Accepting request 649912 from home:stroeder:branches:network
Update to 2.1.27 Please carefully review this change! I don't know what's the build issue on older distro version. I've successfully tested on Tumbleweed x86_64: LDAPI with SASL/EXTERNAL, LDAPS client certs with SASL/EXTERNAL, LDAP with SASL/GSSAPI to MS AD OBS-URL: https://build.opensuse.org/request/show/649912 OBS-URL: https://build.opensuse.org/package/show/network/cyrus-sasl?expand=0&rev=74
This commit is contained in:
parent
aac8956e26
commit
2c4d2f9160
@ -1,3 +0,0 @@
|
|||||||
version https://git-lfs.github.com/spec/v1
|
|
||||||
oid sha256:8fbc5136512b59bb793657f36fadda6359cae3b08f01fd16b3d406f1345b7bc3
|
|
||||||
size 5220231
|
|
@ -1,438 +0,0 @@
|
|||||||
Index: cyrus-sasl-2.1.26/plugins/ntlm.c
|
|
||||||
===================================================================
|
|
||||||
--- cyrus-sasl-2.1.26.orig/plugins/ntlm.c 2012-01-28 00:31:36.000000000 +0100
|
|
||||||
+++ cyrus-sasl-2.1.26/plugins/ntlm.c 2017-09-04 12:00:57.773615637 +0200
|
|
||||||
@@ -417,6 +417,29 @@ static unsigned char *P24(unsigned char
|
|
||||||
return P24;
|
|
||||||
}
|
|
||||||
|
|
||||||
+static HMAC_CTX *_plug_HMAC_CTX_new(const sasl_utils_t *utils)
|
|
||||||
+{
|
|
||||||
+ utils->log(NULL, SASL_LOG_DEBUG, "_plug_HMAC_CTX_new()");
|
|
||||||
+
|
|
||||||
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
|
|
||||||
+ return HMAC_CTX_new();
|
|
||||||
+#else
|
|
||||||
+ return utils->malloc(sizeof(HMAC_CTX));
|
|
||||||
+#endif
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static void _plug_HMAC_CTX_free(HMAC_CTX *ctx, const sasl_utils_t *utils)
|
|
||||||
+{
|
|
||||||
+ utils->log(NULL, SASL_LOG_DEBUG, "_plug_HMAC_CTX_free()");
|
|
||||||
+
|
|
||||||
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
|
|
||||||
+ HMAC_CTX_free(ctx);
|
|
||||||
+#else
|
|
||||||
+ HMAC_cleanup(ctx);
|
|
||||||
+ utils->free(ctx);
|
|
||||||
+#endif
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
static unsigned char *V2(unsigned char *V2, sasl_secret_t *passwd,
|
|
||||||
const char *authid, const char *target,
|
|
||||||
const unsigned char *challenge,
|
|
||||||
@@ -424,7 +447,7 @@ static unsigned char *V2(unsigned char *
|
|
||||||
const sasl_utils_t *utils,
|
|
||||||
char **buf, unsigned *buflen, int *result)
|
|
||||||
{
|
|
||||||
- HMAC_CTX ctx;
|
|
||||||
+ HMAC_CTX *ctx = NULL;
|
|
||||||
unsigned char hash[EVP_MAX_MD_SIZE];
|
|
||||||
char *upper;
|
|
||||||
unsigned int len;
|
|
||||||
@@ -435,6 +458,10 @@ static unsigned char *V2(unsigned char *
|
|
||||||
SETERROR(utils, "cannot allocate NTLMv2 hash");
|
|
||||||
*result = SASL_NOMEM;
|
|
||||||
}
|
|
||||||
+ else if ((ctx = _plug_HMAC_CTX_new(utils)) == NULL) {
|
|
||||||
+ SETERROR(utils, "cannot allocate HMAC CTX");
|
|
||||||
+ *result = SASL_NOMEM;
|
|
||||||
+ }
|
|
||||||
else {
|
|
||||||
/* NTLMv2hash = HMAC-MD5(NTLMhash, unicode(ucase(authid + domain))) */
|
|
||||||
P16_nt(hash, passwd, utils, buf, buflen, result);
|
|
||||||
@@ -449,17 +476,18 @@ static unsigned char *V2(unsigned char *
|
|
||||||
HMAC(EVP_md5(), hash, MD4_DIGEST_LENGTH, *buf, 2 * len, hash, &len);
|
|
||||||
|
|
||||||
/* V2 = HMAC-MD5(NTLMv2hash, challenge + blob) + blob */
|
|
||||||
- HMAC_Init(&ctx, hash, len, EVP_md5());
|
|
||||||
- HMAC_Update(&ctx, challenge, NTLM_NONCE_LENGTH);
|
|
||||||
- HMAC_Update(&ctx, blob, bloblen);
|
|
||||||
- HMAC_Final(&ctx, V2, &len);
|
|
||||||
- HMAC_cleanup(&ctx);
|
|
||||||
+ HMAC_Init_ex(ctx, hash, len, EVP_md5(), NULL);
|
|
||||||
+ HMAC_Update(ctx, challenge, NTLM_NONCE_LENGTH);
|
|
||||||
+ HMAC_Update(ctx, blob, bloblen);
|
|
||||||
+ HMAC_Final(ctx, V2, &len);
|
|
||||||
|
|
||||||
/* the blob is concatenated outside of this function */
|
|
||||||
|
|
||||||
*result = SASL_OK;
|
|
||||||
}
|
|
||||||
|
|
||||||
+ if (ctx) _plug_HMAC_CTX_free(ctx, utils);
|
|
||||||
+
|
|
||||||
return V2;
|
|
||||||
}
|
|
||||||
|
|
||||||
Index: cyrus-sasl-2.1.26/plugins/otp.c
|
|
||||||
===================================================================
|
|
||||||
--- cyrus-sasl-2.1.26.orig/plugins/otp.c 2012-10-12 16:05:48.000000000 +0200
|
|
||||||
+++ cyrus-sasl-2.1.26/plugins/otp.c 2017-09-04 12:00:57.773615637 +0200
|
|
||||||
@@ -96,6 +96,28 @@ static algorithm_option_t algorithm_opti
|
|
||||||
{NULL, 0, NULL}
|
|
||||||
};
|
|
||||||
|
|
||||||
+static EVP_MD_CTX *_plug_EVP_MD_CTX_new(const sasl_utils_t *utils)
|
|
||||||
+{
|
|
||||||
+ utils->log(NULL, SASL_LOG_DEBUG, "_plug_EVP_MD_CTX_new()");
|
|
||||||
+
|
|
||||||
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
|
|
||||||
+ return EVP_MD_CTX_new();
|
|
||||||
+#else
|
|
||||||
+ return utils->malloc(sizeof(EVP_MD_CTX));
|
|
||||||
+#endif
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static void _plug_EVP_MD_CTX_free(EVP_MD_CTX *ctx, const sasl_utils_t *utils)
|
|
||||||
+{
|
|
||||||
+ utils->log(NULL, SASL_LOG_DEBUG, "_plug_EVP_MD_CTX_free()");
|
|
||||||
+
|
|
||||||
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
|
|
||||||
+ EVP_MD_CTX_free(ctx);
|
|
||||||
+#else
|
|
||||||
+ utils->free(ctx);
|
|
||||||
+#endif
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
/* Convert the binary data into ASCII hex */
|
|
||||||
void bin2hex(unsigned char *bin, int binlen, char *hex)
|
|
||||||
{
|
|
||||||
@@ -116,17 +138,16 @@ void bin2hex(unsigned char *bin, int bin
|
|
||||||
* swabbing bytes if necessary.
|
|
||||||
*/
|
|
||||||
static void otp_hash(const EVP_MD *md, char *in, size_t inlen,
|
|
||||||
- unsigned char *out, int swab)
|
|
||||||
+ unsigned char *out, int swab, EVP_MD_CTX *mdctx)
|
|
||||||
{
|
|
||||||
- EVP_MD_CTX mdctx;
|
|
||||||
- char hash[EVP_MAX_MD_SIZE];
|
|
||||||
+ unsigned char hash[EVP_MAX_MD_SIZE];
|
|
||||||
unsigned int i;
|
|
||||||
int j;
|
|
||||||
unsigned hashlen;
|
|
||||||
|
|
||||||
- EVP_DigestInit(&mdctx, md);
|
|
||||||
- EVP_DigestUpdate(&mdctx, in, inlen);
|
|
||||||
- EVP_DigestFinal(&mdctx, hash, &hashlen);
|
|
||||||
+ EVP_DigestInit(mdctx, md);
|
|
||||||
+ EVP_DigestUpdate(mdctx, in, inlen);
|
|
||||||
+ EVP_DigestFinal(mdctx, hash, &hashlen);
|
|
||||||
|
|
||||||
/* Fold the result into 64 bits */
|
|
||||||
for (i = OTP_HASH_SIZE; i < hashlen; i++) {
|
|
||||||
@@ -149,7 +170,9 @@ static int generate_otp(const sasl_utils
|
|
||||||
char *secret, char *otp)
|
|
||||||
{
|
|
||||||
const EVP_MD *md;
|
|
||||||
- char *key;
|
|
||||||
+ EVP_MD_CTX *mdctx = NULL;
|
|
||||||
+ char *key = NULL;
|
|
||||||
+ int r = SASL_OK;
|
|
||||||
|
|
||||||
if (!(md = EVP_get_digestbyname(alg->evp_name))) {
|
|
||||||
utils->seterror(utils->conn, 0,
|
|
||||||
@@ -157,23 +180,32 @@ static int generate_otp(const sasl_utils
|
|
||||||
return SASL_FAIL;
|
|
||||||
}
|
|
||||||
|
|
||||||
+ if ((mdctx = _plug_EVP_MD_CTX_new(utils)) == NULL) {
|
|
||||||
+ SETERROR(utils, "cannot allocate MD CTX");
|
|
||||||
+ r = SASL_NOMEM;
|
|
||||||
+ goto done;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
if ((key = utils->malloc(strlen(seed) + strlen(secret) + 1)) == NULL) {
|
|
||||||
SETERROR(utils, "cannot allocate OTP key");
|
|
||||||
- return SASL_NOMEM;
|
|
||||||
+ r = SASL_NOMEM;
|
|
||||||
+ goto done;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* initial step */
|
|
||||||
strcpy(key, seed);
|
|
||||||
strcat(key, secret);
|
|
||||||
- otp_hash(md, key, strlen(key), otp, alg->swab);
|
|
||||||
+ otp_hash(md, key, strlen(key), otp, alg->swab, mdctx);
|
|
||||||
|
|
||||||
/* computation step */
|
|
||||||
while (seq-- > 0)
|
|
||||||
- otp_hash(md, otp, OTP_HASH_SIZE, otp, alg->swab);
|
|
||||||
-
|
|
||||||
- utils->free(key);
|
|
||||||
+ otp_hash(md, otp, OTP_HASH_SIZE, otp, alg->swab, mdctx);
|
|
||||||
+
|
|
||||||
+ done:
|
|
||||||
+ if (key) utils->free(key);
|
|
||||||
+ if (mdctx) _plug_EVP_MD_CTX_free(mdctx, utils);
|
|
||||||
|
|
||||||
- return SASL_OK;
|
|
||||||
+ return r;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int parse_challenge(const sasl_utils_t *utils,
|
|
||||||
@@ -693,7 +725,8 @@ static int strptrcasecmp(const void *arg
|
|
||||||
|
|
||||||
/* Convert the 6 words into binary data */
|
|
||||||
static int word2bin(const sasl_utils_t *utils,
|
|
||||||
- char *words, unsigned char *bin, const EVP_MD *md)
|
|
||||||
+ char *words, unsigned char *bin, const EVP_MD *md,
|
|
||||||
+ EVP_MD_CTX *mdctx)
|
|
||||||
{
|
|
||||||
int i, j;
|
|
||||||
char *c, *word, buf[OTP_RESPONSE_MAX+1];
|
|
||||||
@@ -752,13 +785,12 @@ static int word2bin(const sasl_utils_t *
|
|
||||||
|
|
||||||
/* alternate dictionary */
|
|
||||||
if (alt_dict) {
|
|
||||||
- EVP_MD_CTX mdctx;
|
|
||||||
- char hash[EVP_MAX_MD_SIZE];
|
|
||||||
- int hashlen;
|
|
||||||
+ unsigned char hash[EVP_MAX_MD_SIZE];
|
|
||||||
+ unsigned hashlen;
|
|
||||||
|
|
||||||
- EVP_DigestInit(&mdctx, md);
|
|
||||||
- EVP_DigestUpdate(&mdctx, word, strlen(word));
|
|
||||||
- EVP_DigestFinal(&mdctx, hash, &hashlen);
|
|
||||||
+ EVP_DigestInit(mdctx, md);
|
|
||||||
+ EVP_DigestUpdate(mdctx, word, strlen(word));
|
|
||||||
+ EVP_DigestFinal(mdctx, hash, &hashlen);
|
|
||||||
|
|
||||||
/* use lowest 11 bits */
|
|
||||||
x = ((hash[hashlen-2] & 0x7) << 8) | hash[hashlen-1];
|
|
||||||
@@ -802,6 +834,7 @@ static int verify_response(server_contex
|
|
||||||
char *response)
|
|
||||||
{
|
|
||||||
const EVP_MD *md;
|
|
||||||
+ EVP_MD_CTX *mdctx = NULL;
|
|
||||||
char *c;
|
|
||||||
int do_init = 0;
|
|
||||||
unsigned char cur_otp[OTP_HASH_SIZE], prev_otp[OTP_HASH_SIZE];
|
|
||||||
@@ -815,6 +848,11 @@ static int verify_response(server_contex
|
|
||||||
return SASL_FAIL;
|
|
||||||
}
|
|
||||||
|
|
||||||
+ if ((mdctx = _plug_EVP_MD_CTX_new(utils)) == NULL) {
|
|
||||||
+ SETERROR(utils, "cannot allocate MD CTX");
|
|
||||||
+ return SASL_NOMEM;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
/* eat leading whitespace */
|
|
||||||
c = response;
|
|
||||||
while (isspace((int) *c)) c++;
|
|
||||||
@@ -824,7 +862,7 @@ static int verify_response(server_contex
|
|
||||||
r = hex2bin(c+strlen(OTP_HEX_TYPE), cur_otp, OTP_HASH_SIZE);
|
|
||||||
}
|
|
||||||
else if (!strncasecmp(c, OTP_WORD_TYPE, strlen(OTP_WORD_TYPE))) {
|
|
||||||
- r = word2bin(utils, c+strlen(OTP_WORD_TYPE), cur_otp, md);
|
|
||||||
+ r = word2bin(utils, c+strlen(OTP_WORD_TYPE), cur_otp, md, mdctx);
|
|
||||||
}
|
|
||||||
else if (!strncasecmp(c, OTP_INIT_HEX_TYPE,
|
|
||||||
strlen(OTP_INIT_HEX_TYPE))) {
|
|
||||||
@@ -834,7 +872,7 @@ static int verify_response(server_contex
|
|
||||||
else if (!strncasecmp(c, OTP_INIT_WORD_TYPE,
|
|
||||||
strlen(OTP_INIT_WORD_TYPE))) {
|
|
||||||
do_init = 1;
|
|
||||||
- r = word2bin(utils, c+strlen(OTP_INIT_WORD_TYPE), cur_otp, md);
|
|
||||||
+ r = word2bin(utils, c+strlen(OTP_INIT_WORD_TYPE), cur_otp, md, mdctx);
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
SETERROR(utils, "unknown OTP extended response type");
|
|
||||||
@@ -843,14 +881,15 @@ static int verify_response(server_contex
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
/* standard response, try word first, and then hex */
|
|
||||||
- r = word2bin(utils, c, cur_otp, md);
|
|
||||||
+ r = word2bin(utils, c, cur_otp, md, mdctx);
|
|
||||||
if (r != SASL_OK)
|
|
||||||
r = hex2bin(c, cur_otp, OTP_HASH_SIZE);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (r == SASL_OK) {
|
|
||||||
/* do one more hash (previous otp) and compare to stored otp */
|
|
||||||
- otp_hash(md, cur_otp, OTP_HASH_SIZE, prev_otp, text->alg->swab);
|
|
||||||
+ otp_hash(md, (char *) cur_otp, OTP_HASH_SIZE,
|
|
||||||
+ prev_otp, text->alg->swab, mdctx);
|
|
||||||
|
|
||||||
if (!memcmp(prev_otp, text->otp, OTP_HASH_SIZE)) {
|
|
||||||
/* update the secret with this seq/otp */
|
|
||||||
@@ -879,23 +918,28 @@ static int verify_response(server_contex
|
|
||||||
*new_resp++ = '\0';
|
|
||||||
}
|
|
||||||
|
|
||||||
- if (!(new_chal && new_resp))
|
|
||||||
- return SASL_BADAUTH;
|
|
||||||
+ if (!(new_chal && new_resp)) {
|
|
||||||
+ r = SASL_BADAUTH;
|
|
||||||
+ goto done;
|
|
||||||
+ }
|
|
||||||
|
|
||||||
if ((r = parse_challenge(utils, new_chal, &alg, &seq, seed, 1))
|
|
||||||
!= SASL_OK) {
|
|
||||||
- return r;
|
|
||||||
+ goto done;
|
|
||||||
}
|
|
||||||
|
|
||||||
- if (seq < 1 || !strcasecmp(seed, text->seed))
|
|
||||||
- return SASL_BADAUTH;
|
|
||||||
+ if (seq < 1 || !strcasecmp(seed, text->seed)) {
|
|
||||||
+ r = SASL_BADAUTH;
|
|
||||||
+ goto done;
|
|
||||||
+ }
|
|
||||||
|
|
||||||
/* find the MDA */
|
|
||||||
if (!(md = EVP_get_digestbyname(alg->evp_name))) {
|
|
||||||
utils->seterror(utils->conn, 0,
|
|
||||||
"OTP algorithm %s is not available",
|
|
||||||
alg->evp_name);
|
|
||||||
- return SASL_BADAUTH;
|
|
||||||
+ r = SASL_BADAUTH;
|
|
||||||
+ goto done;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!strncasecmp(c, OTP_INIT_HEX_TYPE, strlen(OTP_INIT_HEX_TYPE))) {
|
|
||||||
@@ -903,7 +947,7 @@ static int verify_response(server_contex
|
|
||||||
}
|
|
||||||
else if (!strncasecmp(c, OTP_INIT_WORD_TYPE,
|
|
||||||
strlen(OTP_INIT_WORD_TYPE))) {
|
|
||||||
- r = word2bin(utils, new_resp, new_otp, md);
|
|
||||||
+ r = word2bin(utils, new_resp, new_otp, md, mdctx);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (r == SASL_OK) {
|
|
||||||
@@ -914,7 +958,10 @@ static int verify_response(server_contex
|
|
||||||
memcpy(text->otp, new_otp, OTP_HASH_SIZE);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
-
|
|
||||||
+
|
|
||||||
+ done:
|
|
||||||
+ if (mdctx) _plug_EVP_MD_CTX_free(mdctx, utils);
|
|
||||||
+
|
|
||||||
return r;
|
|
||||||
}
|
|
||||||
|
|
||||||
Index: cyrus-sasl-2.1.26/saslauthd/lak.c
|
|
||||||
===================================================================
|
|
||||||
--- cyrus-sasl-2.1.26.orig/saslauthd/lak.c 2012-10-12 16:05:48.000000000 +0200
|
|
||||||
+++ cyrus-sasl-2.1.26/saslauthd/lak.c 2017-09-04 12:00:57.773615637 +0200
|
|
||||||
@@ -61,6 +61,35 @@
|
|
||||||
#include <sasl.h>
|
|
||||||
#include "lak.h"
|
|
||||||
|
|
||||||
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
|
|
||||||
+static EVP_MD_CTX *EVP_MD_CTX_new(void)
|
|
||||||
+{
|
|
||||||
+ return EVP_MD_CTX_create();
|
|
||||||
+}
|
|
||||||
+static void EVP_MD_CTX_free(EVP_MD_CTX *ctx)
|
|
||||||
+{
|
|
||||||
+ if (ctx == NULL)
|
|
||||||
+ return;
|
|
||||||
+
|
|
||||||
+ EVP_MD_CTX_destroy(ctx);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+static EVP_ENCODE_CTX *EVP_ENCODE_CTX_new(void)
|
|
||||||
+{
|
|
||||||
+ EVP_ENCODE_CTX *ctx = OPENSSL_malloc(sizeof(*ctx));
|
|
||||||
+
|
|
||||||
+ if (ctx != NULL) {
|
|
||||||
+ memset(ctx, 0, sizeof(*ctx));
|
|
||||||
+ }
|
|
||||||
+ return ctx;
|
|
||||||
+}
|
|
||||||
+static void EVP_ENCODE_CTX_free(EVP_ENCODE_CTX *ctx)
|
|
||||||
+{
|
|
||||||
+ OPENSSL_free(ctx);
|
|
||||||
+ return;
|
|
||||||
+}
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
typedef struct lak_auth_method {
|
|
||||||
int method;
|
|
||||||
int (*check) (LAK *lak, const char *user, const char *service, const char *realm, const char *password) ;
|
|
||||||
@@ -1715,20 +1744,28 @@ static int lak_base64_decode(
|
|
||||||
|
|
||||||
int rc, i, tlen = 0;
|
|
||||||
char *text;
|
|
||||||
- EVP_ENCODE_CTX EVP_ctx;
|
|
||||||
+ EVP_ENCODE_CTX *enc_ctx = EVP_ENCODE_CTX_new();
|
|
||||||
|
|
||||||
- text = (char *)malloc(((strlen(src)+3)/4 * 3) + 1);
|
|
||||||
if (text == NULL)
|
|
||||||
return LAK_NOMEM;
|
|
||||||
|
|
||||||
- EVP_DecodeInit(&EVP_ctx);
|
|
||||||
- rc = EVP_DecodeUpdate(&EVP_ctx, text, &i, (char *)src, strlen(src));
|
|
||||||
+ text = (char *)malloc(((strlen(src)+3)/4 * 3) + 1);
|
|
||||||
+ if (text == NULL) {
|
|
||||||
+ EVP_ENCODE_CTX_free(enc_ctx);
|
|
||||||
+ return LAK_NOMEM;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ EVP_DecodeInit(enc_ctx);
|
|
||||||
+ rc = EVP_DecodeUpdate(enc_ctx, (unsigned char *) text, &i, (const unsigned char *)src, strlen(src));
|
|
||||||
if (rc < 0) {
|
|
||||||
+ EVP_ENCODE_CTX_free(enc_ctx);
|
|
||||||
free(text);
|
|
||||||
return LAK_FAIL;
|
|
||||||
}
|
|
||||||
tlen += i;
|
|
||||||
- EVP_DecodeFinal(&EVP_ctx, text, &i);
|
|
||||||
+ EVP_DecodeFinal(enc_ctx, (unsigned char *) text, &i);
|
|
||||||
+
|
|
||||||
+ EVP_ENCODE_CTX_free(enc_ctx);
|
|
||||||
|
|
||||||
*ret = text;
|
|
||||||
if (rlen != NULL)
|
|
||||||
@@ -1744,7 +1781,7 @@ static int lak_check_hashed(
|
|
||||||
{
|
|
||||||
int rc, clen;
|
|
||||||
LAK_HASH_ROCK *hrock = (LAK_HASH_ROCK *) rock;
|
|
||||||
- EVP_MD_CTX mdctx;
|
|
||||||
+ EVP_MD_CTX *mdctx;
|
|
||||||
const EVP_MD *md;
|
|
||||||
unsigned char digest[EVP_MAX_MD_SIZE];
|
|
||||||
char *cred;
|
|
||||||
@@ -1753,17 +1790,24 @@ static int lak_check_hashed(
|
|
||||||
if (!md)
|
|
||||||
return LAK_FAIL;
|
|
||||||
|
|
||||||
+ mdctx = EVP_MD_CTX_new();
|
|
||||||
+ if (!mdctx)
|
|
||||||
+ return LAK_NOMEM;
|
|
||||||
+
|
|
||||||
rc = lak_base64_decode(hash, &cred, &clen);
|
|
||||||
- if (rc != LAK_OK)
|
|
||||||
+ if (rc != LAK_OK) {
|
|
||||||
+ EVP_MD_CTX_free(mdctx);
|
|
||||||
return rc;
|
|
||||||
+ }
|
|
||||||
|
|
||||||
- EVP_DigestInit(&mdctx, md);
|
|
||||||
- EVP_DigestUpdate(&mdctx, passwd, strlen(passwd));
|
|
||||||
+ EVP_DigestInit(mdctx, md);
|
|
||||||
+ EVP_DigestUpdate(mdctx, passwd, strlen(passwd));
|
|
||||||
if (hrock->salted) {
|
|
||||||
- EVP_DigestUpdate(&mdctx, &cred[EVP_MD_size(md)],
|
|
||||||
+ EVP_DigestUpdate(mdctx, &cred[EVP_MD_size(md)],
|
|
||||||
clen - EVP_MD_size(md));
|
|
||||||
}
|
|
||||||
- EVP_DigestFinal(&mdctx, digest, NULL);
|
|
||||||
+ EVP_DigestFinal(mdctx, digest, NULL);
|
|
||||||
+ EVP_MD_CTX_free(mdctx);
|
|
||||||
|
|
||||||
rc = memcmp((char *)cred, (char *)digest, EVP_MD_size(md));
|
|
||||||
free(cred);
|
|
3
cyrus-sasl-2.1.27.tar.gz
Normal file
3
cyrus-sasl-2.1.27.tar.gz
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
version https://git-lfs.github.com/spec/v1
|
||||||
|
oid sha256:0385b2f797f13cead2327454eb47550f0bb4c1f0c4af1176d550a31eff7c2cf9
|
||||||
|
size 4166667
|
@ -1,70 +0,0 @@
|
|||||||
commit 06260404c047e111f86b67de2862ec124f8fe2ec
|
|
||||||
Author: Sergio Gelato <Sergio.Gelato@astro.su.se>
|
|
||||||
Date: Wed Oct 21 20:45:17 2015 +0200
|
|
||||||
|
|
||||||
Postpone computing maxbufsize until after security layers have been set.
|
|
||||||
|
|
||||||
Prior to this commit it was possible for the GSSAPI mechanism acceptor to
|
|
||||||
return a zero maxbufsize together with the integrity and/or confidentiality
|
|
||||||
layer bits set. This is not a workable combination.
|
|
||||||
|
|
||||||
Solve this by not zeroing maxbufsize (as required by RFC 4752 when only
|
|
||||||
the only security layer selected is authentication) until computation of
|
|
||||||
the security layer mask is complete. The condition for zeroing maxbufsize
|
|
||||||
then becomes much more straightforward.
|
|
||||||
|
|
||||||
diff --git a/plugins/gssapi.c b/plugins/gssapi.c
|
|
||||||
index 2fd1b3b..e861864 100644
|
|
||||||
--- a/plugins/gssapi.c
|
|
||||||
+++ b/plugins/gssapi.c
|
|
||||||
@@ -1007,21 +1007,14 @@ gssapi_server_mech_ssfcap(context_t *text,
|
|
||||||
}
|
|
||||||
|
|
||||||
/* build up our security properties token */
|
|
||||||
- if (text->requiressf != 0 &&
|
|
||||||
- (text->qop & (LAYER_INTEGRITY|LAYER_CONFIDENTIALITY))) {
|
|
||||||
- if (params->props.maxbufsize > 0xFFFFFF) {
|
|
||||||
- /* make sure maxbufsize isn't too large */
|
|
||||||
- /* maxbufsize = 0xFFFFFF */
|
|
||||||
- sasldata[1] = sasldata[2] = sasldata[3] = 0xFF;
|
|
||||||
- } else {
|
|
||||||
- sasldata[1] = (params->props.maxbufsize >> 16) & 0xFF;
|
|
||||||
- sasldata[2] = (params->props.maxbufsize >> 8) & 0xFF;
|
|
||||||
- sasldata[3] = (params->props.maxbufsize >> 0) & 0xFF;
|
|
||||||
- }
|
|
||||||
+ if (params->props.maxbufsize > 0xFFFFFF) {
|
|
||||||
+ /* make sure maxbufsize isn't too large */
|
|
||||||
+ /* maxbufsize = 0xFFFFFF */
|
|
||||||
+ sasldata[1] = sasldata[2] = sasldata[3] = 0xFF;
|
|
||||||
} else {
|
|
||||||
- /* From RFC 4752: "The client verifies that the server maximum buffer is 0
|
|
||||||
- if the server does not advertise support for any security layer." */
|
|
||||||
- sasldata[1] = sasldata[2] = sasldata[3] = 0;
|
|
||||||
+ sasldata[1] = (params->props.maxbufsize >> 16) & 0xFF;
|
|
||||||
+ sasldata[2] = (params->props.maxbufsize >> 8) & 0xFF;
|
|
||||||
+ sasldata[3] = (params->props.maxbufsize >> 0) & 0xFF;
|
|
||||||
}
|
|
||||||
|
|
||||||
sasldata[0] = 0;
|
|
||||||
@@ -1047,6 +1040,12 @@ gssapi_server_mech_ssfcap(context_t *text,
|
|
||||||
sasldata[0] |= LAYER_CONFIDENTIALITY;
|
|
||||||
}
|
|
||||||
|
|
||||||
+ if ((sasldata[0] & ~LAYER_NONE) == 0) {
|
|
||||||
+ /* From RFC 4752: "The client verifies that the server maximum buffer is 0
|
|
||||||
+ if the server does not advertise support for any security layer." */
|
|
||||||
+ sasldata[1] = sasldata[2] = sasldata[3] = 0;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
/* Remember what we want and can offer */
|
|
||||||
text->qop = sasldata[0];
|
|
||||||
|
|
||||||
@@ -1401,7 +1400,7 @@ int gssapiv2_server_plug_init(
|
|
||||||
keytab, errno);
|
|
||||||
return SASL_FAIL;
|
|
||||||
}
|
|
||||||
-
|
|
||||||
+
|
|
||||||
if(strlen(keytab) > 1024) {
|
|
||||||
utils->log(NULL, SASL_LOG_ERR,
|
|
||||||
"path to keytab is > 1024 characters");
|
|
@ -1,83 +1,13 @@
|
|||||||
--- configure.in.orig
|
--- cyrus-sasl-2.1.27.orig/configure.ac 2018-10-09 16:58:04.000000000 +0200
|
||||||
+++ configure.in
|
+++ cyrus-sasl-2.1.27/configure.ac 2018-11-17 13:05:26.475631124 +0100
|
||||||
@@ -84,7 +84,9 @@ AC_ARG_ENABLE(obsolete_cram_attr,
|
@@ -95,7 +95,9 @@
|
||||||
enable_obsolete_cram_attr=$enableval,
|
enable_obsolete_digest_attr=$enableval,
|
||||||
enable_obsolete_cram_attr=yes)
|
enable_obsolete_digest_attr=yes)
|
||||||
|
|
||||||
-AC_PROG_CC
|
-AC_PROG_CC
|
||||||
+AC_PROG_CC_STDC
|
+AC_PROG_CC_STDC
|
||||||
+AC_USE_SYSTEM_EXTENSIONS
|
+AC_USE_SYSTEM_EXTENSIONS
|
||||||
+AC_SYS_LARGEFILE
|
+AC_SYS_LARGEFILE
|
||||||
|
AX_PROG_CC_FOR_BUILD
|
||||||
AC_PROG_CPP
|
AC_PROG_CPP
|
||||||
AC_PROG_AWK
|
AC_PROG_AWK
|
||||||
AC_PROG_LN_S
|
|
||||||
--- saslauthd/configure.in.orig
|
|
||||||
+++ saslauthd/configure.in
|
|
||||||
@@ -19,7 +19,9 @@ AM_INIT_AUTOMAKE(saslauthd,2.1.25)
|
|
||||||
CMU_INIT_AUTOMAKE
|
|
||||||
|
|
||||||
dnl Checks for programs.
|
|
||||||
-AC_PROG_CC
|
|
||||||
+AC_PROG_CC_STDC
|
|
||||||
+AC_USE_SYSTEM_EXTENSIONS
|
|
||||||
+AC_SYS_LARGEFILE
|
|
||||||
AC_PROG_CPP
|
|
||||||
AC_PROG_AWK
|
|
||||||
AC_PROG_MAKE_SET
|
|
||||||
--- plugins/Makefile.am.orig
|
|
||||||
+++ plugins/Makefile.am
|
|
||||||
@@ -49,7 +49,8 @@
|
|
||||||
plugin_version = 3:0:0
|
|
||||||
|
|
||||||
INCLUDES=-I$(top_srcdir)/include -I$(top_srcdir)/lib -I$(top_srcdir)/sasldb -I$(top_builddir)/include
|
|
||||||
-AM_LDFLAGS = -module -export-dynamic -rpath $(plugindir) -version-info $(plugin_version)
|
|
||||||
+AM_CPPFLAGS = -include $(top_builddir)/config.h
|
|
||||||
+AM_LDFLAGS = -module -shared -export-dynamic -rpath $(plugindir) -version-info $(plugin_version)
|
|
||||||
|
|
||||||
COMPAT_OBJS = @LTGETADDRINFOOBJS@ @LTGETNAMEINFOOBJS@ @LTSNPRINTFOBJS@
|
|
||||||
|
|
||||||
--- lib/Makefile.am.orig
|
|
||||||
+++ lib/Makefile.am
|
|
||||||
@@ -43,7 +43,8 @@
|
|
||||||
# CURRENT:REVISION:AGE
|
|
||||||
sasl_version = 3:0:0
|
|
||||||
|
|
||||||
-INCLUDES=-DLIBSASL_EXPORTS=1 -I$(top_srcdir)/include -I$(top_srcdir)/plugins -I$(top_builddir)/include -I$(top_srcdir)/sasldb
|
|
||||||
+
|
|
||||||
+AM_CPPFLAGS=-DLIBSASL_EXPORTS=1 -include $(top_builddir)/config.h -I$(top_srcdir)/include -I$(top_srcdir)/plugins -I$(top_builddir)/include -I$(top_srcdir)/sasldb
|
|
||||||
|
|
||||||
EXTRA_DIST = windlopen.c staticopen.h NTMakefile
|
|
||||||
EXTRA_LIBRARIES = libsasl2.a
|
|
||||||
--- saslauthd/Makefile.am.orig
|
|
||||||
+++ saslauthd/Makefile.am
|
|
||||||
@@ -26,7 +26,7 @@ saslcache_SOURCES = saslcache.c
|
|
||||||
|
|
||||||
EXTRA_DIST = saslauthd.8 saslauthd.mdoc config include \
|
|
||||||
getnameinfo.c getaddrinfo.c LDAP_SASLAUTHD
|
|
||||||
-INCLUDES = -I$(top_srcdir)/include -I$(top_builddir)/include -I$(top_srcdir)/../include
|
|
||||||
+AM_CPPFLAGS = -include $(top_builddir)/config.h -I$(top_srcdir)/include -I$(top_builddir)/include -I$(top_srcdir)/../include
|
|
||||||
DEFS = @DEFS@ -DSASLAUTHD_CONF_FILE_DEFAULT=\"@sysconfdir@/saslauthd.conf\" -I. -I$(srcdir) -I..
|
|
||||||
|
|
||||||
|
|
||||||
--- utils/Makefile.am.orig
|
|
||||||
+++ utils/Makefile.am
|
|
||||||
@@ -89,7 +89,7 @@ libsfsasl2_la_SOURCES =
|
|
||||||
libsfsasl2_la_LIBADD = sfsasl.lo
|
|
||||||
libsfsasl2_la_LDFLAGS = -version-info 1:0:0 -export-dynamic -rpath $(libdir)
|
|
||||||
|
|
||||||
-INCLUDES=-I$(top_srcdir)/include -I$(top_builddir)/include @SASL_DB_INC@
|
|
||||||
+AM_CPPFLAGS = -include $(top_builddir)/config.h -I$(top_srcdir)/include -I$(top_builddir)/include @SASL_DB_INC@
|
|
||||||
EXTRA_DIST = saslpasswd2.8 sasldblistusers2.8 pluginviewer.8 sfsasl.h sfsasl.c smtptest.c testsuite.c pluginviewer.c NTMakefile
|
|
||||||
|
|
||||||
sfsasl.lo: sfsasl.c
|
|
||||||
--- sasldb/Makefile.am.orig
|
|
||||||
+++ sasldb/Makefile.am
|
|
||||||
@@ -44,7 +44,7 @@
|
|
||||||
# Note that this doesn't necessaraly follow the libsasl2 verison info
|
|
||||||
sasl_version = 1:25:0
|
|
||||||
|
|
||||||
-INCLUDES=-I$(top_srcdir)/include -I$(top_builddir)/include @SASL_DB_INC@
|
|
||||||
+AM_CPPFLAGS= -include $(top_builddir)/config.h -I$(top_srcdir)/include -I$(top_builddir)/include @SASL_DB_INC@
|
|
||||||
|
|
||||||
extra_common_sources = db_none.c db_ndbm.c db_gdbm.c db_berkeley.c
|
|
||||||
|
|
||||||
|
@ -1,7 +1,7 @@
|
|||||||
Index: cyrus-sasl-2.1.26/cmulocal/cyrus.m4
|
Index: cyrus-sasl-2.1.26/m4/cyrus.m4
|
||||||
===================================================================
|
===================================================================
|
||||||
--- cyrus-sasl-2.1.26.orig/cmulocal/cyrus.m4
|
--- cyrus-sasl-2.1.26.orig/m4/cyrus.m4
|
||||||
+++ cyrus-sasl-2.1.26/cmulocal/cyrus.m4
|
+++ cyrus-sasl-2.1.26/m4/cyrus.m4
|
||||||
@@ -32,14 +32,5 @@ AC_DEFUN([CMU_ADD_LIBPATH_TO], [
|
@@ -32,14 +32,5 @@ AC_DEFUN([CMU_ADD_LIBPATH_TO], [
|
||||||
dnl runpath initialization
|
dnl runpath initialization
|
||||||
AC_DEFUN([CMU_GUESS_RUNPATH_SWITCH], [
|
AC_DEFUN([CMU_GUESS_RUNPATH_SWITCH], [
|
||||||
|
@ -1,15 +0,0 @@
|
|||||||
--- a/plugins/gssapi.c
|
|
||||||
+++ b/plugins/gssapi.c
|
|
||||||
@@ -1583,10 +1583,10 @@ static int gssapi_client_mech_step(void *conn_context,
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Setup req_flags properly */
|
|
||||||
- req_flags = GSS_C_INTEG_FLAG;
|
|
||||||
+ req_flags = GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG;
|
|
||||||
if (params->props.max_ssf > params->external_ssf) {
|
|
||||||
/* We are requesting a security layer */
|
|
||||||
- req_flags |= GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG;
|
|
||||||
+ req_flags |= GSS_C_INTEG_FLAG;
|
|
||||||
/* Any SSF bigger than 1 is confidentiality. */
|
|
||||||
/* Let's check if the client of the API requires confidentiality,
|
|
||||||
and it wasn't already provided by an external layer */
|
|
@ -1,3 +1,34 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Sat Nov 17 10:14:14 UTC 2018 - Michael Ströder <michael@stroeder.com>
|
||||||
|
|
||||||
|
- removed patches obsoleted by upstream changes:
|
||||||
|
* shared_link_on_ppc.patch
|
||||||
|
* fix-sasl-header.diff
|
||||||
|
* cyrus-sasl-revert_gssapi_flags.patch
|
||||||
|
* cyrus-sasl-issue-402.patch
|
||||||
|
* cyrus-sasl-2.1.27-openssl-1.1.0.patch
|
||||||
|
- replaced cumlocal/ with m4/ in patches
|
||||||
|
- added fix_libpq-fe_include.diff for fixing including libpq-fe.h
|
||||||
|
- Update to 2.1.27
|
||||||
|
* cache.c:
|
||||||
|
Don’t use cached credentials if timeout has expired
|
||||||
|
Fixed debug logging output
|
||||||
|
* ipc_doors.c:
|
||||||
|
Fixed potential DoS attack (from Oracle)
|
||||||
|
* ipc_unix.c:
|
||||||
|
Prevent premature closing of socket
|
||||||
|
* auth_rimap.c:
|
||||||
|
Added support LOGOUT command
|
||||||
|
Added support for unsolicited CAPABILITY responses in LOGIN reply
|
||||||
|
Properly detect end of responses (don’t needlessly wait)
|
||||||
|
Properly handle backslash in passwords
|
||||||
|
* auth_httpform:
|
||||||
|
Fix off-by-one error in string termination
|
||||||
|
Added support for 204 success response
|
||||||
|
* auth_krb5.c:
|
||||||
|
Added krb5_conv_krb4_instance option
|
||||||
|
Added more verbose error logging
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Tue Feb 13 08:59:21 UTC 2018 - varkoly@suse.com
|
Tue Feb 13 08:59:21 UTC 2018 - varkoly@suse.com
|
||||||
|
|
||||||
|
@ -22,7 +22,7 @@
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
Name: cyrus-sasl-saslauthd
|
Name: cyrus-sasl-saslauthd
|
||||||
Version: 2.1.26
|
Version: 2.1.27
|
||||||
Release: 0
|
Release: 0
|
||||||
Summary: The SASL Authentication Server
|
Summary: The SASL Authentication Server
|
||||||
License: BSD-4-Clause
|
License: BSD-4-Clause
|
||||||
@ -34,12 +34,11 @@ Source1: cyrus-sasl-rc.tar.bz2
|
|||||||
Source2: README.Source
|
Source2: README.Source
|
||||||
Source3: baselibs.conf
|
Source3: baselibs.conf
|
||||||
Source4: saslauthd.service
|
Source4: saslauthd.service
|
||||||
|
|
||||||
Patch: cyrus-sasl.dif
|
Patch: cyrus-sasl.dif
|
||||||
Patch1: shared_link_on_ppc.patch
|
|
||||||
Patch5: cyrus-sasl-no_rpath.patch
|
Patch5: cyrus-sasl-no_rpath.patch
|
||||||
Patch6: cyrus-sasl-lfs.patch
|
Patch6: cyrus-sasl-lfs.patch
|
||||||
Patch7: fix-sasl-header.diff
|
Patch7: fix_libpq-fe_include.diff
|
||||||
Patch10: cyrus-sasl-2.1.27-openssl-1.1.0.patch
|
|
||||||
PreReq: %fillup_prereq
|
PreReq: %fillup_prereq
|
||||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||||
BuildRequires: db-devel
|
BuildRequires: db-devel
|
||||||
@ -77,15 +76,13 @@ The SQL auxprop plugin supports PostgreSQL and MySQL
|
|||||||
%prep
|
%prep
|
||||||
%setup -n cyrus-sasl-%{version} -a 1
|
%setup -n cyrus-sasl-%{version} -a 1
|
||||||
%patch
|
%patch
|
||||||
%patch1
|
|
||||||
%patch5 -p1
|
%patch5 -p1
|
||||||
%patch6
|
%patch6 -p1
|
||||||
%patch7 -p1
|
%patch7 -p1
|
||||||
%patch10 -p1
|
|
||||||
|
|
||||||
%build
|
%build
|
||||||
find . -name "*.cvsignore" -exec rm -fv "{}" "+"
|
find . -name "*.cvsignore" -exec rm -fv "{}" "+"
|
||||||
autoreconf -f -i
|
autoreconf -f
|
||||||
export CFLAGS="-fno-strict-aliasing $RPM_OPT_FLAGS -DLDAP_DEPRECATED"
|
export CFLAGS="-fno-strict-aliasing $RPM_OPT_FLAGS -DLDAP_DEPRECATED"
|
||||||
%configure --with-plugindir=%{_libdir}/sasl2 \
|
%configure --with-plugindir=%{_libdir}/sasl2 \
|
||||||
--with-configdir=/etc/sasl2/:%{_libdir}/sasl2 \
|
--with-configdir=/etc/sasl2/:%{_libdir}/sasl2 \
|
||||||
@ -159,7 +156,7 @@ install -m 644 %{SOURCE4} $RPM_BUILD_ROOT/%{_unitdir}
|
|||||||
/usr/sbin/*
|
/usr/sbin/*
|
||||||
/usr/bin/*
|
/usr/bin/*
|
||||||
%doc %{_mandir}/man8/*.gz
|
%doc %{_mandir}/man8/*.gz
|
||||||
%doc saslauthd/AUTHORS saslauthd/COPYING saslauthd/ChangeLog saslauthd/LDAP_SASLAUTHD saslauthd/NEWS saslauthd/README
|
%doc saslauthd/COPYING saslauthd/ChangeLog saslauthd/LDAP_SASLAUTHD
|
||||||
|
|
||||||
%files -n cyrus-sasl-sqlauxprop
|
%files -n cyrus-sasl-sqlauxprop
|
||||||
%defattr(-,root,root)
|
%defattr(-,root,root)
|
||||||
|
@ -1,3 +1,35 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Sat Nov 17 10:14:14 UTC 2018 - Michael Ströder <michael@stroeder.com>
|
||||||
|
|
||||||
|
- removed patches obsoleted by upstream changes:
|
||||||
|
* shared_link_on_ppc.patch
|
||||||
|
* fix-sasl-header.diff
|
||||||
|
* cyrus-sasl-revert_gssapi_flags.patch
|
||||||
|
* cyrus-sasl-issue-402.patch
|
||||||
|
* cyrus-sasl-2.1.27-openssl-1.1.0.patch
|
||||||
|
- replaced cumlocal/ with m4/ in patches
|
||||||
|
- added fix_libpq-fe_include.diff for fixing including libpq-fe.h
|
||||||
|
- Update to 2.1.27
|
||||||
|
* Added support for OpenSSL 1.1
|
||||||
|
* Added support for lmdb
|
||||||
|
* Lots of build fixes
|
||||||
|
* Treat SCRAM and DIGEST-MD5 as more secure than PLAIN when selecting client mech
|
||||||
|
* DIGEST-MD5 plugin:
|
||||||
|
Fixed memory leaks
|
||||||
|
Fixed a segfault when looking for non-existent reauth cache
|
||||||
|
Prevent client from going from step 3 back to step 2
|
||||||
|
Allow cmusaslsecretDIGEST-MD5 property to be disabled
|
||||||
|
* GSSAPI plugin:
|
||||||
|
Added support for retrieving negotiated SSF
|
||||||
|
Fixed GSS-SPNEGO to use flags negotiated by GSSAPI for SSF
|
||||||
|
Properly compute maxbufsize AFTER security layers have been set
|
||||||
|
* SCRAM plugin:
|
||||||
|
Added support for SCRAM-SHA-256
|
||||||
|
* LOGIN plugin:
|
||||||
|
Don’t prompt client for password until requested by server
|
||||||
|
* NTLM plugin:
|
||||||
|
Fixed crash due to uninitialized HMAC context
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Tue Feb 13 08:59:21 UTC 2018 - varkoly@suse.com
|
Tue Feb 13 08:59:21 UTC 2018 - varkoly@suse.com
|
||||||
|
|
||||||
|
@ -1,7 +1,7 @@
|
|||||||
Index: cmulocal/cyrus.m4
|
Index: m4/cyrus.m4
|
||||||
===================================================================
|
===================================================================
|
||||||
--- cmulocal/cyrus.m4.orig
|
--- m4/cyrus.m4.orig
|
||||||
+++ cmulocal/cyrus.m4
|
+++ m4/cyrus.m4
|
||||||
@@ -37,7 +37,7 @@ AC_DEFUN([CMU_GUESS_RUNPATH_SWITCH], [
|
@@ -37,7 +37,7 @@ AC_DEFUN([CMU_GUESS_RUNPATH_SWITCH], [
|
||||||
SAVE_LDFLAGS="${LDFLAGS}"
|
SAVE_LDFLAGS="${LDFLAGS}"
|
||||||
LDFLAGS="-R /usr/lib"
|
LDFLAGS="-R /usr/lib"
|
||||||
@ -25,20 +25,13 @@ Index: Makefile.am
|
|||||||
else
|
else
|
||||||
Index: sasldb/Makefile.am
|
Index: sasldb/Makefile.am
|
||||||
===================================================================
|
===================================================================
|
||||||
--- sasldb/Makefile.am.orig
|
--- sasldb/Makefile.am 2016-01-29 18:35:35.000000000 +0100
|
||||||
+++ sasldb/Makefile.am
|
+++ sasldb/Makefile.am 2018-11-17 12:51:05.800696917 +0100
|
||||||
@@ -48,6 +48,7 @@ INCLUDES=-I$(top_srcdir)/include -I$(top
|
@@ -57,3 +57,9 @@
|
||||||
|
libsasldb_la_DEPENDENCIES = $(SASL_DB_BACKEND)
|
||||||
extra_common_sources = db_none.c db_ndbm.c db_gdbm.c db_berkeley.c
|
libsasldb_la_LIBADD = $(SASL_DB_BACKEND)
|
||||||
|
libsasldb_la_LDFLAGS = -no-undefined
|
||||||
+AM_CFLAGS = "-fPIC"
|
+
|
||||||
EXTRA_DIST = NTMakefile
|
|
||||||
|
|
||||||
noinst_LTLIBRARIES = libsasldb.la
|
|
||||||
@@ -66,3 +67,8 @@ libsasldb.a: libsasldb.la $(SASL_DB_BACK
|
|
||||||
$(AR) cru .libs/$@ $(SASL_DB_BACKEND_STATIC)
|
|
||||||
|
|
||||||
|
|
||||||
+# avoid these two files created at the same time, they use both the same
|
+# avoid these two files created at the same time, they use both the same
|
||||||
+# dep file
|
+# dep file
|
||||||
+db_berkeley.lo: db_berkeley.o
|
+db_berkeley.lo: db_berkeley.o
|
||||||
|
@ -18,7 +18,7 @@
|
|||||||
|
|
||||||
Name: cyrus-sasl
|
Name: cyrus-sasl
|
||||||
%define lname libsasl2-3
|
%define lname libsasl2-3
|
||||||
Version: 2.1.26
|
Version: 2.1.27
|
||||||
Release: 0
|
Release: 0
|
||||||
Url: http://asg.web.cmu.edu/sasl/
|
Url: http://asg.web.cmu.edu/sasl/
|
||||||
Summary: Implementation of Cyrus SASL API
|
Summary: Implementation of Cyrus SASL API
|
||||||
@ -30,14 +30,9 @@ Source1: cyrus-sasl-rc.tar.bz2
|
|||||||
Source2: README.Source
|
Source2: README.Source
|
||||||
Source3: baselibs.conf
|
Source3: baselibs.conf
|
||||||
Patch: cyrus-sasl.dif
|
Patch: cyrus-sasl.dif
|
||||||
Patch1: shared_link_on_ppc.patch
|
|
||||||
Patch5: cyrus-sasl-no_rpath.patch
|
Patch5: cyrus-sasl-no_rpath.patch
|
||||||
Patch6: cyrus-sasl-lfs.patch
|
Patch6: cyrus-sasl-lfs.patch
|
||||||
Patch7: fix-sasl-header.diff
|
Patch7: fix_libpq-fe_include.diff
|
||||||
Patch8: cyrus-sasl-revert_gssapi_flags.patch
|
|
||||||
# see https://github.com/cyrusimap/cyrus-sasl/issues/402
|
|
||||||
Patch9: cyrus-sasl-issue-402.patch
|
|
||||||
Patch10: cyrus-sasl-2.1.27-openssl-1.1.0.patch
|
|
||||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||||
BuildRequires: db-devel
|
BuildRequires: db-devel
|
||||||
BuildRequires: krb5-mini-devel
|
BuildRequires: krb5-mini-devel
|
||||||
@ -169,17 +164,13 @@ then
|
|||||||
rm -rf %{_builddir}/%{name}-%{version}/dlcompat-*
|
rm -rf %{_builddir}/%{name}-%{version}/dlcompat-*
|
||||||
fi
|
fi
|
||||||
%patch
|
%patch
|
||||||
%patch1
|
|
||||||
%patch5 -p1
|
%patch5 -p1
|
||||||
%patch6
|
%patch6 -p1
|
||||||
%patch7 -p1
|
%patch7 -p1
|
||||||
%patch8 -p1
|
|
||||||
%patch9 -p1
|
|
||||||
%patch10 -p1
|
|
||||||
|
|
||||||
%build
|
%build
|
||||||
find . -name "*.cvsignore" -exec rm -fv "{}" "+"
|
find . -name "*.cvsignore" -exec rm -fv "{}" "+"
|
||||||
autoreconf -f -i
|
autoreconf -f
|
||||||
export CFLAGS="%optflags -fno-strict-aliasing"
|
export CFLAGS="%optflags -fno-strict-aliasing"
|
||||||
%configure --with-pic \
|
%configure --with-pic \
|
||||||
--with-plugindir=%{_libdir}/sasl2 \
|
--with-plugindir=%{_libdir}/sasl2 \
|
||||||
@ -271,7 +262,7 @@ find "%buildroot" -type f -name "*.la" -print -delete
|
|||||||
|
|
||||||
%files devel
|
%files devel
|
||||||
%defattr(-,root,root)
|
%defattr(-,root,root)
|
||||||
%doc AUTHORS COPYING ChangeLog NEWS README doc
|
%doc AUTHORS COPYING ChangeLog README doc
|
||||||
%_includedir/sasl/
|
%_includedir/sasl/
|
||||||
%doc %{_mandir}/man3/sasl_*.gz
|
%doc %{_mandir}/man3/sasl_*.gz
|
||||||
%{_libdir}/libsasl2.so
|
%{_libdir}/libsasl2.so
|
||||||
|
@ -1,12 +0,0 @@
|
|||||||
--- cyrus-sasl-2.1.26/include/sasl.h 2012-10-12 09:05:48.000000000 -0500
|
|
||||||
+++ cyrus-sasl-2.1.26/include/sasl.h 2013-01-31 13:21:04.007739327 -0600
|
|
||||||
@@ -223,6 +223,8 @@ extern "C" {
|
|
||||||
* they must be called before all other SASL functions:
|
|
||||||
*/
|
|
||||||
|
|
||||||
+#include <sys/types.h>
|
|
||||||
+
|
|
||||||
/* memory allocation functions which may optionally be replaced:
|
|
||||||
*/
|
|
||||||
typedef void *sasl_malloc_t(size_t);
|
|
||||||
|
|
11
fix_libpq-fe_include.diff
Normal file
11
fix_libpq-fe_include.diff
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
--- cyrus-sasl-2.1.27.orig/plugins/sql.c 2016-12-10 16:45:55.000000000 +0100
|
||||||
|
+++ cyrus-sasl-2.1.27/plugins/sql.c 2018-11-17 14:04:33.821540573 +0100
|
||||||
|
@@ -188,7 +188,7 @@
|
||||||
|
#endif /* HAVE_MYSQL */
|
||||||
|
|
||||||
|
#ifdef HAVE_PGSQL
|
||||||
|
-#include <libpq-fe.h>
|
||||||
|
+#include <pgsql/libpq-fe.h>
|
||||||
|
|
||||||
|
static void *_pgsql_open(char *host, char *port, int usessl,
|
||||||
|
const char *user, const char *password,
|
@ -1,10 +0,0 @@
|
|||||||
--- config/ltconfig.orig 2003-01-23 09:20:31.000000000 +0100
|
|
||||||
+++ config/ltconfig 2003-01-23 09:20:49.000000000 +0100
|
|
||||||
@@ -2029,7 +2029,6 @@
|
|
||||||
else
|
|
||||||
# Only the GNU ld.so supports shared libraries on MkLinux.
|
|
||||||
case "$host_cpu" in
|
|
||||||
- powerpc*) dynamic_linker=no ;;
|
|
||||||
*) dynamic_linker='Linux ld.so' ;;
|
|
||||||
esac
|
|
||||||
fi
|
|
Loading…
Reference in New Issue
Block a user