开源软件构建与测试

_service:extract_file:krb5.spec Deleted

@@ -1,376 +0,0 @@
-%global _hardening_ldflags %{nil}
-%global WITH_DIRSRV 1
-
-Name:     krb5
-Version:  1.19.2
-Release:  2
-Summary:  The Kerberos network authentication protocol
-License:  MIT
-URL:      http://web.mit.edu/kerberos/www/
-Source0:  https://web.mit.edu/kerberos/dist/krb5/1.19/%{name}-%{version}.tar.gz
-Source1:  https://web.mit.edu/kerberos/dist/krb5/1.19/%{name}-%{version}.tar.gz.asc
-Source2:  kprop.service
-Source3:  kadmin.service
-Source4:  krb5kdc.service
-Source5:  krb5.conf
-Source6:  kdc.conf
-Source7:  kadm5.acl
-Source11: ksu.pamd
-Source12: krb5kdc.logrotate
-Source13: kadmind.logrotate
-Source100: noport.c 
-Patch0: ksu-pam-integration.patch
-Patch1: SELinux-integration.patch
-Patch2: Adjust-build-configuration.patch
-Patch3: netlib-and-dns.patch
-Patch4: fix-debuginfo-with-y.tab.c.patch
-Patch5: Remove-3des-support.patch
-Patch6: FIPS-with-PRNG-and-RADIUS-and-MD4.patch
-Patch7: backport-CVE-2021-37750.patch
-
-BuildRequires:  gettext
-BuildRequires:  gcc make automake autoconf pkgconfig pam-devel libselinux-devel byacc
-BuildRequires:  libcom_err-devel openssl-devel openldap-devel libss-devel libverto-module-base
-
-# tests
-BuildRequires: perl-interpreter dejagnu python3 tcl-devel
-BuildRequires: net-tools rpcbind hostname iproute libverto-devel
-BuildRequires: nss_wrapper socket_wrapper keyutils, keyutils-libs-devel
-BuildRequires: lmdb-devel
-
-Obsoletes:     libkadm5 < %{version}-%{release}
-Provides:      libkadm5 = %{version}-%{release}
-
-%description
-Kerberos is a network authentication protocol.
-It is designed to provide strong authentication
-for client/server applications by using secret-key
-cryptography.
-
-
-%package server
-Summary:    krb5 server
-Requires:   %{name}-libs%{?_isa} = %{version}-%{release}
-Requires:   logrotate libverto systemd words crypto-policies
-Obsoletes:  krb5-pkinit < %{version}-%{release}
-Obsoletes:  krb5-server-ldap < %{version}-%{release}
-Provides:   krb5-pkinit = %{version}-%{release}
-Provides:   krb5-server-ldap = %{version}-%{release}
-Obsoletes:  krb5-pkinit-openssl < %{version}-%{release}
-Provides:   krb5-pkinit-openssl = %{version}-%{release}
-
-%description server
-This package provides krb5 server programs.
-
-%package client
-Summary:    krb5 client
-Requires:   %{name}-libs%{?_isa} = %{version}-%{release}
-Obsoletes:  %{name}-workstation
-Provides:   %{name}-workstation
-
-%description client
-This package provides krb5 client programs.
-
-%package devel
-Summary:    Development files for compiling with krb5
-Requires:   %{name}-libs%{?_isa} = %{version}-%{release}
-Requires:   e2fsprogs-devel keyutils-libs-devel libselinux-devel libverto-devel
-Provides:   krb5-kdb-version = 7.0
-
-%description devel
-%{summary}.
-
-%package libs
-Summary:    The non-admin shared libraries used by Kerberos 5
-Requires:   coreutils gawk grep sed keyutils-libs
-Requires:   /etc/crypto-policies/back-ends/krb5.config
-
-%description libs
-This package contains the shared libraries needed by Kerberos 5.
-
-%package help
-Summary:    The documents for krb5
-BuildArch:  noarch
-
-%description help
-%{summary}.
-
-%prep
-%autosetup -n %{name}-%{version} -p1
-
-pushd src
-autoreconf -fiv
-popd
-
-%build
-source %{_libdir}/tclConfig.sh
-pushd src
-
-# Set this so that configure will have a value even if the current version of
-# autoconf doesn't set one.
-export runstatedir=%{_localstatedir}/run
-# Work out the CFLAGS and CPPFLAGS which we intend to use.
-INCLUDES=-I%{_includedir}/et
-CFLAGS="`echo $RPM_OPT_FLAGS $DEFINES $INCLUDES -fPIC -fno-strict-aliasing -fstack-protector-all`"
-CPPFLAGS="`echo $DEFINES $INCLUDES`"
-%configure \
-    CC="%{__cc}" \
-    CFLAGS="$CFLAGS" \
-    CPPFLAGS="$CPPFLAGS" \
-    SS_LIB="-lss" \
-    --enable-shared \
-    --localstatedir=%{_var}/kerberos \
-    --disable-rpath \
-    --without-krb5-config \
-    --with-system-et \
-    --with-system-ss \
-    --with-netlib=-lresolv \
-    --with-tcl \
-    --enable-dns-for-realm \
-    --with-ldap \
-%if %{WITH_DIRSRV}
-    --with-dirsrv-account-locking \
-%endif
-    --enable-pkinit \
-    --with-crypto-impl=openssl \
-    --with-tls-impl=openssl \
-    --with-system-verto \
-    --with-pam \
-    --with-selinux \
-    --with-prng-alg=os \
-    --with-lmdb \
-    || (cat config.log; exit 1)
-
-%make_build
-popd
-# We need to cut off any access to locally-running nameservers, too.
-%{__cc} -fPIC -shared -o noport.so -Wall -Wextra %{SOURCE100}
-
-%install
-pushd src
-%make_install
-popd
-
-mkdir -p $RPM_BUILD_ROOT/etc
-install -pm 644 %{SOURCE5} $RPM_BUILD_ROOT/etc/krb5.conf
-
-mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc
-install -pm 600 %{SOURCE6} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/
-install -pm 600 %{SOURCE7} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/
-
-mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5/user
-
-mkdir -p $RPM_BUILD_ROOT/etc/krb5.conf.d
-ln -sv /etc/crypto-policies/back-ends/krb5.config $RPM_BUILD_ROOT/etc/krb5.conf.d/crypto-policies
-
-mkdir -m 755 -p $RPM_BUILD_ROOT/etc/gss
-
-mkdir -m 755 -p $RPM_BUILD_ROOT/etc/gss/mech.d
-
-mkdir -p $RPM_BUILD_ROOT%{_unitdir}
-install -pm 644 %{SOURCE2} $RPM_BUILD_ROOT%{_unitdir}
-install -pm 644 %{SOURCE3} $RPM_BUILD_ROOT%{_unitdir}
-install -pm 644 %{SOURCE4} $RPM_BUILD_ROOT%{_unitdir}
-
-mkdir -p $RPM_BUILD_ROOT/%{_localstatedir}/run/krb5kdc
-
-# install logrotate config files for server
-mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d/
-install -pm 644 %{SOURCE12} $RPM_BUILD_ROOT/etc/logrotate.d/`basename %{SOURCE12} .logrotate`
-install -pm 644 %{SOURCE13} $RPM_BUILD_ROOT/etc/logrotate.d/`basename %{SOURCE13} .logrotate`
-
-# PAM configuration files.
-mkdir -p $RPM_BUILD_ROOT/etc/pam.d/
-install -pm 644 %{SOURCE11} $RPM_BUILD_ROOT/etc/pam.d/`basename %{SOURCE11} .pamd`
-
-install -d -m 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth
-install -d -m 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/kdb
-install -d -m 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/authdata
-
-rm -vf %{buildroot}/%{_sbindir}/krb5-send-pr
-rm -vrf %{buildroot}/%{_datadir}/examples
-rm -vf %{buildroot}/%{_libdir}/krb5/plugins/preauth/test.so
-
-find %buildroot -type f $ -name '*.so' -o -name '*.so.*' $ -exec chmod 755 {} +
-
-%find_lang mit-krb5
-
-
-%check

_service:tar_scm:krb5.spec Added

@@ -0,0 +1,376 @@
+%global _hardening_ldflags %{nil}
+%global WITH_DIRSRV 1
+
+Name:     krb5
+Version:  1.19.2
+Release:  2
+Summary:  The Kerberos network authentication protocol
+License:  MIT
+URL:      http://web.mit.edu/kerberos/www/
+Source0:  https://web.mit.edu/kerberos/dist/krb5/1.19/%{name}-%{version}.tar.gz
+Source1:  https://web.mit.edu/kerberos/dist/krb5/1.19/%{name}-%{version}.tar.gz.asc
+Source2:  kprop.service
+Source3:  kadmin.service
+Source4:  krb5kdc.service
+Source5:  krb5.conf
+Source6:  kdc.conf
+Source7:  kadm5.acl
+Source11: ksu.pamd
+Source12: krb5kdc.logrotate
+Source13: kadmind.logrotate
+Source100: noport.c 
+Patch0: ksu-pam-integration.patch
+Patch1: SELinux-integration.patch
+Patch2: Adjust-build-configuration.patch
+Patch3: netlib-and-dns.patch
+Patch4: fix-debuginfo-with-y.tab.c.patch
+Patch5: Remove-3des-support.patch
+Patch6: FIPS-with-PRNG-and-RADIUS-and-MD4.patch
+Patch7: backport-CVE-2021-37750.patch
+
+BuildRequires:  gettext
+BuildRequires:  gcc make automake autoconf pkgconfig pam-devel libselinux-devel byacc
+BuildRequires:  libcom_err-devel openssl-devel openldap-devel libss-devel libverto-module-base
+
+# tests
+BuildRequires: perl-interpreter dejagnu python3 tcl-devel
+BuildRequires: net-tools rpcbind hostname iproute libverto-devel
+BuildRequires: nss_wrapper socket_wrapper keyutils, keyutils-libs-devel
+BuildRequires: lmdb-devel
+
+Obsoletes:     libkadm5 < %{version}-%{release}
+Provides:      libkadm5 = %{version}-%{release}
+
+%description
+Kerberos is a network authentication protocol.
+It is designed to provide strong authentication
+for client/server applications by using secret-key
+cryptography.
+
+
+%package server
+Summary:    krb5 server
+Requires:   %{name}-libs%{?_isa} = %{version}-%{release}
+Requires:   logrotate libverto systemd words crypto-policies
+Obsoletes:  krb5-pkinit < %{version}-%{release}
+Obsoletes:  krb5-server-ldap < %{version}-%{release}
+Provides:   krb5-pkinit = %{version}-%{release}
+Provides:   krb5-server-ldap = %{version}-%{release}
+Obsoletes:  krb5-pkinit-openssl < %{version}-%{release}
+Provides:   krb5-pkinit-openssl = %{version}-%{release}
+
+%description server
+This package provides krb5 server programs.
+
+%package client
+Summary:    krb5 client
+Requires:   %{name}-libs%{?_isa} = %{version}-%{release}
+Obsoletes:  %{name}-workstation
+Provides:   %{name}-workstation
+
+%description client
+This package provides krb5 client programs.
+
+%package devel
+Summary:    Development files for compiling with krb5
+Requires:   %{name}-libs%{?_isa} = %{version}-%{release}
+Requires:   e2fsprogs-devel keyutils-libs-devel libselinux-devel libverto-devel
+Provides:   krb5-kdb-version = 7.0
+
+%description devel
+%{summary}.
+
+%package libs
+Summary:    The non-admin shared libraries used by Kerberos 5
+Requires:   coreutils gawk grep sed keyutils-libs
+Requires:   /etc/crypto-policies/back-ends/krb5.config
+
+%description libs
+This package contains the shared libraries needed by Kerberos 5.
+
+%package help
+Summary:    The documents for krb5
+BuildArch:  noarch
+
+%description help
+%{summary}.
+
+%prep
+%autosetup -n %{name}-%{version} -p1
+
+pushd src
+autoreconf -fiv
+popd
+
+%build
+source %{_libdir}/tclConfig.sh
+pushd src
+
+# Set this so that configure will have a value even if the current version of
+# autoconf doesn't set one.
+export runstatedir=%{_localstatedir}/run
+# Work out the CFLAGS and CPPFLAGS which we intend to use.
+INCLUDES=-I%{_includedir}/et
+CFLAGS="`echo $RPM_OPT_FLAGS $DEFINES $INCLUDES -fPIC -fno-strict-aliasing -fstack-protector-all`"
+CPPFLAGS="`echo $DEFINES $INCLUDES`"
+%configure \
+    CC="%{__cc}" \
+    CFLAGS="$CFLAGS" \
+    CPPFLAGS="$CPPFLAGS" \
+    SS_LIB="-lss" \
+    --enable-shared \
+    --localstatedir=%{_var}/kerberos \
+    --disable-rpath \
+    --without-krb5-config \
+    --with-system-et \
+    --with-system-ss \
+    --with-netlib=-lresolv \
+    --with-tcl \
+    --enable-dns-for-realm \
+    --with-ldap \
+%if %{WITH_DIRSRV}
+    --with-dirsrv-account-locking \
+%endif
+    --enable-pkinit \
+    --with-crypto-impl=openssl \
+    --with-tls-impl=openssl \
+    --with-system-verto \
+    --with-pam \
+    --with-selinux \
+    --with-prng-alg=os \
+    --with-lmdb \
+    || (cat config.log; exit 1)
+
+%make_build
+popd
+# We need to cut off any access to locally-running nameservers, too.
+%{__cc} -fPIC -shared -o noport.so -Wall -Wextra %{SOURCE100}
+
+%install
+pushd src
+%make_install
+popd
+
+mkdir -p $RPM_BUILD_ROOT/etc
+install -pm 644 %{SOURCE5} $RPM_BUILD_ROOT/etc/krb5.conf
+
+mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc
+install -pm 600 %{SOURCE6} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/
+install -pm 600 %{SOURCE7} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/
+
+mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5/user
+
+mkdir -p $RPM_BUILD_ROOT/etc/krb5.conf.d
+ln -sv /etc/crypto-policies/back-ends/krb5.config $RPM_BUILD_ROOT/etc/krb5.conf.d/crypto-policies
+
+mkdir -m 755 -p $RPM_BUILD_ROOT/etc/gss
+
+mkdir -m 755 -p $RPM_BUILD_ROOT/etc/gss/mech.d
+
+mkdir -p $RPM_BUILD_ROOT%{_unitdir}
+install -pm 644 %{SOURCE2} $RPM_BUILD_ROOT%{_unitdir}
+install -pm 644 %{SOURCE3} $RPM_BUILD_ROOT%{_unitdir}
+install -pm 644 %{SOURCE4} $RPM_BUILD_ROOT%{_unitdir}
+
+mkdir -p $RPM_BUILD_ROOT/%{_localstatedir}/run/krb5kdc
+
+# install logrotate config files for server
+mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d/
+install -pm 644 %{SOURCE12} $RPM_BUILD_ROOT/etc/logrotate.d/`basename %{SOURCE12} .logrotate`
+install -pm 644 %{SOURCE13} $RPM_BUILD_ROOT/etc/logrotate.d/`basename %{SOURCE13} .logrotate`
+
+# PAM configuration files.
+mkdir -p $RPM_BUILD_ROOT/etc/pam.d/
+install -pm 644 %{SOURCE11} $RPM_BUILD_ROOT/etc/pam.d/`basename %{SOURCE11} .pamd`
+
+install -d -m 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth
+install -d -m 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/kdb
+install -d -m 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/authdata
+
+rm -vf %{buildroot}/%{_sbindir}/krb5-send-pr
+rm -vrf %{buildroot}/%{_datadir}/examples
+rm -vf %{buildroot}/%{_libdir}/krb5/plugins/preauth/test.so
+
+find %buildroot -type f $ -name '*.so' -o -name '*.so.*' $ -exec chmod 755 {} +
+
+%find_lang mit-krb5
+
+
+%check

_service:extract_file:Adjust-build-configuration.patch Deleted

@@ -1,72 +0,0 @@
-From cbfe13d5f0de6e2a3deab2ba0dacda8c952476ab Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 23 Aug 2016 16:45:26 -0400
-Subject: PATCH downstream Adjust build configuration
-
-Build binaries in this package as RELRO PIEs, libraries as partial RELRO,
-and install shared libraries with the execute bit set on them.  Prune out
-the -L/usr/lib* and PIE flags where they might leak out and affect
-apps which just want to link with the libraries. FIXME: needs to check and
-not just assume that the compiler supports using these flags.
-
-Last-updated: krb5-1.15-beta1
----
- src/build-tools/krb5-config.in | 7 +++++++
- src/config/pre.in              | 2 +-
- src/config/shlib.conf          | 5 +++--
- 3 files changed, 11 insertions(+), 3 deletions(-)
-
-diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in
-index c17cb5eb5..1891dea99 100755
---- a/src/build-tools/krb5-config.in
-+++ b/src/build-tools/krb5-config.in
-@@ -226,6 +226,13 @@ if test -n "$do_libs"; then
- 	    -e 's#\$(PTHREAD_CFLAGS)#'"$PTHREAD_CFLAGS"'#' \
- 	    -e 's#\$(CFLAGS)##'`
- 
-+    if test `dirname $libdir` = /usr ; then
-+        lib_flags=`echo $lib_flags | sed -e "s#-L$libdir##" -e "s#$RPATH_FLAG$libdir##"`
-+    fi
-+    lib_flags=`echo $lib_flags | sed -e "s#-fPIE##g" -e "s#-pie##g"`
-+    lib_flags=`echo $lib_flags | sed -e "s#-Wl,-z,relro##g"`
-+    lib_flags=`echo $lib_flags | sed -e "s#-Wl,-z,now##g"`
-+
-     if test $library = 'kdb'; then
- 	lib_flags="$lib_flags -lkdb5 $KDB5_DB_LIB"
- 	library=krb5
-diff --git a/src/config/pre.in b/src/config/pre.in
-index 917357df9..a8540ae2a 100644
---- a/src/config/pre.in
-+++ b/src/config/pre.in
-@@ -185,7 +185,7 @@ INSTALL_PROGRAM=@INSTALL_PROGRAM@ $(INSTALL_STRIP)
- INSTALL_SCRIPT=@INSTALL_PROGRAM@
- INSTALL_DATA=@INSTALL_DATA@
- INSTALL_SHLIB=@INSTALL_SHLIB@
--INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755 -o root
-+INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755
- ## This is needed because autoconf will sometimes define @exec_prefix@ to be
- ## ${prefix}.
- prefix=@prefix@
-diff --git a/src/config/shlib.conf b/src/config/shlib.conf
-index 3e4af6c02..2b20c3fda 100644
---- a/src/config/shlib.conf
-+++ b/src/config/shlib.conf
-@@ -423,7 +423,7 @@ mips-*-netbsd*)
- 	# Linux ld doesn't default to stuffing the SONAME field...
- 	# Use objdump -x to examine the fields of the library
- 	# UNDEF_CHECK is suppressed by --enable-asan
--	LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) $(UNDEF_CHECK)'
-+	LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) $(UNDEF_CHECK)  -Wl,-z,relro -Wl,--warn-shared-textrel'
- 	UNDEF_CHECK='-Wl,--no-undefined'
- 	# $(EXPORT_CHECK) runs export-check.pl when in maintainer mode.
- 	LDCOMBINE_TAIL='-Wl,--version-script binutils.versions $(EXPORT_CHECK)'
-@@ -435,7 +435,8 @@ mips-*-netbsd*)
- 	SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
- 	PROFFLAGS=-pg
- 	PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)'
--	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)'
-+	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) -pie -Wl,-z,relro -Wl,-z,now $(LDFLAGS)'
-+	INSTALL_SHLIB='${INSTALL} -m755'
- 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)'
- 	CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)'
- 	CXX_LINK_STATIC='$(CXX) $(PROG_LIBPATH) $(CXXFLAGS) $(LDFLAGS)'

_service:extract_file:FIPS-with-PRNG-and-RADIUS-and-MD4.patch Deleted

@@ -1,568 +0,0 @@
-From 5978878bcee5ec39e4357f408470d39e9540d2bf Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Fri, 9 Nov 2018 15:12:21 -0500
-Subject: PATCH downstream FIPS with PRNG and RADIUS and MD4
-
-NB: Use openssl's PRNG in FIPS mode and taint within krad.
-
-A lot of the FIPS error conditions from OpenSSL are incredibly
-mysterious (at best, things return NULL unexpectedly; at worst,
-internal assertions are tripped; most of the time, you just get
-ENOMEM).  In order to cope with this, we need to have some level of
-awareness of what we can and can't safely call.
-
-This will slow down some calls slightly (FIPS_mode() takes multiple
-locks), but not for any ciphers we care about - which is to say that
-AES is fine.  Shame about SPAKE though.
-
-post6 restores MD4 (and therefore keygen-only RC4).
-
-Last-updated: krb5-1.17
----
- src/lib/crypto/krb/prng.c                     | 11 ++++-
- .../crypto/openssl/enc_provider/camellia.c    |  6 +++
- src/lib/crypto/openssl/enc_provider/rc4.c     | 13 +++++-
- .../crypto/openssl/hash_provider/hash_evp.c   | 12 +++++
- src/lib/crypto/openssl/hmac.c                 |  6 ++-
- src/lib/krad/attr.c                           | 45 ++++++++++++++-----
- src/lib/krad/attrset.c                        |  5 ++-
- src/lib/krad/internal.h                       | 13 +++++-
- src/lib/krad/packet.c                         | 22 ++++-----
- src/lib/krad/remote.c                         | 10 ++++-
- src/lib/krad/t_attr.c                         |  3 +-
- src/lib/krad/t_attrset.c                      |  4 +-
- src/plugins/preauth/spake/spake_client.c      |  6 +++
- src/plugins/preauth/spake/spake_kdc.c         |  6 +++
- 14 files changed, 129 insertions(+), 33 deletions(-)
-
-diff --git a/src/lib/crypto/krb/prng.c b/src/lib/crypto/krb/prng.c
-index cb9ca9b98..f0e9984ca 100644
---- a/src/lib/crypto/krb/prng.c
-+++ b/src/lib/crypto/krb/prng.c
-@@ -26,6 +26,8 @@
- 
- #include "crypto_int.h"
- 
-+#include <openssl/rand.h>
-+
- krb5_error_code KRB5_CALLCONV
- krb5_c_random_seed(krb5_context context, krb5_data *data)
- {
-@@ -99,9 +101,16 @@ krb5_boolean
- k5_get_os_entropy(unsigned char *buf, size_t len, int strong)
- {
-     const char *device;
--#if defined(__linux__) && defined(SYS_getrandom)
-     int r;
- 
-+    /* A wild FIPS mode appeared! */
-+    if (FIPS_mode()) {
-+        /* The return codes on this API are not good */
-+        r = RAND_bytes(buf, len);
-+        return r == 1;
-+    }
-+
-+#if defined(__linux__) && defined(SYS_getrandom)
-     while (len > 0) {
-         /*
-          * Pull from the /dev/urandom pool, but require it to have been seeded.
-diff --git a/src/lib/crypto/openssl/enc_provider/camellia.c b/src/lib/crypto/openssl/enc_provider/camellia.c
-index 2da691329..f79679a0b 100644
---- a/src/lib/crypto/openssl/enc_provider/camellia.c
-+++ b/src/lib/crypto/openssl/enc_provider/camellia.c
-@@ -304,6 +304,9 @@ krb5int_camellia_cbc_mac(krb5_key key, const krb5_crypto_iov *data,
-     unsigned char blockYCAMELLIA_BLOCK_SIZE, blockBCAMELLIA_BLOCK_SIZE;
-     struct iov_cursor cursor;
- 
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-+
-     if (output->length < CAMELLIA_BLOCK_SIZE)
-         return KRB5_BAD_MSIZE;
- 
-@@ -331,6 +334,9 @@ static krb5_error_code
- krb5int_camellia_init_state (const krb5_keyblock *key, krb5_keyusage usage,
-                              krb5_data *state)
- {
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-+
-     state->length = 16;
-     state->data = (void *) malloc(16);
-     if (state->data == NULL)
-diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c
-index a65d57b7a..6ccaca94a 100644
---- a/src/lib/crypto/openssl/enc_provider/rc4.c
-+++ b/src/lib/crypto/openssl/enc_provider/rc4.c
-@@ -66,6 +66,9 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
-     EVP_CIPHER_CTX *ctx = NULL;
-     struct arcfour_state *arcstate;
- 
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-+
-     arcstate = (state != NULL) ? (void *)state->data : NULL;
-     if (arcstate != NULL) {
-         ctx = arcstate->ctx;
-@@ -113,7 +116,12 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
- static void
- k5_arcfour_free_state(krb5_data *state)
- {
--    struct arcfour_state *arcstate = (void *)state->data;
-+    struct arcfour_state *arcstate;
-+
-+    if (FIPS_mode())
-+        return;
-+
-+    arcstate = (void *) state->data;
- 
-     EVP_CIPHER_CTX_free(arcstate->ctx);
-     free(arcstate);
-@@ -125,6 +133,9 @@ k5_arcfour_init_state(const krb5_keyblock *key,
- {
-     struct arcfour_state *arcstate;
- 
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-+
-     /*
-      * The cipher state here is a saved pointer to a struct arcfour_state
-      * object, rather than a flat byte array as in most enc providers.  The
-diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c
-index 1e0fb8fc3..feb5eda99 100644
---- a/src/lib/crypto/openssl/hash_provider/hash_evp.c
-+++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c
-@@ -49,6 +49,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
-     if (ctx == NULL)
-         return ENOMEM;
- 
-+    if (type == EVP_md4()) {
-+        /* See comment below in hash_md4(). */
-+        EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
-+    }
-+
-     ok = EVP_DigestInit_ex(ctx, type, NULL);
-     for (i = 0; i < num_data; i++) {
-         if (!SIGN_IOV(&datai))
-@@ -64,12 +69,19 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
- static krb5_error_code
- hash_md4(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
- {
-+    /*
-+     * MD4 is needed in FIPS mode to perform key generation for RC4 keys used
-+     * by IPA.  These keys are only used along a (separately) secured channel
-+     * for legacy reasons when performing trusts to Active Directory.
-+     */
-     return hash_evp(EVP_md4(), data, num_data, output);
- }
- 
- static krb5_error_code
- hash_md5(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
- {
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-     return hash_evp(EVP_md5(), data, num_data, output);
- }
- 
-diff --git a/src/lib/crypto/openssl/hmac.c b/src/lib/crypto/openssl/hmac.c
-index 7dc59dcc0..769a50c00 100644
---- a/src/lib/crypto/openssl/hmac.c
-+++ b/src/lib/crypto/openssl/hmac.c
-@@ -103,7 +103,11 @@ map_digest(const struct krb5_hash_provider *hash)
-         return EVP_sha256();
-     else if (!strncmp(hash->hash_name, "SHA-384",7))
-         return EVP_sha384();
--    else if (!strncmp(hash->hash_name, "MD5", 3))
-+
-+    if (FIPS_mode())
-+        return NULL;
-+
-+    if (!strncmp(hash->hash_name, "MD5", 3))
-         return EVP_md5();
-     else if (!strncmp(hash->hash_name, "MD4", 3))
-         return EVP_md4();
-diff --git a/src/lib/krad/attr.c b/src/lib/krad/attr.c
-index 9c13d9d75..275327e67 100644
---- a/src/lib/krad/attr.c
-+++ b/src/lib/krad/attr.c
-@@ -30,6 +30,7 @@
- #include <k5-int.h>
- #include "internal.h"
- 
-+#include <openssl/crypto.h>
- #include <string.h>
- 
- /* RFC 2865 */
-@@ -38,7 +39,8 @@
- typedef krb5_error_code
- (*attribute_transform_fn)(krb5_context ctx, const char *secret,
-                           const unsigned char *auth, const krb5_data *in,

_service:extract_file:Remove-3des-support.patch Deleted

@@ -1,6453 +0,0 @@
-From fef4e551d3d2dcb55e58cc182304254c36aa8949 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 26 Mar 2019 18:51:10 -0400
-Subject: PATCH downstream Remove 3des support
-
-Completely remove support for all DES3 enctypes (des3-cbc-raw,
-des3-hmac-sha1, des3-cbc-sha1-kd).  Update all tests and documentation
-to user other enctypes.  Mark the 3DES enctypes UNSUPPORTED and retain
-their constants.
-
-Last-updated: 1.19-beta1
----
- doc/admin/advanced/retiring-des.rst           |  11 +
- doc/admin/conf_files/kdc_conf.rst             |   7 +-
- doc/admin/enctypes.rst                        |  10 +-
- doc/admin/troubleshoot.rst                    |   9 +-
- doc/appdev/refs/macros/index.rst              |   1 -
- doc/conf.py                                   |   2 +-
- doc/mitK5features.rst                         |   2 +-
- src/Makefile.in                               |   4 +-
- src/configure.ac                              |   1 -
- src/include/krb5/krb5.hin                     |  10 +-
- src/kadmin/testing/proto/kdc.conf.proto       |   4 +-
- src/kdc/kdc_util.c                            |   4 -
- src/lib/crypto/Makefile.in                    |   8 +-
- src/lib/crypto/builtin/Makefile.in            |   6 +-
- src/lib/crypto/builtin/des/ISSUES             |  13 -
- src/lib/crypto/builtin/des/Makefile.in        |  80 ----
- src/lib/crypto/builtin/des/d3_aead.c          | 133 ------
- src/lib/crypto/builtin/des/d3_kysched.c       |  51 ---
- src/lib/crypto/builtin/des/deps               | 150 -------
- src/lib/crypto/builtin/des/des_int.h          | 285 -------------
- src/lib/crypto/builtin/des/des_keys.c         |  40 --
- src/lib/crypto/builtin/des/destest.c          | 240 -----------
- src/lib/crypto/builtin/des/doc/libdes.doc     | 208 ---------
- src/lib/crypto/builtin/des/f_aead.c           | 173 --------
- src/lib/crypto/builtin/des/f_cbc.c            | 256 ------------
- src/lib/crypto/builtin/des/f_cksum.c          | 136 ------
- src/lib/crypto/builtin/des/f_parity.c         |  56 ---
- src/lib/crypto/builtin/des/f_sched.c          | 359 ----------------
- src/lib/crypto/builtin/des/f_tables.c         | 370 ----------------
- src/lib/crypto/builtin/des/f_tables.h         | 285 -------------
- src/lib/crypto/builtin/des/key_sched.c        |  62 ---
- src/lib/crypto/builtin/des/keytest.data       | 171 --------
- src/lib/crypto/builtin/des/t_verify.c         | 395 ------------------
- src/lib/crypto/builtin/des/weak_key.c         |  86 ----
- .../crypto/builtin/enc_provider/Makefile.in   |   6 +-
- src/lib/crypto/builtin/enc_provider/deps      |  13 -
- src/lib/crypto/builtin/enc_provider/des3.c    | 105 -----
- src/lib/crypto/crypto_tests/t_cf2.expected    |   1 -
- src/lib/crypto/crypto_tests/t_cf2.in          |   5 -
- src/lib/crypto/crypto_tests/t_cksums.c        |  10 -
- src/lib/crypto/crypto_tests/t_decrypt.c       |  57 ---
- src/lib/crypto/crypto_tests/t_derive.c        |  36 --
- src/lib/crypto/crypto_tests/t_encrypt.c       |   1 -
- src/lib/crypto/crypto_tests/t_short.c         |   1 -
- src/lib/crypto/crypto_tests/t_str2key.c       |  52 ---
- src/lib/crypto/krb/Makefile.in                |   3 -
- src/lib/crypto/krb/cksumtypes.c               |   6 -
- src/lib/crypto/krb/crypto_int.h               |  16 -
- src/lib/crypto/krb/default_state.c            |  10 -
- src/lib/crypto/krb/enctype_util.c             |   3 +
- src/lib/crypto/krb/etypes.c                   |  21 -
- src/lib/crypto/krb/prf_des.c                  |  47 ---
- src/lib/crypto/krb/random_to_key.c            |  45 --
- src/lib/crypto/libk5crypto.exports            |   1 -
- src/lib/crypto/openssl/Makefile.in            |   8 +-
- src/lib/crypto/openssl/des/Makefile.in        |  20 -
- src/lib/crypto/openssl/des/deps               |  15 -
- src/lib/crypto/openssl/des/des_keys.c         |  40 --
- .../crypto/openssl/enc_provider/Makefile.in   |   3 -
- src/lib/crypto/openssl/enc_provider/deps      |  11 -
- src/lib/crypto/openssl/enc_provider/des3.c    | 184 --------
- src/lib/gssapi/krb5/accept_sec_context.c      |   1 -
- src/lib/gssapi/krb5/gssapiP_krb5.h            |   6 +-
- src/lib/gssapi/krb5/k5seal.c                  |  35 +-
- src/lib/gssapi/krb5/k5sealiov.c               |  27 +-
- src/lib/gssapi/krb5/k5unseal.c                | 102 ++---
- src/lib/gssapi/krb5/k5unsealiov.c             |  38 +-
- src/lib/gssapi/krb5/util_crypt.c              |  11 -
- .../api.current/chpass-principal-v2.exp       |   4 +-
- .../api.current/get-principal-v2.exp          |   4 +-
- .../api.current/randkey-principal-v2.exp      |   4 +-
- src/lib/krb5/krb/init_ctx.c                   |   3 -
- src/lib/krb5/krb/s4u_creds.c                  |   2 -
- src/lib/krb5/krb/t_etypes.c                   |  48 +--
- src/lib/krb5/os/t_trace.c                     |   4 +-
- src/lib/krb5/os/t_trace.ref                   |   2 +-
- src/plugins/preauth/pkinit/pkcs11.h           |   6 +-
- src/plugins/preauth/pkinit/pkinit_clnt.c      |   8 -
- src/plugins/preauth/pkinit/pkinit_crypto.h    |  12 -
- .../preauth/pkinit/pkinit_crypto_openssl.c    |  38 --
- src/plugins/preauth/pkinit/pkinit_kdf_test.c  |  31 --
- src/plugins/preauth/spake/t_vectors.c         |  25 --
- src/tests/dejagnu/config/default.exp          |  78 ----
- src/tests/dejagnu/krb-standalone/kprop.exp    |   2 +-
- src/tests/gssapi/t_enctypes.py                |  33 +-
- src/tests/gssapi/t_invalid.c                  |  12 -
- src/tests/gssapi/t_pcontok.c                  |  16 +-
- src/tests/gssapi/t_prf.c                      |   7 -
- src/tests/t_authdata.py                       |   2 +-
- src/tests/t_etype_info.py                     |  18 +-
- src/tests/t_keyrollover.py                    |   8 +-
- src/tests/t_mkey.py                           |  35 --
- src/tests/t_salt.py                           |   5 +-
- src/util/k5test.py                            |   7 -
- .../leash/htmlhelp/html/Encryption_Types.htm  |  13 -
- 95 files changed, 160 insertions(+), 4835 deletions(-)
- delete mode 100644 src/lib/crypto/builtin/des/ISSUES
- delete mode 100644 src/lib/crypto/builtin/des/Makefile.in
- delete mode 100644 src/lib/crypto/builtin/des/d3_aead.c
- delete mode 100644 src/lib/crypto/builtin/des/d3_kysched.c
- delete mode 100644 src/lib/crypto/builtin/des/deps
- delete mode 100644 src/lib/crypto/builtin/des/des_int.h
- delete mode 100644 src/lib/crypto/builtin/des/des_keys.c
- delete mode 100644 src/lib/crypto/builtin/des/destest.c
- delete mode 100644 src/lib/crypto/builtin/des/doc/libdes.doc
- delete mode 100644 src/lib/crypto/builtin/des/f_aead.c
- delete mode 100644 src/lib/crypto/builtin/des/f_cbc.c
- delete mode 100644 src/lib/crypto/builtin/des/f_cksum.c
- delete mode 100644 src/lib/crypto/builtin/des/f_parity.c
- delete mode 100644 src/lib/crypto/builtin/des/f_sched.c
- delete mode 100644 src/lib/crypto/builtin/des/f_tables.c
- delete mode 100644 src/lib/crypto/builtin/des/f_tables.h
- delete mode 100644 src/lib/crypto/builtin/des/key_sched.c
- delete mode 100644 src/lib/crypto/builtin/des/keytest.data
- delete mode 100644 src/lib/crypto/builtin/des/t_verify.c
- delete mode 100644 src/lib/crypto/builtin/des/weak_key.c
- delete mode 100644 src/lib/crypto/builtin/enc_provider/des3.c
- delete mode 100644 src/lib/crypto/krb/prf_des.c
- delete mode 100644 src/lib/crypto/openssl/des/Makefile.in
- delete mode 100644 src/lib/crypto/openssl/des/deps
- delete mode 100644 src/lib/crypto/openssl/des/des_keys.c
- delete mode 100644 src/lib/crypto/openssl/enc_provider/des3.c
-
-diff --git a/doc/admin/advanced/retiring-des.rst b/doc/admin/advanced/retiring-des.rst
-index 38f76d3f4..d5e3c30c0 100644
---- a/doc/admin/advanced/retiring-des.rst
-+++ b/doc/admin/advanced/retiring-des.rst
-@@ -10,6 +10,13 @@ ability have rendered DES vulnerable to brute force attacks on its 56-bit
- keyspace.  As such, it is now considered insecure and should not be
- used (:rfc:`6649`).
- 
-+In 1999, MIT krb5 added support for Triple-DES (3DES) encryption types.
-+However, due to weakenings of DES and other security concerns, it is now also
-+considered insecure and should not be used (:rfc:`8429`).  AES encryption
-+types were added to MIT in 2003, meaning that the number of deployments with
-+3DES as the strongest encryption type is hopefully small.  The rotation
-+procedure described herein works for both DES and 3DES.
-+
- History
- -------
- 
-@@ -27,6 +34,10 @@ and removed DES (single-DES) support in release 1.18.  As a
- consequence, a release prior to 1.18 is required to perform these
- migrations.
- 
-+3DES (a flagged deprecated encryption type) was also removed downstream by
-+rharwood@redhat.com starting in 1.18; likewise, a pre-1.18 release is required
-+to perform these migrations.
-+
- Types of keys
- -------------
- 
-diff --git a/doc/admin/conf_files/kdc_conf.rst b/doc/admin/conf_files/kdc_conf.rst
-index 1dc958d62..3a72aabef 100644
---- a/doc/admin/conf_files/kdc_conf.rst
-+++ b/doc/admin/conf_files/kdc_conf.rst
-@@ -848,8 +848,6 @@ Encryption types marked as "weak" and "deprecated" are available for
- compatibility but not recommended for use.
- 
- ==================================================== =========================================================
--des3-cbc-raw                                         Triple DES cbc mode raw (weak)
--des3-cbc-sha1 des3-hmac-sha1 des3-cbc-sha1-kd        Triple DES cbc mode with HMAC/sha1 (deprecated)
- aes256-cts-hmac-sha1-96 aes256-cts aes256-sha1       AES-256 CTS mode with 96-bit SHA-1 HMAC
- aes128-cts-hmac-sha1-96 aes128-cts aes128-sha1       AES-128 CTS mode with 96-bit SHA-1 HMAC
- aes256-cts-hmac-sha384-192 aes256-sha2               AES-256 CTS mode with 192-bit SHA-384 HMAC
-@@ -858,7 +856,6 @@ arcfour-hmac rc4-hmac arcfour-hmac-md5               RC4 with HMAC/MD5 (deprecat
- arcfour-hmac-exp rc4-hmac-exp arcfour-hmac-md5-exp   Exportable RC4 with HMAC/MD5 (weak)
- camellia256-cts-cmac camellia256-cts                 Camellia-256 CTS mode with CMAC
- camellia128-cts-cmac camellia128-cts                 Camellia-128 CTS mode with CMAC
--des3                                                 The triple DES family: des3-cbc-sha1
- aes                                                  The AES family: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha384-192, and aes128-cts-hmac-sha256-128
- rc4                                                  The RC4 family: arcfour-hmac
- camellia                                             The Camellia family: camellia256-cts-cmac and camellia128-cts-cmac
-@@ -870,8 +867,8 @@ from the current list by prefixing them with a minus sign ("-").
- Types or families can be prefixed with a plus sign ("+") for symmetry;
- it has the same meaning as just listing the type or family.  For
- example, "``DEFAULT -rc4``" would be the default set of encryption
--types with RC4 types removed, and "``des3 DEFAULT``" would be the
--default set of encryption types with triple DES types moved to the
-+types with RC4 types removed, and "``aes128-sha2 DEFAULT``" would be
-+the default set of encryption types with aes128-sha2 moved to the
- front.
- 
- While **aes128-cts** and **aes256-cts** are supported for all Kerberos
-diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst
-index 047185afb..b08d954d9 100644
---- a/doc/admin/enctypes.rst

_service:extract_file:SELinux-integration.patch Deleted

@@ -1,1034 +0,0 @@
-From e787771b618a344d45ac515927e914602f48946f Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 23 Aug 2016 16:30:53 -0400
-Subject: PATCH downstream SELinux integration
-
-SELinux bases access to files on the domain of the requesting process,
-the operation being performed, and the context applied to the file.
-
-In many cases, applications needn't be SELinux aware to work properly,
-because SELinux can apply a default label to a file based on the label
-of the directory in which it's created.
-
-In the case of files such as /etc/krb5.keytab, however, this isn't
-sufficient, as /etc/krb5.keytab will almost always need to be given a
-label which differs from that of /etc/issue or /etc/resolv.conf.  The
-the kdb stash file needs a different label than the database for which
-it's holding a master key, even though both typically live in the same
-directory.
-
-To give the file the correct label, we can either force a "restorecon"
-call to fix a file's label after it's created, or create the file with
-the right label, as we attempt to do here.  We lean on THREEPARAMOPEN
-and define a similar macro named WRITABLEFOPEN with which we replace
-several uses of fopen().
-
-The file creation context that we're manipulating here is a process-wide
-attribute.  While for the most part, applications which need to label
-files when they're created have tended to be single-threaded, there's
-not much we can do to avoid interfering with an application that
-manipulates the creation context directly.  Right now we're mediating
-access using a library-local mutex, but that can only work for consumers
-that are part of this package -- an unsuspecting application will still
-stomp all over us.
-
-The selabel APIs for looking up the context should be thread-safe (per
-Red Hat #273081), so switching to using them instead of matchpathcon(),
-which we used earlier, is some improvement.
-
-Last-updated: krb5-1.18-beta1
----
- src/aclocal.m4                                |  48 +++
- src/build-tools/krb5-config.in                |   3 +-
- src/config/pre.in                             |   3 +-
- src/configure.ac                              |   2 +
- src/include/k5-int.h                          |   1 +
- src/include/k5-label.h                        |  32 ++
- src/include/krb5/krb5.hin                     |   6 +
- src/kadmin/dbutil/dump.c                      |  11 +-
- src/kdc/main.c                                |   2 +-
- src/kprop/kpropd.c                            |   9 +
- src/lib/kadm5/logger.c                        |   4 +-
- src/lib/kdb/kdb_log.c                         |   2 +-
- src/lib/krb5/ccache/cc_dir.c                  |  26 +-
- src/lib/krb5/keytab/kt_file.c                 |   4 +-
- src/lib/krb5/os/trace.c                       |   2 +-
- src/plugins/kdb/db2/adb_openclose.c           |   2 +-
- src/plugins/kdb/db2/kdb_db2.c                 |   4 +-
- src/plugins/kdb/db2/libdb2/btree/bt_open.c    |   3 +-
- src/plugins/kdb/db2/libdb2/hash/hash.c        |   3 +-
- src/plugins/kdb/db2/libdb2/recno/rec_open.c   |   4 +-
- .../kdb/ldap/ldap_util/kdb5_ldap_services.c   |  11 +-
- src/util/profile/prof_file.c                  |   3 +-
- src/util/support/Makefile.in                  |   3 +-
- src/util/support/selinux.c                    | 406 ++++++++++++++++++
- 24 files changed, 573 insertions(+), 21 deletions(-)
- create mode 100644 src/include/k5-label.h
- create mode 100644 src/util/support/selinux.c
-
-diff --git a/src/aclocal.m4 b/src/aclocal.m4
-index ca9fcf664..5afb96e58 100644
---- a/src/aclocal.m4
-+++ b/src/aclocal.m4
-@@ -85,6 +85,7 @@ AC_SUBST_FILE(libnodeps_frag)
- dnl
- KRB5_AC_PRAGMA_WEAK_REF
- WITH_LDAP
-+KRB5_WITH_SELINUX
- KRB5_LIB_PARAMS
- KRB5_AC_INITFINI
- KRB5_AC_ENABLE_THREADS
-@@ -1745,4 +1746,51 @@ AC_SUBST(PAM_LIBS)
- AC_SUBST(PAM_MAN)
- AC_SUBST(NON_PAM_MAN)
- )dnl
-+dnl
-+dnl Use libselinux to set file contexts on newly-created files.
-+dnl
-+AC_DEFUN(KRB5_WITH_SELINUX,
-+AC_ARG_WITH(selinux,AC_HELP_STRING(--with-selinux,compile with SELinux labeling support),
-+           withselinux="$withval",withselinux=auto)
-+old_LIBS="$LIBS"
-+if test "$withselinux" != no ; then
-+       AC_MSG_RESULT(checking for libselinux...)
-+       SELINUX_LIBS=
-+       AC_CHECK_HEADERS(selinux/selinux.h selinux/label.h)
-+       if test "x$ac_cv_header_selinux_selinux_h" != xyes ; then
-+               if test "$withselinux" = auto ; then
-+                       AC_MSG_RESULT(Unable to locate selinux/selinux.h.)
-+                       withselinux=no
-+               else
-+                       AC_MSG_ERROR(Unable to locate selinux/selinux.h.)
-+               fi
-+       fi
- 
-+       LIBS=
-+       unset ac_cv_func_setfscreatecon
-+       AC_CHECK_FUNCS(setfscreatecon selabel_open)
-+       if test "x$ac_cv_func_setfscreatecon" = xno ; then
-+               AC_CHECK_LIB(selinux,setfscreatecon)
-+               unset ac_cv_func_setfscreatecon
-+               AC_CHECK_FUNCS(setfscreatecon selabel_open)
-+               if test "x$ac_cv_func_setfscreatecon" = xyes ; then
-+                       SELINUX_LIBS="$LIBS"
-+               else
-+                       if test "$withselinux" = auto ; then
-+                               AC_MSG_RESULT(Unable to locate libselinux.)
-+                               withselinux=no
-+                       else
-+                               AC_MSG_ERROR(Unable to locate libselinux.)
-+                       fi
-+               fi
-+       fi
-+       if test "$withselinux" != no ; then
-+               AC_MSG_NOTICE(building with SELinux labeling support)
-+               AC_DEFINE(USE_SELINUX,1,Define if Kerberos-aware tools should set SELinux file contexts when creating files.)
-+               SELINUX_LIBS="$LIBS"
-+		EXTRA_SUPPORT_SYMS="$EXTRA_SUPPORT_SYMS krb5int_labeled_open krb5int_labeled_fopen krb5int_push_fscreatecon_for krb5int_pop_fscreatecon"
-+       fi
-+fi
-+LIBS="$old_LIBS"
-+AC_SUBST(SELINUX_LIBS)
-+)dnl
-diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in
-index dead0dddc..fef3e054f 100755
---- a/src/build-tools/krb5-config.in
-+++ b/src/build-tools/krb5-config.in
-@@ -41,6 +41,7 @@ DL_LIB='@DL_LIB@'
- DEFCCNAME='@DEFCCNAME@'
- DEFKTNAME='@DEFKTNAME@'
- DEFCKTNAME='@DEFCKTNAME@'
-+SELINUX_LIBS='@SELINUX_LIBS@'
- 
- LIBS='@LIBS@'
- GEN_LIB=@GEN_LIB@
-@@ -254,7 +255,7 @@ if test -n "$do_libs"; then
-     fi
- 
-     # If we ever support a flag to generate output suitable for static
--    # linking, we would output "-lkrb5support $GEN_LIB $LIBS $DL_LIB"
-+    # linking, we would output "-lkrb5support $GEN_LIB $LIBS $SELINUX_LIBS $DL_LIB"
-     # here.
- 
-     echo $lib_flags
-diff --git a/src/config/pre.in b/src/config/pre.in
-index 3752174c7..0d2068575 100644
---- a/src/config/pre.in
-+++ b/src/config/pre.in
-@@ -177,6 +177,7 @@ LD = $(PURE) @LD@
- KRB_INCLUDES = -I$(BUILDTOP)/include -I$(top_srcdir)/include
- LDFLAGS = @LDFLAGS@
- LIBS = @LIBS@
-+SELINUX_LIBS=@SELINUX_LIBS@
- 
- INSTALL=@INSTALL@
- INSTALL_STRIP=
-@@ -403,7 +404,7 @@ SUPPORT_LIB			= -l$(SUPPORT_LIBNAME)
- # HESIOD_LIBS is -lhesiod...
- HESIOD_LIBS	= @HESIOD_LIBS@
- 
--KRB5_BASE_LIBS	= $(KRB5_LIB) $(K5CRYPTO_LIB) $(COM_ERR_LIB) $(SUPPORT_LIB) $(GEN_LIB) $(LIBS) $(DL_LIB)
-+KRB5_BASE_LIBS	= $(KRB5_LIB) $(K5CRYPTO_LIB) $(COM_ERR_LIB) $(SUPPORT_LIB) $(GEN_LIB) $(LIBS) $(SELINUX_LIBS) $(DL_LIB)
- KDB5_LIBS	= $(KDB5_LIB) $(GSSRPC_LIBS)
- GSS_LIBS	= $(GSS_KRB5_LIB)
- # needs fixing if ever used on macOS!
-diff --git a/src/configure.ac b/src/configure.ac
-index 693f76a81..dd2cad3ee 100644
---- a/src/configure.ac
-+++ b/src/configure.ac
-@@ -1391,6 +1391,8 @@ AC_PATH_PROG(GROFF, groff)
- 
- KRB5_WITH_PAM
- 
-+KRB5_WITH_SELINUX
-+
- # Make localedir work in autoconf 2.5x.
- if test "${localedir+set}" != set; then
-     localedir='$(datadir)/locale'
-diff --git a/src/include/k5-int.h b/src/include/k5-int.h
-index cf524252f..efb523689 100644
---- a/src/include/k5-int.h
-+++ b/src/include/k5-int.h
-@@ -128,6 +128,7 @@ typedef unsigned char   u_char;
- 
- 
- #include "k5-platform.h"
-+#include "k5-label.h"
- 
- #define KRB5_KDB_MAX_LIFE       (60*60*24) /* one day */
- #define KRB5_KDB_MAX_RLIFE      (60*60*24*7) /* one week */

_service:extract_file:backport-CVE-2021-37750.patch Deleted

@@ -1,46 +0,0 @@
-From d775c95af7606a51bf79547a94fa52ddd1cb7f49 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Tue, 3 Aug 2021 01:15:27 -0400
-Subject: PATCH Fix KDC null deref on TGS inner body null server
-
-After the KDC decodes a FAST inner body, it does not check for a null
-server.  Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this
-would typically result in an error from krb5_unparse_name(), but with
-the addition of get_local_tgt() it results in a null dereference.  Add
-a null check.
-
-Reported by Joseph Sutton of Catalyst.
-
-CVE-2021-37750:
-
-In MIT krb5 releases 1.14 and later, an authenticated attacker can
-cause a null dereference in the KDC by sending a FAST TGS request with
-no server field.
-
-ticket: 9008 (new)
-tags: pullup
-target_version: 1.19-next
-target_version: 1.18-next
----
- src/kdc/do_tgs_req.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
-index 582e497..32dc65f 100644
---- a/src/kdc/do_tgs_req.c
-+++ b/src/kdc/do_tgs_req.c
-@@ -207,6 +207,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
-         status = "FIND_FAST";
-         goto cleanup;
-     }
-+    if (sprinc == NULL) {
-+        status = "NULL_SERVER";
-+        errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
-+        goto cleanup;
-+    }
- 
-     errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server,
-                             &local_tgt, &local_tgt_storage, &local_tgt_key);
--- 
-1.8.3.1
-

_service:extract_file:fix-debuginfo-with-y.tab.c.patch Deleted

@@ -1,41 +0,0 @@
-From ed161c3f3cb642d025f0fee6d4af6f56bba711e9 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 23 Aug 2016 16:49:25 -0400
-Subject: PATCH downstream fix debuginfo with y.tab.c
-
-We want to keep these y.tab.c files around because the debuginfo points to
-them.  It would be more elegant at the end to use symbolic links, but that
-could mess up people working in the tree on other things.
-
-Last-updated: krb5-1.9
----
- src/kadmin/cli/Makefile.in                 | 5 +++++
- src/plugins/kdb/ldap/ldap_util/Makefile.in | 2 +-
- 2 files changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/src/kadmin/cli/Makefile.in b/src/kadmin/cli/Makefile.in
-index adfea6e2b..d1327e400 100644
---- a/src/kadmin/cli/Makefile.in
-+++ b/src/kadmin/cli/Makefile.in
-@@ -37,3 +37,8 @@ clean-unix::
- # CC_LINK is not meant for compilation and this use may break in the future.
- datetest: getdate.c
- 	$(CC_LINK) $(ALL_CFLAGS) -DTEST -o datetest getdate.c
-+
-+%.c: %.y
-+	$(RM) y.tab.c $@
-+	$(YACC.y) $< 
-+	$(CP) y.tab.c $@
-diff --git a/src/plugins/kdb/ldap/ldap_util/Makefile.in b/src/plugins/kdb/ldap/ldap_util/Makefile.in
-index 8669c2436..a22f23c02 100644
---- a/src/plugins/kdb/ldap/ldap_util/Makefile.in
-+++ b/src/plugins/kdb/ldap/ldap_util/Makefile.in
-@@ -20,7 +20,7 @@ $(PROG): $(OBJS) $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIB) $(GETDATE)
- getdate.c: $(GETDATE)
- 	$(RM) getdate.c y.tab.c
- 	$(YACC) $(GETDATE)
--	$(MV) y.tab.c getdate.c
-+	$(CP) y.tab.c getdate.c
- 
- install:
- 	$(INSTALL_PROGRAM) $(PROG) ${DESTDIR}$(ADMIN_BINDIR)/$(PROG)

_service:extract_file:ksu-pam-integration.patch Deleted

@@ -1,774 +0,0 @@
-From 90ba715be48c2e1b6c7ca53cb1d75f3af2c388d6 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 23 Aug 2016 16:29:58 -0400
-Subject: PATCH downstream ksu pam integration
-
-Modify ksu so that it performs account and session management on behalf of
-the target user account, mimicking the action of regular su.  The default
-service name is "ksu", because on Fedora at least the configuration used
-is determined by whether or not a login shell is being opened, and so
-this may need to vary, too.  At run-time, ksu's behavior can be reset to
-the earlier, non-PAM behavior by setting "use_pam" to false in the ksu
-section of /etc/krb5.conf.
-
-When enabled, ksu gains a dependency on libpam.
-
-Originally RT#5939, though it's changed since then to perform the account
-and session management before dropping privileges, and to apply on top of
-changes we're proposing for how it handles cache collections.
-
-Last-updated: krb5-1.18-beta1
----
- src/aclocal.m4              |  69 +++++++
- src/clients/ksu/Makefile.in |   8 +-
- src/clients/ksu/main.c      |  88 +++++++-
- src/clients/ksu/pam.c       | 389 ++++++++++++++++++++++++++++++++++++
- src/clients/ksu/pam.h       |  57 ++++++
- src/configure.ac            |   2 +
- 6 files changed, 610 insertions(+), 3 deletions(-)
- create mode 100644 src/clients/ksu/pam.c
- create mode 100644 src/clients/ksu/pam.h
-
-diff --git a/src/aclocal.m4 b/src/aclocal.m4
-index 024d6370c..ca9fcf664 100644
---- a/src/aclocal.m4
-+++ b/src/aclocal.m4
-@@ -1677,3 +1677,72 @@ if test "$with_ldap" = yes; then
-   OPENLDAP_PLUGIN=yes
- fi
- )dnl
-+dnl
-+dnl
-+dnl Use PAM instead of local crypt() compare for checking local passwords,
-+dnl and perform PAM account, session management, and password-changing where
-+dnl appropriate.
-+dnl 
-+AC_DEFUN(KRB5_WITH_PAM,
-+AC_ARG_WITH(pam,AC_HELP_STRING(--with-pam,compile with PAM support),
-+	    withpam="$withval",withpam=auto)
-+AC_ARG_WITH(pam-ksu-service,AC_HELP_STRING(--with-ksu-service,PAM service name for ksu "ksu"),
-+	    withksupamservice="$withval",withksupamservice=ksu)
-+old_LIBS="$LIBS"
-+if test "$withpam" != no ; then
-+	AC_MSG_RESULT(checking for PAM...)
-+	PAM_LIBS=
-+
-+	AC_CHECK_HEADERS(security/pam_appl.h)
-+	if test "x$ac_cv_header_security_pam_appl_h" != xyes ; then
-+		if test "$withpam" = auto ; then
-+			AC_MSG_RESULT(Unable to locate security/pam_appl.h.)
-+			withpam=no
-+		else
-+			AC_MSG_ERROR(Unable to locate security/pam_appl.h.)
-+		fi
-+	fi
-+
-+	LIBS=
-+	unset ac_cv_func_pam_start
-+	AC_CHECK_FUNCS(putenv pam_start)
-+	if test "x$ac_cv_func_pam_start" = xno ; then
-+		unset ac_cv_func_pam_start
-+		AC_CHECK_LIB(dl,dlopen)
-+		AC_CHECK_FUNCS(pam_start)
-+		if test "x$ac_cv_func_pam_start" = xno ; then
-+			AC_CHECK_LIB(pam,pam_start)
-+			unset ac_cv_func_pam_start
-+			unset ac_cv_func_pam_getenvlist
-+			AC_CHECK_FUNCS(pam_start pam_getenvlist)
-+			if test "x$ac_cv_func_pam_start" = xyes ; then
-+				PAM_LIBS="$LIBS"
-+			else
-+				if test "$withpam" = auto ; then
-+					AC_MSG_RESULT(Unable to locate libpam.)
-+					withpam=no
-+				else
-+					AC_MSG_ERROR(Unable to locate libpam.)
-+				fi
-+			fi
-+		fi
-+	fi
-+	if test "$withpam" != no ; then
-+		AC_MSG_NOTICE(building with PAM support)
-+		AC_DEFINE(USE_PAM,1,Define if Kerberos-aware tools should support PAM)
-+		AC_DEFINE_UNQUOTED(KSU_PAM_SERVICE,"$withksupamservice",
-+				   Define to the name of the PAM service name to be used by ksu.)
-+		PAM_LIBS="$LIBS"
-+		NON_PAM_MAN=".\\\" "
-+		PAM_MAN=
-+	else
-+		PAM_MAN=".\\\" "
-+		NON_PAM_MAN=
-+	fi
-+fi
-+LIBS="$old_LIBS"
-+AC_SUBST(PAM_LIBS)
-+AC_SUBST(PAM_MAN)
-+AC_SUBST(NON_PAM_MAN)
-+)dnl
-+
-diff --git a/src/clients/ksu/Makefile.in b/src/clients/ksu/Makefile.in
-index 8b4edce4d..9d58f29b5 100644
---- a/src/clients/ksu/Makefile.in
-+++ b/src/clients/ksu/Makefile.in
-@@ -3,12 +3,14 @@ BUILDTOP=$(REL)..$(S)..
- DEFINES = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/usr/local/sbin /usr/local/bin /sbin /bin /usr/sbin /usr/bin"'
- 
- KSU_LIBS=@KSU_LIBS@
-+PAM_LIBS=@PAM_LIBS@
- 
- SRCS = \
- 	$(srcdir)/krb_auth_su.c \
- 	$(srcdir)/ccache.c \
- 	$(srcdir)/authorization.c \
- 	$(srcdir)/main.c \
-+	$(srcdir)/pam.c \
- 	$(srcdir)/heuristic.c \
- 	$(srcdir)/xmalloc.c \
- 	$(srcdir)/setenv.c
-@@ -17,13 +19,17 @@ OBJS = \
- 	ccache.o \
- 	authorization.o \
- 	main.o \
-+	pam.o \
- 	heuristic.o \
- 	xmalloc.o @SETENVOBJ@
- 
- all: ksu
- 
- ksu: $(OBJS) $(KRB5_BASE_DEPLIBS)
--	$(CC_LINK) -o $@ $(OBJS) $(KRB5_BASE_LIBS) $(KSU_LIBS)
-+	$(CC_LINK) -o $@ $(OBJS) $(KRB5_BASE_LIBS) $(KSU_LIBS) $(PAM_LIBS)
-+
-+pam.o: pam.c
-+	$(CC) $(ALL_CFLAGS) -c $<
- 
- clean:
- 	$(RM) ksu
-diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c
-index af1286172..931f05404 100644
---- a/src/clients/ksu/main.c
-+++ b/src/clients/ksu/main.c
-@@ -26,6 +26,7 @@
-  * KSU was written by:  Ari Medvinsky, ari@isi.edu
-  */
- 
-+#include "autoconf.h"
- #include "ksu.h"
- #include "adm_proto.h"
- #include <sys/types.h>
-@@ -33,6 +34,10 @@
- #include <signal.h>
- #include <grp.h>
- 
-+#ifdef USE_PAM
-+#include "pam.h"
-+#endif
-+
- /* globals */
- char * prog_name;
- int auth_debug =0;
-@@ -40,6 +45,7 @@ char k5login_pathMAXPATHLEN;
- char k5users_pathMAXPATHLEN;
- char * gb_err = NULL;
- int quiet = 0;
-+int force_fork = 0;
- /***********/
- 
- #define KS_TEMPORARY_CACHE "MEMORY:_ksu"
-@@ -536,6 +542,23 @@ main (argc, argv)
-                prog_name,target_user,client_name,
-                source_user,ontty());
- 
-+#ifdef USE_PAM
-+        if (appl_pam_enabled(ksu_context, "ksu")) {
-+            if (appl_pam_acct_mgmt(KSU_PAM_SERVICE, 1, target_user, NULL,
-+                                   NULL, source_user,
-+                                   ttyname(STDERR_FILENO)) != 0) {
-+                fprintf(stderr, "Access denied for %s.\n", target_user);
-+                exit(1);
-+            }
-+            if (appl_pam_requires_chauthtok()) {
-+                fprintf(stderr, "Password change required for %s.\n",
-+                        target_user);
-+                exit(1);
-+            }
-+            force_fork++;
-+        }
-+#endif
-+
-         /* Run authorization as target.*/

_service:extract_file:netlib-and-dns.patch Deleted

_service:tar_scm:Adjust-build-configuration.patch Added

@@ -0,0 +1,72 @@
+From cbfe13d5f0de6e2a3deab2ba0dacda8c952476ab Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Tue, 23 Aug 2016 16:45:26 -0400
+Subject: PATCH downstream Adjust build configuration
+
+Build binaries in this package as RELRO PIEs, libraries as partial RELRO,
+and install shared libraries with the execute bit set on them.  Prune out
+the -L/usr/lib* and PIE flags where they might leak out and affect
+apps which just want to link with the libraries. FIXME: needs to check and
+not just assume that the compiler supports using these flags.
+
+Last-updated: krb5-1.15-beta1
+---
+ src/build-tools/krb5-config.in | 7 +++++++
+ src/config/pre.in              | 2 +-
+ src/config/shlib.conf          | 5 +++--
+ 3 files changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in
+index c17cb5eb5..1891dea99 100755
+--- a/src/build-tools/krb5-config.in
++++ b/src/build-tools/krb5-config.in
+@@ -226,6 +226,13 @@ if test -n "$do_libs"; then
+ 	    -e 's#\$(PTHREAD_CFLAGS)#'"$PTHREAD_CFLAGS"'#' \
+ 	    -e 's#\$(CFLAGS)##'`
+ 
++    if test `dirname $libdir` = /usr ; then
++        lib_flags=`echo $lib_flags | sed -e "s#-L$libdir##" -e "s#$RPATH_FLAG$libdir##"`
++    fi
++    lib_flags=`echo $lib_flags | sed -e "s#-fPIE##g" -e "s#-pie##g"`
++    lib_flags=`echo $lib_flags | sed -e "s#-Wl,-z,relro##g"`
++    lib_flags=`echo $lib_flags | sed -e "s#-Wl,-z,now##g"`
++
+     if test $library = 'kdb'; then
+ 	lib_flags="$lib_flags -lkdb5 $KDB5_DB_LIB"
+ 	library=krb5
+diff --git a/src/config/pre.in b/src/config/pre.in
+index 917357df9..a8540ae2a 100644
+--- a/src/config/pre.in
++++ b/src/config/pre.in
+@@ -185,7 +185,7 @@ INSTALL_PROGRAM=@INSTALL_PROGRAM@ $(INSTALL_STRIP)
+ INSTALL_SCRIPT=@INSTALL_PROGRAM@
+ INSTALL_DATA=@INSTALL_DATA@
+ INSTALL_SHLIB=@INSTALL_SHLIB@
+-INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755 -o root
++INSTALL_SETUID=$(INSTALL) $(INSTALL_STRIP) -m 4755
+ ## This is needed because autoconf will sometimes define @exec_prefix@ to be
+ ## ${prefix}.
+ prefix=@prefix@
+diff --git a/src/config/shlib.conf b/src/config/shlib.conf
+index 3e4af6c02..2b20c3fda 100644
+--- a/src/config/shlib.conf
++++ b/src/config/shlib.conf
+@@ -423,7 +423,7 @@ mips-*-netbsd*)
+ 	# Linux ld doesn't default to stuffing the SONAME field...
+ 	# Use objdump -x to examine the fields of the library
+ 	# UNDEF_CHECK is suppressed by --enable-asan
+-	LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) $(UNDEF_CHECK)'
++	LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT) $(UNDEF_CHECK)  -Wl,-z,relro -Wl,--warn-shared-textrel'
+ 	UNDEF_CHECK='-Wl,--no-undefined'
+ 	# $(EXPORT_CHECK) runs export-check.pl when in maintainer mode.
+ 	LDCOMBINE_TAIL='-Wl,--version-script binutils.versions $(EXPORT_CHECK)'
+@@ -435,7 +435,8 @@ mips-*-netbsd*)
+ 	SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)'
+ 	PROFFLAGS=-pg
+ 	PROG_RPATH_FLAGS='$(RPATH_FLAG)$(PROG_RPATH)'
+-	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) $(LDFLAGS)'
++	CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CFLAGS) -pie -Wl,-z,relro -Wl,-z,now $(LDFLAGS)'
++	INSTALL_SHLIB='${INSTALL} -m755'
+ 	CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)'
+ 	CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) $(PROG_RPATH_FLAGS) $(CXXFLAGS) $(LDFLAGS)'
+ 	CXX_LINK_STATIC='$(CXX) $(PROG_LIBPATH) $(CXXFLAGS) $(LDFLAGS)'

_service:tar_scm:FIPS-with-PRNG-and-RADIUS-and-MD4.patch Added

@@ -0,0 +1,568 @@
+From 5978878bcee5ec39e4357f408470d39e9540d2bf Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Fri, 9 Nov 2018 15:12:21 -0500
+Subject: PATCH downstream FIPS with PRNG and RADIUS and MD4
+
+NB: Use openssl's PRNG in FIPS mode and taint within krad.
+
+A lot of the FIPS error conditions from OpenSSL are incredibly
+mysterious (at best, things return NULL unexpectedly; at worst,
+internal assertions are tripped; most of the time, you just get
+ENOMEM).  In order to cope with this, we need to have some level of
+awareness of what we can and can't safely call.
+
+This will slow down some calls slightly (FIPS_mode() takes multiple
+locks), but not for any ciphers we care about - which is to say that
+AES is fine.  Shame about SPAKE though.
+
+post6 restores MD4 (and therefore keygen-only RC4).
+
+Last-updated: krb5-1.17
+---
+ src/lib/crypto/krb/prng.c                     | 11 ++++-
+ .../crypto/openssl/enc_provider/camellia.c    |  6 +++
+ src/lib/crypto/openssl/enc_provider/rc4.c     | 13 +++++-
+ .../crypto/openssl/hash_provider/hash_evp.c   | 12 +++++
+ src/lib/crypto/openssl/hmac.c                 |  6 ++-
+ src/lib/krad/attr.c                           | 45 ++++++++++++++-----
+ src/lib/krad/attrset.c                        |  5 ++-
+ src/lib/krad/internal.h                       | 13 +++++-
+ src/lib/krad/packet.c                         | 22 ++++-----
+ src/lib/krad/remote.c                         | 10 ++++-
+ src/lib/krad/t_attr.c                         |  3 +-
+ src/lib/krad/t_attrset.c                      |  4 +-
+ src/plugins/preauth/spake/spake_client.c      |  6 +++
+ src/plugins/preauth/spake/spake_kdc.c         |  6 +++
+ 14 files changed, 129 insertions(+), 33 deletions(-)
+
+diff --git a/src/lib/crypto/krb/prng.c b/src/lib/crypto/krb/prng.c
+index cb9ca9b98..f0e9984ca 100644
+--- a/src/lib/crypto/krb/prng.c
++++ b/src/lib/crypto/krb/prng.c
+@@ -26,6 +26,8 @@
+ 
+ #include "crypto_int.h"
+ 
++#include <openssl/rand.h>
++
+ krb5_error_code KRB5_CALLCONV
+ krb5_c_random_seed(krb5_context context, krb5_data *data)
+ {
+@@ -99,9 +101,16 @@ krb5_boolean
+ k5_get_os_entropy(unsigned char *buf, size_t len, int strong)
+ {
+     const char *device;
+-#if defined(__linux__) && defined(SYS_getrandom)
+     int r;
+ 
++    /* A wild FIPS mode appeared! */
++    if (FIPS_mode()) {
++        /* The return codes on this API are not good */
++        r = RAND_bytes(buf, len);
++        return r == 1;
++    }
++
++#if defined(__linux__) && defined(SYS_getrandom)
+     while (len > 0) {
+         /*
+          * Pull from the /dev/urandom pool, but require it to have been seeded.
+diff --git a/src/lib/crypto/openssl/enc_provider/camellia.c b/src/lib/crypto/openssl/enc_provider/camellia.c
+index 2da691329..f79679a0b 100644
+--- a/src/lib/crypto/openssl/enc_provider/camellia.c
++++ b/src/lib/crypto/openssl/enc_provider/camellia.c
+@@ -304,6 +304,9 @@ krb5int_camellia_cbc_mac(krb5_key key, const krb5_crypto_iov *data,
+     unsigned char blockYCAMELLIA_BLOCK_SIZE, blockBCAMELLIA_BLOCK_SIZE;
+     struct iov_cursor cursor;
+ 
++    if (FIPS_mode())
++        return KRB5_CRYPTO_INTERNAL;
++
+     if (output->length < CAMELLIA_BLOCK_SIZE)
+         return KRB5_BAD_MSIZE;
+ 
+@@ -331,6 +334,9 @@ static krb5_error_code
+ krb5int_camellia_init_state (const krb5_keyblock *key, krb5_keyusage usage,
+                              krb5_data *state)
+ {
++    if (FIPS_mode())
++        return KRB5_CRYPTO_INTERNAL;
++
+     state->length = 16;
+     state->data = (void *) malloc(16);
+     if (state->data == NULL)
+diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c
+index a65d57b7a..6ccaca94a 100644
+--- a/src/lib/crypto/openssl/enc_provider/rc4.c
++++ b/src/lib/crypto/openssl/enc_provider/rc4.c
+@@ -66,6 +66,9 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
+     EVP_CIPHER_CTX *ctx = NULL;
+     struct arcfour_state *arcstate;
+ 
++    if (FIPS_mode())
++        return KRB5_CRYPTO_INTERNAL;
++
+     arcstate = (state != NULL) ? (void *)state->data : NULL;
+     if (arcstate != NULL) {
+         ctx = arcstate->ctx;
+@@ -113,7 +116,12 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
+ static void
+ k5_arcfour_free_state(krb5_data *state)
+ {
+-    struct arcfour_state *arcstate = (void *)state->data;
++    struct arcfour_state *arcstate;
++
++    if (FIPS_mode())
++        return;
++
++    arcstate = (void *) state->data;
+ 
+     EVP_CIPHER_CTX_free(arcstate->ctx);
+     free(arcstate);
+@@ -125,6 +133,9 @@ k5_arcfour_init_state(const krb5_keyblock *key,
+ {
+     struct arcfour_state *arcstate;
+ 
++    if (FIPS_mode())
++        return KRB5_CRYPTO_INTERNAL;
++
+     /*
+      * The cipher state here is a saved pointer to a struct arcfour_state
+      * object, rather than a flat byte array as in most enc providers.  The
+diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c
+index 1e0fb8fc3..feb5eda99 100644
+--- a/src/lib/crypto/openssl/hash_provider/hash_evp.c
++++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c
+@@ -49,6 +49,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
+     if (ctx == NULL)
+         return ENOMEM;
+ 
++    if (type == EVP_md4()) {
++        /* See comment below in hash_md4(). */
++        EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
++    }
++
+     ok = EVP_DigestInit_ex(ctx, type, NULL);
+     for (i = 0; i < num_data; i++) {
+         if (!SIGN_IOV(&datai))
+@@ -64,12 +69,19 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
+ static krb5_error_code
+ hash_md4(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
+ {
++    /*
++     * MD4 is needed in FIPS mode to perform key generation for RC4 keys used
++     * by IPA.  These keys are only used along a (separately) secured channel
++     * for legacy reasons when performing trusts to Active Directory.
++     */
+     return hash_evp(EVP_md4(), data, num_data, output);
+ }
+ 
+ static krb5_error_code
+ hash_md5(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
+ {
++    if (FIPS_mode())
++        return KRB5_CRYPTO_INTERNAL;
+     return hash_evp(EVP_md5(), data, num_data, output);
+ }
+ 
+diff --git a/src/lib/crypto/openssl/hmac.c b/src/lib/crypto/openssl/hmac.c
+index 7dc59dcc0..769a50c00 100644
+--- a/src/lib/crypto/openssl/hmac.c
++++ b/src/lib/crypto/openssl/hmac.c
+@@ -103,7 +103,11 @@ map_digest(const struct krb5_hash_provider *hash)
+         return EVP_sha256();
+     else if (!strncmp(hash->hash_name, "SHA-384",7))
+         return EVP_sha384();
+-    else if (!strncmp(hash->hash_name, "MD5", 3))
++
++    if (FIPS_mode())
++        return NULL;
++
++    if (!strncmp(hash->hash_name, "MD5", 3))
+         return EVP_md5();
+     else if (!strncmp(hash->hash_name, "MD4", 3))
+         return EVP_md4();
+diff --git a/src/lib/krad/attr.c b/src/lib/krad/attr.c
+index 9c13d9d75..275327e67 100644
+--- a/src/lib/krad/attr.c
++++ b/src/lib/krad/attr.c
+@@ -30,6 +30,7 @@
+ #include <k5-int.h>
+ #include "internal.h"
+ 
++#include <openssl/crypto.h>
+ #include <string.h>
+ 
+ /* RFC 2865 */
+@@ -38,7 +39,8 @@
+ typedef krb5_error_code
+ (*attribute_transform_fn)(krb5_context ctx, const char *secret,
+                           const unsigned char *auth, const krb5_data *in,

_service:tar_scm:Remove-3des-support.patch Added

@@ -0,0 +1,6453 @@
+From fef4e551d3d2dcb55e58cc182304254c36aa8949 Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Tue, 26 Mar 2019 18:51:10 -0400
+Subject: PATCH downstream Remove 3des support
+
+Completely remove support for all DES3 enctypes (des3-cbc-raw,
+des3-hmac-sha1, des3-cbc-sha1-kd).  Update all tests and documentation
+to user other enctypes.  Mark the 3DES enctypes UNSUPPORTED and retain
+their constants.
+
+Last-updated: 1.19-beta1
+---
+ doc/admin/advanced/retiring-des.rst           |  11 +
+ doc/admin/conf_files/kdc_conf.rst             |   7 +-
+ doc/admin/enctypes.rst                        |  10 +-
+ doc/admin/troubleshoot.rst                    |   9 +-
+ doc/appdev/refs/macros/index.rst              |   1 -
+ doc/conf.py                                   |   2 +-
+ doc/mitK5features.rst                         |   2 +-
+ src/Makefile.in                               |   4 +-
+ src/configure.ac                              |   1 -
+ src/include/krb5/krb5.hin                     |  10 +-
+ src/kadmin/testing/proto/kdc.conf.proto       |   4 +-
+ src/kdc/kdc_util.c                            |   4 -
+ src/lib/crypto/Makefile.in                    |   8 +-
+ src/lib/crypto/builtin/Makefile.in            |   6 +-
+ src/lib/crypto/builtin/des/ISSUES             |  13 -
+ src/lib/crypto/builtin/des/Makefile.in        |  80 ----
+ src/lib/crypto/builtin/des/d3_aead.c          | 133 ------
+ src/lib/crypto/builtin/des/d3_kysched.c       |  51 ---
+ src/lib/crypto/builtin/des/deps               | 150 -------
+ src/lib/crypto/builtin/des/des_int.h          | 285 -------------
+ src/lib/crypto/builtin/des/des_keys.c         |  40 --
+ src/lib/crypto/builtin/des/destest.c          | 240 -----------
+ src/lib/crypto/builtin/des/doc/libdes.doc     | 208 ---------
+ src/lib/crypto/builtin/des/f_aead.c           | 173 --------
+ src/lib/crypto/builtin/des/f_cbc.c            | 256 ------------
+ src/lib/crypto/builtin/des/f_cksum.c          | 136 ------
+ src/lib/crypto/builtin/des/f_parity.c         |  56 ---
+ src/lib/crypto/builtin/des/f_sched.c          | 359 ----------------
+ src/lib/crypto/builtin/des/f_tables.c         | 370 ----------------
+ src/lib/crypto/builtin/des/f_tables.h         | 285 -------------
+ src/lib/crypto/builtin/des/key_sched.c        |  62 ---
+ src/lib/crypto/builtin/des/keytest.data       | 171 --------
+ src/lib/crypto/builtin/des/t_verify.c         | 395 ------------------
+ src/lib/crypto/builtin/des/weak_key.c         |  86 ----
+ .../crypto/builtin/enc_provider/Makefile.in   |   6 +-
+ src/lib/crypto/builtin/enc_provider/deps      |  13 -
+ src/lib/crypto/builtin/enc_provider/des3.c    | 105 -----
+ src/lib/crypto/crypto_tests/t_cf2.expected    |   1 -
+ src/lib/crypto/crypto_tests/t_cf2.in          |   5 -
+ src/lib/crypto/crypto_tests/t_cksums.c        |  10 -
+ src/lib/crypto/crypto_tests/t_decrypt.c       |  57 ---
+ src/lib/crypto/crypto_tests/t_derive.c        |  36 --
+ src/lib/crypto/crypto_tests/t_encrypt.c       |   1 -
+ src/lib/crypto/crypto_tests/t_short.c         |   1 -
+ src/lib/crypto/crypto_tests/t_str2key.c       |  52 ---
+ src/lib/crypto/krb/Makefile.in                |   3 -
+ src/lib/crypto/krb/cksumtypes.c               |   6 -
+ src/lib/crypto/krb/crypto_int.h               |  16 -
+ src/lib/crypto/krb/default_state.c            |  10 -
+ src/lib/crypto/krb/enctype_util.c             |   3 +
+ src/lib/crypto/krb/etypes.c                   |  21 -
+ src/lib/crypto/krb/prf_des.c                  |  47 ---
+ src/lib/crypto/krb/random_to_key.c            |  45 --
+ src/lib/crypto/libk5crypto.exports            |   1 -
+ src/lib/crypto/openssl/Makefile.in            |   8 +-
+ src/lib/crypto/openssl/des/Makefile.in        |  20 -
+ src/lib/crypto/openssl/des/deps               |  15 -
+ src/lib/crypto/openssl/des/des_keys.c         |  40 --
+ .../crypto/openssl/enc_provider/Makefile.in   |   3 -
+ src/lib/crypto/openssl/enc_provider/deps      |  11 -
+ src/lib/crypto/openssl/enc_provider/des3.c    | 184 --------
+ src/lib/gssapi/krb5/accept_sec_context.c      |   1 -
+ src/lib/gssapi/krb5/gssapiP_krb5.h            |   6 +-
+ src/lib/gssapi/krb5/k5seal.c                  |  35 +-
+ src/lib/gssapi/krb5/k5sealiov.c               |  27 +-
+ src/lib/gssapi/krb5/k5unseal.c                | 102 ++---
+ src/lib/gssapi/krb5/k5unsealiov.c             |  38 +-
+ src/lib/gssapi/krb5/util_crypt.c              |  11 -
+ .../api.current/chpass-principal-v2.exp       |   4 +-
+ .../api.current/get-principal-v2.exp          |   4 +-
+ .../api.current/randkey-principal-v2.exp      |   4 +-
+ src/lib/krb5/krb/init_ctx.c                   |   3 -
+ src/lib/krb5/krb/s4u_creds.c                  |   2 -
+ src/lib/krb5/krb/t_etypes.c                   |  48 +--
+ src/lib/krb5/os/t_trace.c                     |   4 +-
+ src/lib/krb5/os/t_trace.ref                   |   2 +-
+ src/plugins/preauth/pkinit/pkcs11.h           |   6 +-
+ src/plugins/preauth/pkinit/pkinit_clnt.c      |   8 -
+ src/plugins/preauth/pkinit/pkinit_crypto.h    |  12 -
+ .../preauth/pkinit/pkinit_crypto_openssl.c    |  38 --
+ src/plugins/preauth/pkinit/pkinit_kdf_test.c  |  31 --
+ src/plugins/preauth/spake/t_vectors.c         |  25 --
+ src/tests/dejagnu/config/default.exp          |  78 ----
+ src/tests/dejagnu/krb-standalone/kprop.exp    |   2 +-
+ src/tests/gssapi/t_enctypes.py                |  33 +-
+ src/tests/gssapi/t_invalid.c                  |  12 -
+ src/tests/gssapi/t_pcontok.c                  |  16 +-
+ src/tests/gssapi/t_prf.c                      |   7 -
+ src/tests/t_authdata.py                       |   2 +-
+ src/tests/t_etype_info.py                     |  18 +-
+ src/tests/t_keyrollover.py                    |   8 +-
+ src/tests/t_mkey.py                           |  35 --
+ src/tests/t_salt.py                           |   5 +-
+ src/util/k5test.py                            |   7 -
+ .../leash/htmlhelp/html/Encryption_Types.htm  |  13 -
+ 95 files changed, 160 insertions(+), 4835 deletions(-)
+ delete mode 100644 src/lib/crypto/builtin/des/ISSUES
+ delete mode 100644 src/lib/crypto/builtin/des/Makefile.in
+ delete mode 100644 src/lib/crypto/builtin/des/d3_aead.c
+ delete mode 100644 src/lib/crypto/builtin/des/d3_kysched.c
+ delete mode 100644 src/lib/crypto/builtin/des/deps
+ delete mode 100644 src/lib/crypto/builtin/des/des_int.h
+ delete mode 100644 src/lib/crypto/builtin/des/des_keys.c
+ delete mode 100644 src/lib/crypto/builtin/des/destest.c
+ delete mode 100644 src/lib/crypto/builtin/des/doc/libdes.doc
+ delete mode 100644 src/lib/crypto/builtin/des/f_aead.c
+ delete mode 100644 src/lib/crypto/builtin/des/f_cbc.c
+ delete mode 100644 src/lib/crypto/builtin/des/f_cksum.c
+ delete mode 100644 src/lib/crypto/builtin/des/f_parity.c
+ delete mode 100644 src/lib/crypto/builtin/des/f_sched.c
+ delete mode 100644 src/lib/crypto/builtin/des/f_tables.c
+ delete mode 100644 src/lib/crypto/builtin/des/f_tables.h
+ delete mode 100644 src/lib/crypto/builtin/des/key_sched.c
+ delete mode 100644 src/lib/crypto/builtin/des/keytest.data
+ delete mode 100644 src/lib/crypto/builtin/des/t_verify.c
+ delete mode 100644 src/lib/crypto/builtin/des/weak_key.c
+ delete mode 100644 src/lib/crypto/builtin/enc_provider/des3.c
+ delete mode 100644 src/lib/crypto/krb/prf_des.c
+ delete mode 100644 src/lib/crypto/openssl/des/Makefile.in
+ delete mode 100644 src/lib/crypto/openssl/des/deps
+ delete mode 100644 src/lib/crypto/openssl/des/des_keys.c
+ delete mode 100644 src/lib/crypto/openssl/enc_provider/des3.c
+
+diff --git a/doc/admin/advanced/retiring-des.rst b/doc/admin/advanced/retiring-des.rst
+index 38f76d3f4..d5e3c30c0 100644
+--- a/doc/admin/advanced/retiring-des.rst
++++ b/doc/admin/advanced/retiring-des.rst
+@@ -10,6 +10,13 @@ ability have rendered DES vulnerable to brute force attacks on its 56-bit
+ keyspace.  As such, it is now considered insecure and should not be
+ used (:rfc:`6649`).
+ 
++In 1999, MIT krb5 added support for Triple-DES (3DES) encryption types.
++However, due to weakenings of DES and other security concerns, it is now also
++considered insecure and should not be used (:rfc:`8429`).  AES encryption
++types were added to MIT in 2003, meaning that the number of deployments with
++3DES as the strongest encryption type is hopefully small.  The rotation
++procedure described herein works for both DES and 3DES.
++
+ History
+ -------
+ 
+@@ -27,6 +34,10 @@ and removed DES (single-DES) support in release 1.18.  As a
+ consequence, a release prior to 1.18 is required to perform these
+ migrations.
+ 
++3DES (a flagged deprecated encryption type) was also removed downstream by
++rharwood@redhat.com starting in 1.18; likewise, a pre-1.18 release is required
++to perform these migrations.
++
+ Types of keys
+ -------------
+ 
+diff --git a/doc/admin/conf_files/kdc_conf.rst b/doc/admin/conf_files/kdc_conf.rst
+index 1dc958d62..3a72aabef 100644
+--- a/doc/admin/conf_files/kdc_conf.rst
++++ b/doc/admin/conf_files/kdc_conf.rst
+@@ -848,8 +848,6 @@ Encryption types marked as "weak" and "deprecated" are available for
+ compatibility but not recommended for use.
+ 
+ ==================================================== =========================================================
+-des3-cbc-raw                                         Triple DES cbc mode raw (weak)
+-des3-cbc-sha1 des3-hmac-sha1 des3-cbc-sha1-kd        Triple DES cbc mode with HMAC/sha1 (deprecated)
+ aes256-cts-hmac-sha1-96 aes256-cts aes256-sha1       AES-256 CTS mode with 96-bit SHA-1 HMAC
+ aes128-cts-hmac-sha1-96 aes128-cts aes128-sha1       AES-128 CTS mode with 96-bit SHA-1 HMAC
+ aes256-cts-hmac-sha384-192 aes256-sha2               AES-256 CTS mode with 192-bit SHA-384 HMAC
+@@ -858,7 +856,6 @@ arcfour-hmac rc4-hmac arcfour-hmac-md5               RC4 with HMAC/MD5 (deprecat
+ arcfour-hmac-exp rc4-hmac-exp arcfour-hmac-md5-exp   Exportable RC4 with HMAC/MD5 (weak)
+ camellia256-cts-cmac camellia256-cts                 Camellia-256 CTS mode with CMAC
+ camellia128-cts-cmac camellia128-cts                 Camellia-128 CTS mode with CMAC
+-des3                                                 The triple DES family: des3-cbc-sha1
+ aes                                                  The AES family: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha384-192, and aes128-cts-hmac-sha256-128
+ rc4                                                  The RC4 family: arcfour-hmac
+ camellia                                             The Camellia family: camellia256-cts-cmac and camellia128-cts-cmac
+@@ -870,8 +867,8 @@ from the current list by prefixing them with a minus sign ("-").
+ Types or families can be prefixed with a plus sign ("+") for symmetry;
+ it has the same meaning as just listing the type or family.  For
+ example, "``DEFAULT -rc4``" would be the default set of encryption
+-types with RC4 types removed, and "``des3 DEFAULT``" would be the
+-default set of encryption types with triple DES types moved to the
++types with RC4 types removed, and "``aes128-sha2 DEFAULT``" would be
++the default set of encryption types with aes128-sha2 moved to the
+ front.
+ 
+ While **aes128-cts** and **aes256-cts** are supported for all Kerberos
+diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst
+index 047185afb..b08d954d9 100644
+--- a/doc/admin/enctypes.rst

_service:tar_scm:SELinux-integration.patch Added

@@ -0,0 +1,1034 @@
+From e787771b618a344d45ac515927e914602f48946f Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Tue, 23 Aug 2016 16:30:53 -0400
+Subject: PATCH downstream SELinux integration
+
+SELinux bases access to files on the domain of the requesting process,
+the operation being performed, and the context applied to the file.
+
+In many cases, applications needn't be SELinux aware to work properly,
+because SELinux can apply a default label to a file based on the label
+of the directory in which it's created.
+
+In the case of files such as /etc/krb5.keytab, however, this isn't
+sufficient, as /etc/krb5.keytab will almost always need to be given a
+label which differs from that of /etc/issue or /etc/resolv.conf.  The
+the kdb stash file needs a different label than the database for which
+it's holding a master key, even though both typically live in the same
+directory.
+
+To give the file the correct label, we can either force a "restorecon"
+call to fix a file's label after it's created, or create the file with
+the right label, as we attempt to do here.  We lean on THREEPARAMOPEN
+and define a similar macro named WRITABLEFOPEN with which we replace
+several uses of fopen().
+
+The file creation context that we're manipulating here is a process-wide
+attribute.  While for the most part, applications which need to label
+files when they're created have tended to be single-threaded, there's
+not much we can do to avoid interfering with an application that
+manipulates the creation context directly.  Right now we're mediating
+access using a library-local mutex, but that can only work for consumers
+that are part of this package -- an unsuspecting application will still
+stomp all over us.
+
+The selabel APIs for looking up the context should be thread-safe (per
+Red Hat #273081), so switching to using them instead of matchpathcon(),
+which we used earlier, is some improvement.
+
+Last-updated: krb5-1.18-beta1
+---
+ src/aclocal.m4                                |  48 +++
+ src/build-tools/krb5-config.in                |   3 +-
+ src/config/pre.in                             |   3 +-
+ src/configure.ac                              |   2 +
+ src/include/k5-int.h                          |   1 +
+ src/include/k5-label.h                        |  32 ++
+ src/include/krb5/krb5.hin                     |   6 +
+ src/kadmin/dbutil/dump.c                      |  11 +-
+ src/kdc/main.c                                |   2 +-
+ src/kprop/kpropd.c                            |   9 +
+ src/lib/kadm5/logger.c                        |   4 +-
+ src/lib/kdb/kdb_log.c                         |   2 +-
+ src/lib/krb5/ccache/cc_dir.c                  |  26 +-
+ src/lib/krb5/keytab/kt_file.c                 |   4 +-
+ src/lib/krb5/os/trace.c                       |   2 +-
+ src/plugins/kdb/db2/adb_openclose.c           |   2 +-
+ src/plugins/kdb/db2/kdb_db2.c                 |   4 +-
+ src/plugins/kdb/db2/libdb2/btree/bt_open.c    |   3 +-
+ src/plugins/kdb/db2/libdb2/hash/hash.c        |   3 +-
+ src/plugins/kdb/db2/libdb2/recno/rec_open.c   |   4 +-
+ .../kdb/ldap/ldap_util/kdb5_ldap_services.c   |  11 +-
+ src/util/profile/prof_file.c                  |   3 +-
+ src/util/support/Makefile.in                  |   3 +-
+ src/util/support/selinux.c                    | 406 ++++++++++++++++++
+ 24 files changed, 573 insertions(+), 21 deletions(-)
+ create mode 100644 src/include/k5-label.h
+ create mode 100644 src/util/support/selinux.c
+
+diff --git a/src/aclocal.m4 b/src/aclocal.m4
+index ca9fcf664..5afb96e58 100644
+--- a/src/aclocal.m4
++++ b/src/aclocal.m4
+@@ -85,6 +85,7 @@ AC_SUBST_FILE(libnodeps_frag)
+ dnl
+ KRB5_AC_PRAGMA_WEAK_REF
+ WITH_LDAP
++KRB5_WITH_SELINUX
+ KRB5_LIB_PARAMS
+ KRB5_AC_INITFINI
+ KRB5_AC_ENABLE_THREADS
+@@ -1745,4 +1746,51 @@ AC_SUBST(PAM_LIBS)
+ AC_SUBST(PAM_MAN)
+ AC_SUBST(NON_PAM_MAN)
+ )dnl
++dnl
++dnl Use libselinux to set file contexts on newly-created files.
++dnl
++AC_DEFUN(KRB5_WITH_SELINUX,
++AC_ARG_WITH(selinux,AC_HELP_STRING(--with-selinux,compile with SELinux labeling support),
++           withselinux="$withval",withselinux=auto)
++old_LIBS="$LIBS"
++if test "$withselinux" != no ; then
++       AC_MSG_RESULT(checking for libselinux...)
++       SELINUX_LIBS=
++       AC_CHECK_HEADERS(selinux/selinux.h selinux/label.h)
++       if test "x$ac_cv_header_selinux_selinux_h" != xyes ; then
++               if test "$withselinux" = auto ; then
++                       AC_MSG_RESULT(Unable to locate selinux/selinux.h.)
++                       withselinux=no
++               else
++                       AC_MSG_ERROR(Unable to locate selinux/selinux.h.)
++               fi
++       fi
+ 
++       LIBS=
++       unset ac_cv_func_setfscreatecon
++       AC_CHECK_FUNCS(setfscreatecon selabel_open)
++       if test "x$ac_cv_func_setfscreatecon" = xno ; then
++               AC_CHECK_LIB(selinux,setfscreatecon)
++               unset ac_cv_func_setfscreatecon
++               AC_CHECK_FUNCS(setfscreatecon selabel_open)
++               if test "x$ac_cv_func_setfscreatecon" = xyes ; then
++                       SELINUX_LIBS="$LIBS"
++               else
++                       if test "$withselinux" = auto ; then
++                               AC_MSG_RESULT(Unable to locate libselinux.)
++                               withselinux=no
++                       else
++                               AC_MSG_ERROR(Unable to locate libselinux.)
++                       fi
++               fi
++       fi
++       if test "$withselinux" != no ; then
++               AC_MSG_NOTICE(building with SELinux labeling support)
++               AC_DEFINE(USE_SELINUX,1,Define if Kerberos-aware tools should set SELinux file contexts when creating files.)
++               SELINUX_LIBS="$LIBS"
++		EXTRA_SUPPORT_SYMS="$EXTRA_SUPPORT_SYMS krb5int_labeled_open krb5int_labeled_fopen krb5int_push_fscreatecon_for krb5int_pop_fscreatecon"
++       fi
++fi
++LIBS="$old_LIBS"
++AC_SUBST(SELINUX_LIBS)
++)dnl
+diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in
+index dead0dddc..fef3e054f 100755
+--- a/src/build-tools/krb5-config.in
++++ b/src/build-tools/krb5-config.in
+@@ -41,6 +41,7 @@ DL_LIB='@DL_LIB@'
+ DEFCCNAME='@DEFCCNAME@'
+ DEFKTNAME='@DEFKTNAME@'
+ DEFCKTNAME='@DEFCKTNAME@'
++SELINUX_LIBS='@SELINUX_LIBS@'
+ 
+ LIBS='@LIBS@'
+ GEN_LIB=@GEN_LIB@
+@@ -254,7 +255,7 @@ if test -n "$do_libs"; then
+     fi
+ 
+     # If we ever support a flag to generate output suitable for static
+-    # linking, we would output "-lkrb5support $GEN_LIB $LIBS $DL_LIB"
++    # linking, we would output "-lkrb5support $GEN_LIB $LIBS $SELINUX_LIBS $DL_LIB"
+     # here.
+ 
+     echo $lib_flags
+diff --git a/src/config/pre.in b/src/config/pre.in
+index 3752174c7..0d2068575 100644
+--- a/src/config/pre.in
++++ b/src/config/pre.in
+@@ -177,6 +177,7 @@ LD = $(PURE) @LD@
+ KRB_INCLUDES = -I$(BUILDTOP)/include -I$(top_srcdir)/include
+ LDFLAGS = @LDFLAGS@
+ LIBS = @LIBS@
++SELINUX_LIBS=@SELINUX_LIBS@
+ 
+ INSTALL=@INSTALL@
+ INSTALL_STRIP=
+@@ -403,7 +404,7 @@ SUPPORT_LIB			= -l$(SUPPORT_LIBNAME)
+ # HESIOD_LIBS is -lhesiod...
+ HESIOD_LIBS	= @HESIOD_LIBS@
+ 
+-KRB5_BASE_LIBS	= $(KRB5_LIB) $(K5CRYPTO_LIB) $(COM_ERR_LIB) $(SUPPORT_LIB) $(GEN_LIB) $(LIBS) $(DL_LIB)
++KRB5_BASE_LIBS	= $(KRB5_LIB) $(K5CRYPTO_LIB) $(COM_ERR_LIB) $(SUPPORT_LIB) $(GEN_LIB) $(LIBS) $(SELINUX_LIBS) $(DL_LIB)
+ KDB5_LIBS	= $(KDB5_LIB) $(GSSRPC_LIBS)
+ GSS_LIBS	= $(GSS_KRB5_LIB)
+ # needs fixing if ever used on macOS!
+diff --git a/src/configure.ac b/src/configure.ac
+index 693f76a81..dd2cad3ee 100644
+--- a/src/configure.ac
++++ b/src/configure.ac
+@@ -1391,6 +1391,8 @@ AC_PATH_PROG(GROFF, groff)
+ 
+ KRB5_WITH_PAM
+ 
++KRB5_WITH_SELINUX
++
+ # Make localedir work in autoconf 2.5x.
+ if test "${localedir+set}" != set; then
+     localedir='$(datadir)/locale'
+diff --git a/src/include/k5-int.h b/src/include/k5-int.h
+index cf524252f..efb523689 100644
+--- a/src/include/k5-int.h
++++ b/src/include/k5-int.h
+@@ -128,6 +128,7 @@ typedef unsigned char   u_char;
+ 
+ 
+ #include "k5-platform.h"
++#include "k5-label.h"
+ 
+ #define KRB5_KDB_MAX_LIFE       (60*60*24) /* one day */
+ #define KRB5_KDB_MAX_RLIFE      (60*60*24*7) /* one week */

_service:tar_scm:backport-CVE-2021-37750.patch Added

@@ -0,0 +1,46 @@
+From d775c95af7606a51bf79547a94fa52ddd1cb7f49 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Tue, 3 Aug 2021 01:15:27 -0400
+Subject: PATCH Fix KDC null deref on TGS inner body null server
+
+After the KDC decodes a FAST inner body, it does not check for a null
+server.  Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this
+would typically result in an error from krb5_unparse_name(), but with
+the addition of get_local_tgt() it results in a null dereference.  Add
+a null check.
+
+Reported by Joseph Sutton of Catalyst.
+
+CVE-2021-37750:
+
+In MIT krb5 releases 1.14 and later, an authenticated attacker can
+cause a null dereference in the KDC by sending a FAST TGS request with
+no server field.
+
+ticket: 9008 (new)
+tags: pullup
+target_version: 1.19-next
+target_version: 1.18-next
+---
+ src/kdc/do_tgs_req.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
+index 582e497..32dc65f 100644
+--- a/src/kdc/do_tgs_req.c
++++ b/src/kdc/do_tgs_req.c
+@@ -207,6 +207,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
+         status = "FIND_FAST";
+         goto cleanup;
+     }
++    if (sprinc == NULL) {
++        status = "NULL_SERVER";
++        errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
++        goto cleanup;
++    }
+ 
+     errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server,
+                             &local_tgt, &local_tgt_storage, &local_tgt_key);
+-- 
+1.8.3.1
+

_service:tar_scm:fix-debuginfo-with-y.tab.c.patch Added

@@ -0,0 +1,41 @@
+From ed161c3f3cb642d025f0fee6d4af6f56bba711e9 Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Tue, 23 Aug 2016 16:49:25 -0400
+Subject: PATCH downstream fix debuginfo with y.tab.c
+
+We want to keep these y.tab.c files around because the debuginfo points to
+them.  It would be more elegant at the end to use symbolic links, but that
+could mess up people working in the tree on other things.
+
+Last-updated: krb5-1.9
+---
+ src/kadmin/cli/Makefile.in                 | 5 +++++
+ src/plugins/kdb/ldap/ldap_util/Makefile.in | 2 +-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/src/kadmin/cli/Makefile.in b/src/kadmin/cli/Makefile.in
+index adfea6e2b..d1327e400 100644
+--- a/src/kadmin/cli/Makefile.in
++++ b/src/kadmin/cli/Makefile.in
+@@ -37,3 +37,8 @@ clean-unix::
+ # CC_LINK is not meant for compilation and this use may break in the future.
+ datetest: getdate.c
+ 	$(CC_LINK) $(ALL_CFLAGS) -DTEST -o datetest getdate.c
++
++%.c: %.y
++	$(RM) y.tab.c $@
++	$(YACC.y) $< 
++	$(CP) y.tab.c $@
+diff --git a/src/plugins/kdb/ldap/ldap_util/Makefile.in b/src/plugins/kdb/ldap/ldap_util/Makefile.in
+index 8669c2436..a22f23c02 100644
+--- a/src/plugins/kdb/ldap/ldap_util/Makefile.in
++++ b/src/plugins/kdb/ldap/ldap_util/Makefile.in
+@@ -20,7 +20,7 @@ $(PROG): $(OBJS) $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIB) $(GETDATE)
+ getdate.c: $(GETDATE)
+ 	$(RM) getdate.c y.tab.c
+ 	$(YACC) $(GETDATE)
+-	$(MV) y.tab.c getdate.c
++	$(CP) y.tab.c getdate.c
+ 
+ install:
+ 	$(INSTALL_PROGRAM) $(PROG) ${DESTDIR}$(ADMIN_BINDIR)/$(PROG)

_service:tar_scm:ksu-pam-integration.patch Added

@@ -0,0 +1,774 @@
+From 90ba715be48c2e1b6c7ca53cb1d75f3af2c388d6 Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Tue, 23 Aug 2016 16:29:58 -0400
+Subject: PATCH downstream ksu pam integration
+
+Modify ksu so that it performs account and session management on behalf of
+the target user account, mimicking the action of regular su.  The default
+service name is "ksu", because on Fedora at least the configuration used
+is determined by whether or not a login shell is being opened, and so
+this may need to vary, too.  At run-time, ksu's behavior can be reset to
+the earlier, non-PAM behavior by setting "use_pam" to false in the ksu
+section of /etc/krb5.conf.
+
+When enabled, ksu gains a dependency on libpam.
+
+Originally RT#5939, though it's changed since then to perform the account
+and session management before dropping privileges, and to apply on top of
+changes we're proposing for how it handles cache collections.
+
+Last-updated: krb5-1.18-beta1
+---
+ src/aclocal.m4              |  69 +++++++
+ src/clients/ksu/Makefile.in |   8 +-
+ src/clients/ksu/main.c      |  88 +++++++-
+ src/clients/ksu/pam.c       | 389 ++++++++++++++++++++++++++++++++++++
+ src/clients/ksu/pam.h       |  57 ++++++
+ src/configure.ac            |   2 +
+ 6 files changed, 610 insertions(+), 3 deletions(-)
+ create mode 100644 src/clients/ksu/pam.c
+ create mode 100644 src/clients/ksu/pam.h
+
+diff --git a/src/aclocal.m4 b/src/aclocal.m4
+index 024d6370c..ca9fcf664 100644
+--- a/src/aclocal.m4
++++ b/src/aclocal.m4
+@@ -1677,3 +1677,72 @@ if test "$with_ldap" = yes; then
+   OPENLDAP_PLUGIN=yes
+ fi
+ )dnl
++dnl
++dnl
++dnl Use PAM instead of local crypt() compare for checking local passwords,
++dnl and perform PAM account, session management, and password-changing where
++dnl appropriate.
++dnl 
++AC_DEFUN(KRB5_WITH_PAM,
++AC_ARG_WITH(pam,AC_HELP_STRING(--with-pam,compile with PAM support),
++	    withpam="$withval",withpam=auto)
++AC_ARG_WITH(pam-ksu-service,AC_HELP_STRING(--with-ksu-service,PAM service name for ksu "ksu"),
++	    withksupamservice="$withval",withksupamservice=ksu)
++old_LIBS="$LIBS"
++if test "$withpam" != no ; then
++	AC_MSG_RESULT(checking for PAM...)
++	PAM_LIBS=
++
++	AC_CHECK_HEADERS(security/pam_appl.h)
++	if test "x$ac_cv_header_security_pam_appl_h" != xyes ; then
++		if test "$withpam" = auto ; then
++			AC_MSG_RESULT(Unable to locate security/pam_appl.h.)
++			withpam=no
++		else
++			AC_MSG_ERROR(Unable to locate security/pam_appl.h.)
++		fi
++	fi
++
++	LIBS=
++	unset ac_cv_func_pam_start
++	AC_CHECK_FUNCS(putenv pam_start)
++	if test "x$ac_cv_func_pam_start" = xno ; then
++		unset ac_cv_func_pam_start
++		AC_CHECK_LIB(dl,dlopen)
++		AC_CHECK_FUNCS(pam_start)
++		if test "x$ac_cv_func_pam_start" = xno ; then
++			AC_CHECK_LIB(pam,pam_start)
++			unset ac_cv_func_pam_start
++			unset ac_cv_func_pam_getenvlist
++			AC_CHECK_FUNCS(pam_start pam_getenvlist)
++			if test "x$ac_cv_func_pam_start" = xyes ; then
++				PAM_LIBS="$LIBS"
++			else
++				if test "$withpam" = auto ; then
++					AC_MSG_RESULT(Unable to locate libpam.)
++					withpam=no
++				else
++					AC_MSG_ERROR(Unable to locate libpam.)
++				fi
++			fi
++		fi
++	fi
++	if test "$withpam" != no ; then
++		AC_MSG_NOTICE(building with PAM support)
++		AC_DEFINE(USE_PAM,1,Define if Kerberos-aware tools should support PAM)
++		AC_DEFINE_UNQUOTED(KSU_PAM_SERVICE,"$withksupamservice",
++				   Define to the name of the PAM service name to be used by ksu.)
++		PAM_LIBS="$LIBS"
++		NON_PAM_MAN=".\\\" "
++		PAM_MAN=
++	else
++		PAM_MAN=".\\\" "
++		NON_PAM_MAN=
++	fi
++fi
++LIBS="$old_LIBS"
++AC_SUBST(PAM_LIBS)
++AC_SUBST(PAM_MAN)
++AC_SUBST(NON_PAM_MAN)
++)dnl
++
+diff --git a/src/clients/ksu/Makefile.in b/src/clients/ksu/Makefile.in
+index 8b4edce4d..9d58f29b5 100644
+--- a/src/clients/ksu/Makefile.in
++++ b/src/clients/ksu/Makefile.in
+@@ -3,12 +3,14 @@ BUILDTOP=$(REL)..$(S)..
+ DEFINES = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/usr/local/sbin /usr/local/bin /sbin /bin /usr/sbin /usr/bin"'
+ 
+ KSU_LIBS=@KSU_LIBS@
++PAM_LIBS=@PAM_LIBS@
+ 
+ SRCS = \
+ 	$(srcdir)/krb_auth_su.c \
+ 	$(srcdir)/ccache.c \
+ 	$(srcdir)/authorization.c \
+ 	$(srcdir)/main.c \
++	$(srcdir)/pam.c \
+ 	$(srcdir)/heuristic.c \
+ 	$(srcdir)/xmalloc.c \
+ 	$(srcdir)/setenv.c
+@@ -17,13 +19,17 @@ OBJS = \
+ 	ccache.o \
+ 	authorization.o \
+ 	main.o \
++	pam.o \
+ 	heuristic.o \
+ 	xmalloc.o @SETENVOBJ@
+ 
+ all: ksu
+ 
+ ksu: $(OBJS) $(KRB5_BASE_DEPLIBS)
+-	$(CC_LINK) -o $@ $(OBJS) $(KRB5_BASE_LIBS) $(KSU_LIBS)
++	$(CC_LINK) -o $@ $(OBJS) $(KRB5_BASE_LIBS) $(KSU_LIBS) $(PAM_LIBS)
++
++pam.o: pam.c
++	$(CC) $(ALL_CFLAGS) -c $<
+ 
+ clean:
+ 	$(RM) ksu
+diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c
+index af1286172..931f05404 100644
+--- a/src/clients/ksu/main.c
++++ b/src/clients/ksu/main.c
+@@ -26,6 +26,7 @@
+  * KSU was written by:  Ari Medvinsky, ari@isi.edu
+  */
+ 
++#include "autoconf.h"
+ #include "ksu.h"
+ #include "adm_proto.h"
+ #include <sys/types.h>
+@@ -33,6 +34,10 @@
+ #include <signal.h>
+ #include <grp.h>
+ 
++#ifdef USE_PAM
++#include "pam.h"
++#endif
++
+ /* globals */
+ char * prog_name;
+ int auth_debug =0;
+@@ -40,6 +45,7 @@ char k5login_pathMAXPATHLEN;
+ char k5users_pathMAXPATHLEN;
+ char * gb_err = NULL;
+ int quiet = 0;
++int force_fork = 0;
+ /***********/
+ 
+ #define KS_TEMPORARY_CACHE "MEMORY:_ksu"
+@@ -536,6 +542,23 @@ main (argc, argv)
+                prog_name,target_user,client_name,
+                source_user,ontty());
+ 
++#ifdef USE_PAM
++        if (appl_pam_enabled(ksu_context, "ksu")) {
++            if (appl_pam_acct_mgmt(KSU_PAM_SERVICE, 1, target_user, NULL,
++                                   NULL, source_user,
++                                   ttyname(STDERR_FILENO)) != 0) {
++                fprintf(stderr, "Access denied for %s.\n", target_user);
++                exit(1);
++            }
++            if (appl_pam_requires_chauthtok()) {
++                fprintf(stderr, "Password change required for %s.\n",
++                        target_user);
++                exit(1);
++            }
++            force_fork++;
++        }
++#endif
++
+         /* Run authorization as target.*/

_service:tar_scm:netlib-and-dns.patch Added

_service Changed

_service:extract_file:kadm5.acl Deleted

_service:extract_file:kadmin.service Deleted

_service:extract_file:kadmind.logrotate Deleted

_service:extract_file:kdc.conf Deleted

_service:extract_file:kprop.service Deleted

_service:extract_file:krb5-1.19.2.tar.gz Deleted

_service:extract_file:krb5-1.19.2.tar.gz.asc Deleted

_service:extract_file:krb5.conf Deleted

_service:extract_file:krb5.yaml Deleted

_service:extract_file:krb5kdc.logrotate Deleted

_service:extract_file:krb5kdc.service Deleted

_service:extract_file:ksu.pamd Deleted

_service:extract_file:noport.c Deleted

@@ -1,111 +0,0 @@
-#define _GNU_SOURCE
-#include <sys/socket.h>
-#include <dlfcn.h>
-#include <errno.h>
-#include <stdlib.h>
-#include <string.h>
-#include <netinet/in.h>
-
-static int
-port_is_okay(unsigned short port)
-{
-	char *p, *q;
-	long l;
-
-	p = getenv("NOPORT");
-	while ((p != NULL) && (*p != '\0')) {
-		l = strtol(p, &q, 10);
-		if ((q == NULL) || (q == p)) {
-			break;
-		}
-		if ((*q == '\0') || (*q == ',')) {
-			if (port == l) {
-				errno = ECONNREFUSED;
-				return -1;
-			}
-		}
-		p = q;
-		p += strspn(p, ",");
-	}
-	return 0;
-}
-
-int
-connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
-{
-	unsigned short port;
-	static int (*next_connect)(int, const struct sockaddr *, socklen_t);
-
-	if (next_connect == NULL) {
-		next_connect = dlsym(RTLD_NEXT, "connect");
-		if (next_connect == NULL) {
-			errno = ENOSYS;
-			return -1;
-		}
-	}
-
-	if (getenv("NOPORT") == NULL) {
-		return next_connect(sockfd, addr, addrlen);
-	}
-
-	switch (addr->sa_family) {
-	case AF_INET:
-		port = ntohs(((struct sockaddr_in *)addr)->sin_port);
-		if (port_is_okay(port) != 0) {
-			return -1;
-		}
-		break;
-	case AF_INET6:
-		port = ntohs(((struct sockaddr_in6 *)addr)->sin6_port);
-		if (port_is_okay(port) != 0) {
-			return -1;
-		}
-		break;
-	default:
-		break;
-	}
-	return next_connect(sockfd, addr, addrlen);
-}
-
-ssize_t
-sendto(int sockfd, const void *buf, size_t len, int flags,
-       const struct sockaddr *dest_addr, socklen_t addrlen)
-{
-	unsigned short port;
-	static int (*next_sendto)(int, const void *, size_t, int,
-				  const struct sockaddr *, socklen_t);
-
-	if (next_sendto == NULL) {
-		next_sendto = dlsym(RTLD_NEXT, "sendto");
-		if (next_sendto == NULL) {
-			errno = ENOSYS;
-			return -1;
-		}
-	}
-
-	if (getenv("NOPORT") == NULL) {
-		return next_sendto(sockfd, buf, len, flags, dest_addr, addrlen);
-	}
-
-	if (dest_addr != NULL) {
-		switch (dest_addr->sa_family) {
-		case AF_INET:
-			port = ((struct sockaddr_in *)dest_addr)->sin_port;
-			port = ntohs(port);
-			if (port_is_okay(port) != 0) {
-				return -1;
-			}
-			break;
-		case AF_INET6:
-			port = ((struct sockaddr_in6 *)dest_addr)->sin6_port;
-			port = ntohs(port);
-			if (port_is_okay(port) != 0) {
-				return -1;
-			}
-			break;
-		default:
-			break;
-		}
-	}
-	return next_sendto(sockfd, buf, len, flags, dest_addr, addrlen);
-}

_service:tar_scm:kadm5.acl Added

_service:tar_scm:kadmin.service Added

_service:tar_scm:kadmind.logrotate Added

_service:tar_scm:kdc.conf Added

_service:tar_scm:kprop.service Added

_service:tar_scm:krb5-1646721691.d8acb36.tar -> _service:tar_scm:krb5-1.19.2.tar.gz Changed

_service:tar_scm:krb5-1.19.2.tar.gz.asc Added

_service:tar_scm:krb5.conf Added

_service:tar_scm:krb5.yaml Added

_service:tar_scm:krb5kdc.logrotate Added

_service:tar_scm:krb5kdc.service Added

_service:tar_scm:ksu.pamd Added

_service:tar_scm:noport.c Added

@@ -0,0 +1,111 @@
+#define _GNU_SOURCE
+#include <sys/socket.h>
+#include <dlfcn.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+#include <netinet/in.h>
+
+static int
+port_is_okay(unsigned short port)
+{
+	char *p, *q;
+	long l;
+
+	p = getenv("NOPORT");
+	while ((p != NULL) && (*p != '\0')) {
+		l = strtol(p, &q, 10);
+		if ((q == NULL) || (q == p)) {
+			break;
+		}
+		if ((*q == '\0') || (*q == ',')) {
+			if (port == l) {
+				errno = ECONNREFUSED;
+				return -1;
+			}
+		}
+		p = q;
+		p += strspn(p, ",");
+	}
+	return 0;
+}
+
+int
+connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
+{
+	unsigned short port;
+	static int (*next_connect)(int, const struct sockaddr *, socklen_t);
+
+	if (next_connect == NULL) {
+		next_connect = dlsym(RTLD_NEXT, "connect");
+		if (next_connect == NULL) {
+			errno = ENOSYS;
+			return -1;
+		}
+	}
+
+	if (getenv("NOPORT") == NULL) {
+		return next_connect(sockfd, addr, addrlen);
+	}
+
+	switch (addr->sa_family) {
+	case AF_INET:
+		port = ntohs(((struct sockaddr_in *)addr)->sin_port);
+		if (port_is_okay(port) != 0) {
+			return -1;
+		}
+		break;
+	case AF_INET6:
+		port = ntohs(((struct sockaddr_in6 *)addr)->sin6_port);
+		if (port_is_okay(port) != 0) {
+			return -1;
+		}
+		break;
+	default:
+		break;
+	}
+	return next_connect(sockfd, addr, addrlen);
+}
+
+ssize_t
+sendto(int sockfd, const void *buf, size_t len, int flags,
+       const struct sockaddr *dest_addr, socklen_t addrlen)
+{
+	unsigned short port;
+	static int (*next_sendto)(int, const void *, size_t, int,
+				  const struct sockaddr *, socklen_t);
+
+	if (next_sendto == NULL) {
+		next_sendto = dlsym(RTLD_NEXT, "sendto");
+		if (next_sendto == NULL) {
+			errno = ENOSYS;
+			return -1;
+		}
+	}
+
+	if (getenv("NOPORT") == NULL) {
+		return next_sendto(sockfd, buf, len, flags, dest_addr, addrlen);
+	}
+
+	if (dest_addr != NULL) {
+		switch (dest_addr->sa_family) {
+		case AF_INET:
+			port = ((struct sockaddr_in *)dest_addr)->sin_port;
+			port = ntohs(port);
+			if (port_is_okay(port) != 0) {
+				return -1;
+			}
+			break;
+		case AF_INET6:
+			port = ((struct sockaddr_in6 *)dest_addr)->sin6_port;
+			port = ntohs(port);
+			if (port_is_okay(port) != 0) {
+				return -1;
+			}
+			break;
+		default:
+			break;
+		}
+	}
+	return next_sendto(sockfd, buf, len, flags, dest_addr, addrlen);
+}

Changes of Revision 2