开源软件构建与测试

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 3

_service:tar_scm:krb5.spec Changed

@@ -2,13 +2,13 @@
 %global WITH_DIRSRV 1
 
 Name:     krb5
-Version:  1.19.2
-Release:  2
+Version:  1.20.1
+Release:  1
 Summary:  The Kerberos network authentication protocol
 License:  MIT
 URL:      http://web.mit.edu/kerberos/www/
-Source0:  https://web.mit.edu/kerberos/dist/krb5/1.19/%{name}-%{version}.tar.gz
-Source1:  https://web.mit.edu/kerberos/dist/krb5/1.19/%{name}-%{version}.tar.gz.asc
+Source0:  https://web.mit.edu/kerberos/dist/krb5/1.20/%{name}-%{version}.tar.gz
+Source1:  https://web.mit.edu/kerberos/dist/krb5/1.20/%{name}-%{version}.tar.gz.asc
 Source2:  kprop.service
 Source3:  kadmin.service
 Source4:  krb5kdc.service
@@ -25,8 +25,6 @@
 Patch3: netlib-and-dns.patch
 Patch4: fix-debuginfo-with-y.tab.c.patch
 Patch5: Remove-3des-support.patch
-Patch6: FIPS-with-PRNG-and-RADIUS-and-MD4.patch
-Patch7: backport-CVE-2021-37750.patch
 
 BuildRequires:  gettext
 BuildRequires:  gcc make automake autoconf pkgconfig pam-devel libselinux-devel byacc
@@ -318,6 +316,9 @@
 %{_mandir}/man8/*
 
 %changelog
+* Wed Feb 1 2023 zhouchenchen123 <zhouchenchen@huawei.com> - 1.20.1-1
+- update to 1.20.1
+
 * Tue Mar 8 2022 yixiangzhike <yixiangzhike007@163.com> - 1.19.2-2
 - Add ExecStartPost option to krb5kdc.service for solving error message when krb5kdc starting

_service:tar_scm:FIPS-with-PRNG-and-RADIUS-and-MD4.patch Deleted

@@ -1,568 +0,0 @@
-From 5978878bcee5ec39e4357f408470d39e9540d2bf Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Fri, 9 Nov 2018 15:12:21 -0500
-Subject: PATCH downstream FIPS with PRNG and RADIUS and MD4
-
-NB: Use openssl's PRNG in FIPS mode and taint within krad.
-
-A lot of the FIPS error conditions from OpenSSL are incredibly
-mysterious (at best, things return NULL unexpectedly; at worst,
-internal assertions are tripped; most of the time, you just get
-ENOMEM).  In order to cope with this, we need to have some level of
-awareness of what we can and can't safely call.
-
-This will slow down some calls slightly (FIPS_mode() takes multiple
-locks), but not for any ciphers we care about - which is to say that
-AES is fine.  Shame about SPAKE though.
-
-post6 restores MD4 (and therefore keygen-only RC4).
-
-Last-updated: krb5-1.17
----
- src/lib/crypto/krb/prng.c                     | 11 ++++-
- .../crypto/openssl/enc_provider/camellia.c    |  6 +++
- src/lib/crypto/openssl/enc_provider/rc4.c     | 13 +++++-
- .../crypto/openssl/hash_provider/hash_evp.c   | 12 +++++
- src/lib/crypto/openssl/hmac.c                 |  6 ++-
- src/lib/krad/attr.c                           | 45 ++++++++++++++-----
- src/lib/krad/attrset.c                        |  5 ++-
- src/lib/krad/internal.h                       | 13 +++++-
- src/lib/krad/packet.c                         | 22 ++++-----
- src/lib/krad/remote.c                         | 10 ++++-
- src/lib/krad/t_attr.c                         |  3 +-
- src/lib/krad/t_attrset.c                      |  4 +-
- src/plugins/preauth/spake/spake_client.c      |  6 +++
- src/plugins/preauth/spake/spake_kdc.c         |  6 +++
- 14 files changed, 129 insertions(+), 33 deletions(-)
-
-diff --git a/src/lib/crypto/krb/prng.c b/src/lib/crypto/krb/prng.c
-index cb9ca9b98..f0e9984ca 100644
---- a/src/lib/crypto/krb/prng.c
-+++ b/src/lib/crypto/krb/prng.c
-@@ -26,6 +26,8 @@
- 
- #include "crypto_int.h"
- 
-+#include <openssl/rand.h>
-+
- krb5_error_code KRB5_CALLCONV
- krb5_c_random_seed(krb5_context context, krb5_data *data)
- {
-@@ -99,9 +101,16 @@ krb5_boolean
- k5_get_os_entropy(unsigned char *buf, size_t len, int strong)
- {
-     const char *device;
--#if defined(__linux__) && defined(SYS_getrandom)
-     int r;
- 
-+    /* A wild FIPS mode appeared! */
-+    if (FIPS_mode()) {
-+        /* The return codes on this API are not good */
-+        r = RAND_bytes(buf, len);
-+        return r == 1;
-+    }
-+
-+#if defined(__linux__) && defined(SYS_getrandom)
-     while (len > 0) {
-         /*
-          * Pull from the /dev/urandom pool, but require it to have been seeded.
-diff --git a/src/lib/crypto/openssl/enc_provider/camellia.c b/src/lib/crypto/openssl/enc_provider/camellia.c
-index 2da691329..f79679a0b 100644
---- a/src/lib/crypto/openssl/enc_provider/camellia.c
-+++ b/src/lib/crypto/openssl/enc_provider/camellia.c
-@@ -304,6 +304,9 @@ krb5int_camellia_cbc_mac(krb5_key key, const krb5_crypto_iov *data,
-     unsigned char blockYCAMELLIA_BLOCK_SIZE, blockBCAMELLIA_BLOCK_SIZE;
-     struct iov_cursor cursor;
- 
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-+
-     if (output->length < CAMELLIA_BLOCK_SIZE)
-         return KRB5_BAD_MSIZE;
- 
-@@ -331,6 +334,9 @@ static krb5_error_code
- krb5int_camellia_init_state (const krb5_keyblock *key, krb5_keyusage usage,
-                              krb5_data *state)
- {
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-+
-     state->length = 16;
-     state->data = (void *) malloc(16);
-     if (state->data == NULL)
-diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c
-index a65d57b7a..6ccaca94a 100644
---- a/src/lib/crypto/openssl/enc_provider/rc4.c
-+++ b/src/lib/crypto/openssl/enc_provider/rc4.c
-@@ -66,6 +66,9 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
-     EVP_CIPHER_CTX *ctx = NULL;
-     struct arcfour_state *arcstate;
- 
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-+
-     arcstate = (state != NULL) ? (void *)state->data : NULL;
-     if (arcstate != NULL) {
-         ctx = arcstate->ctx;
-@@ -113,7 +116,12 @@ k5_arcfour_docrypt(krb5_key key, const krb5_data *state, krb5_crypto_iov *data,
- static void
- k5_arcfour_free_state(krb5_data *state)
- {
--    struct arcfour_state *arcstate = (void *)state->data;
-+    struct arcfour_state *arcstate;
-+
-+    if (FIPS_mode())
-+        return;
-+
-+    arcstate = (void *) state->data;
- 
-     EVP_CIPHER_CTX_free(arcstate->ctx);
-     free(arcstate);
-@@ -125,6 +133,9 @@ k5_arcfour_init_state(const krb5_keyblock *key,
- {
-     struct arcfour_state *arcstate;
- 
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-+
-     /*
-      * The cipher state here is a saved pointer to a struct arcfour_state
-      * object, rather than a flat byte array as in most enc providers.  The
-diff --git a/src/lib/crypto/openssl/hash_provider/hash_evp.c b/src/lib/crypto/openssl/hash_provider/hash_evp.c
-index 1e0fb8fc3..feb5eda99 100644
---- a/src/lib/crypto/openssl/hash_provider/hash_evp.c
-+++ b/src/lib/crypto/openssl/hash_provider/hash_evp.c
-@@ -49,6 +49,11 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
-     if (ctx == NULL)
-         return ENOMEM;
- 
-+    if (type == EVP_md4()) {
-+        /* See comment below in hash_md4(). */
-+        EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
-+    }
-+
-     ok = EVP_DigestInit_ex(ctx, type, NULL);
-     for (i = 0; i < num_data; i++) {
-         if (!SIGN_IOV(&datai))
-@@ -64,12 +69,19 @@ hash_evp(const EVP_MD *type, const krb5_crypto_iov *data, size_t num_data,
- static krb5_error_code
- hash_md4(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
- {
-+    /*
-+     * MD4 is needed in FIPS mode to perform key generation for RC4 keys used
-+     * by IPA.  These keys are only used along a (separately) secured channel
-+     * for legacy reasons when performing trusts to Active Directory.
-+     */
-     return hash_evp(EVP_md4(), data, num_data, output);
- }
- 
- static krb5_error_code
- hash_md5(const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
- {
-+    if (FIPS_mode())
-+        return KRB5_CRYPTO_INTERNAL;
-     return hash_evp(EVP_md5(), data, num_data, output);
- }
- 
-diff --git a/src/lib/crypto/openssl/hmac.c b/src/lib/crypto/openssl/hmac.c
-index 7dc59dcc0..769a50c00 100644
---- a/src/lib/crypto/openssl/hmac.c
-+++ b/src/lib/crypto/openssl/hmac.c
-@@ -103,7 +103,11 @@ map_digest(const struct krb5_hash_provider *hash)
-         return EVP_sha256();
-     else if (!strncmp(hash->hash_name, "SHA-384",7))
-         return EVP_sha384();
--    else if (!strncmp(hash->hash_name, "MD5", 3))
-+
-+    if (FIPS_mode())
-+        return NULL;
-+
-+    if (!strncmp(hash->hash_name, "MD5", 3))
-         return EVP_md5();
-     else if (!strncmp(hash->hash_name, "MD4", 3))
-         return EVP_md4();
-diff --git a/src/lib/krad/attr.c b/src/lib/krad/attr.c
-index 9c13d9d75..275327e67 100644
---- a/src/lib/krad/attr.c
-+++ b/src/lib/krad/attr.c
-@@ -30,6 +30,7 @@
- #include <k5-int.h>
- #include "internal.h"
- 
-+#include <openssl/crypto.h>
- #include <string.h>
- 
- /* RFC 2865 */
-@@ -38,7 +39,8 @@
- typedef krb5_error_code
- (*attribute_transform_fn)(krb5_context ctx, const char *secret,
-                           const unsigned char *auth, const krb5_data *in,

_service:tar_scm:Remove-3des-support.patch Changed

@@ -1,4 +1,4 @@
-From fef4e551d3d2dcb55e58cc182304254c36aa8949 Mon Sep 17 00:00:00 2001
+From 7b40250066bbcc529b5348b68199c58fbad82376 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 26 Mar 2019 18:51:10 -0400
 Subject: PATCH downstream Remove 3des support
@@ -8,7 +8,17 @@
 to user other enctypes.  Mark the 3DES enctypes UNSUPPORTED and retain
 their constants.
 
-Last-updated: 1.19-beta1
+Last-updated: 1.20-final
+antorres@redhat.com: remove diffs for:
+     - src/kdamin/testing/proto/kdc.conf.proto
+     - src/lib/kadm5/unit-test/api.current/chpass-principal-v2.exp
+     - src/lib/kadm5/unit-test/api.current/get-principal-v2.exp
+     - src/lib/kadm5/unit-test/api.current/randkey-principal-v2.exp
+ since they were removed by Remove-TCL-based-libkadm5-API-tests.patch
+jrische@redhat.com: restore supportedCMSTypes (not using 3DES any more):
+    - src/plugins/preauth/pkinit/pkinit_crypto.h
+    - src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+    - src/plugins/preauth/pkinit/pkinit_clnt.c
 ---
  doc/admin/advanced/retiring-des.rst           |  11 +
  doc/admin/conf_files/kdc_conf.rst             |   7 +-
@@ -18,35 +28,34 @@
  doc/conf.py                                   |   2 +-
  doc/mitK5features.rst                         |   2 +-
  src/Makefile.in                               |   4 +-
- src/configure.ac                              |   1 -
+ src/configure.ac                              |   4 +-
  src/include/krb5/krb5.hin                     |  10 +-
- src/kadmin/testing/proto/kdc.conf.proto       |   4 +-
  src/kdc/kdc_util.c                            |   4 -
  src/lib/crypto/Makefile.in                    |   8 +-
  src/lib/crypto/builtin/Makefile.in            |   6 +-
  src/lib/crypto/builtin/des/ISSUES             |  13 -
- src/lib/crypto/builtin/des/Makefile.in        |  80 ----
- src/lib/crypto/builtin/des/d3_aead.c          | 133 ------
- src/lib/crypto/builtin/des/d3_kysched.c       |  51 ---
- src/lib/crypto/builtin/des/deps               | 150 -------
+ src/lib/crypto/builtin/des/Makefile.in        |  82 ----
+ src/lib/crypto/builtin/des/d3_aead.c          | 137 ------
+ src/lib/crypto/builtin/des/d3_kysched.c       |  55 ---
+ src/lib/crypto/builtin/des/deps               | 146 -------
  src/lib/crypto/builtin/des/des_int.h          | 285 -------------
- src/lib/crypto/builtin/des/des_keys.c         |  40 --
+ src/lib/crypto/builtin/des/des_keys.c         |  38 --
  src/lib/crypto/builtin/des/destest.c          | 240 -----------
  src/lib/crypto/builtin/des/doc/libdes.doc     | 208 ---------
- src/lib/crypto/builtin/des/f_aead.c           | 173 --------
+ src/lib/crypto/builtin/des/f_aead.c           | 177 --------
  src/lib/crypto/builtin/des/f_cbc.c            | 256 ------------
- src/lib/crypto/builtin/des/f_cksum.c          | 136 ------
- src/lib/crypto/builtin/des/f_parity.c         |  56 ---
- src/lib/crypto/builtin/des/f_sched.c          | 359 ----------------
- src/lib/crypto/builtin/des/f_tables.c         | 370 ----------------
+ src/lib/crypto/builtin/des/f_cksum.c          | 141 -------
+ src/lib/crypto/builtin/des/f_parity.c         |  64 ---
+ src/lib/crypto/builtin/des/f_sched.c          | 363 ----------------
+ src/lib/crypto/builtin/des/f_tables.c         | 375 -----------------
  src/lib/crypto/builtin/des/f_tables.h         | 285 -------------
- src/lib/crypto/builtin/des/key_sched.c        |  62 ---
+ src/lib/crypto/builtin/des/key_sched.c        |  66 ---
  src/lib/crypto/builtin/des/keytest.data       | 171 --------
  src/lib/crypto/builtin/des/t_verify.c         | 395 ------------------
- src/lib/crypto/builtin/des/weak_key.c         |  86 ----
- .../crypto/builtin/enc_provider/Makefile.in   |   6 +-
- src/lib/crypto/builtin/enc_provider/deps      |  13 -
- src/lib/crypto/builtin/enc_provider/des3.c    | 105 -----
+ src/lib/crypto/builtin/des/weak_key.c         |  90 ----
+ .../crypto/builtin/enc_provider/Makefile.in   |   5 +-
+ src/lib/crypto/builtin/enc_provider/deps      |  11 -
+ src/lib/crypto/builtin/enc_provider/des3.c    | 109 -----
  src/lib/crypto/crypto_tests/t_cf2.expected    |   1 -
  src/lib/crypto/crypto_tests/t_cf2.in          |   5 -
  src/lib/crypto/crypto_tests/t_cksums.c        |  10 -
@@ -55,45 +64,40 @@
  src/lib/crypto/crypto_tests/t_encrypt.c       |   1 -
  src/lib/crypto/crypto_tests/t_short.c         |   1 -
  src/lib/crypto/crypto_tests/t_str2key.c       |  52 ---
+ src/lib/crypto/crypto_tests/vectors.c         |   4 -
  src/lib/crypto/krb/Makefile.in                |   3 -
  src/lib/crypto/krb/cksumtypes.c               |   6 -
- src/lib/crypto/krb/crypto_int.h               |  16 -
+ src/lib/crypto/krb/crypto_int.h               |  11 -
  src/lib/crypto/krb/default_state.c            |  10 -
  src/lib/crypto/krb/enctype_util.c             |   3 +
  src/lib/crypto/krb/etypes.c                   |  21 -
  src/lib/crypto/krb/prf_des.c                  |  47 ---
- src/lib/crypto/krb/random_to_key.c            |  45 --
+ src/lib/crypto/krb/random_to_key.c            |  28 --
  src/lib/crypto/libk5crypto.exports            |   1 -
  src/lib/crypto/openssl/Makefile.in            |   8 +-
  src/lib/crypto/openssl/des/Makefile.in        |  20 -
- src/lib/crypto/openssl/des/deps               |  15 -
- src/lib/crypto/openssl/des/des_keys.c         |  40 --
+ src/lib/crypto/openssl/des/deps               |  14 -
+ src/lib/crypto/openssl/des/des_keys.c         |  39 --
  .../crypto/openssl/enc_provider/Makefile.in   |   3 -
  src/lib/crypto/openssl/enc_provider/deps      |  11 -
- src/lib/crypto/openssl/enc_provider/des3.c    | 184 --------
+ src/lib/crypto/openssl/enc_provider/des3.c    | 188 ---------
+ src/lib/crypto/openssl/kdf.c                  |   2 -
  src/lib/gssapi/krb5/accept_sec_context.c      |   1 -
  src/lib/gssapi/krb5/gssapiP_krb5.h            |   6 +-
  src/lib/gssapi/krb5/k5seal.c                  |  35 +-
  src/lib/gssapi/krb5/k5sealiov.c               |  27 +-
- src/lib/gssapi/krb5/k5unseal.c                | 102 ++---
+ src/lib/gssapi/krb5/k5unseal.c                |  88 ++--
  src/lib/gssapi/krb5/k5unsealiov.c             |  38 +-
  src/lib/gssapi/krb5/util_crypt.c              |  11 -
- .../api.current/chpass-principal-v2.exp       |   4 +-
- .../api.current/get-principal-v2.exp          |   4 +-
- .../api.current/randkey-principal-v2.exp      |   4 +-
  src/lib/krb5/krb/init_ctx.c                   |   3 -
  src/lib/krb5/krb/s4u_creds.c                  |   2 -
  src/lib/krb5/krb/t_etypes.c                   |  48 +--
  src/lib/krb5/os/t_trace.c                     |   4 +-
  src/lib/krb5/os/t_trace.ref                   |   2 +-
  src/plugins/preauth/pkinit/pkcs11.h           |   6 +-
- src/plugins/preauth/pkinit/pkinit_clnt.c      |   8 -
- src/plugins/preauth/pkinit/pkinit_crypto.h    |  12 -
- .../preauth/pkinit/pkinit_crypto_openssl.c    |  38 --
- src/plugins/preauth/pkinit/pkinit_kdf_test.c  |  31 --
+ src/plugins/preauth/pkinit/pkinit_crypto.h    |  10 +-
+ src/plugins/preauth/pkinit/pkinit_kdf_test.c  |  30 --
  src/plugins/preauth/spake/t_vectors.c         |  25 --
- src/tests/dejagnu/config/default.exp          |  78 ----
- src/tests/dejagnu/krb-standalone/kprop.exp    |   2 +-
  src/tests/gssapi/t_enctypes.py                |  33 +-
  src/tests/gssapi/t_invalid.c                  |  12 -
  src/tests/gssapi/t_pcontok.c                  |  16 +-
@@ -105,7 +109,7 @@
  src/tests/t_salt.py                           |   5 +-
  src/util/k5test.py                            |   7 -
  .../leash/htmlhelp/html/Encryption_Types.htm  |  13 -
- 95 files changed, 160 insertions(+), 4835 deletions(-)
+ 89 files changed, 151 insertions(+), 4713 deletions(-)
  delete mode 100644 src/lib/crypto/builtin/des/ISSUES
  delete mode 100644 src/lib/crypto/builtin/des/Makefile.in
  delete mode 100644 src/lib/crypto/builtin/des/d3_aead.c
@@ -134,7 +138,7 @@
  delete mode 100644 src/lib/crypto/openssl/enc_provider/des3.c
 
 diff --git a/doc/admin/advanced/retiring-des.rst b/doc/admin/advanced/retiring-des.rst
-index 38f76d3f4..d5e3c30c0 100644
+index 38f76d3f45..d5e3c30c04 100644
 --- a/doc/admin/advanced/retiring-des.rst
 +++ b/doc/admin/advanced/retiring-des.rst
 @@ -10,6 +10,13 @@ ability have rendered DES vulnerable to brute force attacks on its 56-bit
@@ -163,10 +167,10 @@
  -------------
  
 diff --git a/doc/admin/conf_files/kdc_conf.rst b/doc/admin/conf_files/kdc_conf.rst
-index 1dc958d62..3a72aabef 100644
+index 74a0a2acef..846c58ed82 100644
 --- a/doc/admin/conf_files/kdc_conf.rst
 +++ b/doc/admin/conf_files/kdc_conf.rst
-@@ -848,8 +848,6 @@ Encryption types marked as "weak" and "deprecated" are available for
+@@ -854,8 +854,6 @@ Encryption types marked as "weak" and "deprecated" are available for
  compatibility but not recommended for use.
  
  ==================================================== =========================================================
@@ -175,7 +179,7 @@
  aes256-cts-hmac-sha1-96 aes256-cts aes256-sha1       AES-256 CTS mode with 96-bit SHA-1 HMAC
  aes128-cts-hmac-sha1-96 aes128-cts aes128-sha1       AES-128 CTS mode with 96-bit SHA-1 HMAC
  aes256-cts-hmac-sha384-192 aes256-sha2               AES-256 CTS mode with 192-bit SHA-384 HMAC
-@@ -858,7 +856,6 @@ arcfour-hmac rc4-hmac arcfour-hmac-md5               RC4 with HMAC/MD5 (deprecat
+@@ -864,7 +862,6 @@ arcfour-hmac rc4-hmac arcfour-hmac-md5               RC4 with HMAC/MD5 (deprecat
  arcfour-hmac-exp rc4-hmac-exp arcfour-hmac-md5-exp   Exportable RC4 with HMAC/MD5 (weak)
  camellia256-cts-cmac camellia256-cts                 Camellia-256 CTS mode with CMAC
  camellia128-cts-cmac camellia128-cts                 Camellia-128 CTS mode with CMAC
@@ -183,7 +187,7 @@
  aes                                                  The AES family: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha384-192, and aes128-cts-hmac-sha256-128
  rc4                                                  The RC4 family: arcfour-hmac
  camellia                                             The Camellia family: camellia256-cts-cmac and camellia128-cts-cmac
-@@ -870,8 +867,8 @@ from the current list by prefixing them with a minus sign ("-").
+@@ -876,8 +873,8 @@ from the current list by prefixing them with a minus sign ("-").
  Types or families can be prefixed with a plus sign ("+") for symmetry;
  it has the same meaning as just listing the type or family.  For
  example, "``DEFAULT -rc4``" would be the default set of encryption
@@ -195,7 +199,7 @@
  
  While **aes128-cts** and **aes256-cts** are supported for all Kerberos
 diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst
-index 047185afb..b08d954d9 100644
+index 694922c0d9..c4d5499d3b 100644
 --- a/doc/admin/enctypes.rst
 +++ b/doc/admin/enctypes.rst
 @@ -129,7 +129,7 @@ enctype                    weak?      krb5     Windows
@@ -223,7 +227,7 @@
  
  Migrating away from older encryption types
 diff --git a/doc/admin/troubleshoot.rst b/doc/admin/troubleshoot.rst
-index ade5e1f87..e4dc54f7e 100644
+index ade5e1f87a..e4dc54f7e5 100644
 --- a/doc/admin/troubleshoot.rst
 +++ b/doc/admin/troubleshoot.rst
 @@ -73,11 +73,10 @@ credential verification failed: KDC has no support for encryption type

_service:tar_scm:SELinux-integration.patch Changed

@@ -1,4 +1,4 @@
-From e787771b618a344d45ac515927e914602f48946f Mon Sep 17 00:00:00 2001
+From c6b58ed180ed91b579d322ff5004f68750f1eb4f Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:30:53 -0400
 Subject: PATCH downstream SELinux integration
@@ -36,7 +36,9 @@
 Red Hat #273081), so switching to using them instead of matchpathcon(),
 which we used earlier, is some improvement.
 
-Last-updated: krb5-1.18-beta1
+Last-updated: krb5-1.20.1
+jrische@redhat.com: Replace deprecated security_context_t by char *:
+    - src/util/support/selinux.c
 ---
  src/aclocal.m4                                |  48 +++
  src/build-tools/krb5-config.in                |   3 +-
@@ -61,13 +63,13 @@
  .../kdb/ldap/ldap_util/kdb5_ldap_services.c   |  11 +-
  src/util/profile/prof_file.c                  |   3 +-
  src/util/support/Makefile.in                  |   3 +-
- src/util/support/selinux.c                    | 406 ++++++++++++++++++
- 24 files changed, 573 insertions(+), 21 deletions(-)
+ src/util/support/selinux.c                    | 405 ++++++++++++++++++
+ 24 files changed, 572 insertions(+), 21 deletions(-)
  create mode 100644 src/include/k5-label.h
  create mode 100644 src/util/support/selinux.c
 
 diff --git a/src/aclocal.m4 b/src/aclocal.m4
-index ca9fcf664..5afb96e58 100644
+index bf9da35bbc..01283f482e 100644
 --- a/src/aclocal.m4
 +++ b/src/aclocal.m4
 @@ -85,6 +85,7 @@ AC_SUBST_FILE(libnodeps_frag)
@@ -78,7 +80,7 @@
  KRB5_LIB_PARAMS
  KRB5_AC_INITFINI
  KRB5_AC_ENABLE_THREADS
-@@ -1745,4 +1746,51 @@ AC_SUBST(PAM_LIBS)
+@@ -1526,4 +1527,51 @@ AC_SUBST(PAM_LIBS)
  AC_SUBST(PAM_MAN)
  AC_SUBST(NON_PAM_MAN)
  )dnl
@@ -131,7 +133,7 @@
 +AC_SUBST(SELINUX_LIBS)
 +)dnl
 diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in
-index dead0dddc..fef3e054f 100755
+index dead0dddce..fef3e054fc 100755
 --- a/src/build-tools/krb5-config.in
 +++ b/src/build-tools/krb5-config.in
 @@ -41,6 +41,7 @@ DL_LIB='@DL_LIB@'
@@ -152,7 +154,7 @@
  
      echo $lib_flags
 diff --git a/src/config/pre.in b/src/config/pre.in
-index 3752174c7..0d2068575 100644
+index a0c60c70b3..7eaa2f351c 100644
 --- a/src/config/pre.in
 +++ b/src/config/pre.in
 @@ -177,6 +177,7 @@ LD = $(PURE) @LD@
@@ -163,7 +165,7 @@
  
  INSTALL=@INSTALL@
  INSTALL_STRIP=
-@@ -403,7 +404,7 @@ SUPPORT_LIB			= -l$(SUPPORT_LIBNAME)
+@@ -379,7 +380,7 @@ SUPPORT_LIB			= -l$(SUPPORT_LIBNAME)
  # HESIOD_LIBS is -lhesiod...
  HESIOD_LIBS	= @HESIOD_LIBS@
  
@@ -173,10 +175,10 @@
  GSS_LIBS	= $(GSS_KRB5_LIB)
  # needs fixing if ever used on macOS!
 diff --git a/src/configure.ac b/src/configure.ac
-index 693f76a81..dd2cad3ee 100644
+index aa970b0447..40545f2bfc 100644
 --- a/src/configure.ac
 +++ b/src/configure.ac
-@@ -1391,6 +1391,8 @@ AC_PATH_PROG(GROFF, groff)
+@@ -1402,6 +1402,8 @@ AC_PATH_PROG(GROFF, groff)
  
  KRB5_WITH_PAM
  
@@ -186,7 +188,7 @@
  if test "${localedir+set}" != set; then
      localedir='$(datadir)/locale'
 diff --git a/src/include/k5-int.h b/src/include/k5-int.h
-index cf524252f..efb523689 100644
+index 44dc1eeb3f..c3aecba7d4 100644
 --- a/src/include/k5-int.h
 +++ b/src/include/k5-int.h
 @@ -128,6 +128,7 @@ typedef unsigned char   u_char;
@@ -199,7 +201,7 @@
  #define KRB5_KDB_MAX_RLIFE      (60*60*24*7) /* one week */
 diff --git a/src/include/k5-label.h b/src/include/k5-label.h
 new file mode 100644
-index 000000000..dfaaa847c
+index 0000000000..dfaaa847cb
 --- /dev/null
 +++ b/src/include/k5-label.h
 @@ -0,0 +1,32 @@
@@ -236,7 +238,7 @@
 +#endif
 +#endif
 diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
-index 045334a08..db80063eb 100644
+index c0194c3c94..7e1dea2cbf 100644
 --- a/src/include/krb5/krb5.hin
 +++ b/src/include/krb5/krb5.hin
 @@ -87,6 +87,12 @@
@@ -253,7 +255,7 @@
  
  #include <stdlib.h>
 diff --git a/src/kadmin/dbutil/dump.c b/src/kadmin/dbutil/dump.c
-index 634ba4a8b..cea7939f4 100644
+index a89b5144f6..4d6cc0bdf9 100644
 --- a/src/kadmin/dbutil/dump.c
 +++ b/src/kadmin/dbutil/dump.c
 @@ -148,12 +148,21 @@ create_ofile(char *ofile, char **tmpname)
@@ -288,10 +290,10 @@
          com_err(progname, errno, _("while creating 'ok' file, '%s'"), file_ok);
          goto cleanup;
 diff --git a/src/kdc/main.c b/src/kdc/main.c
-index 3be6dcb07..24d441e16 100644
+index 38b9299066..085afc9220 100644
 --- a/src/kdc/main.c
 +++ b/src/kdc/main.c
-@@ -872,7 +872,7 @@ write_pid_file(const char *path)
+@@ -848,7 +848,7 @@ write_pid_file(const char *path)
      FILE *file;
      unsigned long pid;
  
@@ -301,10 +303,10 @@
          return errno;
      pid = (unsigned long) getpid();
 diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c
-index 498ca599a..c6b8efc28 100644
+index f2341d720f..ffdac9f397 100644
 --- a/src/kprop/kpropd.c
 +++ b/src/kprop/kpropd.c
-@@ -487,6 +487,9 @@ doit(int fd)
+@@ -488,6 +488,9 @@ doit(int fd)
      krb5_enctype etype;
      int database_fd;
      char hostINET6_ADDRSTRLEN + 1;
@@ -314,7 +316,7 @@
  
      signal_wrapper(SIGALRM, alarm_handler);
      alarm(params.iprop_resync_timeout);
-@@ -542,9 +545,15 @@ doit(int fd)
+@@ -543,9 +546,15 @@ doit(int fd)
          free(name);
          exit(1);
      }
@@ -331,7 +333,7 @@
                              KRB5_LOCKMODE_EXCLUSIVE | KRB5_LOCKMODE_DONTBLOCK);
      if (retval) {
 diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c
-index c6885edf2..9aec3c05e 100644
+index c6885edf2a..9aec3c05e8 100644
 --- a/src/lib/kadm5/logger.c
 +++ b/src/lib/kadm5/logger.c
 @@ -309,7 +309,7 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do
@@ -353,7 +355,7 @@
                  set_cloexec_file(f);
                  log_control.log_entrieslindex.lfu_filep = f;
 diff --git a/src/lib/kdb/kdb_log.c b/src/lib/kdb/kdb_log.c
-index 2659a2501..e9b95fce5 100644
+index 2659a25018..e9b95fce59 100644
 --- a/src/lib/kdb/kdb_log.c
 +++ b/src/lib/kdb/kdb_log.c
 @@ -480,7 +480,7 @@ ulog_map(krb5_context context, const char *logname, uint32_t ulogentries)
@@ -366,7 +368,7 @@
              retval = errno;
              goto cleanup;
 diff --git a/src/lib/krb5/ccache/cc_dir.c b/src/lib/krb5/ccache/cc_dir.c
-index 7b100a0ec..5683a0433 100644
+index 1da40b51d0..f3ab7340a6 100644
 --- a/src/lib/krb5/ccache/cc_dir.c
 +++ b/src/lib/krb5/ccache/cc_dir.c
 @@ -183,10 +183,19 @@ write_primary_file(const char *primary_path, const char *contents)
@@ -416,7 +418,7 @@
                    _("Credential cache directory %s does not exist"),
                    dirname);
 diff --git a/src/lib/krb5/keytab/kt_file.c b/src/lib/krb5/keytab/kt_file.c
-index e510211fc..f3ea28c8e 100644
+index e510211fc5..f3ea28c8ec 100644
 --- a/src/lib/krb5/keytab/kt_file.c
 +++ b/src/lib/krb5/keytab/kt_file.c
 @@ -735,14 +735,14 @@ krb5_ktfileint_open(krb5_context context, krb5_keytab id, int mode)
@@ -437,10 +439,10 @@
                  goto report_errno;
              writevno = 1;
 diff --git a/src/lib/krb5/os/trace.c b/src/lib/krb5/os/trace.c
-index 7073459f0..e9b99f4ca 100644
+index 3369fc4ba6..95f82cda03 100644
 --- a/src/lib/krb5/os/trace.c
 +++ b/src/lib/krb5/os/trace.c
-@@ -458,7 +458,7 @@ krb5_set_trace_filename(krb5_context context, const char *filename)
+@@ -459,7 +459,7 @@ krb5_set_trace_filename(krb5_context context, const char *filename)

_service:tar_scm:backport-CVE-2021-37750.patch Deleted

@@ -1,46 +0,0 @@
-From d775c95af7606a51bf79547a94fa52ddd1cb7f49 Mon Sep 17 00:00:00 2001
-From: Greg Hudson <ghudson@mit.edu>
-Date: Tue, 3 Aug 2021 01:15:27 -0400
-Subject: PATCH Fix KDC null deref on TGS inner body null server
-
-After the KDC decodes a FAST inner body, it does not check for a null
-server.  Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this
-would typically result in an error from krb5_unparse_name(), but with
-the addition of get_local_tgt() it results in a null dereference.  Add
-a null check.
-
-Reported by Joseph Sutton of Catalyst.
-
-CVE-2021-37750:
-
-In MIT krb5 releases 1.14 and later, an authenticated attacker can
-cause a null dereference in the KDC by sending a FAST TGS request with
-no server field.
-
-ticket: 9008 (new)
-tags: pullup
-target_version: 1.19-next
-target_version: 1.18-next
----
- src/kdc/do_tgs_req.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
-index 582e497..32dc65f 100644
---- a/src/kdc/do_tgs_req.c
-+++ b/src/kdc/do_tgs_req.c
-@@ -207,6 +207,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
-         status = "FIND_FAST";
-         goto cleanup;
-     }
-+    if (sprinc == NULL) {
-+        status = "NULL_SERVER";
-+        errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
-+        goto cleanup;
-+    }
- 
-     errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server,
-                             &local_tgt, &local_tgt_storage, &local_tgt_key);
--- 
-1.8.3.1
-

_service:tar_scm:fix-debuginfo-with-y.tab.c.patch Changed

@@ -1,4 +1,4 @@
-From ed161c3f3cb642d025f0fee6d4af6f56bba711e9 Mon Sep 17 00:00:00 2001
+From c7fe7cbd61f7debf052ddcc6cc5f01bb7e4f5385 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:49:25 -0400
 Subject: PATCH downstream fix debuginfo with y.tab.c
@@ -14,7 +14,7 @@
  2 files changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/src/kadmin/cli/Makefile.in b/src/kadmin/cli/Makefile.in
-index adfea6e2b..d1327e400 100644
+index adfea6e2b5..d1327e400b 100644
 --- a/src/kadmin/cli/Makefile.in
 +++ b/src/kadmin/cli/Makefile.in
 @@ -37,3 +37,8 @@ clean-unix::
@@ -27,7 +27,7 @@
 +	$(YACC.y) $< 
 +	$(CP) y.tab.c $@
 diff --git a/src/plugins/kdb/ldap/ldap_util/Makefile.in b/src/plugins/kdb/ldap/ldap_util/Makefile.in
-index 8669c2436..a22f23c02 100644
+index 8669c2436c..a22f23c02c 100644
 --- a/src/plugins/kdb/ldap/ldap_util/Makefile.in
 +++ b/src/plugins/kdb/ldap/ldap_util/Makefile.in
 @@ -20,7 +20,7 @@ $(PROG): $(OBJS) $(KADMSRV_DEPLIBS) $(KRB5_BASE_DEPLIB) $(GETDATE)
@@ -39,3 +39,6 @@
  
  install:
  	$(INSTALL_PROGRAM) $(PROG) ${DESTDIR}$(ADMIN_BINDIR)/$(PROG)
+-- 
+2.38.1
+

_service:tar_scm:ksu-pam-integration.patch Changed

@@ -1,4 +1,4 @@
-From 90ba715be48c2e1b6c7ca53cb1d75f3af2c388d6 Mon Sep 17 00:00:00 2001
+From 37d69135d0be7f46732c401cdbb3abc075bf4117 Mon Sep 17 00:00:00 2001
 From: Robbie Harwood <rharwood@redhat.com>
 Date: Tue, 23 Aug 2016 16:29:58 -0400
 Subject: PATCH downstream ksu pam integration
@@ -30,10 +30,10 @@
  create mode 100644 src/clients/ksu/pam.h
 
 diff --git a/src/aclocal.m4 b/src/aclocal.m4
-index 024d6370c..ca9fcf664 100644
+index 9920476f91..bf9da35bbc 100644
 --- a/src/aclocal.m4
 +++ b/src/aclocal.m4
-@@ -1677,3 +1677,72 @@ if test "$with_ldap" = yes; then
+@@ -1458,3 +1458,72 @@ if test "$with_ldap" = yes; then
    OPENLDAP_PLUGIN=yes
  fi
  )dnl
@@ -107,7 +107,7 @@
 +)dnl
 +
 diff --git a/src/clients/ksu/Makefile.in b/src/clients/ksu/Makefile.in
-index 8b4edce4d..9d58f29b5 100644
+index 8b4edce4d8..9d58f29b5d 100644
 --- a/src/clients/ksu/Makefile.in
 +++ b/src/clients/ksu/Makefile.in
 @@ -3,12 +3,14 @@ BUILDTOP=$(REL)..$(S)..
@@ -145,7 +145,7 @@
  clean:
  	$(RM) ksu
 diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c
-index af1286172..931f05404 100644
+index af12861729..931f054041 100644
 --- a/src/clients/ksu/main.c
 +++ b/src/clients/ksu/main.c
 @@ -26,6 +26,7 @@
@@ -303,7 +303,7 @@
      }
 diff --git a/src/clients/ksu/pam.c b/src/clients/ksu/pam.c
 new file mode 100644
-index 000000000..cbfe48704
+index 0000000000..cbfe487047
 --- /dev/null
 +++ b/src/clients/ksu/pam.c
 @@ -0,0 +1,389 @@
@@ -698,7 +698,7 @@
 +#endif
 diff --git a/src/clients/ksu/pam.h b/src/clients/ksu/pam.h
 new file mode 100644
-index 000000000..0ab76569c
+index 0000000000..0ab76569cb
 --- /dev/null
 +++ b/src/clients/ksu/pam.h
 @@ -0,0 +1,57 @@
@@ -760,10 +760,10 @@
 +void appl_pam_cleanup(void);
 +#endif
 diff --git a/src/configure.ac b/src/configure.ac
-index 4eb080784..693f76a81 100644
+index f03028b5fd..aa970b0447 100644
 --- a/src/configure.ac
 +++ b/src/configure.ac
-@@ -1389,6 +1389,8 @@ AC_SUBST(VERTO_VERSION)
+@@ -1400,6 +1400,8 @@ AC_SUBST(VERTO_VERSION)
  
  AC_PATH_PROG(GROFF, groff)
  
@@ -772,3 +772,6 @@
  # Make localedir work in autoconf 2.5x.
  if test "${localedir+set}" != set; then
      localedir='$(datadir)/locale'
+-- 
+2.38.1
+

_service:tar_scm:krb5-1.19.2.tar.gz.asc Deleted

_service:tar_scm:krb5-1.19.2.tar.gz -> _service:tar_scm:krb5-1.20.1.tar.gz Changed

_service:tar_scm:krb5-1.20.1.tar.gz.asc Added