diff --git a/0039-Fix-strchr-conformance-to-C23.patch b/0039-Fix-strchr-conformance-to-C23.patch deleted file mode 100644 index ed2cfa7..0000000 --- a/0039-Fix-strchr-conformance-to-C23.patch +++ /dev/null @@ -1,189 +0,0 @@ -From 1761e06398e4f043e4f540f57131c37fcc53a1b9 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Wed, 10 Dec 2025 10:42:02 +0200 -Subject: [PATCH] Fix strchr() conformance to C23 - -C23 7.28.5.1 specifies search functions such as strchr() as generic, -returning const char * if the first argument is of type const char *. -Fix uses of strchr() to conform to this change. - -[jrische@redhat.com: altered changes to avoid casts; fixed an -additional case] -[ghudson@mit.edu: condensed some declarations; rewrote commit message] - -ticket: 9191 (new) -(cherry picked from commit 6cd8580d823585d50ee4f30efd9f7e855823a369) ---- - src/lib/krb5/ccache/ccbase.c | 4 ++-- - src/lib/krb5/os/expand_path.c | 3 ++- - src/lib/krb5/os/locate_kdc.c | 15 +++++++-------- - src/plugins/preauth/pkinit/pkinit_crypto.h | 2 +- - .../preauth/pkinit/pkinit_crypto_openssl.c | 6 +++--- - src/plugins/preauth/pkinit/pkinit_identity.c | 2 +- - src/plugins/preauth/pkinit/pkinit_matching.c | 2 +- - src/tests/responder.c | 3 +-- - 8 files changed, 18 insertions(+), 19 deletions(-) - -diff --git a/src/lib/krb5/ccache/ccbase.c b/src/lib/krb5/ccache/ccbase.c -index 5a01320832..1aada91b5e 100644 ---- a/src/lib/krb5/ccache/ccbase.c -+++ b/src/lib/krb5/ccache/ccbase.c -@@ -201,8 +201,8 @@ krb5_cc_register(krb5_context context, const krb5_cc_ops *ops, - krb5_error_code KRB5_CALLCONV - krb5_cc_resolve (krb5_context context, const char *name, krb5_ccache *cache) - { -- char *pfx, *cp; -- const char *resid; -+ char *pfx; -+ const char *cp, *resid; - unsigned int pfxlen; - krb5_error_code err; - const krb5_cc_ops *ops; -diff --git a/src/lib/krb5/os/expand_path.c b/src/lib/krb5/os/expand_path.c -index 5cbccf08c8..6569b8820b 100644 ---- a/src/lib/krb5/os/expand_path.c -+++ b/src/lib/krb5/os/expand_path.c -@@ -454,7 +454,8 @@ k5_expand_path_tokens_extra(krb5_context context, const char *path_in, - { - krb5_error_code ret; - struct k5buf buf; -- char *tok_begin, *tok_end, *tok_val, **extra_tokens = NULL, *path; -+ const char *tok_begin, *tok_end; -+ char *tok_val, **extra_tokens = NULL, *path; - const char *path_left; - size_t nargs = 0, i; - va_list ap; -diff --git a/src/lib/krb5/os/locate_kdc.c b/src/lib/krb5/os/locate_kdc.c -index edca5ac7eb..47e15c849f 100644 ---- a/src/lib/krb5/os/locate_kdc.c -+++ b/src/lib/krb5/os/locate_kdc.c -@@ -188,8 +188,8 @@ oom: - } - - static void --parse_uri_if_https(const char *host_or_uri, k5_transport *transport, -- const char **host, const char **uri_path) -+parse_uri_if_https(char *host_or_uri, k5_transport *transport, -+ char **host, const char **uri_path) - { - char *cp; - -@@ -229,8 +229,7 @@ locate_srv_conf_1(krb5_context context, const krb5_data *realm, - k5_transport transport, int udpport) - { - const char *realm_srv_names[4]; -- char **hostlist = NULL, *realmstr = NULL, *host = NULL; -- const char *hostspec; -+ char **hostlist = NULL, *realmstr = NULL, *host = NULL, *hostspec; - krb5_error_code code; - int i, default_port; - -@@ -535,8 +534,8 @@ prof_locate_server(krb5_context context, const krb5_data *realm, - * Return a NULL *host_out if there are any problems parsing the URI. - */ - static void --parse_uri_fields(const char *uri, k5_transport *transport_out, -- const char **host_out, int *primary_out) -+parse_uri_fields(char *uri, k5_transport *transport_out, -+ char **host_out, int *primary_out) - - { - k5_transport transport; -@@ -604,8 +603,8 @@ locate_uri(krb5_context context, const krb5_data *realm, - krb5_error_code ret; - k5_transport transport, host_trans; - struct srv_dns_entry *answers, *entry; -- char *host; -- const char *host_field, *path; -+ char *host, *host_field; -+ const char *path; - int port, def_port, primary; - - ret = k5_make_uri_query(context, realm, req_service, &answers); -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h -index 3b12e904b1..99e2394040 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto.h -+++ b/src/plugins/preauth/pkinit/pkinit_crypto.h -@@ -456,7 +456,7 @@ krb5_error_code crypto_load_cas_and_crls - defines the storage type (file, directory, etc) */ - int catype, /* IN - defines the ca type (anchor, intermediate, crls) */ -- char *id); /* IN -+ const char *id); /* IN - defines the location (filename, directory name, etc) */ - - /* -diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -index 429b7d202c..6013080afc 100644 ---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c -@@ -4956,7 +4956,7 @@ load_cas_and_crls(krb5_context context, - pkinit_req_crypto_context req_cryptoctx, - pkinit_identity_crypto_context id_cryptoctx, - int catype, -- char *filename) -+ const char *filename) - { - STACK_OF(X509_INFO) *sk = NULL; - STACK_OF(X509) *ca_certs = NULL; -@@ -5114,7 +5114,7 @@ load_cas_and_crls_dir(krb5_context context, - pkinit_req_crypto_context req_cryptoctx, - pkinit_identity_crypto_context id_cryptoctx, - int catype, -- char *dirname) -+ const char *dirname) - { - krb5_error_code retval = EINVAL; - DIR *d = NULL; -@@ -5166,7 +5166,7 @@ crypto_load_cas_and_crls(krb5_context context, - pkinit_identity_crypto_context id_cryptoctx, - int idtype, - int catype, -- char *id) -+ const char *id) - { - switch (idtype) { - case IDTYPE_FILE: -diff --git a/src/plugins/preauth/pkinit/pkinit_identity.c b/src/plugins/preauth/pkinit/pkinit_identity.c -index a5a979f279..b06d519c66 100644 ---- a/src/plugins/preauth/pkinit/pkinit_identity.c -+++ b/src/plugins/preauth/pkinit/pkinit_identity.c -@@ -474,7 +474,7 @@ process_option_ca_crl(krb5_context context, - const char *value, - int catype) - { -- char *residual; -+ const char *residual; - unsigned int typelen; - int idtype; - -diff --git a/src/plugins/preauth/pkinit/pkinit_matching.c b/src/plugins/preauth/pkinit/pkinit_matching.c -index b42485a50a..5a7f2ba3fa 100644 ---- a/src/plugins/preauth/pkinit/pkinit_matching.c -+++ b/src/plugins/preauth/pkinit/pkinit_matching.c -@@ -263,7 +263,7 @@ parse_rule_component(krb5_context context, - char err_buf[128]; - int ret; - struct keyword_desc *kw, *nextkw; -- char *nk; -+ const char *nk; - int found_next_kw = 0; - char *value = NULL; - size_t len; -diff --git a/src/tests/responder.c b/src/tests/responder.c -index 82f870ea5d..4221a20283 100644 ---- a/src/tests/responder.c -+++ b/src/tests/responder.c -@@ -282,8 +282,7 @@ responder(krb5_context ctx, void *rawdata, krb5_responder_context rctx) - /* Provide a particular response for an OTP challenge. */ - if (data->otp_answer != NULL) { - if (krb5_responder_otp_get_challenge(ctx, rctx, &ochl) == 0) { -- key = strchr(data->otp_answer, '='); -- if (key != NULL) { -+ if (strchr(data->otp_answer, '=') != NULL) { - /* Make a copy of the answer that we can chop up. */ - key = strdup(data->otp_answer); - if (key == NULL) --- -2.51.1 - diff --git a/0040-automated-fast.patch b/0040-automated-fast.patch deleted file mode 100644 index 5a64233..0000000 --- a/0040-automated-fast.patch +++ /dev/null @@ -1,226 +0,0 @@ -From 3baf9b93dc1dfe38585722c71d7268304cb4a01a Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Sun, 21 Sep 2025 11:14:51 +0300 -Subject: libkrb5: in case PKINIT is configured, attempt Anonymous - PKINIT for FAST - -If auto_fast_armor is configured for the realm or globally, optimistically -assume that Anonymous PKINIT is supported as well and try to obtain it for -FAST use in case no pre-made FAST channel was established by the caller. - -This behavior will automatically enable use of passwordless pre-authentication -methods which rely on FAST channel presence in deployments such as FreeIPA. - -Notably, Microsoft Active Directory KDCs do not support Anonymous PKINIT. For -these deployments only a machine account (host keytab) can be used to build a -FAST channel. However, libkrb5 does not have access to /etc/krb5.keytab in a -general case. - -Signed-off-by: Alexander Bokovoy ---- - src/lib/krb5/krb/fast.c | 118 ++++++++++++++++++++++++++++++++++++++++ - src/lib/krb5/krb/fast.h | 2 + - src/man/krb5.conf.man | 13 +++++ - 3 files changed, 133 insertions(+) - -diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c -index 62c9f0841..ee2e08189 100644 ---- a/src/lib/krb5/krb/fast.c -+++ b/src/lib/krb5/krb/fast.c -@@ -168,6 +168,109 @@ krb5int_fast_prep_req_body(krb5_context context, - return retval; - } - -+static krb5_boolean -+fast_is_pkinit_allowed(krb5_context context, krb5_data *realm) -+{ -+ int value; -+ krb5_error_code retval = EINVAL; -+ char realmstr[1024]; -+ const char *option = "auto_fast_armor"; -+ const int def_value = FALSE; -+ -+ if (realm != NULL && realm->length > sizeof(realmstr)-1) -+ return FALSE; -+ -+ if (realm != NULL) { -+ strncpy(realmstr, realm->data, realm->length); -+ realmstr[realm->length] = '\0'; -+ -+ retval = profile_get_boolean(context->profile, -+ KRB5_CONF_REALMS, realmstr, -+ option, def_value, &value); -+ } -+ -+ return retval ? FALSE : value; -+ -+} -+ -+static krb5_error_code -+fast_acquire_pkinit_armor(krb5_context context, -+ struct krb5int_fast_request_state *state, -+ krb5_get_init_creds_opt *opt, krb5_kdc_req *request) -+{ -+ krb5_context ctx; -+ krb5_get_init_creds_opt *options = NULL; -+ krb5_error_code retval = 0; -+ krb5_data *target_realm = &request->server->realm; -+ krb5_creds creds; -+ krb5_principal anon_princ = NULL; -+ krb5_ccache out_cc; -+ -+ /* short circuit, we are asked to perform Anonymous PKINIT already */ -+ if (opt->flags & KRB5_GET_INIT_CREDS_OPT_ANONYMOUS) { -+ return EINVAL; -+ } -+ -+ /* skip realms which do not allow use of automated FAST armor */ -+ if (!fast_is_pkinit_allowed(context, target_realm)) { -+ return EINVAL; -+ } -+ -+ retval = krb5_init_context(&ctx); -+ if (retval != 0) { -+ return retval; -+ } -+ retval = krb5_get_init_creds_opt_alloc(ctx, &options); -+ if (retval != 0) { -+ goto cleanup; -+ } -+ krb5_get_init_creds_opt_set_anonymous(options, 1); -+ retval = krb5_cc_new_unique(ctx, "MEMORY", NULL, &out_cc); -+ if (retval != 0) { -+ goto cleanup; -+ } -+ -+ retval = krb5_get_init_creds_opt_set_out_ccache(ctx, options, out_cc); -+ if (retval != 0) { -+ goto cleanup; -+ } -+ -+ retval = krb5_build_principal_ext(ctx, &anon_princ, -+ target_realm->length, target_realm->data, -+ strlen(KRB5_WELLKNOWN_NAMESTR), -+ KRB5_WELLKNOWN_NAMESTR, -+ strlen(KRB5_ANONYMOUS_PRINCSTR), -+ KRB5_ANONYMOUS_PRINCSTR, 0); -+ if (retval != 0) { -+ goto cleanup; -+ } -+ -+ retval = krb5_get_init_creds_password(ctx, &creds, anon_princ, 0, -+ NULL /* no prompter */, NULL, -+ 0, NULL /* service name */, -+ options); -+ if (retval == 0) { -+ state->fast_state_flags |= KRB5INT_FAST_OWN_ARMOR; -+ state->armor_ccache = out_cc; -+ } -+cleanup: -+ if (retval != 0 && out_cc != NULL) { -+ (void) krb5_cc_destroy(ctx, out_cc); -+ } -+ if (retval == 0) { -+ krb5_free_cred_contents(ctx, &creds); -+ } -+ if (options != NULL) { -+ krb5_get_init_creds_opt_free(ctx, options); -+ } -+ if (anon_princ != NULL) { -+ krb5_free_principal(ctx, anon_princ); -+ } -+ krb5_free_context(ctx); -+ -+ return retval; -+} -+ - krb5_error_code - krb5int_fast_as_armor(krb5_context context, - struct krb5int_fast_request_state *state, -@@ -178,10 +281,20 @@ krb5int_fast_as_armor(krb5_context context, - krb5_principal target_principal = NULL; - krb5_data *target_realm; - const char *ccname = k5_gic_opt_get_fast_ccache_name(opt); -+ char *fast_ccname = NULL; - krb5_flags fast_flags; - - krb5_clear_error_message(context); - target_realm = &request->server->realm; -+ if (ccname == NULL) { -+ retval = fast_acquire_pkinit_armor(context, state, opt, request); -+ if (retval == 0) { -+ retval = krb5_cc_get_full_name(context, state->armor_ccache, &fast_ccname); -+ if (retval == 0 && fast_ccname != NULL) -+ ccname = fast_ccname; -+ } -+ retval = 0; -+ } - if (ccname != NULL) { - TRACE_FAST_ARMOR_CCACHE(context, ccname); - state->fast_state_flags |= KRB5INT_FAST_ARMOR_AVAIL; -@@ -220,6 +333,8 @@ krb5int_fast_as_armor(krb5_context context, - krb5_cc_close(context, ccache); - if (target_principal) - krb5_free_principal(context, target_principal); -+ if (fast_ccname) -+ free(fast_ccname); - return retval; - } - -@@ -615,6 +730,9 @@ krb5int_fast_free_state(krb5_context context, - /*We are responsible for none of the store in the fast_outer_req*/ - krb5_free_keyblock(context, state->armor_key); - krb5_free_fast_armor(context, state->armor); -+ if (state->fast_state_flags & KRB5INT_FAST_OWN_ARMOR) { -+ krb5_cc_destroy(context, state->armor_ccache); -+ } - free(state); - } - -diff --git a/src/lib/krb5/krb/fast.h b/src/lib/krb5/krb/fast.h -index 7156ea203..e5fe8bd54 100644 ---- a/src/lib/krb5/krb/fast.h -+++ b/src/lib/krb5/krb/fast.h -@@ -34,6 +34,7 @@ struct krb5int_fast_request_state { - krb5_kdc_req fast_outer_request; - krb5_keyblock *armor_key; /*non-null means fast is in use*/ - krb5_fast_armor *armor; -+ krb5_ccache armor_ccache; - krb5_ui_4 fast_state_flags; - krb5_ui_4 fast_options; - krb5_int32 nonce; -@@ -41,6 +42,7 @@ struct krb5int_fast_request_state { - - #define KRB5INT_FAST_DO_FAST (1l<<0) /* Perform FAST */ - #define KRB5INT_FAST_ARMOR_AVAIL (1l<<1) -+#define KRB5INT_FAST_OWN_ARMOR (1l<<2) - - krb5_error_code - krb5int_fast_prep_req_body(krb5_context context, -diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man -index d4caa2bd3..ac7649647 100644 ---- a/src/man/krb5.conf.man -+++ b/src/man/krb5.conf.man -@@ -650,6 +650,19 @@ primary KDC, in case the user\(aqs password has just been changed, and - the updated database has not been propagated to the replica - servers yet. New in release 1.19. - .TP -+\fBauto_fast_armor\fP -+If this flag is true, then initial ticket request will use Anonymous -+PKINIT to protect the communication as a FAST channel in case an application -+did not provide its own FAST channel. This is useful for deployments where -+pre-authentication methods require use of the FAST channel, such as -+passwordless methods provided by FreeIPA. Microsoft Active Directory -+implementation of PKINIT does not support Anonymous PKINIT feature. -+As a result, \fIauto_fast_armor\fP defaults to false. -+.sp -+Use of \fIauto_fast_armor = true\fP requires properly configured PKINIT and -+WELLKNOWN/ANONYMOUS principal defined on the KDC side. Consult KDC documentation -+for details. -+.TP - \fBv4_instance_convert\fP - This subsection allows the administrator to configure exceptions - to the \fBdefault_domain\fP mapping rule. It contains V4 instances --- -2.51.0 - diff --git a/0041-bail-if-prompter-is-not-specified-but-required.patch b/0041-bail-if-prompter-is-not-specified-but-required.patch deleted file mode 100644 index d1a3dc7..0000000 --- a/0041-bail-if-prompter-is-not-specified-but-required.patch +++ /dev/null @@ -1,40 +0,0 @@ -From ff580d9cf86202d45454a6b6f53accc22cb40b62 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Sun, 19 Oct 2025 18:14:29 +0300 -Subject: [PATCH] bail if prompter is not specified but required - -GSSAPI gss_init_sec_context() may trigger credential re-initialization -if the cred in ccache is expired. If automatic FAST armor is in use, -we'd request Anonymous PKINIT and use it as an armor and this will -enable seeing pre-authentication methods which require armor presence. - -OTP is one of such methods and its use requires prompter to be set, -but GSSAPI cannot specify a prompter and thus we should fail any -pre-auth where a prompter wasn't passed. - -PKINIT PKCS11 and SAM-2 preauth methods use KRB5_LIBOS_CANTREADPWD while PKINIT -and gic_pwd.c use EIO. Use EIO here because we technically attempt to read a -PIN rather than a password. - -Signed-off-by: Alexander Bokovoy ---- - src/lib/krb5/krb/preauth_otp.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/src/lib/krb5/krb/preauth_otp.c b/src/lib/krb5/krb/preauth_otp.c -index 07ffc15c2..48003da62 100644 ---- a/src/lib/krb5/krb/preauth_otp.c -+++ b/src/lib/krb5/krb/preauth_otp.c -@@ -479,6 +479,9 @@ doprompt(krb5_context context, krb5_prompter_fct prompter, void *prompter_data, - krb5_error_code retval; - krb5_prompt_type prompt_type = KRB5_PROMPT_TYPE_PREAUTH; - -+ if (prompter == NULL) -+ return EIO; -+ - if (prompttxt == NULL || out == NULL) - return EINVAL; - --- -2.51.0 - diff --git a/krb5.spec b/krb5.spec index 4c5b542..120f1de 100644 --- a/krb5.spec +++ b/krb5.spec @@ -10,7 +10,7 @@ # # baserelease is what we have standardized across Fedora and what # rpmdev-bumpspec knows how to handle. -%global baserelease 11 +%global baserelease 5 # This should be e.g. beta1 or %%nil %global pre_release %nil @@ -97,9 +97,6 @@ Patch0035: 0035-Don-t-issue-session-keys-with-deprecated-enctypes.patch Patch0036: 0036-downstream-Remove-3des-support-cumulative-1.patch Patch0037: 0037-Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch Patch0038: 0038-downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch -Patch0039: 0039-Fix-strchr-conformance-to-C23.patch -Patch0040: 0040-automated-fast.patch -Patch0041: 0041-bail-if-prompter-is-not-specified-but-required.patch License: Brian-Gladman-2-Clause AND BSD-2-Clause AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-first-lines AND BSD-3-Clause AND BSD-4-Clause AND CMU-Mach-nodoc AND FSFULLRWD AND HPND AND HPND-export2-US AND HPND-export-US AND HPND-export-US-acknowledgement AND HPND-export-US-modify AND ISC AND MIT AND MIT-CMU AND OLDAP-2.8 AND OpenVision URL: https://web.mit.edu/kerberos/www/ @@ -133,8 +130,6 @@ BuildRequires: openssl-devel < 1:3.0.0 # Enable compilation of optional tests BuildRequires: resolv_wrapper BuildRequires: libcmocka-devel -BuildRequires: opensc -BuildRequires: softhsm %description Kerberos V5 is a trusted-third-party network authentication system, @@ -166,7 +161,7 @@ Requires: openssl-libs >= 1:3.0.0 Requires: openssl-libs >= 1:1.1.1d-4 Requires: openssl-libs < 1:3.0.0 %endif -Requires: coreutils +Requires: coreutils, gawk, sed Requires: keyutils-libs >= 1.5.8 Requires: /etc/crypto-policies/back-ends/krb5.config @@ -279,16 +274,11 @@ Requires: net-tools, rpcbind Requires: perl-interpreter Requires: procps-ng Requires: python3-kdcproxy +Requires: python3-pyrad Requires: resolv_wrapper Requires: /etc/crypto-policies/back-ends/krb5.config Requires: words -Requires: opensc -Requires: softhsm -Recommends: python3-pyrad - -# Restore once openldap upstream tests are fixed -#Recommends: openldap-servers -#Recommends: openldap-clients +#Requires: openldap-servers, openldap-clients %description tests FOR TESTING PURPOSE ONLY @@ -745,46 +735,23 @@ exit 0 %{_datarootdir}/%{name}-tests/%{_arch} %changelog -* Mon Jan 05 2026 Julien Rische - 1.21.3-11 -- Fix strchr() conformance to C23 - -* Mon Oct 20 2025 Alexander Bokovoy - 1.21.3-10 -- Update the prompter patch to upstream version - Resolves: rhbz#2403513 - -* Wed Oct 15 2025 Alexander Bokovoy - 1.21.3-9 -- do not crash when prompter is not available in GSSAPI - Resolves: rhbz#2403513 - -* Fri Sep 26 2025 Alexander Bokovoy - 1.21.3-8 -- Add automated FAST channel for kinit -- https://github.com/krb5/krb5/pull/1447 - work in progress - -* Thu Jul 24 2025 Fedora Release Engineering - 1.21.3-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Wed Jun 04 2025 Julien Rische - 1.21.3-6 +* Fri Jun 06 2025 Julien Rische - 1.21.3-5 - Do not block HMAC-MD4/5 in FIPS mode Resolves: rhbz#2370259 - PKINIT: implement paChecksum2 from MS-PKCA v20230920 Resolves: rhbz#2357215 - Disallow RC4 HMAC-MD5 session keys by default (CVE-2025-3576) - Resolves: rhbz#2359705 + Resolves: rhbz#2359673 -* Wed Jan 29 2025 Julien Rische - 1.21.3-5 +* Tue Feb 11 2025 Julien Rische - 1.21.3-4 - Prevent overflow when calculating ulog block size (CVE-2025-24528) - Resolves: rhbz#2342798 + Resolves: rhbz#2342811 - Support PKCS11 EC client certs in PKINIT Resolves: rhbz#2341962 - kdb5_util: fix DB entry flags on modification Resolves: rhbz#2336555 - Add ECDH support for PKINIT (RFC5349) Resolves: rhbz#2214326 -- Remove dependency of krb5-libs on gawk and sed - Resolves: rhbz#2323859 - -* Fri Jan 17 2025 Fedora Release Engineering - 1.21.3-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Wed Oct 30 2024 Julien Rische - 1.21.3-3 - libkrad: implement support for Message-Authenticator (CVE-2024-3596) diff --git a/tests/got-audit/got-audit.gdb b/tests/got-audit/got-audit.gdb deleted file mode 100644 index 6661297..0000000 --- a/tests/got-audit/got-audit.gdb +++ /dev/null @@ -1,2 +0,0 @@ -gef config gef.disable_color True -got-audit --all diff --git a/tests/got-audit/kdc.conf b/tests/got-audit/kdc.conf deleted file mode 100644 index ed7299f..0000000 --- a/tests/got-audit/kdc.conf +++ /dev/null @@ -1,12 +0,0 @@ -[kdcdefaults] - kdc_ports = 88 - kdc_tcp_ports = 88 - -[realms] - ${krb5REALM1} = { - #master_key_type = aes256-cts - acl_file = /var/kerberos/krb5kdc/kadm5.acl - dict_file = /usr/share/dict/words - admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab - supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal - } diff --git a/tests/got-audit/krb5.conf b/tests/got-audit/krb5.conf deleted file mode 100644 index 6979cb7..0000000 --- a/tests/got-audit/krb5.conf +++ /dev/null @@ -1,29 +0,0 @@ -# To opt out of the system crypto-policies configuration of krb5, remove the -# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated. -includedir /etc/krb5.conf.d/ - -[logging] - default = FILE:/var/log/krb5libs.log - kdc = FILE:/var/log/krb5kdc.log - admin_server = FILE:/var/log/kadmind.log - -[libdefaults] - default_realm = ${krb5REALM1} - dns_lookup_realm = false - ticket_lifetime = 24h - renew_lifetime = 7d - forwardable = true - rdns = false - default_ccache_name = KEYRING:persistent:%{uid} - -[realms] - ${krb5REALM1} = { - kdc = localhost.localdomain - admin_server = localhost.localdomain - } - -[domain_realm] - ${krb5HostName} = ${krb5REALM1} - -[capaths] - ${krb5REALM1} = . diff --git a/tests/got-audit/main.fmf b/tests/got-audit/main.fmf deleted file mode 100644 index f2c1f97..0000000 --- a/tests/got-audit/main.fmf +++ /dev/null @@ -1,12 +0,0 @@ -summary: Audit the GOT for signs of tampering -description: | - Pointers in the server process GOT will be checked to ensure that - each function pointer's value is within a shared object file - that exports a symbol of that name, and that no shared object - files export conflicting symbols. -contact: Gordon Messmer -require+: - - gdb-gef # needed to test got-audit - - krb5-server -test: ./runtest.sh -framework: beakerlib diff --git a/tests/got-audit/runtest.sh b/tests/got-audit/runtest.sh deleted file mode 100755 index 925a04e..0000000 --- a/tests/got-audit/runtest.sh +++ /dev/null @@ -1,121 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/openssh/Sanity/got-audit -# Description: Check pointers in the server process GOT for signs of tampering -# Author: Gordon Messmer -# - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -krb5REALM1='TEST1.REDHAT.COM' -krb5HostName=`hostname` -krb5DomainName=`hostname -d` -krb5User='alice' -krb5UserPass='alice' -krb5UserKrbPass='aaa' -krb5User2='bob' -krb5User3='carl' -krb5KDCPass='qwe' -krb5RootPass='rrr' - -krb5conf="/etc/krb5.conf" -krb5confdir="/etc/krb5.conf.d" -krb5kdcconf="/var/kerberos/krb5kdc/kdc.conf" -krb5kadmacl="/var/kerberos/krb5kdc/kadm5.acl" - -rlJournalStart - rlPhaseStartSetup - rlServiceStart sshd - rlRun "TestDir=\$(pwd)" - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})" - rlPhaseEnd - - rlPhaseStartSetup "KDC and kadmind setup" - # Stop and backup - rlRun "rlServiceStop kadmin krb5kdc" - rlRun "rm -f /var/kerberos/krb5kdc/principal* /var/kerberos/krb5kdc/.k5*" - rlFileBackup $krb5conf /var/kerberos/krb5kdc /etc/sysconfig/{kadmin,krb5kdc} /etc/hosts - rlFileBackup --clean /root/.k5login - [ -e /etc/krb5.keytab ] && rlFileBackup /etc/krb5.keytab - [ -e $krb5confdir ] && rlFileBackup $krb5confdir - # Basic setup of KDC and krb5.conf - rlRun "sed -i \"s/\[libdefaults\]/[libdefaults]\n default_realm = $krb5REALM1/\" $krb5conf" - rlRun "sed -i \"s/\[realms\]/[realms]\n $krb5REALM1 = {\n kdc = $krb5HostName\n admin_server = $krb5HostName\n }/\" $krb5conf" - if [ "$krb5DomainName" ]; then - rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n .$krb5DomainName = $krb5REALM1\n $krb5DomainName = $krb5REALM1/\" $krb5conf" - else - rlRun "sed -i \"s/\[domain_realm\]/[domain_realm]\n $krb5HostName = $krb5REALM1/\" $krb5conf" - fi - rlRun "sed -i s/EXAMPLE.COM/$krb5REALM1/ $krb5kdcconf" - # Configure the kadmin ACL - rlRun "echo \"*/master@$krb5REALM1 *\" > $krb5kadmacl" - if rlIsFedora '>=31';then - rlLog "Modify supported_enctypes for Fedora >=31. Remove *DES ciphers." - rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf" - elif rlIsRHEL '8' && [ `rpm -q --qf '%{VERSION}' krb5-server | cut -d"." -f2` -lt 18 ];then - rlLog "Modify supported_enctypes for RHEL-8." - rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf" - else - #RHEL-8 Bug 1802334 - [Rebase] krb5: rebase to 1.18: - #- Removal of *DES encryption types - #https://bugzilla.redhat.com/show_bug.cgi?id=1802334 - rlLog "Modify supported_enctypes for RHEL-8 with krb-1.18. Remove *DES ciphers." - rlRun "sed -i \"s/supported_enctypes.*/supported_enctypes = aes256-cts:normal aes128-cts:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal/\" /var/kerberos/krb5kdc/kdc.conf" - fi - # Create the realm databases - rlRun "rngd -r /dev/urandom" - rlRun "kdb5_util create -s -r $krb5REALM1 -P $krb5KDCPass" - rlRun "rlServiceStart kadmin krb5kdc" - rlRun "kadmin.local -r $krb5REALM1 -q \"addprinc -pw $krb5RootPass root/master\"" - rlRun "kadmin.local -r $krb5REALM1 -q \"addprinc -pw $krb5UserKrbPass $krb5User\"" - rlRun "kadmin.local -r $krb5REALM1 -q \"addprinc -randkey host/$krb5HostName\"" - rlRun "kadmin.local -r $krb5REALM1 -q \"ktadd host/$krb5HostName\"" - # Create test system user - [ $krb5User != "root" ] && rlRun "useradd $krb5User" - rlRun "echo $krb5UserPass | passwd --stdin $krb5User" - rlPhaseEnd - - rlPhaseStartTest "Run GEF got-audit" - rlRun "systemctl restart krb5kdc.service" - rlRun "systemctl restart kadmin.service" - rlRun "systemctl --no-pager status krb5kdc.service" - rlRun "systemctl --no-pager status kadmin.service" - - rlRun "SERVICE_PID=\$( systemctl show --property=MainPID krb5kdc.service | cut -f2 -d= )" - rlRun "echo SERVICE_PID is '$SERVICE_PID'" - [ -n "$SERVICE_PID" ] || rlFail "No service pid was found" - rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'" - # Basic test: ensure that at least one symbol is found in libc.so, - # to verify that the report looks plausible. - rlAssertGrep " : /.*/libc.so" "$auditfile" - # Ensure the got-audit did not report any errors - rlAssertNotGrep " :: ERROR" "$auditfile" - rlRun "cp '$auditfile' '$TMT_TEST_DATA'/krb5kdc-got-audit.txt" - - rlRun "SERVICE_PID=\$( systemctl show --property=MainPID kadmin.service | cut -f2 -d= )" - rlRun "echo SERVICE_PID is '$SERVICE_PID'" - [ -n "$SERVICE_PID" ] || rlFail "No service pid was found" - rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'" - # Basic test: ensure that at least one symbol is found in libc.so, - # to verify that the report looks plausible. - rlAssertGrep " : /.*/libc.so" "$auditfile" - # Ensure the got-audit did not report any errors - rlAssertNotGrep " :: ERROR" "$auditfile" - rlRun "cp '$auditfile' '$TMT_TEST_DATA'/kadmin-got-audit.txt" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -rf /var/kerberos/krb5kdc/* /var/kerberos/krb5kdc/.k5* /etc/krb5* /etc/sysconfig/{kadmin,krb5kdc}" - rlFileRestore - rlServiceRestore krb5kdc kadmin - [ $krb5User != "root" ] && rlRun "userdel -r -f $krb5User" - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd