diff --git a/Add-configure-variable-for-default-PKCS-11-module.patch b/Add-configure-variable-for-default-PKCS-11-module.patch new file mode 100644 index 0000000..724b707 --- /dev/null +++ b/Add-configure-variable-for-default-PKCS-11-module.patch @@ -0,0 +1,201 @@ +From 2a91dabd9752825b96faf3b25ea643d5282c5957 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Fri, 22 Apr 2022 14:12:37 +0200 +Subject: [PATCH] Add configure variable for default PKCS#11 module + +[ghudson@mit.edu: added documentation of configure variable and doc +substitution; shortened commit message] + +ticket: 9058 (new) +--- + doc/admin/conf_files/krb5_conf.rst | 2 +- + doc/build/options2configure.rst | 3 +++ + doc/conf.py | 3 +++ + doc/mitK5defaults.rst | 25 +++++++++++++------------ + src/configure.ac | 8 ++++++++ + src/doc/Makefile.in | 2 ++ + src/man/Makefile.in | 4 +++- + src/man/krb5.conf.man | 2 +- + src/plugins/preauth/pkinit/pkinit.h | 1 - + 9 files changed, 34 insertions(+), 16 deletions(-) + +diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst +index adba8238d..3d25c9a12 100644 +--- a/doc/admin/conf_files/krb5_conf.rst ++++ b/doc/admin/conf_files/krb5_conf.rst +@@ -1020,7 +1020,7 @@ information for PKINIT is as follows: + All keyword/values are optional. *modname* specifies the location + of a library implementing PKCS #11. If a value is encountered + with no keyword, it is assumed to be the *modname*. If no +- module-name is specified, the default is ``opensc-pkcs11.so``. ++ module-name is specified, the default is |pkcs11_modname|. + ``slotid=`` and/or ``token=`` may be specified to force the use of + a particular smard card reader or token if there is more than one + available. ``certid=`` and/or ``certlabel=`` may be specified to +diff --git a/doc/build/options2configure.rst b/doc/build/options2configure.rst +index a8959626d..8f8ac911c 100644 +--- a/doc/build/options2configure.rst ++++ b/doc/build/options2configure.rst +@@ -143,6 +143,9 @@ Environment variables + This option allows one to specify libraries to be passed to the + linker (e.g., ``-l``) + ++**PKCS11_MODNAME=**\ *library* ++ Override the built-in default PKCS11 library name. ++ + **SS_LIB=**\ *libs*... + If ``-lss`` is not the correct way to link in your installed ss + library, for example if additional support libraries are needed, +diff --git a/doc/conf.py b/doc/conf.py +index a876fd633..252ab891a 100644 +--- a/doc/conf.py ++++ b/doc/conf.py +@@ -242,6 +242,7 @@ if 'mansubs' in tags: + ccache = '``@CCNAME@``' + keytab = '``@KTNAME@``' + ckeytab = '``@CKTNAME@``' ++ pkcs11_modname = '``@PKCS11MOD@``' + elif 'pathsubs' in tags: + # Read configured paths from a file produced by the build system. + exec(open("paths.py").read()) +@@ -255,6 +256,7 @@ else: + ccache = ':ref:`DEFCCNAME `' + keytab = ':ref:`DEFKTNAME `' + ckeytab = ':ref:`DEFCKTNAME `' ++ pkcs11_modname = ':ref:`PKCS11_MODNAME `' + + rst_epilog = '\n' + +@@ -275,6 +277,7 @@ else: + rst_epilog += '.. |ccache| replace:: %s\n' % ccache + rst_epilog += '.. |keytab| replace:: %s\n' % keytab + rst_epilog += '.. |ckeytab| replace:: %s\n' % ckeytab ++ rst_epilog += '.. |pkcs11_modname| replace:: %s\n' % pkcs11_modname + rst_epilog += ''' + .. |krb5conf| replace:: ``/etc/krb5.conf`` + .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal`` +diff --git a/doc/mitK5defaults.rst b/doc/mitK5defaults.rst +index 74e69f4ad..aea7af3db 100644 +--- a/doc/mitK5defaults.rst ++++ b/doc/mitK5defaults.rst +@@ -59,18 +59,19 @@ subdirectories of ``/usr/local``. When MIT krb5 is integrated into an + operating system, the paths are generally chosen to match the + operating system's filesystem layout. + +-========================== ============= =========================== =========================== +-Description Symbolic name Custom build path Typical OS path +-========================== ============= =========================== =========================== +-User programs BINDIR ``/usr/local/bin`` ``/usr/bin`` +-Libraries and plugins LIBDIR ``/usr/local/lib`` ``/usr/lib`` +-Parent of KDC state dir LOCALSTATEDIR ``/usr/local/var`` ``/var`` +-Parent of KDC runtime dir RUNSTATEDIR ``/usr/local/var/run`` ``/run`` +-Administrative programs SBINDIR ``/usr/local/sbin`` ``/usr/sbin`` +-Alternate krb5.conf dir SYSCONFDIR ``/usr/local/etc`` ``/etc`` +-Default ccache name DEFCCNAME ``FILE:/tmp/krb5cc_%{uid}`` ``FILE:/tmp/krb5cc_%{uid}`` +-Default keytab name DEFKTNAME ``FILE:/etc/krb5.keytab`` ``FILE:/etc/krb5.keytab`` +-========================== ============= =========================== =========================== ++========================== ============== =========================== =========================== ++Description Symbolic name Custom build path Typical OS path ++========================== ============== =========================== =========================== ++User programs BINDIR ``/usr/local/bin`` ``/usr/bin`` ++Libraries and plugins LIBDIR ``/usr/local/lib`` ``/usr/lib`` ++Parent of KDC state dir LOCALSTATEDIR ``/usr/local/var`` ``/var`` ++Parent of KDC runtime dir RUNSTATEDIR ``/usr/local/var/run`` ``/run`` ++Administrative programs SBINDIR ``/usr/local/sbin`` ``/usr/sbin`` ++Alternate krb5.conf dir SYSCONFDIR ``/usr/local/etc`` ``/etc`` ++Default ccache name DEFCCNAME ``FILE:/tmp/krb5cc_%{uid}`` ``FILE:/tmp/krb5cc_%{uid}`` ++Default keytab name DEFKTNAME ``FILE:/etc/krb5.keytab`` ``FILE:/etc/krb5.keytab`` ++Default PKCS11 module PKCS11_MODNAME ``opensc-pkcs11.so`` ``opensc-pkcs11.so`` ++========================== ============== =========================== =========================== + + The default client keytab name (DEFCKTNAME) typically defaults to + ``FILE:/usr/local/var/krb5/user/%{euid}/client.keytab`` for a custom +diff --git a/src/configure.ac b/src/configure.ac +index 82b049af9..52e6563da 100644 +--- a/src/configure.ac ++++ b/src/configure.ac +@@ -1442,6 +1442,14 @@ AC_DEFINE_UNQUOTED(DEFKTNAME, ["$DEFKTNAME"], [Define to default keytab name]) + AC_DEFINE_UNQUOTED(DEFCKTNAME, ["$DEFCKTNAME"], + [Define to default client keytab name]) + ++AC_ARG_VAR(PKCS11_MODNAME, [Default PKCS11 module name]) ++if test "${PKCS11_MODNAME+set}" != set; then ++ PKCS11_MODNAME=opensc-pkcs11.so ++fi ++AC_MSG_NOTICE([Default PKCS11 module name: $PKCS11_MODNAME]) ++AC_DEFINE_UNQUOTED(PKCS11_MODNAME, ["$PKCS11_MODNAME"], ++ [Default PKCS11 module name]) ++ + AC_CONFIG_FILES([build-tools/krb5-config], [chmod +x build-tools/krb5-config]) + AC_CONFIG_FILES([build-tools/kadm-server.pc + build-tools/kadm-client.pc +diff --git a/src/doc/Makefile.in b/src/doc/Makefile.in +index 379bc3651..a1b0cff0a 100644 +--- a/src/doc/Makefile.in ++++ b/src/doc/Makefile.in +@@ -10,6 +10,7 @@ sysconfdir=@sysconfdir@ + DEFCCNAME=@DEFCCNAME@ + DEFKTNAME=@DEFKTNAME@ + DEFCKTNAME=@DEFCKTNAME@ ++PKCS11_MODNAME=@PKCS11_MODNAME@ + + RST_SOURCES= _static \ + _templates \ +@@ -118,6 +119,7 @@ paths.py: + echo 'ccache = "``$(DEFCCNAME)``"' >> $@ + echo 'keytab = "``$(DEFKTNAME)``"' >> $@ + echo 'ckeytab = "``$(DEFCKTNAME)``"' >> $@ ++ echo 'pkcs11_modname = "``$(PKCS11_MODNAME)``"' >> $@ + + # Dummy rule that man/Makefile can invoke + version.py: $(docsrc)/version.py +diff --git a/src/man/Makefile.in b/src/man/Makefile.in +index 00b1b2de0..85cae0914 100644 +--- a/src/man/Makefile.in ++++ b/src/man/Makefile.in +@@ -8,6 +8,7 @@ sysconfdir=@sysconfdir@ + DEFCCNAME=@DEFCCNAME@ + DEFKTNAME=@DEFKTNAME@ + DEFCKTNAME=@DEFCKTNAME@ ++PKCS11_MODNAME=@PKCS11_MODNAME@ + + MANSUBS=k5identity.sub k5login.sub k5srvutil.sub kadm5.acl.sub kadmin.sub \ + kadmind.sub kdb5_ldap_util.sub kdb5_util.sub kdc.conf.sub \ +@@ -47,7 +48,8 @@ $(docsrc)/version.py: $(top_srcdir)/patchlevel.h + -e 's|@SYSCONFDIR@|$(sysconfdir)|g' \ + -e 's|@CCNAME@|$(DEFCCNAME)|g' \ + -e 's|@KTNAME@|$(DEFKTNAME)|g' \ +- -e 's|@CKTNAME@|$(DEFCKTNAME)|g' $? > $@ ++ -e 's|@CKTNAME@|$(DEFCKTNAME)|g' \ ++ -e 's|@PKCS11MOD@|$(PKCS11_MODNAME)|g' $? > $@ + + all: $(MANSUBS) + +diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man +index e993d5c09..42f5ea4f9 100644 +--- a/src/man/krb5.conf.man ++++ b/src/man/krb5.conf.man +@@ -1151,7 +1151,7 @@ user\(aqs certificate and private key. + All keyword/values are optional. \fImodname\fP specifies the location + of a library implementing PKCS #11. If a value is encountered + with no keyword, it is assumed to be the \fImodname\fP\&. If no +-module\-name is specified, the default is \fBopensc\-pkcs11.so\fP\&. ++module\-name is specified, the default is \fB@PKCS11MOD@\fP\&. + \fBslotid=\fP and/or \fBtoken=\fP may be specified to force the use of + a particular smard card reader or token if there is more than one + available. \fBcertid=\fP and/or \fBcertlabel=\fP may be specified to +diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h +index b437fd53f..a2018cb10 100644 +--- a/src/plugins/preauth/pkinit/pkinit.h ++++ b/src/plugins/preauth/pkinit/pkinit.h +@@ -42,7 +42,6 @@ + #ifndef WITHOUT_PKCS11 + #include "pkcs11.h" + +-#define PKCS11_MODNAME "opensc-pkcs11.so" + #define PK_SIGLEN_GUESS 1000 + #define PK_NOSLOT 999999 + #endif +-- +2.35.1 + diff --git a/Fix-integer-overflows-in-PAC-parsing.patch b/Fix-integer-overflows-in-PAC-parsing.patch new file mode 100644 index 0000000..e9e2af6 --- /dev/null +++ b/Fix-integer-overflows-in-PAC-parsing.patch @@ -0,0 +1,106 @@ +From c0f643a96272d11ae1255bc361f24133d1e58b74 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Mon, 17 Oct 2022 20:25:11 -0400 +Subject: [PATCH] Fix integer overflows in PAC parsing + +In krb5_parse_pac(), check for buffer counts large enough to threaten +integer overflow in the header length and memory length calculations. +Avoid potential integer overflows when checking the length of each +buffer. + +CVE-2022-42898: + +In MIT krb5 releases 1.8 and later, an authenticated attacker may be +able to cause a KDC or kadmind process to crash by reading beyond the +bounds of allocated memory, creating a denial of service. A +privileged attacker may similarly be able to cause a Kerberos or GSS +application service to crash. On 32-bit platforms, an attacker can +also cause insufficient memory to be allocated for the result, +potentially leading to remote code execution in a KDC, kadmind, or GSS +or Kerberos application server process. An attacker with the +privileges of a cross-realm KDC may be able to extract secrets from +the KDC process's memory by having them copied into the PAC of a new +ticket. + +ticket: 9074 (new) +tags: pullup +target_version: 1.20-next +target_version: 1.19-next +--- + src/lib/krb5/krb/pac.c | 9 +++++++-- + src/lib/krb5/krb/t_pac.c | 18 ++++++++++++++++++ + 2 files changed, 25 insertions(+), 2 deletions(-) + +diff --git a/src/lib/krb5/krb/pac.c b/src/lib/krb5/krb/pac.c +index 950beda657..1b9ef12276 100644 +--- a/src/lib/krb5/krb/pac.c ++++ b/src/lib/krb5/krb/pac.c +@@ -27,6 +27,8 @@ + #include "k5-int.h" + #include "authdata.h" + ++#define MAX_BUFFERS 4096 ++ + /* draft-brezak-win2k-krb-authz-00 */ + + /* +@@ -316,6 +318,9 @@ krb5_pac_parse(krb5_context context, + if (version != 0) + return EINVAL; + ++ if (cbuffers < 1 || cbuffers > MAX_BUFFERS) ++ return ERANGE; ++ + header_len = PACTYPE_LENGTH + (cbuffers * PAC_INFO_BUFFER_LENGTH); + if (len < header_len) + return ERANGE; +@@ -348,8 +353,8 @@ krb5_pac_parse(krb5_context context, + krb5_pac_free(context, pac); + return EINVAL; + } +- if (buffer->Offset < header_len || +- buffer->Offset + buffer->cbBufferSize > len) { ++ if (buffer->Offset < header_len || buffer->Offset > len || ++ buffer->cbBufferSize > len - buffer->Offset) { + krb5_pac_free(context, pac); + return ERANGE; + } +diff --git a/src/lib/krb5/krb/t_pac.c b/src/lib/krb5/krb/t_pac.c +index ee47152ee4..ccd165380d 100644 +--- a/src/lib/krb5/krb/t_pac.c ++++ b/src/lib/krb5/krb/t_pac.c +@@ -431,6 +431,16 @@ static const unsigned char s4u_pac_ent_xrealm[] = { + 0x8a, 0x81, 0x9c, 0x9c, 0x00, 0x00, 0x00, 0x00 + }; + ++static const unsigned char fuzz1[] = { ++ 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, ++ 0x06, 0xff, 0xff, 0xff, 0x00, 0x00, 0xf5 ++}; ++ ++static const unsigned char fuzz2[] = { ++ 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, ++ 0x20, 0x20 ++}; ++ + static const char *s4u_principal = "w2k8u@ACME.COM"; + static const char *s4u_enterprise = "w2k8u@abc@ACME.COM"; + +@@ -646,6 +656,14 @@ main(int argc, char **argv) + krb5_free_principal(context, sep); + } + ++ /* Check problematic PACs found by fuzzing. */ ++ ret = krb5_pac_parse(context, fuzz1, sizeof(fuzz1), &pac); ++ if (!ret) ++ err(context, ret, "krb5_pac_parse should have failed"); ++ ret = krb5_pac_parse(context, fuzz2, sizeof(fuzz2), &pac); ++ if (!ret) ++ err(context, ret, "krb5_pac_parse should have failed"); ++ + /* + * Test empty free + */ +-- +2.37.3 + diff --git a/Read-GSS-configuration-files-with-mtime-0.patch b/Read-GSS-configuration-files-with-mtime-0.patch new file mode 100644 index 0000000..5bcae39 --- /dev/null +++ b/Read-GSS-configuration-files-with-mtime-0.patch @@ -0,0 +1,71 @@ +From f8747c22fd159ad3556fdf6ec4f269c754c1eadb Mon Sep 17 00:00:00 2001 +From: Simo Sorce +Date: Thu, 19 May 2022 12:27:40 -0400 +Subject: [PATCH] Read GSS configuration files with mtime 0 + +There is at least one case (with flatpaks) where configuration files +in the special read-only /etc all have an mtime of 0. Using an +initial last modified time of 0 in g_initialize.c causes these files +to never be read. + +Change the initial high value to the be the "invalid" value +(time_t)-1. Since the C and POSIX standards do not require time_t to +be signed, special-case the checks in load_if_changed() and +updateMechList() to treat all mod times as newer than -1. + +[ghudson@mit.edu: edited commit message; slightly modified approach] + +ticket: 9060 (new) +target_version: 1.20 +tags: pullup +--- + src/lib/gssapi/mechglue/g_initialize.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c +index 6d49700a5..857d4a4f2 100644 +--- a/src/lib/gssapi/mechglue/g_initialize.c ++++ b/src/lib/gssapi/mechglue/g_initialize.c +@@ -93,7 +93,7 @@ static void free_mechSet(void); + static gss_mech_info g_mechList = NULL; + static gss_mech_info g_mechListTail = NULL; + static k5_mutex_t g_mechListLock = K5_MUTEX_PARTIAL_INITIALIZER; +-static time_t g_confFileModTime = (time_t)0; ++static time_t g_confFileModTime = (time_t)-1; + static time_t g_confLastCall = (time_t)0; + + static gss_OID_set_desc g_mechSet = { 0, NULL }; +@@ -469,9 +469,9 @@ load_if_changed(const char *pathname, time_t last, time_t *highest) + mtime = check_link_mtime(pathname, &mtime); + if (mtime == (time_t)-1) + return; +- if (mtime > *highest) ++ if (mtime > *highest || *highest == (time_t)-1) + *highest = mtime; +- if (mtime > last) ++ if (mtime > last || last == (time_t)-1) + loadConfigFile(pathname); + } + +@@ -482,7 +482,7 @@ static void + loadConfigFiles() + { + glob_t globbuf; +- time_t highest = 0, now; ++ time_t highest = (time_t)-1, now; + char **path; + const char *val; + +@@ -522,7 +522,8 @@ updateMechList(void) + + #if defined(_WIN32) + time_t lastConfModTime = getRegConfigModTime(MECH_KEY); +- if (g_confFileModTime >= lastConfModTime) ++ if (g_confFileModTime >= lastConfModTime && ++ g_confFileModTime != (time_t)-1) + return; + g_confFileModTime = lastConfModTime; + loadConfigFromRegistry(HKEY_CURRENT_USER, MECH_KEY); +-- +2.35.3 + diff --git a/Try-harder-to-avoid-password-change-replay-errors.patch b/Try-harder-to-avoid-password-change-replay-errors.patch new file mode 100644 index 0000000..8ae1885 --- /dev/null +++ b/Try-harder-to-avoid-password-change-replay-errors.patch @@ -0,0 +1,91 @@ +From f214136115e2e8724866de258021e93554034678 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 4 Mar 2022 00:45:00 -0500 +Subject: [PATCH] Try harder to avoid password change replay errors + +Commit d7b3018d338fc9c989c3fa17505870f23c3759a8 (ticket 7905) changed +change_set_password() to prefer TCP. However, because UDP_LAST falls +back to UDP after one second, we can still get a replay error due to a +dropped packet, before the TCP layer has a chance to retry. + +Instead, try k5_sendto() with NO_UDP, and only fall back to UDP after +TCP fails completely without reaching a server. In sendto_kdc.c, +implement an ONLY_UDP transport strategy to allow the UDP fallback. + +ticket: 9037 +--- + src/lib/krb5/os/changepw.c | 9 ++++++++- + src/lib/krb5/os/os-proto.h | 1 + + src/lib/krb5/os/sendto_kdc.c | 12 ++++++++---- + 3 files changed, 17 insertions(+), 5 deletions(-) + +diff --git a/src/lib/krb5/os/changepw.c b/src/lib/krb5/os/changepw.c +index 9f968da7f..c59232586 100644 +--- a/src/lib/krb5/os/changepw.c ++++ b/src/lib/krb5/os/changepw.c +@@ -255,9 +255,16 @@ change_set_password(krb5_context context, + callback_info.pfn_cleanup = kpasswd_sendto_msg_cleanup; + krb5_free_data_contents(callback_ctx.context, &chpw_rep); + ++ /* UDP retransmits may be seen as replays. Only try UDP after other ++ * transports fail completely. */ + code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm, +- &sl, UDP_LAST, &callback_info, &chpw_rep, ++ &sl, NO_UDP, &callback_info, &chpw_rep, + ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL); ++ if (code == KRB5_KDC_UNREACH) { ++ code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm, ++ &sl, ONLY_UDP, &callback_info, &chpw_rep, ++ ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL); ++ } + if (code) + goto cleanup; + +diff --git a/src/lib/krb5/os/os-proto.h b/src/lib/krb5/os/os-proto.h +index a985f2aec..91d2791ce 100644 +--- a/src/lib/krb5/os/os-proto.h ++++ b/src/lib/krb5/os/os-proto.h +@@ -49,6 +49,7 @@ typedef enum { + UDP_FIRST = 0, + UDP_LAST, + NO_UDP, ++ ONLY_UDP + } k5_transport_strategy; + + /* A single server hostname or address. */ +diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c +index 0eedec175..c7f5d861a 100644 +--- a/src/lib/krb5/os/sendto_kdc.c ++++ b/src/lib/krb5/os/sendto_kdc.c +@@ -802,11 +802,14 @@ resolve_server(krb5_context context, const krb5_data *realm, + int err, result; + char portbuf[PORT_LENGTH]; + +- /* Skip UDP entries if we don't want UDP. */ ++ /* Skip entries excluded by the strategy. */ + if (strategy == NO_UDP && entry->transport == UDP) + return 0; ++ if (strategy == ONLY_UDP && entry->transport != UDP && ++ entry->transport != TCP_OR_UDP) ++ return 0; + +- transport = (strategy == UDP_FIRST) ? UDP : TCP; ++ transport = (strategy == UDP_FIRST || strategy == ONLY_UDP) ? UDP : TCP; + if (entry->hostname == NULL) { + /* Added by a module, so transport is either TCP or UDP. */ + ai.ai_socktype = socktype_for_transport(entry->transport); +@@ -850,8 +853,9 @@ resolve_server(krb5_context context, const krb5_data *realm, + } + + /* For TCP_OR_UDP entries, add each address again with the non-preferred +- * transport, unless we are avoiding UDP. Flag these as deferred. */ +- if (retval == 0 && entry->transport == TCP_OR_UDP && strategy != NO_UDP) { ++ * transport, if there is one. Flag these as deferred. */ ++ if (retval == 0 && entry->transport == TCP_OR_UDP && ++ (strategy == UDP_FIRST || strategy == UDP_LAST)) { + transport = (strategy == UDP_FIRST) ? TCP : UDP; + for (a = addrs; a != 0 && retval == 0; a = a->ai_next) { + a->ai_socktype = socktype_for_transport(transport); +-- +2.35.1 + diff --git a/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch b/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch new file mode 100644 index 0000000..5c0c425 --- /dev/null +++ b/Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch @@ -0,0 +1,113 @@ +From 73daa015af24476bb7cf7e36a7b16d7197c81acd Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Fri, 11 Mar 2022 11:33:56 +0100 +Subject: [PATCH] Use SHA-256 instead of SHA-1 for PKINIT CMS digest + +Various organizations including NIST have been strongly recommending to +stop using SHA-1 for digital signatures for some years already. CMS +digest is used to generate such signatures, hence it should be upgraded +to use SHA-256. +--- + .../preauth/pkinit/pkinit_crypto_openssl.c | 27 ++++++++++--------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index 42e5c581d..2a6ef4aaa 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -1240,7 +1240,7 @@ cms_signeddata_create(krb5_context context, + /* will not fill-out EVP_PKEY because it's on the smartcard */ + + /* Set digest algs */ +- p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha1); ++ p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha256); + + if (p7si->digest_alg->parameter != NULL) + ASN1_TYPE_free(p7si->digest_alg->parameter); +@@ -1251,17 +1251,17 @@ cms_signeddata_create(krb5_context context, + /* Set sig algs */ + if (p7si->digest_enc_alg->parameter != NULL) + ASN1_TYPE_free(p7si->digest_enc_alg->parameter); +- p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha1WithRSAEncryption); ++ p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha256WithRSAEncryption); + if (!(p7si->digest_enc_alg->parameter = ASN1_TYPE_new())) + goto cleanup; + p7si->digest_enc_alg->parameter->type = V_ASN1_NULL; + + /* add signed attributes */ +- /* compute sha1 digest over the EncapsulatedContentInfo */ ++ /* compute sha256 digest over the EncapsulatedContentInfo */ + ctx = EVP_MD_CTX_new(); + if (ctx == NULL) + goto cleanup; +- EVP_DigestInit_ex(ctx, EVP_sha1(), NULL); ++ EVP_DigestInit_ex(ctx, EVP_sha256(), NULL); + EVP_DigestUpdate(ctx, data, data_len); + md_tmp = EVP_MD_CTX_md(ctx); + EVP_DigestFinal_ex(ctx, md_data, &md_len); +@@ -1289,9 +1289,10 @@ cms_signeddata_create(krb5_context context, + goto cleanup2; + + #ifndef WITHOUT_PKCS11 +- /* Some tokens can only do RSAEncryption without sha1 hash */ +- /* to compute sha1WithRSAEncryption, encode the algorithm ID for the hash +- * function and the hash value into an ASN.1 value of type DigestInfo ++ /* Some tokens can only do RSAEncryption without sha256 hash */ ++ /* to compute sha256WithRSAEncryption, encode the algorithm ID for the ++ * hash function and the hash value into an ASN.1 value of type ++ * DigestInfo + * DigestInfo::=SEQUENCE { + * digestAlgorithm AlgorithmIdentifier, + * digest OCTET STRING } +@@ -1310,7 +1311,7 @@ cms_signeddata_create(krb5_context context, + alg = X509_ALGOR_new(); + if (alg == NULL) + goto cleanup2; +- X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha1), V_ASN1_NULL, NULL); ++ X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha256), V_ASN1_NULL, NULL); + alg_len = i2d_X509_ALGOR(alg, NULL); + + digest = ASN1_OCTET_STRING_new(); +@@ -1339,7 +1340,7 @@ cms_signeddata_create(krb5_context context, + #endif + { + pkiDebug("mech = %s\n", +- id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA1_RSA_PKCS" : "FS"); ++ id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA256_RSA_PKCS" : "FS"); + retval = pkinit_sign_data(context, id_cryptoctx, abuf, alen, + &sig, &sig_len); + } +@@ -4189,7 +4190,7 @@ create_signature(unsigned char **sig, unsigned int *sig_len, + ctx = EVP_MD_CTX_new(); + if (ctx == NULL) + return ENOMEM; +- EVP_SignInit(ctx, EVP_sha1()); ++ EVP_SignInit(ctx, EVP_sha256()); + EVP_SignUpdate(ctx, data, data_len); + *sig_len = EVP_PKEY_size(pkey); + if ((*sig = malloc(*sig_len)) == NULL) +@@ -4663,10 +4664,10 @@ pkinit_get_certs_pkcs11(krb5_context context, + + #ifndef PKINIT_USE_MECH_LIST + /* +- * We'd like to use CKM_SHA1_RSA_PKCS for signing if it's available, but ++ * We'd like to use CKM_SHA256_RSA_PKCS for signing if it's available, but + * many cards seems to be confused about whether they are capable of + * this or not. The safe thing seems to be to ignore the mechanism list, +- * always use CKM_RSA_PKCS and calculate the sha1 digest ourselves. ++ * always use CKM_RSA_PKCS and calculate the sha256 digest ourselves. + */ + + id_cryptoctx->mech = CKM_RSA_PKCS; +@@ -4694,7 +4695,7 @@ pkinit_get_certs_pkcs11(krb5_context context, + if (mechp[i] == CKM_RSA_PKCS) { + /* This seems backwards... */ + id_cryptoctx->mech = +- (info.flags & CKF_SIGN) ? CKM_SHA1_RSA_PKCS : CKM_RSA_PKCS; ++ (info.flags & CKF_SIGN) ? CKM_SHA256_RSA_PKCS : CKM_RSA_PKCS; + } + } + free(mechp); +-- +2.35.1 + diff --git a/downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch b/downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch new file mode 100644 index 0000000..7455cb9 --- /dev/null +++ b/downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch @@ -0,0 +1,81 @@ +From a43d621ae83c89abb74764f0fd9d90a8e9992333 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Thu, 5 May 2022 17:15:12 +0200 +Subject: [PATCH] Allow krad UDP/TCP localhost connection with FIPS + +libkrad allows to establish connections only to UNIX socket in FIPS +mode, because MD5 digest is not considered safe enough to be used for +network communication. However, FreeRadius requires connection on TCP or +UDP ports. + +This commit allows TCP or UDP connections in FIPS mode if destination is +localhost. + +Resolves: rhbz#2082189 +--- + src/lib/krad/remote.c | 35 +++++++++++++++++++++++++++++++++-- + 1 file changed, 33 insertions(+), 2 deletions(-) + +diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c +index 7b5804b1d..e671bc5c2 100644 +--- a/src/lib/krad/remote.c ++++ b/src/lib/krad/remote.c +@@ -33,6 +33,7 @@ + + #include + #include ++#include + + #include + +@@ -74,6 +75,35 @@ on_io(verto_ctx *ctx, verto_ev *ev); + static void + on_timeout(verto_ctx *ctx, verto_ev *ev); + ++static in_addr_t get_in_addr(struct addrinfo *info) ++{ return ((struct sockaddr_in *)(info->ai_addr))->sin_addr.s_addr; } ++ ++static struct in6_addr *get_in6_addr(struct addrinfo *info) ++{ return &(((struct sockaddr_in6 *)(info->ai_addr))->sin6_addr); } ++ ++static bool is_inet_localhost(struct addrinfo *info) ++{ ++ struct addrinfo *p; ++ ++ for (p = info; p; p = p->ai_next) { ++ switch (p->ai_family) { ++ case AF_INET: ++ if (IN_LOOPBACKNET != (get_in_addr(p) & IN_CLASSA_NET ++ >> IN_CLASSA_NSHIFT)) ++ return false; ++ break; ++ case AF_INET6: ++ if (!IN6_IS_ADDR_LOOPBACK(get_in6_addr(p))) ++ return false; ++ break; ++ default: ++ return false; ++ } ++ } ++ ++ return true; ++} ++ + /* Iterate over the set of outstanding packets. */ + static const krad_packet * + iterator(request **out) +@@ -455,8 +485,9 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, + (krad_packet_iter_cb)iterator, &r, &tmp); + if (retval != 0) + goto error; +- else if (tmp->is_fips && rr->info->ai_family != AF_LOCAL && +- rr->info->ai_family != AF_UNIX) { ++ else if (tmp->is_fips && rr->info->ai_family != AF_LOCAL ++ && rr->info->ai_family != AF_UNIX ++ && !is_inet_localhost(rr->info)) { + /* This would expose cleartext passwords, so abort. */ + retval = ESOCKTNOSUPPORT; + goto error; +-- +2.35.1 + diff --git a/krb5-krad-larger-attrs.patch b/krb5-krad-larger-attrs.patch new file mode 100644 index 0000000..32111ec --- /dev/null +++ b/krb5-krad-larger-attrs.patch @@ -0,0 +1,69 @@ +From f35077bfc570205092eca2a9d44e50ce265622f4 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Mon, 8 Nov 2021 17:48:50 +0100 +Subject: [PATCH] Support larger RADIUS attributes in libkrad + +In kr_attrset_decode(), explicitly treat the length byte as unsigned. +Otherwise attributes longer than 125 characters will be rejected with +EBADMSG. + +Add a 253-character-long NAS-Identifier attribute to the tests to make +sure that attributes with the maximal number of characters are working +as expected. + +[ghudson@mit.edu: used uint8_t cast per current practices; edited +commit message] + +ticket: 9036 (new) +--- + src/lib/krad/attrset.c | 2 +- + src/lib/krad/t_packet.c | 13 +++++++++++++ + 2 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c +index 03c613716..f309f1581 100644 +--- a/src/lib/krad/attrset.c ++++ b/src/lib/krad/attrset.c +@@ -217,7 +217,7 @@ kr_attrset_decode(krb5_context ctx, const krb5_data *in, const char *secret, + + for (i = 0; i + 2 < in->length; ) { + type = in->data[i++]; +- tmp = make_data(&in->data[i + 1], in->data[i] - 2); ++ tmp = make_data(&in->data[i + 1], (uint8_t)in->data[i] - 2); + i += tmp.length + 1; + + retval = (in->length < i) ? EBADMSG : 0; +diff --git a/src/lib/krad/t_packet.c b/src/lib/krad/t_packet.c +index 0a92e9cc2..c22489144 100644 +--- a/src/lib/krad/t_packet.c ++++ b/src/lib/krad/t_packet.c +@@ -57,6 +57,14 @@ make_packet(krb5_context ctx, const krb5_data *username, + krb5_error_code retval; + const krb5_data *data; + int i = 0; ++ krb5_data nas_id; ++ ++ nas_id = string2data("12345678901234567890123456789012345678901234567890" ++ "12345678901234567890123456789012345678901234567890" ++ "12345678901234567890123456789012345678901234567890" ++ "12345678901234567890123456789012345678901234567890" ++ "12345678901234567890123456789012345678901234567890" ++ "123"); + + retval = krad_attrset_new(ctx, &set); + if (retval != 0) +@@ -71,6 +79,11 @@ make_packet(krb5_context ctx, const krb5_data *username, + if (retval != 0) + goto out; + ++ retval = krad_attrset_add(set, krad_attr_name2num("NAS-Identifier"), ++ &nas_id); ++ if (retval != 0) ++ goto out; ++ + retval = krad_packet_new_request(ctx, "foo", + krad_code_name2num("Access-Request"), + set, iterator, &i, &tmp); +-- +2.35.1 + diff --git a/krb5-krad-remote.patch b/krb5-krad-remote.patch new file mode 100644 index 0000000..42452ff --- /dev/null +++ b/krb5-krad-remote.patch @@ -0,0 +1,209 @@ +From ce160f8826bae223876a6527a731c36b6912db15 Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Tue, 9 Nov 2021 13:00:43 -0500 +Subject: [PATCH 1/2] Avoid use after free during libkrad cleanup + +libkrad client requests contain a list of references to remotes, with +no back-references or reference counts. To prevent accesses to +dangling references during cleanup, cancel all requests on all remotes +before freeing any remotes. + +Remove the code for aging out unused servers. This code was fairly +safe as all requests referencing a remote should have completed or +timed out during an hour of disuse, but in the current design we have +no way to guarantee or check that. The set of addresses we send +RADIUS requests to will generally be small, so aging out servers is +unnecessary. + +ticket: 9035 (new) +--- + src/lib/krad/client.c | 42 ++++++++++++++--------------------------- + src/lib/krad/internal.h | 4 ++++ + src/lib/krad/remote.c | 11 ++++++++--- + 3 files changed, 26 insertions(+), 31 deletions(-) + +diff --git a/src/lib/krad/client.c b/src/lib/krad/client.c +index 6365dd1c6..810940afc 100644 +--- a/src/lib/krad/client.c ++++ b/src/lib/krad/client.c +@@ -64,7 +64,6 @@ struct request_st { + + struct server_st { + krad_remote *serv; +- time_t last; + K5_LIST_ENTRY(server_st) list; + }; + +@@ -81,15 +80,10 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret, + krad_remote **out) + { + krb5_error_code retval; +- time_t currtime; + server *srv; + +- if (time(&currtime) == (time_t)-1) +- return errno; +- + K5_LIST_FOREACH(srv, &rc->servers, list) { + if (kr_remote_equals(srv->serv, ai, secret)) { +- srv->last = currtime; + *out = srv->serv; + return 0; + } +@@ -98,7 +92,6 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret, + srv = calloc(1, sizeof(server)); + if (srv == NULL) + return ENOMEM; +- srv->last = currtime; + + retval = kr_remote_new(rc->kctx, rc->vctx, ai, secret, &srv->serv); + if (retval != 0) { +@@ -173,28 +166,12 @@ request_new(krad_client *rc, krad_code code, const krad_attrset *attrs, + return 0; + } + +-/* Close remotes that haven't been used in a while. */ +-static void +-age(struct server_head *head, time_t currtime) +-{ +- server *srv, *tmp; +- +- K5_LIST_FOREACH_SAFE(srv, head, list, tmp) { +- if (currtime == (time_t)-1 || currtime - srv->last > 60 * 60) { +- K5_LIST_REMOVE(srv, list); +- kr_remote_free(srv->serv); +- free(srv); +- } +- } +-} +- + /* Handle a response from a server (or related errors). */ + static void + on_response(krb5_error_code retval, const krad_packet *reqp, + const krad_packet *rspp, void *data) + { + request *req = data; +- time_t currtime; + size_t i; + + /* Do nothing if we are already completed. */ +@@ -221,10 +198,6 @@ on_response(krb5_error_code retval, const krad_packet *reqp, + for (i = 0; req->remotes[i].remote != NULL; i++) + kr_remote_cancel(req->remotes[i].remote, req->remotes[i].packet); + +- /* Age out servers that haven't been used in a while. */ +- if (time(&currtime) != (time_t)-1) +- age(&req->rc->servers, currtime); +- + request_free(req); + } + +@@ -247,10 +220,23 @@ krad_client_new(krb5_context kctx, verto_ctx *vctx, krad_client **out) + void + krad_client_free(krad_client *rc) + { ++ server *srv; ++ + if (rc == NULL) + return; + +- age(&rc->servers, -1); ++ /* Cancel all requests before freeing any remotes, since each request's ++ * callback data may contain references to multiple remotes. */ ++ K5_LIST_FOREACH(srv, &rc->servers, list) ++ kr_remote_cancel_all(srv->serv); ++ ++ while (!K5_LIST_EMPTY(&rc->servers)) { ++ srv = K5_LIST_FIRST(&rc->servers); ++ K5_LIST_REMOVE(srv, list); ++ kr_remote_free(srv->serv); ++ free(srv); ++ } ++ + free(rc); + } + +diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h +index 0143d155a..7619563fc 100644 +--- a/src/lib/krad/internal.h ++++ b/src/lib/krad/internal.h +@@ -109,6 +109,10 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs, + void + kr_remote_cancel(krad_remote *rr, const krad_packet *pkt); + ++/* Cancel all requests awaiting responses. */ ++void ++kr_remote_cancel_all(krad_remote *rr); ++ + /* Determine if this remote object refers to the remote resource identified + * by the addrinfo struct and the secret. */ + krb5_boolean +diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c +index 7e491e994..06ae751bc 100644 +--- a/src/lib/krad/remote.c ++++ b/src/lib/krad/remote.c +@@ -421,15 +421,20 @@ error: + return retval; + } + ++void ++kr_remote_cancel_all(krad_remote *rr) ++{ ++ while (!K5_TAILQ_EMPTY(&rr->list)) ++ request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL); ++} ++ + void + kr_remote_free(krad_remote *rr) + { + if (rr == NULL) + return; + +- while (!K5_TAILQ_EMPTY(&rr->list)) +- request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL); +- ++ kr_remote_cancel_all(rr); + free(rr->secret); + if (rr->info != NULL) + free(rr->info->ai_addr); +-- +2.35.1 + + +From e0084425df784952e76b3bcc8ae9d08300234733 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Mon, 8 Nov 2021 17:47:17 +0100 +Subject: [PATCH 2/2] More python3 fixes for t_daemon.py + +[ghudson@mit.edu: use a list comprehension instead of map()] +--- + src/lib/krad/t_daemon.py | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/lib/krad/t_daemon.py b/src/lib/krad/t_daemon.py +index 7668cd7f8..4a3de079c 100755 +--- a/src/lib/krad/t_daemon.py ++++ b/src/lib/krad/t_daemon.py +@@ -50,7 +50,7 @@ class TestServer(server.Server): + + for key in pkt.keys(): + if key == "User-Password": +- passwd = map(pkt.PwDecrypt, pkt[key]) ++ passwd = [pkt.PwDecrypt(x) for x in pkt[key]] + + reply = self.CreateReplyPacket(pkt) + if passwd == ['accept']: +@@ -61,8 +61,8 @@ class TestServer(server.Server): + + srv = TestServer(addresses=["localhost"], + hosts={"127.0.0.1": +- server.RemoteHost("127.0.0.1", "foo", "localhost")}, +- dict=dictionary.Dictionary(StringIO.StringIO(DICTIONARY))) ++ server.RemoteHost("127.0.0.1", b"foo", "localhost")}, ++ dict=dictionary.Dictionary(StringIO(DICTIONARY))) + + # Write a sentinel character to let the parent process know we're listening. + sys.stdout.write("~") +-- +2.35.1 + diff --git a/krb5.spec b/krb5.spec index 4d595fb..b958c36 100644 --- a/krb5.spec +++ b/krb5.spec @@ -1,8 +1,3 @@ -# Force to not include the package note file -# the non-existing package note file is pulled into krb5-config -# and breaks any application that is using krb5 development libs -%undefine _package_note_file - %bcond_without check %if %{without check} %global skipcheck 1 @@ -47,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}5%{?dist} +Release: %{?zdpd}12%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -99,6 +94,14 @@ Patch33: Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch Patch34: Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch Patch35: Handle-OpenSSL-3-s-providers.patch Patch36: Remove-TCL-based-libkadm5-API-tests.patch +Patch37: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch +Patch38: krb5-krad-remote.patch +Patch39: krb5-krad-larger-attrs.patch +Patch40: Try-harder-to-avoid-password-change-replay-errors.patch +Patch41: Add-configure-variable-for-default-PKCS-11-module.patch +Patch42: downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch +Patch43: Read-GSS-configuration-files-with-mtime-0.patch +Patch44: Fix-integer-overflows-in-PAC-parsing.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -158,7 +161,7 @@ to install this package. %package libs Summary: The non-admin shared libraries used by Kerberos 5 Requires: openssl-libs >= 1:3.0.0 -Requires: coreutils, gawk, grep, sed +Requires: coreutils, gawk, sed Requires: keyutils-libs >= 1.5.8 Requires: /etc/crypto-policies/back-ends/krb5.config @@ -290,6 +293,7 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`" CFLAGS="$CFLAGS" \ CPPFLAGS="$CPPFLAGS" \ SS_LIB="-lss" \ + PKCS11_MODNAME="p11-kit-proxy.so" \ --enable-shared \ --runstatedir=/run \ --localstatedir=%{_var}/kerberos \ @@ -436,7 +440,8 @@ sed -r -i -e 's|^libdir=/usr/lib(64)?$|libdir=/usr/lib|g' $RPM_BUILD_ROOT%{_bind # Workaround krb5-config reading too much from LDFLAGS. # https://bugzilla.redhat.com/show_bug.cgi?id=1997021 -sed -i -e "s/-specs=[^ ]*//g" $RPM_BUILD_ROOT%{_bindir}/krb5-config +# https://bugzilla.redhat.com/show_bug.cgi?id=2048909 +sed -i -r -e 's/^(LDFLAGS=).*/\1/' $RPM_BUILD_ROOT%{_bindir}/krb5-config # Install processed man pages. for section in 1 5 8 ; do @@ -465,12 +470,6 @@ rm -- "$RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth/test.so" %ldconfig_scriptlets libs -%triggerun libs -- krb5-libs < 1.15.1-5 -if ! grep -q 'includedir /etc/krb5.conf.d' /etc/krb5.conf ; then - sed -i '1i # To opt out of the system crypto-policies configuration of krb5, remove the\n# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.\nincludedir /etc/krb5.conf.d/\n' /etc/krb5.conf -fi -exit 0 - %ldconfig_scriptlets server-ldap %post server @@ -653,6 +652,35 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Nov 09 2022 Julien Rische - 1.19.2-12 +- Fix integer overflows in PAC parsing (CVE-2022-42898) +- Resolves: rhbz#2143010 + +* Wed Jun 15 2022 Julien Rische - 1.19.2-11 +- Allow libkrad UDP/TCP connection to localhost in FIPS mode +- Resolves: rhbz#2082189 +- Read GSS configuration files with mtime 0 + +* Mon May 2 2022 Julien Rische - 1.19.2-10 +- Use p11-kit as default PKCS11 module +- Resolves: rhbz#2073274 +- Try harder to avoid password change replay errors +- Resolves: rhbz#2076965 + +* Tue Apr 05 2022 Alexander Bokovoy - 1.19.2-9 +- Fix libkrad client cleanup +- Fixes rhbz#2072059 + +* Tue Apr 05 2022 Alexander Bokovoy - 1.19.2-8 +- Allow use of larger RADIUS attributes in krad library + +* Wed Mar 23 2022 Julien Rische - 1.19.2-7 +- Use SHA-256 instead of SHA-1 for PKINIT CMS digest + +* Tue Feb 8 2022 Zbigniew Jędrzejewski-Szmek - 1.19.2-6 +- Drop old trigger scriplet +- Reenable package notes and strip LDFLAGS from krb5-config (rhbz#2048909) + * Wed Feb 02 2022 Alexander Bokovoy - 1.19.2-5 - Temporarily remove package note to unblock krb5-dependent packages - Resolves: rhbz#2048909