/krb5-1.19.2.tar.gz.asc

  /krb5-1.20.1.tar.gz

  /krb5-1.20.1.tar.gz.asc

  From: Robbie Harwood <rharwood@redhat.com>

  Date: Tue, 23 Aug 2016 16:29:58 -0400

  Subject: [PATCH] [downstream] ksu pam integration

   create mode 100644 src/clients/ksu/pam.h

  diff --git a/src/aclocal.m4 b/src/aclocal.m4

  --- a/src/aclocal.m4

  +++ b/src/aclocal.m4

  @@ -1458,3 +1458,72 @@ if test "$with_ldap" = yes; then

  +void appl_pam_cleanup(void);

  +#endif

  diff --git a/src/configure.ac b/src/configure.ac

  --- a/src/configure.ac

  +++ b/src/configure.ac

   AC_PATH_PROG(GROFF, groff)

   if test "${localedir+set}" != set; then

       localedir='$(datadir)/locale'

  -- 

  From: Robbie Harwood <rharwood@redhat.com>

  Date: Tue, 23 Aug 2016 16:30:53 -0400

  Subject: [PATCH] [downstream] SELinux integration

   create mode 100644 src/util/support/selinux.c

  diff --git a/src/aclocal.m4 b/src/aclocal.m4

  --- a/src/aclocal.m4

  +++ b/src/aclocal.m4

  @@ -85,6 +85,7 @@ AC_SUBST_FILE(libnodeps_frag)

  +AC_SUBST(SELINUX_LIBS)

  +])dnl

  diff --git a/src/build-tools/krb5-config.in b/src/build-tools/krb5-config.in

  --- a/src/build-tools/krb5-config.in

  +++ b/src/build-tools/krb5-config.in

   DEFCCNAME='@DEFCCNAME@'

   DEFKTNAME='@DEFKTNAME@'

   DEFCKTNAME='@DEFCKTNAME@'

   LIBS='@LIBS@'

   GEN_LIB=@GEN_LIB@

       fi

       # If we ever support a flag to generate output suitable for static

   GSS_LIBS	= $(GSS_KRB5_LIB)

   # needs fixing if ever used on macOS!

  diff --git a/src/configure.ac b/src/configure.ac

  --- a/src/configure.ac

  +++ b/src/configure.ac

   KRB5_WITH_PAM

   if test "${localedir+set}" != set; then

       localedir='$(datadir)/locale'

  diff --git a/src/include/k5-int.h b/src/include/k5-int.h

  --- a/src/include/k5-int.h

  +++ b/src/include/k5-int.h

  @@ -128,6 +128,7 @@ typedef unsigned char   u_char;

  +#endif

  +#endif

  diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin

  --- a/src/include/krb5/krb5.hin

  +++ b/src/include/krb5/krb5.hin

  @@ -87,6 +87,12 @@

           com_err(progname, errno, _("while creating 'ok' file, '%s'"), file_ok);

           goto cleanup;

  diff --git a/src/kdc/main.c b/src/kdc/main.c

  --- a/src/kdc/main.c

  +++ b/src/kdc/main.c

       FILE *file;

       unsigned long pid;

           return errno;

       pid = (unsigned long) getpid();

  diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c

  --- a/src/kprop/kpropd.c

  +++ b/src/kprop/kpropd.c

  @@ -488,6 +488,9 @@ doit(int fd)

                               KRB5_LOCKMODE_EXCLUSIVE | KRB5_LOCKMODE_DONTBLOCK);

       if (retval) {

  diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c

  --- a/src/lib/kadm5/logger.c

  +++ b/src/lib/kadm5/logger.c

                        */

                       append = (cp[4] == ':') ? O_APPEND : 0;

                       if (append || cp[4] == '=') {

                                     S_IRUSR | S_IWUSR | S_IRGRP);

                           if (fd != -1)

                               f = fdopen(fd, append ? "a" : "w");

                * In case the old logfile did not get moved out of the

                * way, open for append to prevent squashing the old logs.

                */

                   goto report_errno;

               writevno = 1;

  diff --git a/src/lib/krb5/os/trace.c b/src/lib/krb5/os/trace.c

  --- a/src/lib/krb5/os/trace.c

  +++ b/src/lib/krb5/os/trace.c

       fd = malloc(sizeof(*fd));

       if (fd == NULL)

           return ENOMEM;

           free(fd);

           return errno;

  diff --git a/src/plugins/kdb/db2/adb_openclose.c b/src/plugins/kdb/db2/adb_openclose.c

  --- a/src/plugins/kdb/db2/adb_openclose.c

  +++ b/src/plugins/kdb/db2/adb_openclose.c

  @@ -152,7 +152,7 @@ osa_adb_init_db(osa_adb_db_t *dbp, char *filename, char *lockfilename,

  +

  +#endif /* USE_SELINUX */

  -- 

  From: Robbie Harwood <rharwood@redhat.com>

  Date: Tue, 23 Aug 2016 16:49:25 -0400

  Subject: [PATCH] [downstream] fix debuginfo with y.tab.c

   install:

   	$(INSTALL_PROGRAM) $(PROG) ${DESTDIR}$(ADMIN_BINDIR)/$(PROG)

  -- 

  From: Robbie Harwood <rharwood@redhat.com>

  Date: Tue, 26 Mar 2019 18:51:10 -0400

  Subject: [PATCH] [downstream] Remove 3des support

   src/include/krb5/krb5.hin                     |  10 +-

   src/kdc/kdc_util.c                            |   4 -

   src/lib/crypto/Makefile.in                    |   8 +-

   src/lib/crypto/builtin/des/ISSUES             |  13 -

   src/lib/crypto/builtin/des/Makefile.in        |  82 ----

   src/lib/crypto/builtin/des/d3_aead.c          | 137 ------

   src/lib/crypto/krb/prf_des.c                  |  47 ---

   src/lib/crypto/krb/random_to_key.c            |  28 --

   src/lib/crypto/libk5crypto.exports            |   1 -

   src/lib/crypto/openssl/des/Makefile.in        |  20 -

   src/lib/crypto/openssl/des/deps               |  14 -

   src/lib/crypto/openssl/des/des_keys.c         |  39 --

   src/plugins/preauth/pkinit/pkinit_crypto.h    |  10 +-

   src/plugins/preauth/pkinit/pkinit_kdf_test.c  |  30 --

   src/plugins/preauth/spake/t_vectors.c         |  25 --

   src/tests/gssapi/t_invalid.c                  |  12 -

   src/tests/gssapi/t_pcontok.c                  |  16 +-

   src/tests/gssapi/t_prf.c                      |   7 -

   src/tests/t_authdata.py                       |   2 +-

   src/tests/t_keyrollover.py                    |   8 +-

   src/tests/t_mkey.py                           |  35 --

   src/tests/t_salt.py                           |   5 +-

   src/util/k5test.py                            |   7 -

   .../leash/htmlhelp/html/Encryption_Types.htm  |  13 -

   delete mode 100644 src/lib/crypto/builtin/des/ISSUES

   delete mode 100644 src/lib/crypto/builtin/des/Makefile.in

   delete mode 100644 src/lib/crypto/builtin/des/d3_aead.c

   While **aes128-cts** and **aes256-cts** are supported for all Kerberos

  diff --git a/doc/admin/enctypes.rst b/doc/admin/enctypes.rst

  --- a/doc/admin/enctypes.rst

  +++ b/doc/admin/enctypes.rst

   des-cbc-crc                weak       <1.18    >=2000

   des-cbc-md4                weak       <1.18    ?

   des-cbc-md5                weak       <1.18    >=2000

   arcfour-hmac               deprecated >=1.3    >=2000

   arcfour-hmac-exp           weak       >=1.3    >=2000

   aes128-cts-hmac-sha1-96               >=1.3    >=Vista

   krb5 releases 1.17 and later flag deprecated encryption types

   (including ``des3-cbc-sha1`` and ``arcfour-hmac``) in KDC logs and

   kadmin output.  krb5 release 1.19 issues a warning during initial

   .. _err_cert_chain_cert_expired:

  diff --git a/doc/appdev/refs/macros/index.rst b/doc/appdev/refs/macros/index.rst

  --- a/doc/appdev/refs/macros/index.rst

  +++ b/doc/appdev/refs/macros/index.rst

  @@ -36,7 +36,6 @@ Public

      CKSUMTYPE_NIST_SHA.rst

      CKSUMTYPE_RSA_MD4.rst

  diff --git a/doc/conf.py b/doc/conf.py

  --- a/doc/conf.py

  +++ b/doc/conf.py

       rst_epilog += '''

   .. |krb5conf| replace:: ``/etc/krb5.conf``

   .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal``

   .. |copy| unicode:: U+000A9

   '''

  diff --git a/doc/mitK5features.rst b/doc/mitK5features.rst

  --- a/doc/mitK5features.rst

  +++ b/doc/mitK5features.rst

  @@ -37,7 +37,7 @@ Database backends: LDAP, DB2, LMDB

   ##DOS##	$(WCONFIG) config < $@.in > $@

   ##DOS##lib\crypto\builtin\camellia\Makefile: lib\crypto\builtin\camellia\Makefile.in $(MKFDEP)

  diff --git a/src/configure.ac b/src/configure.ac

  --- a/src/configure.ac

  +++ b/src/configure.ac

   	lib lib/kdb

   	lib/crypto lib/crypto/krb lib/crypto/crypto_tests

   	lib/krb5 lib/krb5/error_tables lib/krb5/asn.1 lib/krb5/ccache

  diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin

  --- a/src/include/krb5/krb5.hin

  +++ b/src/include/krb5/krb5.hin

  @@ -426,8 +426,8 @@ typedef struct _krb5_crypto_iov {

   #define CKSUMTYPE_HMAC_SHA1_96_AES128 0x000f /**< RFC 3962. Used with

                                                   ENCTYPE_AES128_CTS_HMAC_SHA1_96 */

  diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c

  --- a/src/kdc/kdc_util.c

  +++ b/src/kdc/kdc_util.c

           name = "rsaEncryption-EnvOID";

       else if (ktype == ENCTYPE_RSA_ES_OAEP_ENV)

           name = "id-RSAES-OAEP-EnvOID";

       else

           return krb5_enctype_to_name(ktype, FALSE, buf, buflen);

   enctype_requires_etype_info_2(krb5_enctype enctype)

   {

       switch(enctype) {

   all-unix: all-liblinks

   install-unix: install-libs

  diff --git a/src/lib/crypto/builtin/Makefile.in b/src/lib/crypto/builtin/Makefile.in

  --- a/src/lib/crypto/builtin/Makefile.in

  +++ b/src/lib/crypto/builtin/Makefile.in

  @@ -1,6 +1,6 @@

   	$(srcdir)/kdf.c		\

   	$(srcdir)/pbkdf2.c	

  -SUBDIROBJLISTS= des/OBJS.ST md4/OBJS.ST 	\

  +SUBDIROBJLISTS= md4/OBJS.ST	 	\

   		md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST 	\

   krb5int_camellia_encrypt

   krb5int_cmac_checksum

  diff --git a/src/lib/crypto/openssl/Makefile.in b/src/lib/crypto/openssl/Makefile.in

  --- a/src/lib/crypto/openssl/Makefile.in

  +++ b/src/lib/crypto/openssl/Makefile.in

  @@ -1,6 +1,6 @@

   LOCALINCLUDES=-I$(srcdir)/../krb $(CRYPTO_IMPL_CFLAGS)

   STLIBOBJS=\

   	$(srcdir)/pbkdf2.c	\

   	$(srcdir)/sha256.c

  -SUBDIROBJLISTS= des/OBJS.ST md4/OBJS.ST 	\

  +SUBDIROBJLISTS= md4/OBJS.ST 		\

   		md5/OBJS.ST sha1/OBJS.ST sha2/OBJS.ST 	\

   		enc_provider/OBJS.ST 		\

   		hash_provider/OBJS.ST 		\

  diff --git a/src/lib/crypto/openssl/des/Makefile.in b/src/lib/crypto/openssl/des/Makefile.in

  deleted file mode 100644

  index a6cece1dd1..0000000000

   }

  diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c

  --- a/src/lib/gssapi/krb5/accept_sec_context.c

  +++ b/src/lib/gssapi/krb5/accept_sec_context.c

               }

               switch (negotiated_etype) {

               case ENCTYPE_ARCFOUR_HMAC_EXP:

                   /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer"

  diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h

  --- a/src/lib/gssapi/krb5/gssapiP_krb5.h

  +++ b/src/lib/gssapi/krb5/gssapiP_krb5.h

  @@ -125,14 +125,14 @@ enum sgn_alg {

   };

  diff --git a/src/lib/gssapi/krb5/k5seal.c b/src/lib/gssapi/krb5/k5seal.c

  --- a/src/lib/gssapi/krb5/k5seal.c

  +++ b/src/lib/gssapi/krb5/k5seal.c

       /* pad the plaintext, encrypt if needed, and stick it in the token */

       code = krb5_c_checksum_length(context, md5cksum.checksum_type, &sumlen);

       if (code) {

           gssalloc_free(t);

           return(code);

       }

  -         */

  -        if (md5cksum.length != cksum_size)

  -            abort ();

  -        break;

  -    case SGN_ALG_HMAC_MD5:

  -        break;

  -    }

  +

       krb5_free_checksum_contents(context, &md5cksum);

  diff --git a/src/lib/gssapi/krb5/k5sealiov.c b/src/lib/gssapi/krb5/k5sealiov.c

  --- a/src/lib/gssapi/krb5/k5sealiov.c

  +++ b/src/lib/gssapi/krb5/k5sealiov.c

       /* pad the plaintext, encrypt if needed, and stick it in the token */

       /* initialize the checksum */

       code = krb5_c_checksum_length(context, md5cksum.checksum_type, &k5_trailerlen);

       if (code != 0)

       if (code != 0)

           goto cleanup;

  -    switch (ctx->signalg) {

  -    case SGN_ALG_HMAC_SHA1_DES3_KD:

  -        assert(md5cksum.length == ctx->cksum_size);

  -        break;

  -    case SGN_ALG_HMAC_MD5:

  -        break;

  -    }

       /* create the seq_num */

       code = kg_make_seq_num(context, ctx->seq, ctx->initiate ? 0 : 0xFF,

       case ENCTYPE_ARCFOUR_HMAC_EXP:

           /* RFC 4121 accidentally omits RC4-HMAC-EXP as a "not-newer" enctype,

  diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c

  --- a/src/lib/krb5/krb/init_ctx.c

  +++ b/src/lib/krb5/krb/init_ctx.c

  @@ -59,7 +59,6 @@

       ENCTYPE_ARCFOUR_HMAC,

       ENCTYPE_CAMELLIA128_CTS_CMAC, ENCTYPE_CAMELLIA256_CTS_CMAC,

       0

               /* Set all enctypes in the default list. */

               for (i = 0; default_list[i]; i++)

                   mod_list(default_list[i], sel, weak, &list);

   #define CKK_CAST3		(0x17)

   #define CKK_CAST128		(0x18)

  diff --git a/src/plugins/preauth/pkinit/pkinit_crypto.h b/src/plugins/preauth/pkinit/pkinit_crypto.h

  --- a/src/plugins/preauth/pkinit/pkinit_crypto.h

  +++ b/src/plugins/preauth/pkinit/pkinit_crypto.h

    * krb5_algorithm_identifier

    */

   krb5_error_code create_krb5_supportedCMSTypes

         /* initial key, w, x, y, T, S, K */

         "8846F7EAEE8FB117AD06BDD830B7586C",

  diff --git a/src/tests/gssapi/t_enctypes.py b/src/tests/gssapi/t_enctypes.py

  --- a/src/tests/gssapi/t_enctypes.py

  +++ b/src/tests/gssapi/t_enctypes.py

   from k5test import *

  -# Define some convenience abbreviations for enctypes we will see in

   # These tests make assumptions about the default enctype lists, so set

   # them explicitly rather than relying on the library defaults.

  -supp='aes256-cts:normal aes128-cts:normal des3-cbc-sha1:normal rc4-hmac:normal'

  +supp='aes256-cts:normal aes128-cts:normal rc4-hmac:normal'

           'realms': {'$realm': {'supported_enctypes': supp}}}

   realm = K5Realm(krb5_conf=conf)

   shutil.copyfile(realm.ccache, os.path.join(realm.testdir, 'save'))

   test_err('acc aes128', None, 'aes128-cts',

            'Encryption type aes256-cts-hmac-sha1-96 not permitted')

   # subkey.

   test('upgrade noargs', None, None,

        tktenc=aes256, tktsession=d_rc4,

        tktenc=aes256, tktsession=d_rc4,

        proto='cfx', isubkey=rc4, asubkey=aes128)

         "3BB3AE288C12B3B9D06B208A4151B3B6",

         "9AEA11A3BCF3C53F1F91F5A0BA2132E2501ADF5F3C28"

  diff --git a/src/tests/t_authdata.py b/src/tests/t_authdata.py

  --- a/src/tests/t_authdata.py

  +++ b/src/tests/t_authdata.py

   # preferred krbtgt enctype changes.

   mark('#8139 regression test')

   realm.kinit(realm.user_princ, password('user'), ['-f'])

   realm.run(['./forward'])

   realm.run([kvno, realm.host_princ])

  diff --git a/src/tests/t_etype_info.py b/src/tests/t_etype_info.py

  --- a/src/tests/t_etype_info.py

  +++ b/src/tests/t_etype_info.py

   from k5test import *

  -supported_enctypes = 'aes128-cts des3-cbc-sha1 rc4-hmac'

  +supported_enctypes = 'aes128-cts rc4-hmac'

           'realms': {'$realm': {'supported_enctypes': supported_enctypes}}}

   realm = K5Realm(create_host=False, get_creds=False, krb5_conf=conf)

  @@ -26,9 +26,9 @@ def test_etinfo(princ, enctypes, expected_lines):

   # With no newer enctypes in the request, PA-ETYPE-INFO2,

   # PA-ETYPE-INFO, and PA-PW-SALT appear in the AS-REP, each listing one

   # Verify that etype-info2 is included in a MORE_PREAUTH_DATA_REQUIRED

   # error if the client does optimistic preauth.

  diff --git a/src/tests/t_keyrollover.py b/src/tests/t_keyrollover.py

  --- a/src/tests/t_keyrollover.py

  +++ b/src/tests/t_keyrollover.py

  @@ -37,9 +37,9 @@ realm.run([klist, '-e'], expected_msg=msg)

   # Test using different salt types in a principal's key list.

   # Parameters from one key in the list must not leak over to later ones.

  diff --git a/src/util/k5test.py b/src/util/k5test.py

  --- a/src/util/k5test.py

  +++ b/src/util/k5test.py

       # No special settings; exercises AES256.

       ('default', None, None, None),

  -    # Exercise the DES3 enctype.

  -    ('des3', None,

  -     {'realms': {'$realm': {

  -                    'supported_enctypes': 'des3-cbc-sha1:normal',

  -                    'master_key_type': 'des3-cbc-sha1'}}}),

  -

       # Exercise the arcfour enctype.

       ('arcfour', None,

  diff --git a/src/windows/leash/htmlhelp/html/Encryption_Types.htm b/src/windows/leash/htmlhelp/html/Encryption_Types.htm

  index 1aebdd0b4a..c38eefd2bd 100644

  --- a/src/windows/leash/htmlhelp/html/Encryption_Types.htm

        <td>The AES Advanced Encryption Standard

   family, like 3DES, is a symmetric block cipher and was designed

  -- 

  From: Robbie Harwood <rharwood@redhat.com>

  Date: Fri, 9 Nov 2018 15:12:21 -0500

  Subject: [PATCH] [downstream] FIPS with PRNG and RADIUS and MD4

   15 files changed, 155 insertions(+), 33 deletions(-)

  diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst

  --- a/doc/admin/conf_files/krb5_conf.rst

  +++ b/doc/admin/conf_files/krb5_conf.rst

       qualification of shortnames, set this relation to the empty string

       with ``qualify_shortname = ""``.  (New in release 1.18.)

       vt->name = "spake";

       vt->pa_type_list = pa_types;

  -- 

  From: Julien Rische <jrische@redhat.com>

  Date: Thu, 5 May 2022 17:15:12 +0200

  libkrad allows to establish connections only to UNIX socket in FIPS

  mode, because MD5 digest is not considered safe enough to be used for

           retval = ESOCKTNOSUPPORT;

           goto error;

  --