From adf34d4b1354014caff40a3fc3a957bd29c881b4 Mon Sep 17 00:00:00 2001 From: Roy Li Date: Wed, 13 May 2015 14:14:48 +0800 Subject: krb5: upgrade to 1.13.2 Upgrade to include the CVE fixes: [CVE-2014-5354] [CVE-2014-5353]... Remove the 0001-Return-only-new-keys-in-randkey-CVE-2014-5351.patch Regenerate the /var/run/krb5kdc dir Signed-off-by: Roy Li Signed-off-by: Martin Jansa --- ...rn-only-new-keys-in-randkey-CVE-2014-5351.patch | 92 ------------------- meta-oe/recipes-connectivity/krb5/krb5_1.12.2.bb | 80 ----------------- meta-oe/recipes-connectivity/krb5/krb5_1.13.2.bb | 100 +++++++++++++++++++++ 3 files changed, 100 insertions(+), 172 deletions(-) delete mode 100644 meta-oe/recipes-connectivity/krb5/krb5/0001-Return-only-new-keys-in-randkey-CVE-2014-5351.patch delete mode 100644 meta-oe/recipes-connectivity/krb5/krb5_1.12.2.bb create mode 100644 meta-oe/recipes-connectivity/krb5/krb5_1.13.2.bb diff --git a/meta-oe/recipes-connectivity/krb5/krb5/0001-Return-only-new-keys-in-randkey-CVE-2014-5351.patch b/meta-oe/recipes-connectivity/krb5/krb5/0001-Return-only-new-keys-in-randkey-CVE-2014-5351.patch deleted file mode 100644 index 08526610aa..0000000000 --- a/meta-oe/recipes-connectivity/krb5/krb5/0001-Return-only-new-keys-in-randkey-CVE-2014-5351.patch +++ /dev/null @@ -1,92 +0,0 @@ -From af0ed4df4dfae762ab5fb605f5a0c8f59cb4f6ca Mon Sep 17 00:00:00 2001 -From: Greg Hudson -Date: Thu, 21 Aug 2014 13:52:07 -0400 -Subject: [PATCH] Return only new keys in randkey [CVE-2014-5351] - -In kadmind's randkey operation, if a client specifies the keepold -flag, do not include the preserved old keys in the response. - -CVE-2014-5351: - -An authenticated remote attacker can retrieve the current keys for a -service principal when generating a new set of keys for that -principal. The attacker needs to be authenticated as a user who has -the elevated privilege for randomizing the keys of other principals. - -Normally, when a Kerberos administrator randomizes the keys of a -service principal, kadmind returns only the new keys. This prevents -an administrator who lacks legitimate privileged access to a service -from forging tickets to authenticate to that service. If the -"keepold" flag to the kadmin randkey RPC operation is true, kadmind -retains the old keys in the KDC database as intended, but also -unexpectedly returns the old keys to the client, which exposes the -service to ticket forgery attacks from the administrator. - -A mitigating factor is that legitimate clients of the affected service -will start failing to authenticate to the service once they begin to -receive service tickets encrypted in the new keys. The affected -service will be unable to decrypt the newly issued tickets, possibly -alerting the legitimate administrator of the affected service. - -CVSSv2: AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C - -[tlyu@mit.edu: CVE description and CVSS score] - -ticket: 8018 (new) -target_version: 1.13 -tags: pullup - -Upstream-Status: Backport ---- - src/lib/kadm5/srv/svr_principal.c | 21 ++++++++++++++++++--- - 1 files changed, 18 insertions(+), 3 deletions(-) - -diff --git a/lib/kadm5/srv/svr_principal.c b/lib/kadm5/srv/svr_principal.c -index 5d358bd..d4e74cc 100644 ---- a/lib/kadm5/srv/svr_principal.c -+++ b/lib/kadm5/srv/svr_principal.c -@@ -344,6 +344,20 @@ check_1_6_dummy(kadm5_principal_ent_t entry, long mask, - *passptr = NULL; - } - -+/* Return the number of keys with the newest kvno. Assumes that all key data -+ * with the newest kvno are at the front of the key data array. */ -+static int -+count_new_keys(int n_key_data, krb5_key_data *key_data) -+{ -+ int n; -+ -+ for (n = 1; n < n_key_data; n++) { -+ if (key_data[n - 1].key_data_kvno != key_data[n].key_data_kvno) -+ return n; -+ } -+ return n_key_data; -+} -+ - kadm5_ret_t - kadm5_create_principal(void *server_handle, - kadm5_principal_ent_t entry, long mask, -@@ -1593,7 +1607,7 @@ kadm5_randkey_principal_3(void *server_handle, - osa_princ_ent_rec adb; - krb5_int32 now; - kadm5_policy_ent_rec pol; -- int ret, last_pwd; -+ int ret, last_pwd, n_new_keys; - krb5_boolean have_pol = FALSE; - kadm5_server_handle_t handle = server_handle; - krb5_keyblock *act_mkey; -@@ -1686,8 +1700,9 @@ kadm5_randkey_principal_3(void *server_handle, - kdb->fail_auth_count = 0; - - if (keyblocks) { -- ret = decrypt_key_data(handle->context, -- kdb->n_key_data, kdb->key_data, -+ /* Return only the new keys added by krb5_dbe_crk. */ -+ n_new_keys = count_new_keys(kdb->n_key_data, kdb->key_data); -+ ret = decrypt_key_data(handle->context, n_new_keys, kdb->key_data, - keyblocks, n_keys); - if (ret) - goto done; --- -1.7.4.1 - diff --git a/meta-oe/recipes-connectivity/krb5/krb5_1.12.2.bb b/meta-oe/recipes-connectivity/krb5/krb5_1.12.2.bb deleted file mode 100644 index c492496b64..0000000000 --- a/meta-oe/recipes-connectivity/krb5/krb5_1.12.2.bb +++ /dev/null @@ -1,80 +0,0 @@ -SUMMARY = "A network authentication protocol" -DESCRIPTION = "Kerberos is a system for authenticating users and services on a network. \ - Kerberos is a trusted third-party service. That means that there is a \ - third party (the Kerberos server) that is trusted by all the entities on \ - the network (users and services, usually called "principals"). \ - . \ - This is the MIT reference implementation of Kerberos V5. \ - . \ - This package contains the Kerberos key server (KDC). The KDC manages all \ - authentication credentials for a Kerberos realm, holds the master keys \ - for the realm, and responds to authentication requests. This package \ - should be installed on both master and slave KDCs." - -HOMEPAGE = "http://web.mit.edu/Kerberos/" -SECTION = "console/network" -LICENSE = "MIT" -LIC_FILES_CHKSUM = "file://${S}/../NOTICE;md5=450c80c6258ce03387bd09df37638ebc" -DEPENDS = "ncurses util-linux e2fsprogs e2fsprogs-native" - -inherit autotools-brokensep binconfig perlnative - -SHRT_VER = "${@oe.utils.trim_version("${PV}", 2)}" -SRC_URI = "http://web.mit.edu/kerberos/dist/${BPN}/${SHRT_VER}/${BP}-signed.tar \ - file://0001-aclocal-Add-parameter-to-disable-keyutils-detection.patch \ - file://0001-Return-only-new-keys-in-randkey-CVE-2014-5351.patch \ - file://debian-suppress-usr-lib-in-krb5-config.patch;striplevel=2 \ - file://crosscompile_nm.patch \ - file://etc/init.d/krb5-kdc \ - file://etc/init.d/krb5-admin-server \ - file://etc/default/krb5-kdc \ - file://etc/default/krb5-admin-server \ -" -SRC_URI[md5sum] = "357f1312b7720a0a591e22db0f7829fe" -SRC_URI[sha256sum] = "09bd180107b5c2b3b7378c57c023fb02a103d4cac39d6f2dd600275d7a4f3744" - -S = "${WORKDIR}/${BP}/src/" - -PACKAGECONFIG ??= "openssl" -PACKAGECONFIG[libedit] = "--with-libedit,--without-libedit,libedit" -PACKAGECONFIG[openssl] = "--with-pkinit-crypto-impl=openssl,,openssl" -PACKAGECONFIG[keyutils] = "--enable-keyutils,--disable-keyutils,keyutils" -PACKAGECONFIG[ldap] = "--with-ldap,--without-ldap,openldap" -PACKAGECONFIG[readline] = "--with-readline,--without-readline,readline" - -EXTRA_OECONF += " --without-tcl --with-system-et --disable-rpath" -CACHED_CONFIGUREVARS += "krb5_cv_attr_constructor_destructor=yes ac_cv_func_regcomp=yes \ - ac_cv_printf_positional=yes ac_cv_file__etc_environment=yes \ - ac_cv_file__etc_TIMEZONE=no" - -CFLAGS_append += "-DDESTRUCTOR_ATTR_WORKS=1 -I${STAGING_INCDIR}/et" -LDFLAGS_append += "-lpthread" - -FILES_${PN} += "${datadir}/gnats" -FILES_${PN}-doc += "${datadir}/examples" -FILES_${PN}-dbg += "${libdir}/krb5/plugins/*/.debug" - -# As this recipe doesn't inherit update-rc.d, we need to add this dependency here -RDEPENDS_${PN} += "initscripts-functions" - -krb5_do_unpack() { - # ${P}-signed.tar contains ${P}.tar.gz.asc and ${P}.tar.gz - tar xzf ${WORKDIR}/${BP}.tar.gz -C ${WORKDIR}/ -} - -python do_unpack() { - bb.build.exec_func('base_do_unpack', d) - bb.build.exec_func('krb5_do_unpack', d) -} - -do_configure() { - gnu-configize --force - autoreconf - oe_runconf -} - -do_install_append() { - mkdir -p ${D}/etc/init.d ${D}/etc/default - install -m 0755 ${WORKDIR}/etc/init.d/* ${D}/etc/init.d - install -m 0644 ${WORKDIR}/etc/default/* ${D}/etc/default -} diff --git a/meta-oe/recipes-connectivity/krb5/krb5_1.13.2.bb b/meta-oe/recipes-connectivity/krb5/krb5_1.13.2.bb new file mode 100644 index 0000000000..ec88296df6 --- /dev/null +++ b/meta-oe/recipes-connectivity/krb5/krb5_1.13.2.bb @@ -0,0 +1,100 @@ +SUMMARY = "A network authentication protocol" +DESCRIPTION = "Kerberos is a system for authenticating users and services on a network. \ + Kerberos is a trusted third-party service. That means that there is a \ + third party (the Kerberos server) that is trusted by all the entities on \ + the network (users and services, usually called "principals"). \ + . \ + This is the MIT reference implementation of Kerberos V5. \ + . \ + This package contains the Kerberos key server (KDC). The KDC manages all \ + authentication credentials for a Kerberos realm, holds the master keys \ + for the realm, and responds to authentication requests. This package \ + should be installed on both master and slave KDCs." + +HOMEPAGE = "http://web.mit.edu/Kerberos/" +SECTION = "console/network" +LICENSE = "MIT" +LIC_FILES_CHKSUM = "file://${S}/../NOTICE;md5=f64248328d2d9928e1f04158b5243e7f" +DEPENDS = "ncurses util-linux e2fsprogs e2fsprogs-native" + +inherit autotools-brokensep binconfig perlnative + +SHRT_VER = "${@oe.utils.trim_version("${PV}", 2)}" +SRC_URI = "http://web.mit.edu/kerberos/dist/${BPN}/${SHRT_VER}/${BP}-signed.tar \ + file://0001-aclocal-Add-parameter-to-disable-keyutils-detection.patch \ + file://debian-suppress-usr-lib-in-krb5-config.patch;striplevel=2 \ + file://crosscompile_nm.patch \ + file://etc/init.d/krb5-kdc \ + file://etc/init.d/krb5-admin-server \ + file://etc/default/krb5-kdc \ + file://etc/default/krb5-admin-server \ +" +SRC_URI[md5sum] = "f7ebfa6c99c10b16979ebf9a98343189" +SRC_URI[sha256sum] = "e528c30b0209c741f6f320cb83122ded92f291802b6a1a1dc1a01dcdb3ff6de1" + +S = "${WORKDIR}/${BP}/src/" + +PACKAGECONFIG ??= "openssl" +PACKAGECONFIG[libedit] = "--with-libedit,--without-libedit,libedit" +PACKAGECONFIG[openssl] = "--with-pkinit-crypto-impl=openssl,,openssl" +PACKAGECONFIG[keyutils] = "--enable-keyutils,--disable-keyutils,keyutils" +PACKAGECONFIG[ldap] = "--with-ldap,--without-ldap,openldap" +PACKAGECONFIG[readline] = "--with-readline,--without-readline,readline" + +EXTRA_OECONF += " --without-tcl --with-system-et --disable-rpath" +CACHED_CONFIGUREVARS += "krb5_cv_attr_constructor_destructor=yes ac_cv_func_regcomp=yes \ + ac_cv_printf_positional=yes ac_cv_file__etc_environment=yes \ + ac_cv_file__etc_TIMEZONE=no" + +CFLAGS_append += "-DDESTRUCTOR_ATTR_WORKS=1 -I${STAGING_INCDIR}/et" +LDFLAGS_append += "-lpthread" + +FILES_${PN} += "${datadir}/gnats" +FILES_${PN}-doc += "${datadir}/examples" +FILES_${PN}-dbg += "${libdir}/krb5/plugins/*/.debug" + +# As this recipe doesn't inherit update-rc.d, we need to add this dependency here +RDEPENDS_${PN} += "initscripts-functions" + +krb5_do_unpack() { + # ${P}-signed.tar contains ${P}.tar.gz.asc and ${P}.tar.gz + tar xzf ${WORKDIR}/${BP}.tar.gz -C ${WORKDIR}/ +} + +python do_unpack() { + bb.build.exec_func('base_do_unpack', d) + bb.build.exec_func('krb5_do_unpack', d) +} + +do_configure() { + gnu-configize --force + autoreconf + oe_runconf +} + +do_install_append() { + mkdir -p ${D}/etc/init.d ${D}/etc/default + install -m 0755 ${WORKDIR}/etc/init.d/* ${D}/etc/init.d + install -m 0644 ${WORKDIR}/etc/default/* ${D}/etc/default + + rm -rf ${D}/var/run + mkdir -p ${D}/etc/default/volatiles + echo "d root root 0755 ${localstatedir}/run/krb5kdc none" \ + > ${D}${sysconfdir}/default/volatiles/87_krb5 + if ${@base_contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then + install -d ${D}${sysconfdir}/tmpfiles.d + echo "d /run/krb5kdc - - - -" \ + > ${D}${sysconfdir}/tmpfiles.d/krb5.conf + fi + +} + +pkg_postinst_${PN} () { + if [ -z "$D" ]; then + if command -v systemd-tmpfiles >/dev/null; then + systemd-tmpfiles --create ${sysconfdir}/tmpfiles.d/krb5.conf + elif [ -e ${sysconfdir}/init.d/populate-volatile.sh ]; then + ${sysconfdir}/init.d/populate-volatile.sh update + fi + fi +} -- cgit v1.2.3-54-g00ecf