diff -u libapache-mod-auth-kerb-5.4/debian/changelog libapache-mod-auth-kerb-5.4/debian/changelog --- libapache-mod-auth-kerb-5.4/debian/changelog +++ libapache-mod-auth-kerb-5.4/debian/changelog @@ -1,3 +1,10 @@ +libapache-mod-auth-kerb (5.4-2.5) unstable; urgency=medium + + * Non-maintainer upload. + * Always assume none replay cache type is present, Closes: #975344 + + -- Sam Hartman Mon, 23 Nov 2020 09:34:53 -0500 + libapache-mod-auth-kerb (5.4-2.4) unstable; urgency=medium * Non-maintainer upload. diff -u libapache-mod-auth-kerb-5.4/debian/patches/amd64.patch libapache-mod-auth-kerb-5.4/debian/patches/amd64.patch --- libapache-mod-auth-kerb-5.4/debian/patches/amd64.patch +++ libapache-mod-auth-kerb-5.4/debian/patches/amd64.patch @@ -1,8 +1,17 @@ -Index: libapache-mod-auth-kerb-5.3/spnegokrb5/spnego_asn1.h +From: Ghe Rivero +Date: Mon, 23 Nov 2020 09:22:08 -0500 +Subject: amd64 + =================================================================== ---- libapache-mod-auth-kerb-5.3.orig/spnegokrb5/spnego_asn1.h 2008-05-08 08:25:26.000000000 +0200 -+++ libapache-mod-auth-kerb-5.3/spnegokrb5/spnego_asn1.h 2008-05-08 08:25:51.000000000 +0200 -@@ -100,7 +100,6 @@ +--- + spnegokrb5/spnego_asn1.h | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/spnegokrb5/spnego_asn1.h b/spnegokrb5/spnego_asn1.h +index d185d84..4062d28 100644 +--- a/spnegokrb5/spnego_asn1.h ++++ b/spnegokrb5/spnego_asn1.h +@@ -100,7 +100,6 @@ size_t length_ContextFlags(const ContextFlags *); int copy_ContextFlags (const ContextFlags *, ContextFlags *); unsigned ContextFlags2int(ContextFlags); ContextFlags int2ContextFlags(unsigned); diff -u libapache-mod-auth-kerb-5.4/debian/patches/apache24.patch libapache-mod-auth-kerb-5.4/debian/patches/apache24.patch --- libapache-mod-auth-kerb-5.4/debian/patches/apache24.patch +++ libapache-mod-auth-kerb-5.4/debian/patches/apache24.patch @@ -1,3 +1,13 @@ +From: Ghe Rivero +Date: Mon, 23 Nov 2020 09:22:08 -0500 +Subject: apache24 + +--- + src/mod_auth_kerb.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/src/mod_auth_kerb.c b/src/mod_auth_kerb.c +index ed228aa..0351eba 100644 --- a/src/mod_auth_kerb.c +++ b/src/mod_auth_kerb.c @@ -152,10 +152,14 @@ @@ -16,7 +26,7 @@ #endif #ifdef STANDARD20_MODULE_STUFF -@@ -389,9 +393,14 @@ cmd_delegationlock(cmd_parms *cmd, void +@@ -388,9 +392,14 @@ cmd_delegationlock(cmd_parms *cmd, void *dconf, const char *a1) return NULL; } @@ -31,7 +41,7 @@ { char errstr[1024]; va_list ap; -@@ -401,7 +410,9 @@ log_rerror(const char *file, int line, i +@@ -400,7 +409,9 @@ log_rerror(const char *file, int line, int level, int status, va_end(ap); @@ -42,7 +52,7 @@ ap_log_rerror(file, line, level | APLOG_NOERRNO, status, r, "%s", errstr); #else ap_log_rerror(file, line, level | APLOG_NOERRNO, r, "%s", errstr); -@@ -1882,7 +1893,7 @@ already_succeeded(request_rec *r, char * +@@ -1881,7 +1892,7 @@ already_succeeded(request_rec *r, char *auth_line) char keyname[1024]; snprintf(keyname, sizeof(keyname) - 1, @@ -51,7 +61,7 @@ r->connection->id); if (apr_pool_userdata_get((void**)&conn_data, keyname, r->connection->pool) != 0) -@@ -2044,7 +2055,7 @@ kerb_authenticate_user(request_rec *r) +@@ -2035,7 +2046,7 @@ kerb_authenticate_user(request_rec *r) prevauth->last_return = ret; snprintf(keyname, sizeof(keyname) - 1, "mod_auth_kerb::connection::%s::%ld", reverted: --- libapache-mod-auth-kerb-5.4/debian/patches/auth_to_local.patch +++ libapache-mod-auth-kerb-5.4.orig/debian/patches/auth_to_local.patch @@ -1,131 +0,0 @@ -Index: libapache-mod-auth-kerb-5.3/src/mod_auth_kerb.c -=================================================================== ---- libapache-mod-auth-kerb-5.3.orig/src/mod_auth_kerb.c 2008-05-08 10:30:59.000000000 +0200 -+++ libapache-mod-auth-kerb-5.3/src/mod_auth_kerb.c 2008-05-08 10:31:05.000000000 +0200 -@@ -165,6 +165,7 @@ - char *krb_5_keytab; - int krb_method_gssapi; - int krb_method_k5pass; -+ int krb5_auth_to_local; - #endif - #ifdef KRB4 - char *krb_4_srvtab; -@@ -227,6 +228,9 @@ - - command("KrbMethodK5Passwd", ap_set_flag_slot, krb_method_k5pass, - FLAG, "Enable Kerberos V5 password authentication."), -+ -+ command("Krb5AuthToLocal", ap_set_flag_slot, krb5_auth_to_local, -+ FLAG, "Enable Kerberos V5 auth_to_local mapping."), - #endif - - #ifdef KRB4 -@@ -322,6 +326,7 @@ - #ifdef KRB5 - ((kerb_auth_config *)rec)->krb_method_k5pass = 1; - ((kerb_auth_config *)rec)->krb_method_gssapi = 1; -+ ((kerb_auth_config *)rec)->krb5_auth_to_local = 0; - #endif - #ifdef KRB4 - ((kerb_auth_config *)rec)->krb_method_k4pass = 1; -@@ -746,6 +751,78 @@ - } - - static int -+do_krb5_an_to_ln(request_rec *r, const kerb_auth_config *conf, MK_POOL *p) -+{ -+ const int lname_size = 1024; -+ -+ krb5_context kcontext; -+ krb5_principal princ; -+ krb5_error_code code; -+ char lname[lname_size]; -+ int ret; -+ -+ if (!conf->krb5_auth_to_local) { -+ return OK; -+ } -+ -+ ret = HTTP_INTERNAL_SERVER_ERROR; -+ -+ code = krb5_init_context(&kcontext); -+ if (code) { -+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r, -+ "Cannot initialize Kerberos5 context (%d)", code); -+ return HTTP_INTERNAL_SERVER_ERROR; -+ } -+ -+ code = krb5_parse_name(kcontext, MK_USER, &princ); -+ if (code) { -+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r, -+ "krb5_parse_name() failed for name %s: %s", -+ MK_USER, -+ krb5_get_err_text(kcontext, code)); -+ krb5_free_context(kcontext); -+ return HTTP_INTERNAL_SERVER_ERROR; -+ } -+ -+ code = krb5_aname_to_localname(kcontext, princ, sizeof(lname), lname); -+ if (code) { -+ if (code != KRB5_LNAME_NOTRANS) { -+ log_rerror(APLOG_MARK, APLOG_ERR, 0, r, -+ "krb5_aname_to_localname() failed: %s", -+ krb5_get_err_text(kcontext, code)); -+ /* fall through */ -+ } -+ else { -+ log_rerror(APLOG_MARK, APLOG_NOTICE, 0, r, -+ "krb5_aname_to_localname() found no " -+ "mapping for principal %s", -+ MK_USER); -+ /* fall through */ -+ } -+ } -+ else { -+ /* Does this belong in an authz handler? */ -+ if (!krb5_kuserok(kcontext, princ, lname)) { -+ log_rerror(APLOG_MARK, APLOG_NOTICE, 0, r, -+ "krb5_kuserok(%s, %s) == false", -+ MK_USER, lname); -+ ret = HTTP_UNAUTHORIZED; -+ } -+ else { -+ log_rerror(APLOG_MARK, APLOG_NOTICE, 0, r, -+ "doing auth_to_local: %s -> %s", -+ MK_USER, lname); -+ MK_USER = apr_pstrdup(p, lname); -+ ret = OK; -+ } -+ } -+ krb5_free_principal(kcontext, princ); -+ krb5_free_context(kcontext); -+ -+ return ret; -+} -+ -+static int - krb5_cache_cleanup(void *data) - { - krb5_context context; -@@ -1537,11 +1614,17 @@ - - #ifdef KRB5 - if (use_krb5 && conf->krb_method_gssapi && -- strcasecmp(auth_type, MECH_NEGOTIATE) == 0) { -- ret = authenticate_user_gss(r, conf, auth_line, &negotiate_ret_value); -+ strcasecmp(auth_type, MECH_NEGOTIATE) == 0) { -+ ret = authenticate_user_gss(r, conf, auth_line, &negotiate_ret_value); -+ if (ret == OK) { -+ ret = do_krb5_an_to_ln(r, conf, r->connection->pool); -+ } - } else if (use_krb5 && conf->krb_method_k5pass && -- strcasecmp(auth_type, "Basic") == 0) { -- ret = authenticate_user_krb5pwd(r, conf, auth_line); -+ strcasecmp(auth_type, "Basic") == 0) { -+ ret = authenticate_user_krb5pwd(r, conf, auth_line); -+ if (ret == OK) { -+ ret = do_krb5_an_to_ln(r, conf, r->pool); -+ } - } - #endif - reverted: --- libapache-mod-auth-kerb-5.4/debian/patches/gssapi_any.patch +++ libapache-mod-auth-kerb-5.4.orig/debian/patches/gssapi_any.patch @@ -1,29 +0,0 @@ -Index: libapache-mod-auth-kerb-5.3/README -=================================================================== ---- libapache-mod-auth-kerb-5.3.orig/README 2008-05-08 08:25:26.000000000 +0200 -+++ libapache-mod-auth-kerb-5.3/README 2008-05-08 08:26:15.000000000 +0200 -@@ -66,6 +66,8 @@ - is used. The FQDN part can contain any hostname and can be used to work - around problems with misconfigured DNS. A corresponding key of this name - must be stored in the keytab. -+ If this option is set to 'Any', then any prinicpal from the keytab which -+ matches the client's request may be used. - - Krb4Srvtab /path/to/srvtab - This option takes one argument, specifying the path to the Kerberos V4 -Index: libapache-mod-auth-kerb-5.3/src/mod_auth_kerb.c -=================================================================== ---- libapache-mod-auth-kerb-5.3.orig/src/mod_auth_kerb.c 2008-05-08 08:25:26.000000000 +0200 -+++ libapache-mod-auth-kerb-5.3/src/mod_auth_kerb.c 2008-05-08 08:26:15.000000000 +0200 -@@ -1140,7 +1140,10 @@ - have_server_princ = conf->krb_service_name && strchr(conf->krb_service_name, '/') != NULL; - if (have_server_princ) - strncpy(buf, conf->krb_service_name, sizeof(buf)); -- else -+ else if (conf->krb_service_name && strcmp(conf->krb_service_name, "Any") == 0) { -+ *server_creds = GSS_C_NO_CREDENTIAL; -+ return 0; -+ } else - snprintf(buf, sizeof(buf), "%s@%s", - (conf->krb_service_name) ? conf->krb_service_name : SERVICE_NAME, - ap_get_server_name(r)); diff -u libapache-mod-auth-kerb-5.4/debian/patches/gssapi_delegation.patch libapache-mod-auth-kerb-5.4/debian/patches/gssapi_delegation.patch --- libapache-mod-auth-kerb-5.4/debian/patches/gssapi_delegation.patch +++ libapache-mod-auth-kerb-5.4/debian/patches/gssapi_delegation.patch @@ -1,3 +1,13 @@ +From: Ghe Rivero +Date: Mon, 23 Nov 2020 09:22:08 -0500 +Subject: gssapi_delegation + +--- + src/mod_auth_kerb.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/src/mod_auth_kerb.c b/src/mod_auth_kerb.c +index d3f5e5c..ed228aa 100644 --- a/src/mod_auth_kerb.c +++ b/src/mod_auth_kerb.c @@ -190,6 +190,7 @@ typedef struct { @@ -8,7 +18,7 @@ #if 0 int krb_ssl_preauthentication; #endif -@@ -260,6 +261,9 @@ static const command_rec kerb_auth_cmds[ +@@ -259,6 +260,9 @@ static const command_rec kerb_auth_cmds[] = { command("KrbDelegateBasic", ap_set_flag_slot, krb_delegate_basic, FLAG, "Always offer Basic authentication regardless of KrbMethodK5Pass and pass on authentication to lower modules if Basic headers arrive."), @@ -18,7 +28,7 @@ #if 0 command("KrbEnableSSLPreauthentication", ap_set_flag_slot, krb_ssl_preauthentication, FLAG, "Don't do Kerberos authentication if the user is already authenticated using SSL and her client certificate."), -@@ -343,6 +347,7 @@ static void *kerb_dir_create_config(MK_P +@@ -342,6 +346,7 @@ static void *kerb_dir_create_config(MK_POOL *p, char *d) ((kerb_auth_config *)rec)->krb_service_name = NULL; ((kerb_auth_config *)rec)->krb_authoritative = 1; ((kerb_auth_config *)rec)->krb_delegate_basic = 0; @@ -26,7 +36,7 @@ #if 0 ((kerb_auth_config *)rec)->krb_ssl_preauthentication = 0; #endif -@@ -561,7 +566,8 @@ authenticate_user_krb4pwd(request_rec *r +@@ -560,7 +565,8 @@ authenticate_user_krb4pwd(request_rec *r, user = apr_pstrdup(r->pool, sent_name); if (sent_instance) user = apr_pstrcat(r->pool, user, ".", sent_instance, NULL); @@ -36,7 +46,7 @@ MK_USER = user; MK_AUTH_TYPE = "Basic"; -@@ -1102,6 +1108,9 @@ authenticate_user_krb5pwd(request_rec *r +@@ -1101,6 +1107,9 @@ authenticate_user_krb5pwd(request_rec *r, MK_AUTH_TYPE = "Basic"; free(name); @@ -46,7 +56,7 @@ if (conf->krb_save_credentials) store_krb5_creds(kcontext, r, conf, ccache); -@@ -1643,6 +1652,7 @@ authenticate_user_gss(request_rec *r, ke +@@ -1642,6 +1651,7 @@ authenticate_user_gss(request_rec *r, kerb_auth_config *conf, gss_ctx_id_t context = GSS_C_NO_CONTEXT; gss_cred_id_t server_creds = GSS_C_NO_CREDENTIAL; OM_uint32 ret_flags = 0; @@ -54,7 +64,7 @@ *negotiate_ret_value = "\0"; -@@ -1775,6 +1785,9 @@ authenticate_user_gss(request_rec *r, ke +@@ -1774,6 +1784,9 @@ authenticate_user_gss(request_rec *r, kerb_auth_config *conf, MK_AUTH_TYPE = MECH_NEGOTIATE; MK_USER = apr_pstrdup(r->pool, output_token.value); reverted: --- libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-delegation.patch +++ libapache-mod-auth-kerb-5.4.orig/debian/patches/mod_auth_kerb-5.4-delegation.patch @@ -1,68 +0,0 @@ - -https://bugzilla.redhat.com/show_bug.cgi?id=688210 - ---- a/src/mod_auth_kerb.c -+++ b/src/mod_auth_kerb.c -@@ -209,6 +209,7 @@ typedef struct krb5_conn_data { - char *authline; - char *user; - char *mech; -+ char *ccname; - int last_return; - } krb5_conn_data; - -@@ -875,7 +876,7 @@ create_krb5_ccache(krb5_context kcontext - int ret; - krb5_ccache tmp_ccache = NULL; - -- ccname = apr_psprintf(r->pool, "FILE:%s/krb5cc_apache_XXXXXX", P_tmpdir); -+ ccname = apr_psprintf(r->connection->pool, "FILE:%s/krb5cc_apache_XXXXXX", P_tmpdir); - fd = mkstemp(ccname + strlen("FILE:")); - if (fd < 0) { - log_rerror(APLOG_MARK, APLOG_ERR, 0, r, -@@ -905,7 +906,7 @@ create_krb5_ccache(krb5_context kcontext - } - - apr_table_setn(r->subprocess_env, "KRB5CCNAME", ccname); -- apr_pool_cleanup_register(r->pool, ccname, krb5_cache_cleanup, -+ apr_pool_cleanup_register(r->connection->pool, ccname, krb5_cache_cleanup, - apr_pool_cleanup_null); - - *ccache = tmp_ccache; -@@ -1875,10 +1876,15 @@ already_succeeded(request_rec *r, char * - if (apr_pool_userdata_get((void**)&conn_data, keyname, r->connection->pool) != 0) - return NULL; - -- if(conn_data) { -- if(strcmp(conn_data->authline, auth_line) == 0) { -- log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "matched previous auth request"); -- return conn_data; -+ if(conn_data && conn_data->ccname != NULL) { -+ apr_finfo_t finfo; -+ -+ if (apr_stat(&finfo, conn_data->ccname + strlen("FILE:"), -+ APR_FINFO_NORM, r->pool) == APR_SUCCESS -+ && (finfo.valid & APR_FINFO_TYPE) -+ && finfo.filetype == APR_REG) { -+ log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "matched previous auth request"); -+ return conn_data; - } - } - return NULL; -@@ -2010,6 +2016,8 @@ kerb_authenticate_user(request_rec *r) - ret = prevauth->last_return; - MK_USER = prevauth->user; - MK_AUTH_TYPE = prevauth->mech; -+ if (prevauth->ccname) -+ apr_table_setn(r->subprocess_env, "KRB5CCNAME", prevauth->ccname); - } - - /* -@@ -2020,6 +2028,7 @@ kerb_authenticate_user(request_rec *r) - prevauth->user = apr_pstrdup(r->connection->pool, MK_USER); - prevauth->authline = apr_pstrdup(r->connection->pool, auth_line); - prevauth->mech = apr_pstrdup(r->connection->pool, auth_type); -+ prevauth->ccname = apr_pstrdup(r->connection->pool, apr_table_get(r->subprocess_env, "KRB5CCNAME")); - prevauth->last_return = ret; - snprintf(keyname, sizeof(keyname) - 1, - "mod_auth_kerb::connection::%s::%ld", diff -u libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-fixes.patch libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-fixes.patch --- libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-fixes.patch +++ libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-fixes.patch @@ -1,6 +1,14 @@ +From: Ghe Rivero +Date: Mon, 23 Nov 2020 09:22:08 -0500 +Subject: mod_auth_kerb-5.4-fixes Compiler warning fixes. +--- + src/mod_auth_kerb.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) +diff --git a/src/mod_auth_kerb.c b/src/mod_auth_kerb.c +index 1a9bff0..950bd1b 100644 --- a/src/mod_auth_kerb.c +++ b/src/mod_auth_kerb.c @@ -649,7 +649,8 @@ end: @@ -21,7 +29,7 @@ static int cmp_gss_type(gss_buffer_t token, gss_OID oid) { -@@ -1253,6 +1255,7 @@ cmp_gss_type(gss_buffer_t token, gss_OID +@@ -1253,6 +1255,7 @@ cmp_gss_type(gss_buffer_t token, gss_OID oid) return memcmp(p, oid->elements, oid->length); } diff -u libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-handle-continue.patch libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-handle-continue.patch --- libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-handle-continue.patch +++ libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-handle-continue.patch @@ -1,6 +1,16 @@ +From: Ghe Rivero +Date: Mon, 23 Nov 2020 09:22:08 -0500 +Subject: mod_auth_kerb-5.4-handle-continue + +--- + src/mod_auth_kerb.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/src/mod_auth_kerb.c b/src/mod_auth_kerb.c +index 2da9739..d3f5e5c 100644 --- a/src/mod_auth_kerb.c +++ b/src/mod_auth_kerb.c -@@ -1754,7 +1754,6 @@ authenticate_user_gss(request_rec *r, ke +@@ -1753,7 +1753,6 @@ authenticate_user_gss(request_rec *r, kerb_auth_config *conf, goto end; } @@ -8,7 +18,7 @@ /* This is a _Kerberos_ module so multiple authentication rounds aren't * supported. If we wanted a generic GSS authentication we would have to do * some magic with exporting context etc. */ -@@ -1762,7 +1761,6 @@ authenticate_user_gss(request_rec *r, ke +@@ -1761,7 +1760,6 @@ authenticate_user_gss(request_rec *r, kerb_auth_config *conf, ret = HTTP_UNAUTHORIZED; goto end; } diff -u libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-longuser.patch libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-longuser.patch --- libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-longuser.patch +++ libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-longuser.patch @@ -1,8 +1,14 @@ - -https://bugzilla.redhat.com/show_bug.cgi?id=867153 +From: Ghe Rivero +Date: Mon, 23 Nov 2020 09:22:08 -0500 +Subject: mod_auth_kerb-5.4-longuser Patch by: jkaluza +--- + src/mod_auth_kerb.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) +diff --git a/src/mod_auth_kerb.c b/src/mod_auth_kerb.c +index 0392c5a..2da9739 100644 --- a/src/mod_auth_kerb.c +++ b/src/mod_auth_kerb.c @@ -80,6 +80,7 @@ @@ -13,7 +19,7 @@ #include #include -@@ -1824,13 +1825,13 @@ do_krb5_an_to_ln(request_rec *r) { +@@ -1823,13 +1824,13 @@ do_krb5_an_to_ln(request_rec *r) { krb5_get_err_text(kcontext, code)); goto end; } diff -u libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-rcopshack.patch libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-rcopshack.patch --- libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-rcopshack.patch +++ libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-rcopshack.patch @@ -1,9 +1,17 @@ +From: Ghe Rivero +Date: Mon, 23 Nov 2020 09:22:08 -0500 +Subject: mod_auth_kerb-5.4-rcopshack Remove the Krb5 1.3.x-specific hack which mucks about with libkrb5 internals, and shouldn't. +--- + src/mod_auth_kerb.c | 53 ----------------------------------------------------- + 1 file changed, 53 deletions(-) ---- mod_auth_kerb-5.4/src/mod_auth_kerb.c.rcopshack -+++ mod_auth_kerb-5.4/src/mod_auth_kerb.c +diff --git a/src/mod_auth_kerb.c b/src/mod_auth_kerb.c +index d204a3e..1a9bff0 100644 +--- a/src/mod_auth_kerb.c ++++ b/src/mod_auth_kerb.c @@ -285,34 +285,6 @@ mkstemp(char *template) } #endif diff -u libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-s4u2proxy.patch libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-s4u2proxy.patch --- libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-s4u2proxy.patch +++ libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-5.4-s4u2proxy.patch @@ -1,3 +1,6 @@ +From: Ghe Rivero +Date: Mon, 23 Nov 2020 09:22:08 -0500 +Subject: mod_auth_kerb-5.4-s4u2proxy Add S4U2Proxy feature: @@ -18,10 +21,16 @@ I've added a new module option to enable this support, KrbConstrainedDelegation. The default is off. +--- + README | 12 ++ + src/mod_auth_kerb.c | 444 +++++++++++++++++++++++++++++++++++++++++++++++++++- + 2 files changed, 455 insertions(+), 1 deletion(-) +diff --git a/README b/README +index 672305b..c866811 100644 --- a/README +++ b/README -@@ -122,4 +122,16 @@ KrbSaveCredentials, the tickets will be +@@ -122,4 +122,16 @@ KrbSaveCredentials, the tickets will be retrieved into a ticket file or credential cache that will be available for the request handler. The ticket file will be removed after request is handled. @@ -38,6 +47,8 @@ +The module itself will obtain and manage the necessary credentials. + $Id: README,v 1.12 2008/09/17 14:01:55 baalberith Exp $ +diff --git a/src/mod_auth_kerb.c b/src/mod_auth_kerb.c +index 950bd1b..0392c5a 100644 --- a/src/mod_auth_kerb.c +++ b/src/mod_auth_kerb.c @@ -42,6 +42,31 @@ @@ -80,7 +91,7 @@ #define MODAUTHKERB_VERSION "5.4" -@@ -131,6 +157,12 @@ module AP_MODULE_DECLARE_DATA auth_kerb_ +@@ -131,6 +157,12 @@ module AP_MODULE_DECLARE_DATA auth_kerb_module; module auth_kerb_module; #endif @@ -101,7 +112,7 @@ #endif #ifdef KRB4 char *krb_4_srvtab; -@@ -185,6 +218,11 @@ set_kerb_auth_headers(request_rec *r, co +@@ -185,6 +218,11 @@ set_kerb_auth_headers(request_rec *r, const kerb_auth_config *conf, static const char* krb5_save_realms(cmd_parms *cmd, void *sec, const char *arg); @@ -113,7 +124,7 @@ #ifdef STANDARD20_MODULE_STUFF #define command(name, func, var, type, usage) \ -@@ -237,6 +275,12 @@ static const command_rec kerb_auth_cmds[ +@@ -237,6 +275,12 @@ static const command_rec kerb_auth_cmds[] = { command("KrbLocalUserMapping", ap_set_flag_slot, krb5_do_auth_to_local, FLAG, "Set to 'on' to have Kerberos do auth_to_local mapping of principal names to system user names."), @@ -126,7 +137,7 @@ #endif #ifdef KRB4 -@@ -302,6 +346,7 @@ static void *kerb_dir_create_config(MK_P +@@ -302,6 +346,7 @@ static void *kerb_dir_create_config(MK_POOL *p, char *d) #endif #ifdef KRB5 ((kerb_auth_config *)rec)->krb5_do_auth_to_local = 0; @@ -134,7 +145,7 @@ ((kerb_auth_config *)rec)->krb_method_k5pass = 1; ((kerb_auth_config *)rec)->krb_method_gssapi = 1; #endif -@@ -319,6 +364,24 @@ krb5_save_realms(cmd_parms *cmd, void *v +@@ -319,6 +364,24 @@ krb5_save_realms(cmd_parms *cmd, void *vsec, const char *arg) return NULL; } @@ -183,7 +194,7 @@ server_creds, NULL, NULL); gss_release_name(&minor_status2, &server_name); if (GSS_ERROR(major_status)) { -@@ -1257,6 +1325,302 @@ cmp_gss_type(gss_buffer_t token, gss_OID +@@ -1257,6 +1325,302 @@ cmp_gss_type(gss_buffer_t token, gss_OID oid) } #endif @@ -555,7 +566,7 @@ ap_add_version_component(p, "mod_auth_kerb/" MODAUTHKERB_VERSION); #ifndef HEIMDAL /* Suppress the MIT replay cache. Requires MIT Kerberos 1.4.0 or later. -@@ -1748,14 +2163,41 @@ kerb_init_handler(apr_pool_t *p, apr_poo +@@ -1748,14 +2163,41 @@ kerb_init_handler(apr_pool_t *p, apr_pool_t *plog, if (getenv("KRB5RCACHETYPE") == NULL && have_rcache_type("none")) putenv(strdup("KRB5RCACHETYPE=none")); #endif @@ -572,7 +583,7 @@ return OK; } - static void ++static void +initialize_child(apr_pool_t *p, server_rec *s) +{ + apr_status_t rv = 0; @@ -589,7 +600,7 @@ +#endif +} + -+static void + static void kerb_register_hooks(apr_pool_t *p) { ap_hook_post_config(kerb_init_handler, NULL, NULL, APR_HOOK_MIDDLE); diff -u libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-krb5_kt_close.patch libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-krb5_kt_close.patch --- libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-krb5_kt_close.patch +++ libapache-mod-auth-kerb-5.4/debian/patches/mod_auth_kerb-krb5_kt_close.patch @@ -1,12 +1,19 @@ -Description: fix use after free in authenticate_user_krb5pwd() +From: Ghe Rivero +Date: Mon, 23 Nov 2020 09:22:08 -0500 +Subject: fix use after free in authenticate_user_krb5pwd() + Origin: https://sourceforge.net/p/modauthkerb/bugs/61/attachment/mod_auth_kerb-krb5_kt_close.patch Bug: https://sourceforge.net/p/modauthkerb/bugs/61/ Bug-Debian: https://bugs.debian.org/934043 -Author: Johan Ymerson (https://sourceforge.net/u/ymerson/) -diff -ruN mod_auth_kerb-5.4.orig/src/mod_auth_kerb.c mod_auth_kerb-5.4/src/mod_auth_kerb.c ---- mod_auth_kerb-5.4.orig/src/mod_auth_kerb.c 2018-12-12 16:59:43.762013269 +0100 -+++ mod_auth_kerb-5.4/src/mod_auth_kerb.c 2018-12-12 16:59:59.151945123 +0100 -@@ -799,11 +799,9 @@ +--- + src/mod_auth_kerb.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/src/mod_auth_kerb.c b/src/mod_auth_kerb.c +index 0351eba..55dd011 100644 +--- a/src/mod_auth_kerb.c ++++ b/src/mod_auth_kerb.c +@@ -798,11 +798,9 @@ verify_krb5_user(request_rec *r, krb5_context context, krb5_principal principal, "failed to verify krb5 credentials: %s", krb5_get_err_text(context, ret)); krb5_kt_end_seq_get(context, keytab, &cursor); diff -u libapache-mod-auth-kerb-5.4/debian/patches/remove_bashism.patch libapache-mod-auth-kerb-5.4/debian/patches/remove_bashism.patch --- libapache-mod-auth-kerb-5.4/debian/patches/remove_bashism.patch +++ libapache-mod-auth-kerb-5.4/debian/patches/remove_bashism.patch @@ -1,8 +1,17 @@ -Index: libapache-mod-auth-kerb-5.4/Makefile.in +From: Ghe Rivero +Date: Mon, 23 Nov 2020 09:22:08 -0500 +Subject: remove_bashism + =================================================================== ---- libapache-mod-auth-kerb-5.4.orig/Makefile.in 2008-12-02 15:07:10.000000000 +0100 -+++ libapache-mod-auth-kerb-5.4/Makefile.in 2010-03-15 09:06:11.000000000 +0100 -@@ -20,9 +20,15 @@ +--- + Makefile.in | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/Makefile.in b/Makefile.in +index 36f6046..2911f01 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -20,9 +20,15 @@ install: clean: for i in . src spnegokrb5; do \ diff -u libapache-mod-auth-kerb-5.4/debian/patches/series libapache-mod-auth-kerb-5.4/debian/patches/series --- libapache-mod-auth-kerb-5.4/debian/patches/series +++ libapache-mod-auth-kerb-5.4/debian/patches/series @@ -1,7 +1,6 @@ mod_auth_kerb-5.4-rcopshack.patch mod_auth_kerb-5.4-fixes.patch mod_auth_kerb-5.4-s4u2proxy.patch -#mod_auth_kerb-5.4-delegation.patch mod_auth_kerb-5.4-longuser.patch mod_auth_kerb-5.4-handle-continue.patch amd64.patch @@ -11,0 +11 @@ +0011-Always-use-NONE-replay-cache-type.patch only in patch2: unchanged: --- libapache-mod-auth-kerb-5.4.orig/debian/patches/0011-Always-use-NONE-replay-cache-type.patch +++ libapache-mod-auth-kerb-5.4/debian/patches/0011-Always-use-NONE-replay-cache-type.patch @@ -0,0 +1,66 @@ +From: Sam Hartman +Date: Mon, 23 Nov 2020 09:30:22 -0500 +Subject: Always use NONE replay cache type + +It's 2020. Any MIT Kerberos in the wild supports the none replay +cache type. The previous code used an internal function to detect +that replay cache type; that function is no longer available. +Instead, assume it is present. + +An alternative would be to enable the default replay cache. It was +originally disabled because of problems between Microsoft +authenticators and 2004-era MIT Kerberos 1.3. That's probably a good +idea. It probably closes off security attacks, although analyzing the +impact of replays in cases where neither channel binding nor +per-message services are used is difficult. I believe that a replay +cache is not strictly necessary in the common configuration where +mod-auth-kerb is used over a TLS-protected connection where the client +properly verifies the TLS certificate presented by the server prior to +sending a GSS token. + +I have elected not to enable replay cache to affect a minimal change. +--- + src/mod_auth_kerb.c | 23 +---------------------- + 1 file changed, 1 insertion(+), 22 deletions(-) + +diff --git a/src/mod_auth_kerb.c b/src/mod_auth_kerb.c +index 55dd011..6508f2d 100644 +--- a/src/mod_auth_kerb.c ++++ b/src/mod_auth_kerb.c +@@ -2057,27 +2057,6 @@ kerb_authenticate_user(request_rec *r) + return ret; + } + +-static int +-have_rcache_type(const char *type) +-{ +- krb5_error_code ret; +- krb5_context context; +- krb5_rcache id = NULL; +- int found; +- +- ret = krb5_init_context(&context); +- if (ret) +- return 0; +- +- ret = krb5_rc_resolve_full(context, &id, "none:"); +- found = (ret == 0); +- +- if (ret == 0) +- krb5_rc_destroy(context, id); +- krb5_free_context(context); +- +- return found; +-} + + /*************************************************************************** + Module Setup/Configuration +@@ -2139,7 +2118,7 @@ kerb_module_init(server_rec *dummy, pool *p) + #ifndef HEIMDAL + /* Suppress the MIT replay cache. Requires MIT Kerberos 1.4.0 or later. + 1.3.x are covered by the hack overiding the replay calls */ +- if (getenv("KRB5RCACHETYPE") == NULL && have_rcache_type("none")) ++ if (getenv("KRB5RCACHETYPE") == NULL ) + putenv(strdup("KRB5RCACHETYPE=none")); + #endif + }