Hello community, here is the log from the commit of package cyrus-sasl for openSUSE:Factory checked in at 2017-04-12 17:11:10 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/cyrus-sasl (Old) and /work/SRC/openSUSE:Factory/.cyrus-sasl.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "cyrus-sasl" Wed Apr 12 17:11:10 2017 rev:52 rq:486306 version:2.1.26 Changes: -------- --- /work/SRC/openSUSE:Factory/cyrus-sasl/cyrus-sasl.changes 2015-01-09 20:50:26.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.cyrus-sasl.new/cyrus-sasl.changes 2017-04-12 17:11:11.765900456 +0200 @@ -1,0 +2,7 @@ +Wed Mar 22 09:56:37 UTC 2017 - [email protected] + +- added cyrus-sasl-issue-402.patch to fix + SASL GSSAPI mechanism acceptor wrongly returns zero maxbufsize #402 + (see https://github.com/cyrusimap/cyrus-sasl/issues/402) + +------------------------------------------------------------------- New: ---- cyrus-sasl-issue-402.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cyrus-sasl.spec ++++++ --- /var/tmp/diff_new_pack.ZFVYGq/_old 2017-04-12 17:11:12.841748159 +0200 +++ /var/tmp/diff_new_pack.ZFVYGq/_new 2017-04-12 17:11:12.845747593 +0200 @@ -35,6 +35,8 @@ Patch6: cyrus-sasl-lfs.patch Patch7: fix-sasl-header.diff Patch8: cyrus-sasl-revert_gssapi_flags.patch +# see https://github.com/cyrusimap/cyrus-sasl/issues/402 +Patch9: cyrus-sasl-issue-402.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRequires: db-devel BuildRequires: krb5-mini-devel @@ -171,6 +173,7 @@ %patch6 %patch7 -p1 %patch8 -p1 +%patch9 -p1 %build find . -name "*.cvsignore" -exec rm -fv "{}" "+" ++++++ cyrus-sasl-issue-402.patch ++++++ commit 06260404c047e111f86b67de2862ec124f8fe2ec Author: Sergio Gelato <[email protected]> Date: Wed Oct 21 20:45:17 2015 +0200 Postpone computing maxbufsize until after security layers have been set. Prior to this commit it was possible for the GSSAPI mechanism acceptor to return a zero maxbufsize together with the integrity and/or confidentiality layer bits set. This is not a workable combination. Solve this by not zeroing maxbufsize (as required by RFC 4752 when only the only security layer selected is authentication) until computation of the security layer mask is complete. The condition for zeroing maxbufsize then becomes much more straightforward. diff --git a/plugins/gssapi.c b/plugins/gssapi.c index 2fd1b3b..e861864 100644 --- a/plugins/gssapi.c +++ b/plugins/gssapi.c @@ -1007,21 +1007,14 @@ gssapi_server_mech_ssfcap(context_t *text, } /* build up our security properties token */ - if (text->requiressf != 0 && - (text->qop & (LAYER_INTEGRITY|LAYER_CONFIDENTIALITY))) { - if (params->props.maxbufsize > 0xFFFFFF) { - /* make sure maxbufsize isn't too large */ - /* maxbufsize = 0xFFFFFF */ - sasldata[1] = sasldata[2] = sasldata[3] = 0xFF; - } else { - sasldata[1] = (params->props.maxbufsize >> 16) & 0xFF; - sasldata[2] = (params->props.maxbufsize >> 8) & 0xFF; - sasldata[3] = (params->props.maxbufsize >> 0) & 0xFF; - } + if (params->props.maxbufsize > 0xFFFFFF) { + /* make sure maxbufsize isn't too large */ + /* maxbufsize = 0xFFFFFF */ + sasldata[1] = sasldata[2] = sasldata[3] = 0xFF; } else { - /* From RFC 4752: "The client verifies that the server maximum buffer is 0 - if the server does not advertise support for any security layer." */ - sasldata[1] = sasldata[2] = sasldata[3] = 0; + sasldata[1] = (params->props.maxbufsize >> 16) & 0xFF; + sasldata[2] = (params->props.maxbufsize >> 8) & 0xFF; + sasldata[3] = (params->props.maxbufsize >> 0) & 0xFF; } sasldata[0] = 0; @@ -1047,6 +1040,12 @@ gssapi_server_mech_ssfcap(context_t *text, sasldata[0] |= LAYER_CONFIDENTIALITY; } + if ((sasldata[0] & ~LAYER_NONE) == 0) { + /* From RFC 4752: "The client verifies that the server maximum buffer is 0 + if the server does not advertise support for any security layer." */ + sasldata[1] = sasldata[2] = sasldata[3] = 0; + } + /* Remember what we want and can offer */ text->qop = sasldata[0]; @@ -1401,7 +1400,7 @@ int gssapiv2_server_plug_init( keytab, errno); return SASL_FAIL; } - + if(strlen(keytab) > 1024) { utils->log(NULL, SASL_LOG_ERR, "path to keytab is > 1024 characters");
