Explicitly use openssl rather than builtin crypto

Resolves: #1570910

Continue-after-KRB5_CC_END-in-KCM-cache-iteration.patch

@@ -0,0 +1,43 @@
+From bc42112fbc232c2afba602672affc3e92ae1491e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <fidencio@redhat.com>
+Date: Wed, 28 Mar 2018 18:27:06 +0200
+Subject: [PATCH] Continue after KRB5_CC_END in KCM cache iteration
+
+The KCM server returns KRB5_CC_END in response to a GET_CACHE_BY_UUID
+request to indicate that the specified ccache uuid no longer exists.
+In krb5_ptcursor_next(), ignore this error and continue the iteration,
+as the Heimdal KCM client code does.
+
+In addition to addressing the case where a third party deletes a cache
+between the GET_CACHE_UUID_LIST request and when we reach that uuid in
+the iteration, this change also fixes a bug in kdestroy -A where the
+caller deletes the primary cache and we later request it by uuid when
+iterating over the list.
+
+[ghudson@mit.edu: rewrote commit message; edited comment]
+
+ticket: 8658 (new)
+tags: pullup
+target_version: 1.16-next
+target_version: 1.15-next
+
+(cherry picked from commit 49087f5e6309f298f8898c35af6f4ade418ced60)
+(cherry picked from commit 3001200ba4598aeb14511353a72dc746034280b1)
+---
+ src/lib/krb5/ccache/cc_kcm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c
+index a889e67b4..a3afd7056 100644
+--- a/src/lib/krb5/ccache/cc_kcm.c
++++ b/src/lib/krb5/ccache/cc_kcm.c
+@@ -966,6 +966,9 @@ kcm_ptcursor_next(krb5_context context, krb5_cc_ptcursor cursor,
+         kcmreq_init(&req, KCM_OP_GET_CACHE_BY_UUID, NULL);
+         k5_buf_add_len(&req.reqbuf, id, KCM_UUID_LEN);
+         ret = kcmio_call(context, data->io, &req);
++        /* Continue if the cache has been deleted. */
++        if (ret == KRB5_CC_END)
++            continue;
+         if (ret)
+             goto cleanup;
+         ret = kcmreq_get_name(&req, &name);

Fix-PKINIT-cert-matching-data-construction.patch

@@ -0,0 +1,105 @@
+From 3fe07aaa6d8b6115aa19e2c04087352a5c87a568 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Tue, 24 Oct 2017 15:33:37 -0400
+Subject: [PATCH] Fix PKINIT cert matching data construction
+
+Rewrite X509_NAME_oneline_ex() and its call sites to use dynamic
+allocation and to perform proper error checking.
+
+(cherry picked from commit 1d8fb334a6256b9ddd3d4377a92c2441407d8a12)
+---
+ src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 63 ++++++++--------------
+ 1 file changed, 21 insertions(+), 42 deletions(-)
+
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 7fa2efd21..336102656 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -5139,33 +5139,23 @@ out:
+     return retval;
+ }
+ 
+-/*
+- * Return a string format of an X509_NAME in buf where
+- * size is an in/out parameter.  On input it is the size
+- * of the buffer, and on output it is the actual length
+- * of the name.
+- * If buf is NULL, returns the length req'd to hold name
+- */
+-static char *
+-X509_NAME_oneline_ex(X509_NAME * a,
+-                     char *buf,
+-                     unsigned int *size,
+-                     unsigned long flag)
++static krb5_error_code
++rfc2253_name(X509_NAME *name, char **str_out)
+ {
+-    BIO *out = NULL;
++    BIO *b = NULL;
++    char *str;
+ 
+-    out = BIO_new(BIO_s_mem ());
+-    if (X509_NAME_print_ex(out, a, 0, flag) > 0) {
+-        if (buf != NULL && (*size) >  (unsigned int) BIO_number_written(out)) {
+-            memset(buf, 0, *size);
+-            BIO_read(out, buf, (int) BIO_number_written(out));
+-        }
+-        else {
+-            *size = BIO_number_written(out);
+-        }
+-    }
+-    BIO_free(out);
+-    return (buf);
++    *str_out = NULL;
++    b = BIO_new(BIO_s_mem());
++    if (X509_NAME_print_ex(b, name, 0, XN_FLAG_SEP_COMMA_PLUS) < 0)
++        return ENOMEM;
++    str = calloc(BIO_number_written(b) + 1, 1);
++    if (str == NULL)
++        return ENOMEM;
++    BIO_read(b, str, BIO_number_written(b));
++    BIO_free(b);
++    *str_out = str;
++    return 0;
+ }
+ 
+ /*
+@@ -5181,8 +5171,6 @@ crypto_cert_get_matching_data(krb5_context context,
+     krb5_principal *pkinit_sans =NULL, *upn_sans = NULL;
+     struct _pkinit_cert_data *cd = (struct _pkinit_cert_data *)ch;
+     unsigned int i, j;
+-    char buf[DN_BUF_LEN];
+-    unsigned int bufsize = sizeof(buf);
+ 
+     if (cd == NULL || cd->magic != CERT_MAGIC)
+         return EINVAL;
+@@ -5195,23 +5183,14 @@ crypto_cert_get_matching_data(krb5_context context,
+ 
+     md->ch = ch;
+ 
+-    /* get the subject name (in rfc2253 format) */
+-    X509_NAME_oneline_ex(X509_get_subject_name(cd->cred->cert),
+-                         buf, &bufsize, XN_FLAG_SEP_COMMA_PLUS);
+-    md->subject_dn = strdup(buf);
+-    if (md->subject_dn == NULL) {
+-        retval = ENOMEM;
++    retval = rfc2253_name(X509_get_subject_name(cd->cred->cert),
++                          &md->subject_dn);
++    if (retval)
+         goto cleanup;
+-    }
+-
+-    /* get the issuer name (in rfc2253 format) */
+-    X509_NAME_oneline_ex(X509_get_issuer_name(cd->cred->cert),
+-                         buf, &bufsize, XN_FLAG_SEP_COMMA_PLUS);
+-    md->issuer_dn = strdup(buf);
+-    if (md->issuer_dn == NULL) {
+-        retval = ENOMEM;
++    retval = rfc2253_name(X509_get_issuer_name(cd->cred->cert),
++                          &md->issuer_dn);
++    if (retval)
+         goto cleanup;
+-    }
+ 
+     /* get the san data */
+     retval = crypto_retrieve_X509_sans(context, cd->plgctx, cd->reqctx,

krb5.spec

@@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.15.2
 # for prerelease, should be e.g., 0.3.beta2% { ?dist } (without spaces)
-Release: 2%{?dist}
+Release: 9%{?dist}
 
 # lookaside-cached sources; two downloads and a build artifact
 Source0: https://web.mit.edu/kerberos/dist/krb5/1.15/krb5-%{version}%{prerelease}.tar.gz
@@ -92,6 +92,8 @@ Patch68: Add-test-cert-with-no-extensions.patch
 Patch69: Add-PKINIT-test-case-for-generic-client-cert.patch
 Patch70: Add-hostname-based-ccselect-module.patch
 Patch71: Add-German-translation.patch
+Patch72: Fix-PKINIT-cert-matching-data-construction.patch
+Patch73: Continue-after-KRB5_CC_END-in-KCM-cache-iteration.patch
 
 License: MIT
 URL: http://web.mit.edu/kerberos/www/
@@ -141,7 +143,6 @@ BuildRequires: perl-interpreter, dejagnu, tcl-devel
 BuildRequires: net-tools, rpcbind
 BuildRequires: hostname
 BuildRequires: iproute
-BuildRequires: python2-pyrad
 BuildRequires: libverto-devel
 BuildRequires: openldap-devel
 BuildRequires: openssl-devel >= 0.9.8
@@ -351,6 +352,7 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`"
 	--with-dirsrv-account-locking \
 %endif
 	--enable-pkinit \
+	--with-crypto-impl=openssl \
 	--with-pkinit-crypto-impl=openssl \
 	--with-tls-impl=openssl \
 	--with-system-verto \
@@ -745,6 +747,30 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Mon Apr 23 2018 Robbie Harwood <rharwood@redhat.com> - 1.15.2-9
+- Explicitly use openssl rather than builtin crypto
+- Resolves: #1570910
+
+* Thu Mar 29 2018 Robbie Harwood <rharwood@redhat.com> - 1.15.2-8
+- Continue after KRB5_CC_END in KCM cache iteration
+
+* Tue Feb 13 2018 Robbie Harwood <rharwood@redhat.com> - 1.15.2-7
+- Fix flaws in LDAP DN checking
+- CVE-2018-5729, CVE-2018-5730
+
+* Mon Feb 12 2018 Robbie Harwood <rharwood@redhat.com> - 1.15.2-6
+- Fix leak in previous commit
+- Resolves: #1540939
+
+* Mon Jan 29 2018 Robbie Harwood <rharwood@redhat.com> - 1.15.2-5
+- Process include directories in alphabetical order
+
+* Tue Oct 24 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.2-4
+- Fix CVE-2017-15088 (Buffer overflow in get_matching_data())
+
+* Mon Oct 23 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.2-3
+- Drop dependency on python2-pyrad (dead upstream, broken with new python)
+
 * Thu Sep 28 2017 Robbie Harwood <rharwood@redhat.com> - 1.15.2-2
 - Add German translation