diff --git a/Continue-after-KRB5_CC_END-in-KCM-cache-iteration.patch b/Continue-after-KRB5_CC_END-in-KCM-cache-iteration.patch new file mode 100644 index 0000000..01073e1 --- /dev/null +++ b/Continue-after-KRB5_CC_END-in-KCM-cache-iteration.patch @@ -0,0 +1,43 @@ +From bc42112fbc232c2afba602672affc3e92ae1491e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= +Date: Wed, 28 Mar 2018 18:27:06 +0200 +Subject: [PATCH] Continue after KRB5_CC_END in KCM cache iteration + +The KCM server returns KRB5_CC_END in response to a GET_CACHE_BY_UUID +request to indicate that the specified ccache uuid no longer exists. +In krb5_ptcursor_next(), ignore this error and continue the iteration, +as the Heimdal KCM client code does. + +In addition to addressing the case where a third party deletes a cache +between the GET_CACHE_UUID_LIST request and when we reach that uuid in +the iteration, this change also fixes a bug in kdestroy -A where the +caller deletes the primary cache and we later request it by uuid when +iterating over the list. + +[ghudson@mit.edu: rewrote commit message; edited comment] + +ticket: 8658 (new) +tags: pullup +target_version: 1.16-next +target_version: 1.15-next + +(cherry picked from commit 49087f5e6309f298f8898c35af6f4ade418ced60) +(cherry picked from commit 3001200ba4598aeb14511353a72dc746034280b1) +--- + src/lib/krb5/ccache/cc_kcm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c +index a889e67b4..a3afd7056 100644 +--- a/src/lib/krb5/ccache/cc_kcm.c ++++ b/src/lib/krb5/ccache/cc_kcm.c +@@ -966,6 +966,9 @@ kcm_ptcursor_next(krb5_context context, krb5_cc_ptcursor cursor, + kcmreq_init(&req, KCM_OP_GET_CACHE_BY_UUID, NULL); + k5_buf_add_len(&req.reqbuf, id, KCM_UUID_LEN); + ret = kcmio_call(context, data->io, &req); ++ /* Continue if the cache has been deleted. */ ++ if (ret == KRB5_CC_END) ++ continue; + if (ret) + goto cleanup; + ret = kcmreq_get_name(&req, &name); diff --git a/Fix-PKINIT-cert-matching-data-construction.patch b/Fix-PKINIT-cert-matching-data-construction.patch new file mode 100644 index 0000000..99b3db7 --- /dev/null +++ b/Fix-PKINIT-cert-matching-data-construction.patch @@ -0,0 +1,105 @@ +From 3fe07aaa6d8b6115aa19e2c04087352a5c87a568 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Tue, 24 Oct 2017 15:33:37 -0400 +Subject: [PATCH] Fix PKINIT cert matching data construction + +Rewrite X509_NAME_oneline_ex() and its call sites to use dynamic +allocation and to perform proper error checking. + +(cherry picked from commit 1d8fb334a6256b9ddd3d4377a92c2441407d8a12) +--- + src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 63 ++++++++-------------- + 1 file changed, 21 insertions(+), 42 deletions(-) + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index 7fa2efd21..336102656 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -5139,33 +5139,23 @@ out: + return retval; + } + +-/* +- * Return a string format of an X509_NAME in buf where +- * size is an in/out parameter. On input it is the size +- * of the buffer, and on output it is the actual length +- * of the name. +- * If buf is NULL, returns the length req'd to hold name +- */ +-static char * +-X509_NAME_oneline_ex(X509_NAME * a, +- char *buf, +- unsigned int *size, +- unsigned long flag) ++static krb5_error_code ++rfc2253_name(X509_NAME *name, char **str_out) + { +- BIO *out = NULL; ++ BIO *b = NULL; ++ char *str; + +- out = BIO_new(BIO_s_mem ()); +- if (X509_NAME_print_ex(out, a, 0, flag) > 0) { +- if (buf != NULL && (*size) > (unsigned int) BIO_number_written(out)) { +- memset(buf, 0, *size); +- BIO_read(out, buf, (int) BIO_number_written(out)); +- } +- else { +- *size = BIO_number_written(out); +- } +- } +- BIO_free(out); +- return (buf); ++ *str_out = NULL; ++ b = BIO_new(BIO_s_mem()); ++ if (X509_NAME_print_ex(b, name, 0, XN_FLAG_SEP_COMMA_PLUS) < 0) ++ return ENOMEM; ++ str = calloc(BIO_number_written(b) + 1, 1); ++ if (str == NULL) ++ return ENOMEM; ++ BIO_read(b, str, BIO_number_written(b)); ++ BIO_free(b); ++ *str_out = str; ++ return 0; + } + + /* +@@ -5181,8 +5171,6 @@ crypto_cert_get_matching_data(krb5_context context, + krb5_principal *pkinit_sans =NULL, *upn_sans = NULL; + struct _pkinit_cert_data *cd = (struct _pkinit_cert_data *)ch; + unsigned int i, j; +- char buf[DN_BUF_LEN]; +- unsigned int bufsize = sizeof(buf); + + if (cd == NULL || cd->magic != CERT_MAGIC) + return EINVAL; +@@ -5195,23 +5183,14 @@ crypto_cert_get_matching_data(krb5_context context, + + md->ch = ch; + +- /* get the subject name (in rfc2253 format) */ +- X509_NAME_oneline_ex(X509_get_subject_name(cd->cred->cert), +- buf, &bufsize, XN_FLAG_SEP_COMMA_PLUS); +- md->subject_dn = strdup(buf); +- if (md->subject_dn == NULL) { +- retval = ENOMEM; ++ retval = rfc2253_name(X509_get_subject_name(cd->cred->cert), ++ &md->subject_dn); ++ if (retval) + goto cleanup; +- } +- +- /* get the issuer name (in rfc2253 format) */ +- X509_NAME_oneline_ex(X509_get_issuer_name(cd->cred->cert), +- buf, &bufsize, XN_FLAG_SEP_COMMA_PLUS); +- md->issuer_dn = strdup(buf); +- if (md->issuer_dn == NULL) { +- retval = ENOMEM; ++ retval = rfc2253_name(X509_get_issuer_name(cd->cred->cert), ++ &md->issuer_dn); ++ if (retval) + goto cleanup; +- } + + /* get the san data */ + retval = crypto_retrieve_X509_sans(context, cd->plgctx, cd->reqctx, diff --git a/krb5.spec b/krb5.spec index df62457..1031c0d 100644 --- a/krb5.spec +++ b/krb5.spec @@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.15.2 # for prerelease, should be e.g., 0.3.beta2% { ?dist } (without spaces) -Release: 2%{?dist} +Release: 9%{?dist} # lookaside-cached sources; two downloads and a build artifact Source0: https://web.mit.edu/kerberos/dist/krb5/1.15/krb5-%{version}%{prerelease}.tar.gz @@ -92,6 +92,8 @@ Patch68: Add-test-cert-with-no-extensions.patch Patch69: Add-PKINIT-test-case-for-generic-client-cert.patch Patch70: Add-hostname-based-ccselect-module.patch Patch71: Add-German-translation.patch +Patch72: Fix-PKINIT-cert-matching-data-construction.patch +Patch73: Continue-after-KRB5_CC_END-in-KCM-cache-iteration.patch License: MIT URL: http://web.mit.edu/kerberos/www/ @@ -141,7 +143,6 @@ BuildRequires: perl-interpreter, dejagnu, tcl-devel BuildRequires: net-tools, rpcbind BuildRequires: hostname BuildRequires: iproute -BuildRequires: python2-pyrad BuildRequires: libverto-devel BuildRequires: openldap-devel BuildRequires: openssl-devel >= 0.9.8 @@ -351,6 +352,7 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`" --with-dirsrv-account-locking \ %endif --enable-pkinit \ + --with-crypto-impl=openssl \ --with-pkinit-crypto-impl=openssl \ --with-tls-impl=openssl \ --with-system-verto \ @@ -745,6 +747,30 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Mon Apr 23 2018 Robbie Harwood - 1.15.2-9 +- Explicitly use openssl rather than builtin crypto +- Resolves: #1570910 + +* Thu Mar 29 2018 Robbie Harwood - 1.15.2-8 +- Continue after KRB5_CC_END in KCM cache iteration + +* Tue Feb 13 2018 Robbie Harwood - 1.15.2-7 +- Fix flaws in LDAP DN checking +- CVE-2018-5729, CVE-2018-5730 + +* Mon Feb 12 2018 Robbie Harwood - 1.15.2-6 +- Fix leak in previous commit +- Resolves: #1540939 + +* Mon Jan 29 2018 Robbie Harwood - 1.15.2-5 +- Process include directories in alphabetical order + +* Tue Oct 24 2017 Robbie Harwood - 1.15.2-4 +- Fix CVE-2017-15088 (Buffer overflow in get_matching_data()) + +* Mon Oct 23 2017 Robbie Harwood - 1.15.2-3 +- Drop dependency on python2-pyrad (dead upstream, broken with new python) + * Thu Sep 28 2017 Robbie Harwood - 1.15.2-2 - Add German translation