summaryrefslogtreecommitdiff
path: root/app-crypt/mit-krb5
diff options
context:
space:
mode:
Diffstat (limited to 'app-crypt/mit-krb5')
-rw-r--r--app-crypt/mit-krb5/Manifest5
-rw-r--r--app-crypt/mit-krb5/files/CVE-2020-28196.patch71
-rw-r--r--app-crypt/mit-krb5/mit-krb5-1.18.2-r2.ebuild (renamed from app-crypt/mit-krb5/mit-krb5-1.18.2-r1.ebuild)3
-rw-r--r--app-crypt/mit-krb5/mit-krb5-1.18.3.ebuild167
4 files changed, 244 insertions, 2 deletions
diff --git a/app-crypt/mit-krb5/Manifest b/app-crypt/mit-krb5/Manifest
index 7e8e05e5e2f5..bb31c3c611ee 100644
--- a/app-crypt/mit-krb5/Manifest
+++ b/app-crypt/mit-krb5/Manifest
@@ -1,3 +1,4 @@
+AUX CVE-2020-28196.patch 3128 BLAKE2B 52674cb21a589b1f72b2ba110657952cd2946d08df58417eb86f75663e5ded48a49bb4e6bed87598b74209ae03ff3dca2f80fe9305f7e44070806f02c8ecafcc SHA512 98fa20ad32610dfa9fd6b9e1657e8c6d7e8905d266ef8953e4d6fdb344f0005ee356a9cca7d5aaa1c5333073b7e464c26201302138e0bf8f1f696c818024ba9d
AUX kpropd.xinetd 194 BLAKE2B cfc40af2e75b0ce5a71e0dfdcfe076d13d996b25d2cb50d4282bc88d7b33b317a202d57df0bb4a2b47113f0d38cb508614e122e4a3bb7dfd2397e2daa3178396 SHA512 c9bbd13f2fadfd2a925bfae834ba61f227cd4386b4c4466b5227d93c792f4549778ef4d6e08353372df99804459277c71f61b41ec71f3afcc600d73c5705f72f
AUX mit-krb5-1.12_warn_cflags.patch 448 BLAKE2B cd9793866173b394bab3497d19653ca3296924cc49aaf540499b149254265af1d995b4d7493b76185ce35d123e70827cb5fcb221efc6499b86a346cfad7478ab SHA512 42364d9cd8c0a6fd28ae661eeac4d0dd3f2001fe290bf9731ee99c2c786a6488805fc93057d59e201e2cef1e5280af4c170187aa5603f4cf542906abc0fccc2b
AUX mit-krb5-1.16.3-libressl-r1.patch 3815 BLAKE2B b3ad56fee5fd5ace5e5ef0b1002c2f69c14383ca156182c65f4b1d2a5b8010d30677aabab271726c0fa9cbccf4734a3dda54cc492c9b1e5e1bdc7e8757292a73 SHA512 1298cadf15e5f1512af66c6584cff99b1d8f7c9764cb91e1e606fd331da1747b5fd7080c928a373369ab3817acadfa214121fee694a0ac515c0f4d6a623fb834
@@ -16,5 +17,7 @@ AUX mit-krb5kpropd.service 128 BLAKE2B 31d002c16987bd6fc42e22e64dd9bd1f9db36655d
AUX mit-krb5kpropd.socket 122 BLAKE2B 2ce51e67b909c6955d9796f80f7985c9209af398ad2a60beebe83bd766d42261bd44c712df14608a1e5e922715780a6c4aa8ad294c34ba4e8fc336a24d038fd3 SHA512 4e7ae175425e0787a1d5ff959471a88bf5af4cd6e213dc6d4048902fab7547c1186a082370b523f9549f5096acfab1fb03b4839e42bd80dc539130ae4bb3ea55
AUX mit-krb5kpropd_at.service 162 BLAKE2B ccd1dea2419656a95ea1e5068457ea45a765a831f36e7abe3e27cdd9b42f2b703cd6ddad1ac60d75feff4d74bf31dbf146ee2cbfdd34ac38c11908d44162e77a SHA512 4b7121da07b11fa65db4edc185c57197ebb25ed5c49797e36bc31b8b7bbb22a6f512f4a986c8430dfc31b1b8fcfba66dcfe154cd6eeb8b4bb445d5006fff3802
DIST krb5-1.18.2.tar.gz 8713927 BLAKE2B f0eb34e67adcb86f347c59ec6ef74970a57530cc56336a84909f852cd6135079ea89828e77c906a272f54e0faf6a4a0497f2b648446eb9d048d1c51e4ec513af SHA512 7cbb1b28e677fea3e0794e93951f3caaa2c49bb1175dd187951e72a466cc69d96c3b833d838000fe911c1a437d96a558e550f27c53a8b332fb9dfc7cbb7ec44c
-EBUILD mit-krb5-1.18.2-r1.ebuild 4369 BLAKE2B 6b367c9fb266c2c6b4b217ea8cb812f9ede386e22ca24d6df5425242d2acefec0e927acb512657044c61632ff7e121917460e1cb9038567df2732ca73be99552 SHA512 89107dcadce9925627443b99cfde007c66ae5d3f1117864d2dcce65d4dd68f96711349d6ca76f91add8fe92c95a6e37e57e3b248ce0b153e62faf9e74045f2cd
+DIST krb5-1.18.3.tar.gz 8715312 BLAKE2B 4f6ad4a529e7578e83d82b43c2cada33bce1dca5081ec826ee06a713f82520b783f72ec56d2ce289e10d1ddcfaa079491e43f21c035b214d244bb80e6b2a1c9f SHA512 cf0bf6cf8f622fa085954e6da998d952cf64dc7ccc319972ed81ea0542089cabf2d0e8243df84da01ad6f40584768ca2f02d108630c6741fa7b3d7d98c887c01
+EBUILD mit-krb5-1.18.2-r2.ebuild 4407 BLAKE2B 11eb4671f85a6685e8017c49d3a55cb315e26a55430c900c9191249468a15ede542deaddaa30c395f62f97747bb6307944bda497792a03b7358f3ffb9d34304c SHA512 3daa206ed5a5c8b79366282bc809ff7eea00097038977788a1d3dd36f90372481bd1cb489846a0830165066308dad4391d6a2edddeb87ed2936e8dbaa6cf48e6
+EBUILD mit-krb5-1.18.3.ebuild 4379 BLAKE2B e0cd5aefed3c0be6cfe3169a529451ef57205d767d56c8f5733ab74ef651c68bc33d837f9f81f4eada854502ea0e3b735f8d5c80bc09bb35fb72faeafe7744d4 SHA512 e800dc2d76190c7705c121e4ad87487c943272281b74e3c3888406a6c8dbf9f5fb7acfb3044f2bbdb43190a436b371072c64ace80d31f5c8738019762c6f1bbe
MISC metadata.xml 823 BLAKE2B b1e312e7d7d1dde62a6260572d68c5c9df90a00c9ca7d43939df0ce7c6e528ac8dfcf839827938f783c241c19255660e1e7806210aaf407a6e86cbaeef24295a SHA512 844715444284f5c7f1a73ed15c0ebe0b5dd8c96c3aa7e6450f465e2a2086509c04d637f139ede5e427972d4b1bb298255388f50978b41de875b47ee40251451e
diff --git a/app-crypt/mit-krb5/files/CVE-2020-28196.patch b/app-crypt/mit-krb5/files/CVE-2020-28196.patch
new file mode 100644
index 000000000000..486078437e89
--- /dev/null
+++ b/app-crypt/mit-krb5/files/CVE-2020-28196.patch
@@ -0,0 +1,71 @@
+diff --git a/src/lib/krb5/asn.1/asn1_encode.c b/src/lib/krb5/asn.1/asn1_encode.c
+index a160cf4fe8..cd6b879f77 100644
+--- a/lib/krb5/asn.1/asn1_encode.c
++++ b/lib/krb5/asn.1/asn1_encode.c
+@@ -356,7 +356,7 @@ make_tag(asn1buf *buf, const taginfo *t, size_t len)
+ static krb5_error_code
+ get_tag(const uint8_t *asn1, size_t len, taginfo *tag_out,
+ const uint8_t **contents_out, size_t *clen_out,
+- const uint8_t **remainder_out, size_t *rlen_out)
++ const uint8_t **remainder_out, size_t *rlen_out, int recursion)
+ {
+ krb5_error_code ret;
+ uint8_t o;
+@@ -394,9 +394,11 @@ get_tag(const uint8_t *asn1, size_t len, taginfo *tag_out,
+ /* Indefinite form (should not be present in DER, but we accept it). */
+ if (tag_out->construction != CONSTRUCTED)
+ return ASN1_MISMATCH_INDEF;
++ if (recursion >= 32)
++ return ASN1_OVERFLOW;
+ p = asn1;
+ while (!(len >= 2 && p[0] == 0 && p[1] == 0)) {
+- ret = get_tag(p, len, &t, &c, &clen, &p, &len);
++ ret = get_tag(p, len, &t, &c, &clen, &p, &len, recursion + 1);
+ if (ret)
+ return ret;
+ }
+@@ -613,7 +615,7 @@ split_der(asn1buf *buf, uint8_t *const *der, size_t len, taginfo *tag_out)
+ const uint8_t *contents, *remainder;
+ size_t clen, rlen;
+
+- ret = get_tag(*der, len, tag_out, &contents, &clen, &remainder, &rlen);
++ ret = get_tag(*der, len, tag_out, &contents, &clen, &remainder, &rlen, 0);
+ if (ret)
+ return ret;
+ if (rlen != 0)
+@@ -1199,7 +1201,7 @@ decode_atype(const taginfo *t, const uint8_t *asn1, size_t len,
+ const uint8_t *rem;
+ size_t rlen;
+ if (!tag->implicit) {
+- ret = get_tag(asn1, len, &inner_tag, &asn1, &len, &rem, &rlen);
++ ret = get_tag(asn1, len, &inner_tag, &asn1, &len, &rem, &rlen, 0);
+ if (ret)
+ return ret;
+ /* Note: we don't check rlen (it should be 0). */
+@@ -1420,7 +1422,7 @@ decode_sequence(const uint8_t *asn1, size_t len, const struct seq_info *seq,
+ for (i = 0; i < seq->n_fields; i++) {
+ if (len == 0)
+ break;
+- ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len);
++ ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len, 0);
+ if (ret)
+ goto error;
+ /*
+@@ -1478,7 +1480,7 @@ decode_sequence_of(const uint8_t *asn1, size_t len,
+ *seq_out = NULL;
+ *count_out = 0;
+ while (len > 0) {
+- ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len);
++ ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len, 0);
+ if (ret)
+ goto error;
+ if (!check_atype_tag(elemtype, &t)) {
+@@ -1584,7 +1586,7 @@ k5_asn1_full_decode(const krb5_data *code, const struct atype_info *a,
+
+ *retrep = NULL;
+ ret = get_tag((uint8_t *)code->data, code->length, &t, &contents,
+- &clen, &remainder, &rlen);
++ &clen, &remainder, &rlen, 0);
+ if (ret)
+ return ret;
+ /* rlen should be 0, but we don't check it (and due to padding in
diff --git a/app-crypt/mit-krb5/mit-krb5-1.18.2-r1.ebuild b/app-crypt/mit-krb5/mit-krb5-1.18.2-r2.ebuild
index 626da606a476..1edf1c1527f4 100644
--- a/app-crypt/mit-krb5/mit-krb5-1.18.2-r1.ebuild
+++ b/app-crypt/mit-krb5/mit-krb5-1.18.2-r2.ebuild
@@ -3,7 +3,7 @@
EAPI=7
-PYTHON_COMPAT=( python3_{7,8} )
+PYTHON_COMPAT=( python3_{7,8,9} )
inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd toolchain-funcs
MY_P="${P/mit-}"
@@ -63,6 +63,7 @@ PATCHES=(
"${FILESDIR}/${PN}-1.16.3-libressl-r1.patch"
"${FILESDIR}/${PN}_dont_create_run.patch"
"${FILESDIR}/${PN}-1.18-libressl.patch"
+ "${FILESDIR}/CVE-2020-28196.patch"
)
MULTILIB_CHOST_TOOLS=(
diff --git a/app-crypt/mit-krb5/mit-krb5-1.18.3.ebuild b/app-crypt/mit-krb5/mit-krb5-1.18.3.ebuild
new file mode 100644
index 000000000000..61ce1944b46e
--- /dev/null
+++ b/app-crypt/mit-krb5/mit-krb5-1.18.3.ebuild
@@ -0,0 +1,167 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( python3_{7,8,9} )
+inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd toolchain-funcs
+
+MY_P="${P/mit-}"
+P_DIR=$(ver_cut 1-2)
+DESCRIPTION="MIT Kerberos V"
+HOMEPAGE="https://web.mit.edu/kerberos/www/"
+SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
+
+LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+IUSE="cpu_flags_x86_aes doc +keyutils libressl lmdb nls openldap +pkinit selinux +threads test xinetd"
+
+# Test suite requires network access
+RESTRICT="test"
+
+DEPEND="
+ !!app-crypt/heimdal
+ >=sys-libs/e2fsprogs-libs-1.42.9[${MULTILIB_USEDEP}]
+ || (
+ >=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
+ >=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
+ >=dev-libs/libverto-0.2.5[tevent,${MULTILIB_USEDEP}]
+ )
+ keyutils? ( >=sys-apps/keyutils-1.5.8:=[${MULTILIB_USEDEP}] )
+ lmdb? ( dev-db/lmdb )
+ nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
+ openldap? ( >=net-nds/openldap-2.4.38-r1[${MULTILIB_USEDEP}] )
+ pkinit? (
+ !libressl? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
+ libressl? ( dev-libs/libressl:0=[${MULTILIB_USEDEP}] )
+ )
+ xinetd? ( sys-apps/xinetd )
+ "
+BDEPEND="
+ ${PYTHON_DEPS}
+ virtual/yacc
+ cpu_flags_x86_aes? (
+ amd64? ( dev-lang/yasm )
+ x86? ( dev-lang/yasm )
+ )
+ doc? ( virtual/latex-base )
+ test? (
+ ${PYTHON_DEPS}
+ dev-lang/tcl:0
+ dev-util/dejagnu
+ dev-util/cmocka
+ )"
+RDEPEND="${DEPEND}
+ selinux? ( sec-policy/selinux-kerberos )"
+
+S=${WORKDIR}/${MY_P}/src
+
+PATCHES=(
+ "${FILESDIR}/${PN}-1.12_warn_cflags.patch"
+ "${FILESDIR}/${PN}-config_LDFLAGS-r1.patch"
+ "${FILESDIR}/${PN}-1.16.3-libressl-r1.patch"
+ "${FILESDIR}/${PN}_dont_create_run.patch"
+ "${FILESDIR}/${PN}-1.18-libressl.patch"
+)
+
+MULTILIB_CHOST_TOOLS=(
+ /usr/bin/krb5-config
+)
+
+src_prepare() {
+ default
+ # Make sure we always use the system copies.
+ rm -rf util/{et,ss,verto}
+ sed -i 's:^[[:space:]]*util/verto$::' configure.ac || die
+
+ eautoreconf
+}
+
+src_configure() {
+ # QA
+ append-flags -fno-strict-aliasing
+ append-flags -fno-strict-overflow
+
+ multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+ ECONF_SOURCE=${S} \
+ WARN_CFLAGS="set" \
+ econf \
+ $(use_with openldap ldap) \
+ "$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \
+ $(use_enable nls) \
+ $(use_enable pkinit) \
+ $(use_enable threads thread-support) \
+ $(use_with lmdb) \
+ $(use_with keyutils) \
+ --without-hesiod \
+ --enable-shared \
+ --with-system-et \
+ --with-system-ss \
+ --enable-dns-for-realm \
+ --enable-kdc-lookaside-cache \
+ --with-system-verto \
+ --disable-rpath \
+ \
+ AR="$(tc-getAR)"
+}
+
+multilib_src_compile() {
+ emake -j1
+}
+
+multilib_src_test() {
+ multilib_is_native_abi && emake -j1 check
+}
+
+multilib_src_install() {
+ emake \
+ DESTDIR="${D}" \
+ EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
+ install
+}
+
+multilib_src_install_all() {
+ # default database dir
+ keepdir /var/lib/krb5kdc
+
+ cd ..
+ dodoc README
+
+ if use doc; then
+ dodoc -r doc/html
+ docinto pdf
+ dodoc doc/pdf/*.pdf
+ fi
+
+ newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
+ newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
+ newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
+ newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
+ newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
+ newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
+
+ systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service
+ systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service
+ systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service
+ systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service"
+ systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket
+
+ insinto /etc
+ newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
+ insinto /var/lib/krb5kdc
+ newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
+
+ if use openldap ; then
+ insinto /etc/openldap/schema
+ doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
+ fi
+
+ if use xinetd ; then
+ insinto /etc/xinetd.d
+ newins "${FILESDIR}/kpropd.xinetd" kpropd
+ fi
+}
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-18 10:33:49 +0000