From b9ca4cd2ca51a1d621fc308fd0959c94f381eda07523510c586dc39d3f07036d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ismail=20D=C3=B6nmez?= Date: Mon, 11 Jan 2016 12:39:08 +0000 Subject: [PATCH] - Add two patches from Fedora, fixing two crashes: * krb5-fix_interposer.patch * krb5-mechglue_inqure_attrs.patch - Add two patches from Fedora, fixing two crashes: * krb5-fix_interposer.patch * krb5-mechglue_inqure_attrs.patch OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=156 --- krb5-fix_interposer.patch | 222 +++++++++++++++++++++++++++++++ krb5-mechglue_inqure_attrs.patch | 56 ++++++++ krb5-mini.changes | 7 + krb5-mini.spec | 6 +- krb5.changes | 7 + krb5.spec | 6 +- 6 files changed, 302 insertions(+), 2 deletions(-) create mode 100644 krb5-fix_interposer.patch create mode 100644 krb5-mechglue_inqure_attrs.patch diff --git a/krb5-fix_interposer.patch b/krb5-fix_interposer.patch new file mode 100644 index 0000000..5c01616 --- /dev/null +++ b/krb5-fix_interposer.patch @@ -0,0 +1,222 @@ +From b3901af6970fb7bde88eb16d51c8d05db6f37746 Mon Sep 17 00:00:00 2001 +From: Simo Sorce +Date: Fri, 13 Nov 2015 14:54:11 -0500 +Subject: [PATCH] Fix impersonate_name to work with interposers + +This follows the same modifications applied to +gss_acquire_cred_with_password() when interposer plugins were +introduced. + +[ghudson@mit.edu: minor whitespace changes; initialize out_mcred in +spnego_gss_acquire_cred_impersonate_name() since it is released in the +cleanup handler] + +ticket: 8280 (new) +--- + src/lib/gssapi/mechglue/g_acquire_cred_imp_name.c | 58 +++++++++++++++-------- + src/lib/gssapi/spnego/spnego_mech.c | 35 +++++++------- + 2 files changed, 54 insertions(+), 39 deletions(-) + +diff --git a/src/lib/gssapi/mechglue/g_acquire_cred_imp_name.c b/src/lib/gssapi/mechglue/g_acquire_cred_imp_name.c +index 0dd4f87..9eab25e 100644 +--- a/src/lib/gssapi/mechglue/g_acquire_cred_imp_name.c ++++ b/src/lib/gssapi/mechglue/g_acquire_cred_imp_name.c +@@ -334,6 +334,8 @@ gss_add_cred_impersonate_name(OM_uint32 *minor_status, + gss_cred_id_t cred = NULL; + gss_OID new_mechs_array = NULL; + gss_cred_id_t * new_cred_array = NULL; ++ gss_OID_set target_mechs = GSS_C_NO_OID_SET; ++ gss_OID selected_mech = GSS_C_NO_OID; + + status = val_add_cred_impersonate_name_args(minor_status, + input_cred_handle, +@@ -350,7 +352,12 @@ gss_add_cred_impersonate_name(OM_uint32 *minor_status, + if (status != GSS_S_COMPLETE) + return (status); + +- mech = gssint_get_mechanism(desired_mech); ++ status = gssint_select_mech_type(minor_status, desired_mech, ++ &selected_mech); ++ if (status != GSS_S_COMPLETE) ++ return status; ++ ++ mech = gssint_get_mechanism(selected_mech); + if (!mech) + return GSS_S_BAD_MECH; + else if (!mech->gss_acquire_cred) +@@ -367,27 +374,26 @@ gss_add_cred_impersonate_name(OM_uint32 *minor_status, + internal_name = GSS_C_NO_NAME; + } else { + union_cred = (gss_union_cred_t)input_cred_handle; +- if (gssint_get_mechanism_cred(union_cred, desired_mech) != ++ if (gssint_get_mechanism_cred(union_cred, selected_mech) != + GSS_C_NO_CREDENTIAL) + return (GSS_S_DUPLICATE_ELEMENT); + } + + mech_impersonator_cred = + gssint_get_mechanism_cred((gss_union_cred_t)impersonator_cred_handle, +- desired_mech); ++ selected_mech); + if (mech_impersonator_cred == GSS_C_NO_CREDENTIAL) + return (GSS_S_NO_CRED); + + /* may need to create a mechanism specific name */ + union_name = (gss_union_name_t)desired_name; + if (union_name->mech_type && +- g_OID_equal(union_name->mech_type, +- &mech->mech_type)) ++ g_OID_equal(union_name->mech_type, selected_mech)) + internal_name = union_name->mech_name; + else { + if (gssint_import_internal_name(minor_status, +- &mech->mech_type, union_name, +- &allocated_name) != GSS_S_COMPLETE) ++ selected_mech, union_name, ++ &allocated_name) != GSS_S_COMPLETE) + return (GSS_S_BAD_NAME); + internal_name = allocated_name; + } +@@ -402,11 +408,21 @@ gss_add_cred_impersonate_name(OM_uint32 *minor_status, + else + time_req = 0; + ++ status = gss_create_empty_oid_set(minor_status, &target_mechs); ++ if (status != GSS_S_COMPLETE) ++ goto errout; ++ ++ status = gss_add_oid_set_member(minor_status, ++ gssint_get_public_oid(selected_mech), ++ &target_mechs); ++ if (status != GSS_S_COMPLETE) ++ goto errout; ++ + status = mech->gss_acquire_cred_impersonate_name(minor_status, + mech_impersonator_cred, + internal_name, + time_req, +- GSS_C_NULL_OID_SET, ++ target_mechs, + cred_usage, + &cred, + NULL, +@@ -445,19 +461,15 @@ gss_add_cred_impersonate_name(OM_uint32 *minor_status, + + new_cred_array[union_cred->count] = cred; + if ((new_mechs_array[union_cred->count].elements = +- malloc(mech->mech_type.length)) == NULL) ++ malloc(selected_mech->length)) == NULL) + goto errout; + +- g_OID_copy(&new_mechs_array[union_cred->count], +- &mech->mech_type); ++ g_OID_copy(&new_mechs_array[union_cred->count], selected_mech); + + if (actual_mechs != NULL) { +- gss_OID_set_desc oids; +- +- oids.count = union_cred->count + 1; +- oids.elements = new_mechs_array; +- +- status = generic_gss_copy_oid_set(minor_status, &oids, actual_mechs); ++ status = gssint_make_public_oid_set(minor_status, new_mechs_array, ++ union_cred->count + 1, ++ actual_mechs); + if (GSS_ERROR(status)) { + free(new_mechs_array[union_cred->count].elements); + goto errout; +@@ -486,10 +498,12 @@ gss_add_cred_impersonate_name(OM_uint32 *minor_status, + /* We're done with the internal name. Free it if we allocated it. */ + + if (allocated_name) +- (void) gssint_release_internal_name(&temp_minor_status, +- &mech->mech_type, ++ (void) gssint_release_internal_name(&temp_minor_status, selected_mech, + &allocated_name); + ++ if (target_mechs) ++ (void) gss_release_oid_set(&temp_minor_status, &target_mechs); ++ + return (GSS_S_COMPLETE); + + errout: +@@ -503,8 +517,10 @@ errout: + + if (allocated_name) + (void) gssint_release_internal_name(&temp_minor_status, +- &mech->mech_type, +- &allocated_name); ++ selected_mech, &allocated_name); ++ ++ if (target_mechs) ++ (void) gss_release_oid_set(&temp_minor_status, &target_mechs); + + if (input_cred_handle == GSS_C_NO_CREDENTIAL && union_cred) + free(union_cred); +diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c +index e6703eb..28fb9b1 100644 +--- a/src/lib/gssapi/spnego/spnego_mech.c ++++ b/src/lib/gssapi/spnego/spnego_mech.c +@@ -2619,10 +2619,10 @@ spnego_gss_acquire_cred_impersonate_name(OM_uint32 *minor_status, + gss_OID_set *actual_mechs, + OM_uint32 *time_rec) + { +- OM_uint32 status; ++ OM_uint32 status, tmpmin; + gss_OID_set amechs = GSS_C_NULL_OID_SET; + spnego_gss_cred_id_t imp_spcred = NULL, out_spcred = NULL; +- gss_cred_id_t imp_mcred, out_mcred; ++ gss_cred_id_t imp_mcred, out_mcred = GSS_C_NO_CREDENTIAL; + + dsyslog("Entering spnego_gss_acquire_cred_impersonate_name\n"); + +@@ -2634,31 +2634,30 @@ spnego_gss_acquire_cred_impersonate_name(OM_uint32 *minor_status, + + imp_spcred = (spnego_gss_cred_id_t)impersonator_cred_handle; + imp_mcred = imp_spcred ? imp_spcred->mcred : GSS_C_NO_CREDENTIAL; +- if (desired_mechs == GSS_C_NO_OID_SET) { +- status = gss_inquire_cred(minor_status, imp_mcred, NULL, NULL, +- NULL, &amechs); +- if (status != GSS_S_COMPLETE) +- return status; +- +- desired_mechs = amechs; +- } ++ status = gss_inquire_cred(minor_status, imp_mcred, NULL, NULL, ++ NULL, &amechs); ++ if (status != GSS_S_COMPLETE) ++ return status; + + status = gss_acquire_cred_impersonate_name(minor_status, imp_mcred, + desired_name, time_req, +- desired_mechs, cred_usage, ++ amechs, cred_usage, + &out_mcred, actual_mechs, + time_rec); +- +- if (amechs != GSS_C_NULL_OID_SET) +- (void) gss_release_oid_set(minor_status, &amechs); ++ if (status != GSS_S_COMPLETE) ++ goto cleanup; + + status = create_spnego_cred(minor_status, out_mcred, &out_spcred); +- if (status != GSS_S_COMPLETE) { +- gss_release_cred(minor_status, &out_mcred); +- return (status); +- } ++ if (status != GSS_S_COMPLETE) ++ goto cleanup; ++ ++ out_mcred = GSS_C_NO_CREDENTIAL; + *output_cred_handle = (gss_cred_id_t)out_spcred; + ++cleanup: ++ (void) gss_release_oid_set(&tmpmin, &amechs); ++ (void) gss_release_cred(&tmpmin, &out_mcred); ++ + dsyslog("Leaving spnego_gss_acquire_cred_impersonate_name\n"); + return (status); + } +-- +2.6.2 + diff --git a/krb5-mechglue_inqure_attrs.patch b/krb5-mechglue_inqure_attrs.patch new file mode 100644 index 0000000..be994da --- /dev/null +++ b/krb5-mechglue_inqure_attrs.patch @@ -0,0 +1,56 @@ +From 26f94f6e8fd99ee0dfc2f71afb38c74a12482601 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Wed, 16 Dec 2015 19:31:22 -0500 +Subject: [PATCH] Fix mechglue on gss_inquire_attrs_for_mech() + +This includes proper mechanism selection in gss_inquire_attrs_for_mech() +itself as well as passing the correct mech down from gss_accept_sec_context() +through allow_mech_by_default(). + +Also-authored-by: Simo Sorce +--- + src/lib/gssapi/mechglue/g_accept_sec_context.c | 2 +- + src/lib/gssapi/mechglue/g_mechattr.c | 7 ++++++- + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/src/lib/gssapi/mechglue/g_accept_sec_context.c b/src/lib/gssapi/mechglue/g_accept_sec_context.c +index 6c72d1f..4a86024 100644 +--- a/src/lib/gssapi/mechglue/g_accept_sec_context.c ++++ b/src/lib/gssapi/mechglue/g_accept_sec_context.c +@@ -245,7 +245,7 @@ gss_cred_id_t * d_cred; + status = GSS_S_NO_CRED; + goto error_out; + } +- } else if (!allow_mech_by_default(selected_mech)) { ++ } else if (!allow_mech_by_default(gssint_get_public_oid(selected_mech))) { + status = GSS_S_NO_CRED; + goto error_out; + } +diff --git a/src/lib/gssapi/mechglue/g_mechattr.c b/src/lib/gssapi/mechglue/g_mechattr.c +index e9299f4..4bd44b5 100644 +--- a/src/lib/gssapi/mechglue/g_mechattr.c ++++ b/src/lib/gssapi/mechglue/g_mechattr.c +@@ -161,6 +161,7 @@ gss_inquire_attrs_for_mech( + { + OM_uint32 status, tmpMinor; + gss_mechanism mech; ++ gss_OID selected_mech; + + if (minor == NULL) + return GSS_S_CALL_INACCESSIBLE_WRITE; +@@ -173,7 +174,11 @@ gss_inquire_attrs_for_mech( + if (known_mech_attrs != NULL) + *known_mech_attrs = GSS_C_NO_OID_SET; + +- mech = gssint_get_mechanism((gss_OID)mech_oid); ++ status = gssint_select_mech_type(minor, mech_oid, &selected_mech); ++ if (status != GSS_S_COMPLETE) ++ return (status); ++ ++ mech = gssint_get_mechanism(selected_mech); + if (mech != NULL && mech->gss_inquire_attrs_for_mech != NULL) { + status = mech->gss_inquire_attrs_for_mech(minor, + mech_oid, +-- +2.6.4 + diff --git a/krb5-mini.changes b/krb5-mini.changes index e6af839..56f5148 100644 --- a/krb5-mini.changes +++ b/krb5-mini.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Mon Jan 11 12:33:54 UTC 2016 - idonmez@suse.com + +- Add two patches from Fedora, fixing two crashes: + * krb5-fix_interposer.patch + * krb5-mechglue_inqure_attrs.patch + ------------------------------------------------------------------- Tue Dec 8 20:40:26 UTC 2015 - michael@stroeder.com diff --git a/krb5-mini.spec b/krb5-mini.spec index 68e54c4..da1083a 100644 --- a/krb5-mini.spec +++ b/krb5-mini.spec @@ -83,7 +83,9 @@ Patch11: krb5-1.12-ksu-path.patch Patch12: krb5-1.12-selinux-label.patch Patch13: krb5-1.9-debuginfo.patch # see http://krbdev.mit.edu/rt/Ticket/Display.html?id=8301 -Patch15: krbdev.mit.edu-8301.patch +Patch14: krbdev.mit.edu-8301.patch +Patch15: krb5-fix_interposer.patch +Patch16: krb5-mechglue_inqure_attrs.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build PreReq: mktemp, grep, /bin/touch, coreutils PreReq: %fillup_prereq @@ -201,7 +203,9 @@ Include Files for Development %patch11 -p1 %patch12 -p1 %patch13 -p0 +%patch14 -p1 %patch15 -p1 +%patch16 -p1 %build # needs to be re-generated diff --git a/krb5.changes b/krb5.changes index e6af839..56f5148 100644 --- a/krb5.changes +++ b/krb5.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Mon Jan 11 12:33:54 UTC 2016 - idonmez@suse.com + +- Add two patches from Fedora, fixing two crashes: + * krb5-fix_interposer.patch + * krb5-mechglue_inqure_attrs.patch + ------------------------------------------------------------------- Tue Dec 8 20:40:26 UTC 2015 - michael@stroeder.com diff --git a/krb5.spec b/krb5.spec index e4f234d..f5326dc 100644 --- a/krb5.spec +++ b/krb5.spec @@ -83,7 +83,9 @@ Patch11: krb5-1.12-ksu-path.patch Patch12: krb5-1.12-selinux-label.patch Patch13: krb5-1.9-debuginfo.patch # see http://krbdev.mit.edu/rt/Ticket/Display.html?id=8301 -Patch15: krbdev.mit.edu-8301.patch +Patch14: krbdev.mit.edu-8301.patch +Patch15: krb5-fix_interposer.patch +Patch16: krb5-mechglue_inqure_attrs.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build PreReq: mktemp, grep, /bin/touch, coreutils PreReq: %fillup_prereq @@ -201,7 +203,9 @@ Include Files for Development %patch11 -p1 %patch12 -p1 %patch13 -p0 +%patch14 -p1 %patch15 -p1 +%patch16 -p1 %build # needs to be re-generated