild similarity index 86% rename from sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.19.3-r2.ebuild rename to sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.20.1.ebuild index 00127c9aa4..014a0511af 100644 --- a/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.19.3-r2.ebuild +++ b/sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.20.1.ebuild @@ -3,8 +3,8 @@ EAPI=8 -PYTHON_COMPAT=( python3_{8..10} ) -inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd toolchain-funcs +PYTHON_COMPAT=( python3_{8..11} ) +inherit autotools python-any-r1 systemd toolchain-funcs multilib-minimal MY_P="${P/mit-}" P_DIR=$(ver_cut 1-2) @@ -14,11 +14,10 @@ SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz" LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )" SLOT="0" -KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86" +KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~mips ~ppc ppc64 ~riscv ~s390 sparc x86" IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux +threads test xinetd" -# some tests requires network access -RESTRICT="test" +RESTRICT="!test? ( test )" DEPEND=" !!app-crypt/heimdal @@ -36,18 +35,14 @@ DEPEND=" " BDEPEND=" ${PYTHON_DEPS} - virtual/yacc + app-alternatives/yacc cpu_flags_x86_aes? ( amd64? ( dev-lang/yasm ) x86? ( dev-lang/yasm ) ) doc? ( virtual/latex-base ) - test? ( - ${PYTHON_DEPS} - dev-lang/tcl:0 - dev-util/dejagnu - dev-util/cmocka - )" + test? ( dev-util/cmocka ) + " RDEPEND="${DEPEND} selinux? ( sec-policy/selinux-kerberos )" @@ -58,6 +53,8 @@ PATCHES=( "${FILESDIR}/${PN}-config_LDFLAGS-r1.patch" "${FILESDIR}/${PN}_dont_create_rundir.patch" "${FILESDIR}/${PN}-1.18.2-krb5-config.patch" + "${FILESDIR}/${PN}-1.20-missing-time-include.patch" + "${FILESDIR}/${PN}-1.20.1-autoconf-2.72.patch" ) MULTILIB_CHOST_TOOLS=( @@ -73,21 +70,12 @@ src_prepare() { eautoreconf } -src_configure() { - # QA - append-flags -fno-strict-aliasing - append-flags -fno-strict-overflow - - multilib-minimal_src_configure -} - multilib_src_configure() { ECONF_SOURCE=${S} \ AR="$(tc-getAR)" \ WARN_CFLAGS="set" \ econf \ $(use_with openldap ldap) \ - "$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \ $(use_enable nls) \ $(use_enable pkinit) \ $(use_enable threads thread-support) \