mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-15 08:56:58 +02:00
app-crypt/mit-krb5: Sync with Gentoo
It's from Gentoo commit 02b17c9bb64e147affc4acecaa0ff4151b2329bf.
This commit is contained in:
Krzesimir Nowak
parent
962a694804
commit
dd8444f6b6
@ -1,2 +1 @@
|
||||
DIST krb5-1.19.2.tar.gz 8741053 BLAKE2B 963722721201e75381c91a2af6e982f569a5b1602beb2d1ded83d35f6f914235a6ed91e5d54f56c97e94921a32ed27c49aded258327966ee13d39485208c38d8 SHA512 b90d6ed0e1e8a87eb5cb2c36d88b823a6a6caabf85e5d419adb8a930f7eea09a5f8491464e7e454cca7ba88be09d19415962fe0036ad2e31fc584f9fc0bbd470
|
||||
DIST krb5-1.19.3.tar.gz 8741343 BLAKE2B 79e68237ee82affa85299060c509e303453c0fab965adc6b9ed305ab64a1f73bd51e65df1b3faadc60815cd506ffefaeed535765ca060d393a9141812f85b48a SHA512 18235440d6f7d8a72c5d7ca5cd8c6465e8adf091d85c483225c7b00d64b4688c1c7924cb800c2fc17e590b2709f1a9de48e6ec79f6debd11dcb7d6fa16c6f351
|
||||
DIST krb5-1.20.1.tar.gz 8661660 BLAKE2B ead16f8b1aec8bba3776628b74257c9aec891770c1fa6d5c5e66275db5f078ca59c9944cd2b017453b777ce080f8e5a322f735fab77691479cfad7b881b92830 SHA512 6f57479f13f107cd84f30de5c758eb6b9fc59171329c13e5da6073b806755f8d163eb7bd84767ea861ad6458ea0c9eeb00ee044d3bcad01ef136e9888564b6a2
|
||||
|
||||
@ -0,0 +1,20 @@
|
||||
https://github.com/krb5/krb5/commit/c3958cec43b598b25484b9805224c56f25f7a755
|
||||
https://bugs.gentoo.org/854561
|
||||
|
||||
From: Greg Hudson <ghudson@mit.edu>
|
||||
Date: Tue, 29 Mar 2022 16:27:55 -0400
|
||||
Subject: [PATCH] Include time.h in kdb.h
|
||||
|
||||
kdb.h uses time_t, and therefore must include <time.h> to ensure its
|
||||
definition. Noticed when building t_sort_key_data.c on macOS.
|
||||
--- a/include/kdb.h
|
||||
+++ b/include/kdb.h
|
||||
@@ -65,6 +65,7 @@
|
||||
#ifndef KRB5_KDB5__
|
||||
#define KRB5_KDB5__
|
||||
|
||||
+#include <time.h>
|
||||
#include <krb5.h>
|
||||
|
||||
/* This version will be incremented when incompatible changes are made to the
|
||||
|
||||
@ -0,0 +1,31 @@
|
||||
https://github.com/krb5/krb5/commit/d864d740d019fdf2c640460f2aa2760c7fa4d5e9
|
||||
|
||||
From d864d740d019fdf2c640460f2aa2760c7fa4d5e9 Mon Sep 17 00:00:00 2001
|
||||
From: Julien Rische <jrische@redhat.com>
|
||||
Date: Thu, 17 Nov 2022 15:01:24 +0100
|
||||
Subject: [PATCH] Fix aclocal.m4 syntax error for autoconf 2.72
|
||||
|
||||
An incorrect closure inside KRB5_AC_INET6 is innocuous with autoconf
|
||||
versions up to 2.71, but will cause an error at configure time with
|
||||
the forthcoming autoconf 2.72.
|
||||
|
||||
[ghudson@mit.edu: added more context to commit message]
|
||||
|
||||
ticket: 9077 (new)
|
||||
tags: pullup
|
||||
target_version: 1.20-next
|
||||
target_version: 1.19-next
|
||||
--- a/aclocal.m4
|
||||
+++ b/aclocal.m4
|
||||
@@ -409,8 +409,8 @@ else
|
||||
[[struct sockaddr_in6 in;
|
||||
AF_INET6;
|
||||
IN6_IS_ADDR_LINKLOCAL(&in.sin6_addr);]])],
|
||||
- [krb5_cv_inet6=yes], [krb5_cv_inet6=no])])
|
||||
-fi
|
||||
+ [krb5_cv_inet6=yes], [krb5_cv_inet6=no])
|
||||
+fi])
|
||||
AC_MSG_RESULT($krb5_cv_inet6)
|
||||
if test "$krb5_cv_inet6" = no && test "$ac_cv_func_inet_ntop" = yes; then
|
||||
AC_MSG_CHECKING(for IPv6 compile-time support with -DINET6)
|
||||
|
||||
@ -1,43 +0,0 @@
|
||||
From d775c95af7606a51bf79547a94fa52ddd1cb7f49 Mon Sep 17 00:00:00 2001
|
||||
From: Greg Hudson <ghudson@mit.edu>
|
||||
Date: Tue, 3 Aug 2021 01:15:27 -0400
|
||||
Subject: [PATCH] Fix KDC null deref on TGS inner body null server
|
||||
|
||||
After the KDC decodes a FAST inner body, it does not check for a null
|
||||
server. Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this
|
||||
would typically result in an error from krb5_unparse_name(), but with
|
||||
the addition of get_local_tgt() it results in a null dereference. Add
|
||||
a null check.
|
||||
|
||||
Reported by Joseph Sutton of Catalyst.
|
||||
|
||||
CVE-2021-37750:
|
||||
|
||||
In MIT krb5 releases 1.14 and later, an authenticated attacker can
|
||||
cause a null dereference in the KDC by sending a FAST TGS request with
|
||||
no server field.
|
||||
|
||||
ticket: 9008 (new)
|
||||
tags: pullup
|
||||
target_version: 1.19-next
|
||||
target_version: 1.18-next
|
||||
---
|
||||
src/kdc/do_tgs_req.c | 5 +++++
|
||||
1 file changed, 5 insertions(+)
|
||||
|
||||
diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
|
||||
index 582e497cc9..32dc65fa8e 100644
|
||||
--- a/kdc/do_tgs_req.c
|
||||
+++ b/kdc/do_tgs_req.c
|
||||
@@ -204,6 +204,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
|
||||
status = "FIND_FAST";
|
||||
goto cleanup;
|
||||
}
|
||||
+ if (sprinc == NULL) {
|
||||
+ status = "NULL_SERVER";
|
||||
+ errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
|
||||
+ goto cleanup;
|
||||
+ }
|
||||
|
||||
errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server,
|
||||
&local_tgt, &local_tgt_storage, &local_tgt_key);
|
||||
@ -12,11 +12,12 @@
|
||||
which depends on kerberos
|
||||
</flag>
|
||||
<flag name="keyutils">Enable for the keyring ccache using keyutils</flag>
|
||||
<flag name="lmdb">Add support for using dev-db/lmdb for lookup tables</flag>
|
||||
<flag name="lmdb">Add support for using <pkg>dev-db/lmdb</pkg> for lookup tables</flag>
|
||||
<flag name="pkinit">Enable pkinit support for the initial ticket</flag>
|
||||
<flag name="openldap">Enable support for ldap as a database backend</flag>
|
||||
</use>
|
||||
<upstream>
|
||||
<remote-id type="cpe">cpe:/a:mit:kerberos</remote-id>
|
||||
<remote-id type="github">krb5/krb5</remote-id>
|
||||
</upstream>
|
||||
</pkgmetadata>
|
||||
|
||||
@ -1,162 +0,0 @@
|
||||
# Copyright 1999-2022 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
|
||||
PYTHON_COMPAT=( python3_{8..10} )
|
||||
inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd toolchain-funcs
|
||||
|
||||
MY_P="${P/mit-}"
|
||||
P_DIR=$(ver_cut 1-2)
|
||||
DESCRIPTION="MIT Kerberos V"
|
||||
HOMEPAGE="https://web.mit.edu/kerberos/www/"
|
||||
SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
|
||||
|
||||
LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
|
||||
SLOT="0"
|
||||
KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~mips ~ppc ppc64 ~riscv ~s390 sparc x86"
|
||||
IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux +threads test xinetd"
|
||||
|
||||
# some tests requires network access
|
||||
RESTRICT="test"
|
||||
|
||||
DEPEND="
|
||||
!!app-crypt/heimdal
|
||||
>=sys-fs/e2fsprogs-1.46.4-r51[${MULTILIB_USEDEP}]
|
||||
|| (
|
||||
>=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
|
||||
>=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
|
||||
)
|
||||
keyutils? ( >=sys-apps/keyutils-1.5.8:=[${MULTILIB_USEDEP}] )
|
||||
lmdb? ( dev-db/lmdb:= )
|
||||
nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
|
||||
openldap? ( >=net-nds/openldap-2.4.38-r1:=[${MULTILIB_USEDEP}] )
|
||||
pkinit? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
|
||||
xinetd? ( sys-apps/xinetd )
|
||||
"
|
||||
BDEPEND="
|
||||
${PYTHON_DEPS}
|
||||
virtual/yacc
|
||||
cpu_flags_x86_aes? (
|
||||
amd64? ( dev-lang/yasm )
|
||||
x86? ( dev-lang/yasm )
|
||||
)
|
||||
doc? ( virtual/latex-base )
|
||||
test? (
|
||||
${PYTHON_DEPS}
|
||||
dev-lang/tcl:0
|
||||
dev-util/dejagnu
|
||||
dev-util/cmocka
|
||||
)"
|
||||
RDEPEND="${DEPEND}
|
||||
selinux? ( sec-policy/selinux-kerberos )"
|
||||
|
||||
S=${WORKDIR}/${MY_P}/src
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}/${PN}-1.12_warn_cflags.patch"
|
||||
"${FILESDIR}/${PN}-config_LDFLAGS-r1.patch"
|
||||
"${FILESDIR}/${PN}_dont_create_rundir.patch"
|
||||
"${FILESDIR}/${PN}-1.18.2-krb5-config.patch"
|
||||
"${FILESDIR}/${PN}-CVE-2021-37750.patch"
|
||||
)
|
||||
|
||||
MULTILIB_CHOST_TOOLS=(
|
||||
/usr/bin/krb5-config
|
||||
)
|
||||
|
||||
src_prepare() {
|
||||
default
|
||||
# Make sure we always use the system copies.
|
||||
rm -rf util/{et,ss,verto}
|
||||
sed -i 's:^[[:space:]]*util/verto$::' configure.ac || die
|
||||
|
||||
eautoreconf
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
# QA
|
||||
append-flags -fno-strict-aliasing
|
||||
append-flags -fno-strict-overflow
|
||||
|
||||
multilib-minimal_src_configure
|
||||
}
|
||||
|
||||
multilib_src_configure() {
|
||||
ECONF_SOURCE=${S} \
|
||||
AR="$(tc-getAR)" \
|
||||
WARN_CFLAGS="set" \
|
||||
econf \
|
||||
$(use_with openldap ldap) \
|
||||
"$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \
|
||||
$(use_enable nls) \
|
||||
$(use_enable pkinit) \
|
||||
$(use_enable threads thread-support) \
|
||||
$(use_with lmdb) \
|
||||
$(use_with keyutils) \
|
||||
--without-hesiod \
|
||||
--enable-shared \
|
||||
--with-system-et \
|
||||
--with-system-ss \
|
||||
--enable-dns-for-realm \
|
||||
--enable-kdc-lookaside-cache \
|
||||
--with-system-verto \
|
||||
--disable-rpath
|
||||
}
|
||||
|
||||
multilib_src_compile() {
|
||||
emake -j1
|
||||
}
|
||||
|
||||
multilib_src_test() {
|
||||
multilib_is_native_abi && emake -j1 check
|
||||
}
|
||||
|
||||
multilib_src_install() {
|
||||
emake \
|
||||
DESTDIR="${D}" \
|
||||
EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
|
||||
install
|
||||
}
|
||||
|
||||
multilib_src_install_all() {
|
||||
# default database dir
|
||||
keepdir /var/lib/krb5kdc
|
||||
|
||||
cd ..
|
||||
dodoc README
|
||||
|
||||
if use doc; then
|
||||
dodoc -r doc/html
|
||||
docinto pdf
|
||||
dodoc doc/pdf/*.pdf
|
||||
fi
|
||||
|
||||
newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
|
||||
newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
|
||||
newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
|
||||
newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
|
||||
newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
|
||||
newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
|
||||
|
||||
systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service
|
||||
systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service
|
||||
systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service
|
||||
systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service"
|
||||
systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket
|
||||
|
||||
insinto /etc
|
||||
newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
|
||||
insinto /var/lib/krb5kdc
|
||||
newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
|
||||
|
||||
if use openldap ; then
|
||||
insinto /etc/openldap/schema
|
||||
doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
|
||||
fi
|
||||
|
||||
if use xinetd ; then
|
||||
insinto /etc/xinetd.d
|
||||
newins "${FILESDIR}/kpropd.xinetd" kpropd
|
||||
fi
|
||||
}
|
||||
@ -3,8 +3,8 @@
|
||||
|
||||
EAPI=8
|
||||
|
||||
PYTHON_COMPAT=( python3_{8..10} )
|
||||
inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd toolchain-funcs
|
||||
PYTHON_COMPAT=( python3_{8..11} )
|
||||
inherit autotools python-any-r1 systemd toolchain-funcs multilib-minimal
|
||||
|
||||
MY_P="${P/mit-}"
|
||||
P_DIR=$(ver_cut 1-2)
|
||||
@ -14,11 +14,10 @@ SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
|
||||
|
||||
LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
|
||||
SLOT="0"
|
||||
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
|
||||
KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~mips ~ppc ppc64 ~riscv ~s390 sparc x86"
|
||||
IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux +threads test xinetd"
|
||||
|
||||
# some tests requires network access
|
||||
RESTRICT="test"
|
||||
RESTRICT="!test? ( test )"
|
||||
|
||||
DEPEND="
|
||||
!!app-crypt/heimdal
|
||||
@ -36,18 +35,14 @@ DEPEND="
|
||||
"
|
||||
BDEPEND="
|
||||
${PYTHON_DEPS}
|
||||
virtual/yacc
|
||||
app-alternatives/yacc
|
||||
cpu_flags_x86_aes? (
|
||||
amd64? ( dev-lang/yasm )
|
||||
x86? ( dev-lang/yasm )
|
||||
)
|
||||
doc? ( virtual/latex-base )
|
||||
test? (
|
||||
${PYTHON_DEPS}
|
||||
dev-lang/tcl:0
|
||||
dev-util/dejagnu
|
||||
dev-util/cmocka
|
||||
)"
|
||||
test? ( dev-util/cmocka )
|
||||
"
|
||||
RDEPEND="${DEPEND}
|
||||
selinux? ( sec-policy/selinux-kerberos )"
|
||||
|
||||
@ -58,6 +53,8 @@ PATCHES=(
|
||||
"${FILESDIR}/${PN}-config_LDFLAGS-r1.patch"
|
||||
"${FILESDIR}/${PN}_dont_create_rundir.patch"
|
||||
"${FILESDIR}/${PN}-1.18.2-krb5-config.patch"
|
||||
"${FILESDIR}/${PN}-1.20-missing-time-include.patch"
|
||||
"${FILESDIR}/${PN}-1.20.1-autoconf-2.72.patch"
|
||||
)
|
||||
|
||||
MULTILIB_CHOST_TOOLS=(
|
||||
@ -73,21 +70,12 @@ src_prepare() {
|
||||
eautoreconf
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
# QA
|
||||
append-flags -fno-strict-aliasing
|
||||
append-flags -fno-strict-overflow
|
||||
|
||||
multilib-minimal_src_configure
|
||||
}
|
||||
|
||||
multilib_src_configure() {
|
||||
ECONF_SOURCE=${S} \
|
||||
AR="$(tc-getAR)" \
|
||||
WARN_CFLAGS="set" \
|
||||
econf \
|
||||
$(use_with openldap ldap) \
|
||||
"$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \
|
||||
$(use_enable nls) \
|
||||
$(use_enable pkinit) \
|
||||
$(use_enable threads thread-support) \
|
||||
Loading…
Reference in New Issue
Block a user