diff options
author | Mingli Yu <mingli.yu@windriver.com> | 2019-03-12 01:34:15 -0700 |
---|---|---|
committer | Khem Raj <raj.khem@gmail.com> | 2019-03-14 07:24:03 -0700 |
commit | b3eeaf4498f09339c3727c95d3d9368ba9903286 (patch) | |
tree | 5e29ac739857ed3453bf93077ae79fcd9401b527 /meta-oe/recipes-connectivity | |
parent | f7f06219f14dae1099bc5a0744a2196e5ecf2f5b (diff) | |
download | meta-openembedded-b3eeaf4498f09339c3727c95d3d9368ba9903286.tar.gz |
krb5: Upgrade to 1.17
License-Update: Copyright year updated to 2019.
Remove one backported patch.
Fix below do_package issue:
ERROR: krb5-1.17-r0 do_package: QA Issue: krb5: Files/directories were installed but not shipped in any package:
/usr/lib/krb5/plugins/preauth/spake.so
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Diffstat (limited to 'meta-oe/recipes-connectivity')
-rw-r--r-- | meta-oe/recipes-connectivity/krb5/krb5/0001-Ignore-password-attributes-for-S4U2Self-requests.patch | 80 | ||||
-rw-r--r-- | meta-oe/recipes-connectivity/krb5/krb5_1.17.bb (renamed from meta-oe/recipes-connectivity/krb5/krb5_1.16.2.bb) | 9 |
2 files changed, 5 insertions, 84 deletions
diff --git a/meta-oe/recipes-connectivity/krb5/krb5/0001-Ignore-password-attributes-for-S4U2Self-requests.patch b/meta-oe/recipes-connectivity/krb5/krb5/0001-Ignore-password-attributes-for-S4U2Self-requests.patch deleted file mode 100644 index 8d1e14358..000000000 --- a/meta-oe/recipes-connectivity/krb5/krb5/0001-Ignore-password-attributes-for-S4U2Self-requests.patch +++ /dev/null | |||
@@ -1,80 +0,0 @@ | |||
1 | From 6fad7d45701234c8e81300d50dd5b8037d846d11 Mon Sep 17 00:00:00 2001 | ||
2 | From: Isaac Boukris <iboukris@gmail.com> | ||
3 | Date: Wed, 27 Feb 2019 23:59:59 -0800 | ||
4 | Subject: [PATCH] Ignore password attributes for S4U2Self requests | ||
5 | |||
6 | For consistency with Windows KDCs, allow protocol transition to work | ||
7 | even if the password has expired or needs changing. | ||
8 | |||
9 | Also, when looking up an enterprise principal with an AS request, | ||
10 | treat ERR_KEY_EXP as confirmation that the client is present in the | ||
11 | realm. | ||
12 | |||
13 | [ghudson@mit.edu: added comment in kdc_process_s4u2self_req(); edited | ||
14 | commit message] | ||
15 | |||
16 | ticket: 8763 (new) | ||
17 | tags: pullup | ||
18 | target_version: 1.17 | ||
19 | |||
20 | Upsteam-Status: Backport [https://github.com/krb5/krb5/commit/5e6d1796106df8ba6bc1973ee0917c170d929086] | ||
21 | CVE: CVE-2018-20217 | ||
22 | |||
23 | Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> | ||
24 | --- | ||
25 | src/kdc/kdc_util.c | 5 +++++ | ||
26 | src/lib/krb5/krb/s4u_creds.c | 2 +- | ||
27 | src/tests/gssapi/t_s4u.py | 8 ++++++++ | ||
28 | 3 files changed, 14 insertions(+), 1 deletion(-) | ||
29 | |||
30 | diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c | ||
31 | index 754570c..034c979 100644 | ||
32 | --- a/src/kdc/kdc_util.c | ||
33 | +++ b/src/kdc/kdc_util.c | ||
34 | @@ -1574,6 +1574,11 @@ kdc_process_s4u2self_req(kdc_realm_t *kdc_active_realm, | ||
35 | |||
36 | memset(&no_server, 0, sizeof(no_server)); | ||
37 | |||
38 | + /* Ignore password expiration and needchange attributes (as Windows | ||
39 | + * does), since S4U2Self is not password authentication. */ | ||
40 | + princ->pw_expiration = 0; | ||
41 | + clear(princ->attributes, KRB5_KDB_REQUIRES_PWCHANGE); | ||
42 | + | ||
43 | code = validate_as_request(kdc_active_realm, request, *princ, | ||
44 | no_server, kdc_time, status, &e_data); | ||
45 | if (code) { | ||
46 | diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c | ||
47 | index 91c02aa..2037984 100644 | ||
48 | --- a/src/lib/krb5/krb/s4u_creds.c | ||
49 | +++ b/src/lib/krb5/krb/s4u_creds.c | ||
50 | @@ -117,7 +117,7 @@ s4u_identify_user(krb5_context context, | ||
51 | code = k5_get_init_creds(context, &creds, client, NULL, NULL, 0, NULL, | ||
52 | opts, krb5_get_as_key_noop, &userid, &use_master, | ||
53 | NULL); | ||
54 | - if (code == 0 || code == KRB5_PREAUTH_FAILED) { | ||
55 | + if (!code || code == KRB5_PREAUTH_FAILED || code == KRB5KDC_ERR_KEY_EXP) { | ||
56 | *canon_user = userid.user; | ||
57 | userid.user = NULL; | ||
58 | code = 0; | ||
59 | diff --git a/src/tests/gssapi/t_s4u.py b/src/tests/gssapi/t_s4u.py | ||
60 | index 3da6544..ba0469e 100755 | ||
61 | --- a/src/tests/gssapi/t_s4u.py | ||
62 | +++ b/src/tests/gssapi/t_s4u.py | ||
63 | @@ -20,6 +20,14 @@ pservice2 = 'p:' + service2 | ||
64 | # Get forwardable creds for service1 in the default cache. | ||
65 | realm.kinit(service1, None, ['-f', '-k']) | ||
66 | |||
67 | +# Try S4U2Self for user with a restricted password. | ||
68 | +realm.run([kadminl, 'modprinc', '+needchange', realm.user_princ]) | ||
69 | +realm.run(['./t_s4u', 'e:user', '-']) | ||
70 | +realm.run([kadminl, 'modprinc', '-needchange', | ||
71 | + '-pwexpire', '1/1/2000', realm.user_princ]) | ||
72 | +realm.run(['./t_s4u', 'e:user', '-']) | ||
73 | +realm.run([kadminl, 'modprinc', '-pwexpire', 'never', realm.user_princ]) | ||
74 | + | ||
75 | # Try krb5 -> S4U2Proxy with forwardable user creds. This should fail | ||
76 | # at the S4U2Proxy step since the DB2 back end currently has no | ||
77 | # support for allowing it. | ||
78 | -- | ||
79 | 2.17.1 | ||
80 | |||
diff --git a/meta-oe/recipes-connectivity/krb5/krb5_1.16.2.bb b/meta-oe/recipes-connectivity/krb5/krb5_1.17.bb index 1d3ef8a34..e29c52783 100644 --- a/meta-oe/recipes-connectivity/krb5/krb5_1.16.2.bb +++ b/meta-oe/recipes-connectivity/krb5/krb5_1.17.bb | |||
@@ -14,7 +14,7 @@ DESCRIPTION = "Kerberos is a system for authenticating users and services on a n | |||
14 | HOMEPAGE = "http://web.mit.edu/Kerberos/" | 14 | HOMEPAGE = "http://web.mit.edu/Kerberos/" |
15 | SECTION = "console/network" | 15 | SECTION = "console/network" |
16 | LICENSE = "MIT" | 16 | LICENSE = "MIT" |
17 | LIC_FILES_CHKSUM = "file://${S}/../NOTICE;md5=7f95bc3d8d0351aa481d56d5e9de20c3" | 17 | LIC_FILES_CHKSUM = "file://${S}/../NOTICE;md5=aff541e7261f1926ac6a2a9a7bbab839" |
18 | DEPENDS = "bison-native ncurses util-linux e2fsprogs e2fsprogs-native openssl" | 18 | DEPENDS = "bison-native ncurses util-linux e2fsprogs e2fsprogs-native openssl" |
19 | 19 | ||
20 | inherit autotools-brokensep binconfig perlnative systemd update-rc.d | 20 | inherit autotools-brokensep binconfig perlnative systemd update-rc.d |
@@ -30,10 +30,9 @@ SRC_URI = "http://web.mit.edu/kerberos/dist/${BPN}/${SHRT_VER}/${BP}.tar.gz \ | |||
30 | file://etc/default/krb5-admin-server \ | 30 | file://etc/default/krb5-admin-server \ |
31 | file://krb5-kdc.service \ | 31 | file://krb5-kdc.service \ |
32 | file://krb5-admin-server.service \ | 32 | file://krb5-admin-server.service \ |
33 | file://0001-Ignore-password-attributes-for-S4U2Self-requests.patch;striplevel=2 \ | ||
34 | " | 33 | " |
35 | SRC_URI[md5sum] = "ffd52595e969fb700d37313606e4dc3d" | 34 | SRC_URI[md5sum] = "3b729d89eb441150e146780c4138481b" |
36 | SRC_URI[sha256sum] = "9f721e1fe593c219174740c71de514c7228a97d23eb7be7597b2ae14e487f027" | 35 | SRC_URI[sha256sum] = "5a6e2284a53de5702d3dc2be3b9339c963f9b5397d3fbbc53beb249380a781f5" |
37 | 36 | ||
38 | CVE_PRODUCT = "kerberos" | 37 | CVE_PRODUCT = "kerberos" |
39 | 38 | ||
@@ -105,6 +104,7 @@ PACKAGES =+ "${PN}-admin-server \ | |||
105 | ${PN}-kpropd \ | 104 | ${PN}-kpropd \ |
106 | ${PN}-otp \ | 105 | ${PN}-otp \ |
107 | ${PN}-pkinit \ | 106 | ${PN}-pkinit \ |
107 | ${PN}-spake \ | ||
108 | ${PN}-user \ | 108 | ${PN}-user \ |
109 | libgssapi-krb5 \ | 109 | libgssapi-krb5 \ |
110 | libgssrpc \ | 110 | libgssrpc \ |
@@ -151,6 +151,7 @@ FILES_${PN}-kdc-ldap = "${libdir}/krb5/libkdb_ldap${SOLIBS} \ | |||
151 | FILES_${PN}-kpropd = "${sbindir}/kpropd" | 151 | FILES_${PN}-kpropd = "${sbindir}/kpropd" |
152 | FILES_${PN}-otp = "${libdir}/krb5/plugins/preauth/otp.so" | 152 | FILES_${PN}-otp = "${libdir}/krb5/plugins/preauth/otp.so" |
153 | FILES_${PN}-pkinit = "${libdir}/krb5/plugins/preauth/pkinit.so" | 153 | FILES_${PN}-pkinit = "${libdir}/krb5/plugins/preauth/pkinit.so" |
154 | FILES_${PN}-spake = "${libdir}/krb5/plugins/preauth/spake.so" | ||
154 | FILES_${PN}-user = "${bindir}/k*" | 155 | FILES_${PN}-user = "${bindir}/k*" |
155 | 156 | ||
156 | FILES_libgssapi-krb5 = "${libdir}/libgssapi_krb5${SOLIBS}" | 157 | FILES_libgssapi-krb5 = "${libdir}/libgssapi_krb5${SOLIBS}" |