commit: e6232da235fc02eabf2dc7ee0790a51f5e811e0d
Author: Eray Aslan <eras <AT> gentoo <DOT> org>
AuthorDate: Tue Dec 5 10:00:13 2017 +0000
Commit: Eray Aslan <eras <AT> gentoo <DOT> org>
CommitDate: Tue Dec 5 10:00:13 2017 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e6232da2
app-crypt/mit-krb5: security bump to 1.15.2-r1. Bug 639702
Package-Manager: Portage-2.3.16, Repoman-2.3.6
.../files/mit-krb5-1.15.2-fix-pkinit.patch | 98 ++++++++++++++
app-crypt/mit-krb5/mit-krb5-1.15.2-r1.ebuild | 149 +++++++++++++++++++++
2 files changed, 247 insertions(+)
diff --git a/app-crypt/mit-krb5/files/mit-krb5-1.15.2-fix-pkinit.patch
b/app-crypt/mit-krb5/files/mit-krb5-1.15.2-fix-pkinit.patch
new file mode 100644
index 00000000000..4f721d4d961
--- /dev/null
+++ b/app-crypt/mit-krb5/files/mit-krb5-1.15.2-fix-pkinit.patch
@@ -0,0 +1,98 @@
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 74fffbf321..4b86a6f302 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -5145,33 +5145,29 @@ crypto_retieve_X509_key_usage(krb5_context context,
+ return retval;
+ }
+
+-/*
+- * Return a string format of an X509_NAME in buf where
+- * size is an in/out parameter. On input it is the size
+- * of the buffer, and on output it is the actual length
+- * of the name.
+- * If buf is NULL, returns the length req'd to hold name
+- */
+-static char *
+-X509_NAME_oneline_ex(X509_NAME * a,
+- char *buf,
+- unsigned int *size,
+- unsigned long flag)
++static krb5_error_code
++rfc2253_name(X509_NAME *name, char **str_out)
+ {
+- BIO *out = NULL;
++ BIO *b = NULL;
++ char *str;
+
+- out = BIO_new(BIO_s_mem ());
+- if (X509_NAME_print_ex(out, a, 0, flag) > 0) {
+- if (buf != NULL && (*size) > (unsigned int) BIO_number_written(out))
{
+- memset(buf, 0, *size);
+- BIO_read(out, buf, (int) BIO_number_written(out));
+- }
+- else {
+- *size = BIO_number_written(out);
+- }
+- }
+- BIO_free(out);
+- return (buf);
++ *str_out = NULL;
++ b = BIO_new(BIO_s_mem());
++ if (b == NULL)
++ return ENOMEM;
++ if (X509_NAME_print_ex(b, name, 0, XN_FLAG_SEP_COMMA_PLUS) < 0)
++ goto error;
++ str = calloc(BIO_number_written(b) + 1, 1);
++ if (str == NULL)
++ goto error;
++ BIO_read(b, str, BIO_number_written(b));
++ BIO_free(b);
++ *str_out = str;
++ return 0;
++
++error:
++ BIO_free(b);
++ return ENOMEM;
+ }
+
+ /*
+@@ -5187,8 +5183,6 @@ crypto_cert_get_matching_data(krb5_context context,
+ krb5_principal *pkinit_sans =NULL, *upn_sans = NULL;
+ struct _pkinit_cert_data *cd = (struct _pkinit_cert_data *)ch;
+ unsigned int i, j;
+- char buf[DN_BUF_LEN];
+- unsigned int bufsize = sizeof(buf);
+
+ if (cd == NULL || cd->magic != CERT_MAGIC)
+ return EINVAL;
+@@ -5201,23 +5195,14 @@ crypto_cert_get_matching_data(krb5_context context,
+
+ md->ch = ch;
+
+- /* get the subject name (in rfc2253 format) */
+- X509_NAME_oneline_ex(X509_get_subject_name(cd->cred->cert),
+- buf, &bufsize, XN_FLAG_SEP_COMMA_PLUS);
+- md->subject_dn = strdup(buf);
+- if (md->subject_dn == NULL) {
+- retval = ENOMEM;
++ retval = rfc2253_name(X509_get_subject_name(cd->cred->cert),
++ &md->subject_dn);
++ if (retval)
+ goto cleanup;
+- }
+-
+- /* get the issuer name (in rfc2253 format) */
+- X509_NAME_oneline_ex(X509_get_issuer_name(cd->cred->cert),
+- buf, &bufsize, XN_FLAG_SEP_COMMA_PLUS);
+- md->issuer_dn = strdup(buf);
+- if (md->issuer_dn == NULL) {
+- retval = ENOMEM;
++ retval = rfc2253_name(X509_get_issuer_name(cd->cred->cert),
++ &md->issuer_dn);
++ if (retval)
+ goto cleanup;
+- }
+
+ /* get the san data */
+ retval = crypto_retrieve_X509_sans(context, cd->plgctx, cd->reqctx,
diff --git a/app-crypt/mit-krb5/mit-krb5-1.15.2-r1.ebuild
b/app-crypt/mit-krb5/mit-krb5-1.15.2-r1.ebuild
new file mode 100644
index 00000000000..1f9cfda9466
--- /dev/null
+++ b/app-crypt/mit-krb5/mit-krb5-1.15.2-r1.ebuild
@@ -0,0 +1,149 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+PYTHON_COMPAT=( python2_7 )
+inherit autotools flag-o-matic multilib-minimal python-any-r1 versionator
+
+MY_P="${P/mit-}"
+P_DIR=$(get_version_component_range 1-2)
+DESCRIPTION="MIT Kerberos V"
+HOMEPAGE="http://web.mit.edu/kerberos/www/";
+SRC_URI="http://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz";
+
+LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0
|| ( BSD-2 GPL-2+ )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh
~sparc ~x86"
+IUSE="doc +keyutils libressl nls openldap +pkinit selinux +threads test xinetd"
+
+CDEPEND="
+ !!app-crypt/heimdal
+ >=sys-libs/e2fsprogs-libs-1.42.9[${MULTILIB_USEDEP}]
+ || (
+ >=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
+ >=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
+ >=dev-libs/libverto-0.2.5[tevent,${MULTILIB_USEDEP}]
+ )
+ keyutils? ( >=sys-apps/keyutils-1.5.8[${MULTILIB_USEDEP}] )
+ openldap? ( >=net-nds/openldap-2.4.38-r1[${MULTILIB_USEDEP}] )
+ pkinit? (
+ !libressl? ( >=dev-libs/openssl-1.0.1h-r2:0[${MULTILIB_USEDEP}]
)
+ libressl? ( dev-libs/libressl[${MULTILIB_USEDEP}] )
+ )
+ xinetd? ( sys-apps/xinetd )
+ abi_x86_32? (
+ !<=app-emulation/emul-linux-x86-baselibs-20140508-r1
+ !app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)]
+ )"
+DEPEND="${CDEPEND}
+ ${PYTHON_DEPS}
+ virtual/yacc
+ doc? ( virtual/latex-base )
+ test? (
+ ${PYTHON_DEPS}
+ dev-lang/tcl:0
+ dev-util/dejagnu
+ )"
+RDEPEND="${CDEPEND}
+ selinux? ( sec-policy/selinux-kerberos )"
+
+S=${WORKDIR}/${MY_P}/src
+
+MULTILIB_CHOST_TOOLS=(
+ /usr/bin/krb5-config
+)
+
+src_prepare() {
+ eapply "${FILESDIR}/${PN}-1.12_warn_cflags.patch"
+ eapply -p2 "${FILESDIR}/${PN}-config_LDFLAGS.patch"
+ eapply -p0 "${FILESDIR}/${PN}-1.14.2-redeclared-ttyname.patch"
+ eapply "${FILESDIR}/${PN}-1.14.4-disable-nls.patch"
+ eapply -p2 "${FILESDIR}/${PN}-1.15.2-fix-pkinit.patch"
+
+ # Make sure we always use the system copies.
+ rm -rf util/{et,ss,verto}
+ sed -i 's:^[[:space:]]*util/verto$::' configure.in || die
+
+ eapply_user
+ eautoreconf
+}
+
+src_configure() {
+ # QA
+ append-flags -fno-strict-aliasing
+ append-flags -fno-strict-overflow
+
+ multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+ use keyutils || export ac_cv_header_keyutils_h=no
+ ECONF_SOURCE=${S} \
+ WARN_CFLAGS="set" \
+ econf \
+ $(use_with openldap ldap) \
+ "$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \
+ $(use_enable nls) \
+ $(use_enable pkinit) \
+ $(use_enable threads thread-support) \
+ --without-hesiod \
+ --enable-shared \
+ --with-system-et \
+ --with-system-ss \
+ --enable-dns-for-realm \
+ --enable-kdc-lookaside-cache \
+ --with-system-verto \
+ --disable-rpath
+}
+
+multilib_src_compile() {
+ emake -j1
+}
+
+multilib_src_test() {
+ multilib_is_native_abi && emake -j1 check
+}
+
+multilib_src_install() {
+ emake \
+ DESTDIR="${D}" \
+ EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
+ install
+}
+
+multilib_src_install_all() {
+ # default database dir
+ keepdir /var/lib/krb5kdc
+
+ cd ..
+ dodoc README
+
+ if use doc; then
+ dodoc -r doc/html
+ docinto pdf
+ dodoc doc/pdf/*.pdf
+ fi
+
+ newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
+ newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
+ newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
+ newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
+ newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
+ newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
+
+ insinto /etc
+ newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
+ insinto /var/lib/krb5kdc
+ newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
+
+ if use openldap ; then
+ insinto /etc/openldap/schema
+ doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
+ fi
+
+ if use xinetd ; then
+ insinto /etc/xinetd.d
+ newins "${FILESDIR}/kpropd.xinetd" kpropd
+ fi
+}
