From 8d1257e4f6560b55b23521cfc58a2d8053919897 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: May 12 2022 04:12:54 +0000 Subject: import krb5-1.18.2-20.el8 --- diff --git a/SOURCES/Make-kprop-work-for-dump-files-larger-than-4GB.patch b/SOURCES/Make-kprop-work-for-dump-files-larger-than-4GB.patch new file mode 100644 index 0000000..8358d7e --- /dev/null +++ b/SOURCES/Make-kprop-work-for-dump-files-larger-than-4GB.patch @@ -0,0 +1,365 @@ +From 5d541f1f0b468b1c976acf8ec2359bd0c8c73be7 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Wed, 19 Jan 2022 19:46:08 +0100 +Subject: [PATCH] Make kprop work for dump files larger than 4GB + +If the dump file size does not fit in 32 bits, encode four zero bytes +(forcing an error for unmodified kpropd) followed by the size in the +next 64 bits. + +Add a functional test case, but only run it when an environment +variable is set, as processing a 4GB dump file is too +resource-intensive for make check. + +[ghudson@mit.edu: edited comments and commit message; eliminated use +of defined constant in some cases; added test case] + +ticket: 9053 (new) +--- + src/kprop/kprop.c | 37 +++++++++++++++++++++---------------- + src/kprop/kprop.h | 12 ++++++++++++ + src/kprop/kprop_util.c | 42 ++++++++++++++++++++++++++++++++++++++++++ + src/kprop/kpropd.c | 33 +++++++++++++++++++++------------ + src/tests/t_kprop.py | 34 ++++++++++++++++++++++++++++++++++ + 5 files changed, 130 insertions(+), 28 deletions(-) + +diff --git a/src/kprop/kprop.c b/src/kprop/kprop.c +index 0b53aae7e..5adb4d31f 100644 +--- a/src/kprop/kprop.c ++++ b/src/kprop/kprop.c +@@ -25,6 +25,7 @@ + */ + + #include "k5-int.h" ++#include + #include + #include + #include +@@ -71,11 +72,11 @@ static void open_connection(krb5_context context, char *host, int *fd_out); + static void kerberos_authenticate(krb5_context context, + krb5_auth_context *auth_context, int fd, + krb5_principal me, krb5_creds **new_creds); +-static int open_database(krb5_context context, char *data_fn, int *size); ++static int open_database(krb5_context context, char *data_fn, off_t *size); + static void close_database(krb5_context context, int fd); + static void xmit_database(krb5_context context, + krb5_auth_context auth_context, krb5_creds *my_creds, +- int fd, int database_fd, int in_database_size); ++ int fd, int database_fd, off_t in_database_size); + static void send_error(krb5_context context, krb5_creds *my_creds, int fd, + char *err_text, krb5_error_code err_code); + static void update_last_prop_file(char *hostname, char *file_name); +@@ -90,7 +91,8 @@ static void usage() + int + main(int argc, char **argv) + { +- int fd, database_fd, database_size; ++ int fd, database_fd; ++ off_t database_size; + krb5_error_code retval; + krb5_context context; + krb5_creds *my_creds; +@@ -339,7 +341,7 @@ kerberos_authenticate(krb5_context context, krb5_auth_context *auth_context, + * in the size of the database file. + */ + static int +-open_database(krb5_context context, char *data_fn, int *size) ++open_database(krb5_context context, char *data_fn, off_t *size) + { + struct stat stbuf, stbuf_ok; + char *data_ok_fn; +@@ -413,19 +415,18 @@ close_database(krb5_context context, int fd) + static void + xmit_database(krb5_context context, krb5_auth_context auth_context, + krb5_creds *my_creds, int fd, int database_fd, +- int in_database_size) ++ off_t in_database_size) + { + krb5_int32 n; + krb5_data inbuf, outbuf; +- char buf[KPROP_BUFSIZ]; ++ char buf[KPROP_BUFSIZ], dbsize_buf[KPROP_DBSIZE_MAX_BUFSIZ]; + krb5_error_code retval; + krb5_error *error; +- krb5_ui_4 database_size = in_database_size, send_size, sent_size; ++ uint64_t database_size = in_database_size, send_size, sent_size; + + /* Send over the size. */ +- send_size = htonl(database_size); +- inbuf.data = (char *)&send_size; +- inbuf.length = sizeof(send_size); /* must be 4, really */ ++ inbuf = make_data(dbsize_buf, sizeof(dbsize_buf)); ++ encode_database_size(database_size, &inbuf); + /* KPROP_CKSUMTYPE */ + retval = krb5_mk_safe(context, auth_context, &inbuf, &outbuf, NULL); + if (retval) { +@@ -460,7 +461,7 @@ xmit_database(krb5_context context, krb5_auth_context auth_context, + retval = krb5_mk_priv(context, auth_context, &inbuf, &outbuf, NULL); + if (retval) { + snprintf(buf, sizeof(buf), +- "while encoding database block starting at %d", ++ "while encoding database block starting at %"PRIu64, + sent_size); + com_err(progname, retval, "%s", buf); + send_error(context, my_creds, fd, buf, retval); +@@ -471,14 +472,14 @@ xmit_database(krb5_context context, krb5_auth_context auth_context, + if (retval) { + krb5_free_data_contents(context, &outbuf); + com_err(progname, retval, +- _("while sending database block starting at %d"), ++ _("while sending database block starting at %"PRIu64), + sent_size); + exit(1); + } + krb5_free_data_contents(context, &outbuf); + sent_size += n; + if (debug) +- printf("%d bytes sent.\n", sent_size); ++ printf("%"PRIu64" bytes sent.\n", sent_size); + } + if (sent_size != database_size) { + com_err(progname, 0, _("Premature EOF found for database file!")); +@@ -533,10 +534,14 @@ xmit_database(krb5_context context, krb5_auth_context auth_context, + exit(1); + } + +- memcpy(&send_size, outbuf.data, sizeof(send_size)); +- send_size = ntohl(send_size); ++ retval = decode_database_size(&outbuf, &send_size); ++ if (retval) { ++ com_err(progname, retval, _("malformed sent database size message")); ++ exit(1); ++ } + if (send_size != database_size) { +- com_err(progname, 0, _("Kpropd sent database size %d, expecting %d"), ++ com_err(progname, 0, _("Kpropd sent database size %"PRIu64 ++ ", expecting %"PRIu64), + send_size, database_size); + exit(1); + } +diff --git a/src/kprop/kprop.h b/src/kprop/kprop.h +index 75331cc8a..3a319b535 100644 +--- a/src/kprop/kprop.h ++++ b/src/kprop/kprop.h +@@ -32,6 +32,7 @@ + #define KPROP_PROT_VERSION "kprop5_01" + + #define KPROP_BUFSIZ 32768 ++#define KPROP_DBSIZE_MAX_BUFSIZ 12 /* max length of an encoded DB size */ + + /* pathnames are in osconf.h, included via k5-int.h */ + +@@ -41,3 +42,14 @@ int sockaddr2krbaddr(krb5_context context, int family, struct sockaddr *sa, + krb5_error_code + sn2princ_realm(krb5_context context, const char *hostname, const char *sname, + const char *realm, krb5_principal *princ_out); ++ ++/* ++ * Encode size in four bytes (for backward compatibility) if it fits; otherwise ++ * use the larger encoding. buf must be allocated with at least ++ * KPROP_DBSIZE_MAX_BUFSIZ bytes. ++ */ ++void encode_database_size(uint64_t size, krb5_data *buf); ++ ++/* Decode a database size. Return KRB5KRB_ERR_GENERIC if buf has an invalid ++ * length or did not encode a 32-bit size compactly. */ ++krb5_error_code decode_database_size(const krb5_data *buf, uint64_t *size_out); +diff --git a/src/kprop/kprop_util.c b/src/kprop/kprop_util.c +index c32d174b9..9d6b25389 100644 +--- a/src/kprop/kprop_util.c ++++ b/src/kprop/kprop_util.c +@@ -96,3 +96,45 @@ sn2princ_realm(krb5_context context, const char *hostname, const char *sname, + (*princ_out)->type = KRB5_NT_SRV_HST; + return ret; + } ++ ++void ++encode_database_size(uint64_t size, krb5_data *buf) ++{ ++ assert(buf->length >= 12); ++ if (size > 0 && size <= UINT32_MAX) { ++ /* Encode in 32 bits for backward compatibility. */ ++ store_32_be(size, buf->data); ++ buf->length = 4; ++ } else { ++ /* Set the first 32 bits to 0 and encode in the following 64 bits. */ ++ store_32_be(0, buf->data); ++ store_64_be(size, buf->data + 4); ++ buf->length = 12; ++ } ++} ++ ++krb5_error_code ++decode_database_size(const krb5_data *buf, uint64_t *size_out) ++{ ++ uint64_t size; ++ ++ if (buf->length == 12) { ++ /* A 12-byte buffer must have the first four bytes zeroed. */ ++ if (load_32_be(buf->data) != 0) ++ return KRB5KRB_ERR_GENERIC; ++ ++ /* The size is stored in the next 64 bits. Values from 1..2^32-1 must ++ * be encoded in four bytes. */ ++ size = load_64_be(buf->data + 4); ++ if (size > 0 && size <= UINT32_MAX) ++ return KRB5KRB_ERR_GENERIC; ++ } else if (buf->length == 4) { ++ size = load_32_be(buf->data); ++ } else { ++ /* Invalid buffer size. */ ++ return KRB5KRB_ERR_GENERIC; ++ } ++ ++ *size_out = size; ++ return 0; ++} +diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c +index 356e3e0e6..a83a86866 100644 +--- a/src/kprop/kpropd.c ++++ b/src/kprop/kpropd.c +@@ -55,6 +55,7 @@ + #include "com_err.h" + #include "fake-addrinfo.h" + ++#include + #include + #include + #include +@@ -1354,9 +1355,10 @@ static void + recv_database(krb5_context context, int fd, int database_fd, + krb5_data *confmsg) + { +- krb5_ui_4 database_size, received_size; ++ uint64_t database_size, received_size; + int n; + char buf[1024]; ++ char dbsize_buf[KPROP_DBSIZE_MAX_BUFSIZ]; + krb5_data inbuf, outbuf; + krb5_error_code retval; + +@@ -1378,10 +1380,17 @@ recv_database(krb5_context context, int fd, int database_fd, + _("while decoding database size from client")); + exit(1); + } +- memcpy(&database_size, outbuf.data, sizeof(database_size)); ++ ++ retval = decode_database_size(&outbuf, &database_size); ++ if (retval) { ++ send_error(context, fd, retval, "malformed database size message"); ++ com_err(progname, retval, ++ _("malformed database size message from client")); ++ exit(1); ++ } ++ + krb5_free_data_contents(context, &inbuf); + krb5_free_data_contents(context, &outbuf); +- database_size = ntohl(database_size); + + /* Initialize the initial vector. */ + retval = krb5_auth_con_initivector(context, auth_context); +@@ -1401,7 +1410,7 @@ recv_database(krb5_context context, int fd, int database_fd, + retval = krb5_read_message(context, &fd, &inbuf); + if (retval) { + snprintf(buf, sizeof(buf), +- "while reading database block starting at offset %d", ++ "while reading database block starting at offset %"PRIu64, + received_size); + com_err(progname, retval, "%s", buf); + send_error(context, fd, retval, buf); +@@ -1412,8 +1421,8 @@ recv_database(krb5_context context, int fd, int database_fd, + retval = krb5_rd_priv(context, auth_context, &inbuf, &outbuf, NULL); + if (retval) { + snprintf(buf, sizeof(buf), +- "while decoding database block starting at offset %d", +- received_size); ++ "while decoding database block starting at offset %" ++ PRIu64, received_size); + com_err(progname, retval, "%s", buf); + send_error(context, fd, retval, buf); + krb5_free_data_contents(context, &inbuf); +@@ -1424,13 +1433,13 @@ recv_database(krb5_context context, int fd, int database_fd, + krb5_free_data_contents(context, &outbuf); + if (n < 0) { + snprintf(buf, sizeof(buf), +- "while writing database block starting at offset %d", ++ "while writing database block starting at offset %"PRIu64, + received_size); + send_error(context, fd, errno, buf); + } else if ((unsigned int)n != outbuf.length) { + snprintf(buf, sizeof(buf), + "incomplete write while writing database block starting " +- "at \noffset %d (%d written, %d expected)", ++ "at \noffset %"PRIu64" (%d written, %d expected)", + received_size, n, outbuf.length); + send_error(context, fd, KRB5KRB_ERR_GENERIC, buf); + } +@@ -1440,7 +1449,8 @@ recv_database(krb5_context context, int fd, int database_fd, + /* OK, we've seen the entire file. Did we get too many bytes? */ + if (received_size > database_size) { + snprintf(buf, sizeof(buf), +- "Received %d bytes, expected %d bytes for database file", ++ "Received %"PRIu64" bytes, expected %"PRIu64 ++ " bytes for database file", + received_size, database_size); + send_error(context, fd, KRB5KRB_ERR_GENERIC, buf); + } +@@ -1450,9 +1460,8 @@ recv_database(krb5_context context, int fd, int database_fd, + + /* Create message acknowledging number of bytes received, but + * don't send it until kdb5_util returns successfully. */ +- database_size = htonl(database_size); +- inbuf.data = (char *)&database_size; +- inbuf.length = sizeof(database_size); ++ inbuf = make_data(dbsize_buf, sizeof(dbsize_buf)); ++ encode_database_size(database_size, &inbuf); + retval = krb5_mk_safe(context,auth_context,&inbuf,confmsg,NULL); + if (retval) { + com_err(progname, retval, "while encoding # of receieved bytes"); +diff --git a/src/tests/t_kprop.py b/src/tests/t_kprop.py +index c33e4fea2..f8ffd653a 100755 +--- a/src/tests/t_kprop.py ++++ b/src/tests/t_kprop.py +@@ -87,5 +87,39 @@ realm.run([kdb5_util, 'dump', dumpfile]) + realm.run([kprop, '-f', dumpfile, '-P', str(realm.kprop_port()), hostname]) + check_output(kpropd) + realm.run([kadminl, 'listprincs'], replica3, expected_msg='wakawaka') ++stop_daemon(kpropd) ++ ++# This test is too resource-intensive to be included in "make check" ++# by default, but it can be enabled in the environment to test the ++# propagation of databases large enough to require a 12-byte encoding ++# of the database size. ++if 'KPROP_LARGE_DB_TEST' in os.environ: ++ output('Generating >4GB dumpfile\n') ++ with open(dumpfile, 'w') as f: ++ f.write('kdb5_util load_dump version 6\n') ++ f.write('princ\t38\t15\t3\t1\t0\tK/M@KRBTEST.COM\t64\t86400\t0\t0\t0' ++ '\t0\t0\t0\t8\t2\t0100\t9\t8\t0100010000000000\t2\t28' ++ '\tb93e105164625f6372656174696f6e404b5242544553542e434f4d00' ++ '\t1\t1\t18\t62\t2000408c027c250e8cc3b81476414f2214d57c1ce' ++ '38891e29792e87258247c73547df4d5756266931dd6686b62270e6568' ++ '95a31ec66bfe913b4f15226227\t-1;\n') ++ for i in range(1, 20000000): ++ f.write('princ\t38\t21\t1\t1\t0\tp%08d@KRBTEST.COM' % i) ++ f.write('\t0\t86400\t0\t0\t0\t0\t0\t0\t2\t27' ++ '\td73e1051757365722f61646d696e404b5242544553542e434f4d00' ++ '\t1\t1\t17\t46' ++ '\t10009c8ab7b3f89ccf3ca3ad98352a461b7f4f1b0c49' ++ '5605117591d9ad52ba4da0adef7a902126973ed2bdc3ffbf\t-1;\n') ++ assert os.path.getsize(dumpfile) > 4 * 1024 * 1024 * 1024 ++ with open(dumpfile + '.dump_ok', 'w') as f: ++ f.write('\0') ++ conf_large = {'dbmodules': {'db': {'database_name': '$testdir/db.large'}}, ++ 'realms': {'$realm': {'iprop_resync_timeout': '3600'}}} ++ large = realm.special_env('large', True, kdc_conf=conf_large) ++ kpropd = realm.start_kpropd(large, ['-d']) ++ realm.run([kprop, '-f', dumpfile, '-P', str(realm.kprop_port()), hostname]) ++ check_output(kpropd) ++ realm.run([kadminl, 'getprinc', 'p19999999'], env=large, ++ expected_msg='Principal: p19999999') + + success('kprop tests') +-- +2.35.1 + diff --git a/SOURCES/Try-harder-to-avoid-password-change-replay-errors.patch b/SOURCES/Try-harder-to-avoid-password-change-replay-errors.patch new file mode 100644 index 0000000..382559f --- /dev/null +++ b/SOURCES/Try-harder-to-avoid-password-change-replay-errors.patch @@ -0,0 +1,91 @@ +From 6b4cdaac48e6b736b66ccc21f4eed7c6fc4c2e4a Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Fri, 4 Mar 2022 00:45:00 -0500 +Subject: [PATCH] Try harder to avoid password change replay errors + +Commit d7b3018d338fc9c989c3fa17505870f23c3759a8 (ticket 7905) changed +change_set_password() to prefer TCP. However, because UDP_LAST falls +back to UDP after one second, we can still get a replay error due to a +dropped packet, before the TCP layer has a chance to retry. + +Instead, try k5_sendto() with NO_UDP, and only fall back to UDP after +TCP fails completely without reaching a server. In sendto_kdc.c, +implement an ONLY_UDP transport strategy to allow the UDP fallback. + +ticket: 9037 +--- + src/lib/krb5/os/changepw.c | 9 ++++++++- + src/lib/krb5/os/os-proto.h | 1 + + src/lib/krb5/os/sendto_kdc.c | 12 ++++++++---- + 3 files changed, 17 insertions(+), 5 deletions(-) + +diff --git a/src/lib/krb5/os/changepw.c b/src/lib/krb5/os/changepw.c +index 9f968da7f..c59232586 100644 +--- a/src/lib/krb5/os/changepw.c ++++ b/src/lib/krb5/os/changepw.c +@@ -255,9 +255,16 @@ change_set_password(krb5_context context, + callback_info.pfn_cleanup = kpasswd_sendto_msg_cleanup; + krb5_free_data_contents(callback_ctx.context, &chpw_rep); + ++ /* UDP retransmits may be seen as replays. Only try UDP after other ++ * transports fail completely. */ + code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm, +- &sl, UDP_LAST, &callback_info, &chpw_rep, ++ &sl, NO_UDP, &callback_info, &chpw_rep, + ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL); ++ if (code == KRB5_KDC_UNREACH) { ++ code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm, ++ &sl, ONLY_UDP, &callback_info, &chpw_rep, ++ ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL); ++ } + if (code) + goto cleanup; + +diff --git a/src/lib/krb5/os/os-proto.h b/src/lib/krb5/os/os-proto.h +index a16a34b74..ad3839131 100644 +--- a/src/lib/krb5/os/os-proto.h ++++ b/src/lib/krb5/os/os-proto.h +@@ -49,6 +49,7 @@ typedef enum { + UDP_FIRST = 0, + UDP_LAST, + NO_UDP, ++ ONLY_UDP + } k5_transport_strategy; + + /* A single server hostname or address. */ +diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c +index 82523c561..d76e24ccf 100644 +--- a/src/lib/krb5/os/sendto_kdc.c ++++ b/src/lib/krb5/os/sendto_kdc.c +@@ -799,11 +799,14 @@ resolve_server(krb5_context context, const krb5_data *realm, + int err, result; + char portbuf[PORT_LENGTH]; + +- /* Skip UDP entries if we don't want UDP. */ ++ /* Skip entries excluded by the strategy. */ + if (strategy == NO_UDP && entry->transport == UDP) + return 0; ++ if (strategy == ONLY_UDP && entry->transport != UDP && ++ entry->transport != TCP_OR_UDP) ++ return 0; + +- transport = (strategy == UDP_FIRST) ? UDP : TCP; ++ transport = (strategy == UDP_FIRST || strategy == ONLY_UDP) ? UDP : TCP; + if (entry->hostname == NULL) { + /* Added by a module, so transport is either TCP or UDP. */ + ai.ai_socktype = socktype_for_transport(entry->transport); +@@ -847,8 +850,9 @@ resolve_server(krb5_context context, const krb5_data *realm, + } + + /* For TCP_OR_UDP entries, add each address again with the non-preferred +- * transport, unless we are avoiding UDP. Flag these as deferred. */ +- if (retval == 0 && entry->transport == TCP_OR_UDP && strategy != NO_UDP) { ++ * transport, if there is one. Flag these as deferred. */ ++ if (retval == 0 && entry->transport == TCP_OR_UDP && ++ (strategy == UDP_FIRST || strategy == UDP_LAST)) { + transport = (strategy == UDP_FIRST) ? TCP : UDP; + for (a = addrs; a != 0 && retval == 0; a = a->ai_next) { + a->ai_socktype = socktype_for_transport(transport); +-- +2.35.1 + diff --git a/SOURCES/downstream-Fix-dejagnu-unit-tests-directory-name-for-RPC-lib.patch b/SOURCES/downstream-Fix-dejagnu-unit-tests-directory-name-for-RPC-lib.patch new file mode 100644 index 0000000..7028373 --- /dev/null +++ b/SOURCES/downstream-Fix-dejagnu-unit-tests-directory-name-for-RPC-lib.patch @@ -0,0 +1,156 @@ +From 10b32480395a01798b21818e884a593930b400d1 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Wed, 27 Apr 2022 15:29:08 +0200 +Subject: [PATCH] Fix dejagnu unit tests directory name for RPC lib + +This commit renames RPC library's unit tests directory to match the +newly enforced naming convention of dejagnu. + +Resolves: rhbz#2070879 + +Signed-off-by: Julien Rische +--- + src/configure.ac | 2 +- + src/lib/rpc/Makefile.in | 2 +- + src/lib/rpc/{unit-test => testsuite}/Makefile.in | 10 +++++----- + src/lib/rpc/{unit-test => testsuite}/client.c | 0 + src/lib/rpc/{unit-test => testsuite}/config/unix.exp | 0 + src/lib/rpc/{unit-test => testsuite}/deps | 0 + src/lib/rpc/{unit-test => testsuite}/lib/helpers.exp | 0 + .../rpc/{unit-test => testsuite}/rpc_test.0/expire.exp | 0 + .../{unit-test => testsuite}/rpc_test.0/fullrun.exp | 0 + .../rpc/{unit-test => testsuite}/rpc_test.0/gsserr.exp | 0 + src/lib/rpc/{unit-test => testsuite}/rpc_test.h | 0 + src/lib/rpc/{unit-test => testsuite}/rpc_test.x | 0 + src/lib/rpc/{unit-test => testsuite}/rpc_test_clnt.c | 0 + src/lib/rpc/{unit-test => testsuite}/rpc_test_svc.c | 0 + src/lib/rpc/{unit-test => testsuite}/server.c | 0 + 15 files changed, 7 insertions(+), 7 deletions(-) + rename src/lib/rpc/{unit-test => testsuite}/Makefile.in (93%) + rename src/lib/rpc/{unit-test => testsuite}/client.c (100%) + rename src/lib/rpc/{unit-test => testsuite}/config/unix.exp (100%) + rename src/lib/rpc/{unit-test => testsuite}/deps (100%) + rename src/lib/rpc/{unit-test => testsuite}/lib/helpers.exp (100%) + rename src/lib/rpc/{unit-test => testsuite}/rpc_test.0/expire.exp (100%) + rename src/lib/rpc/{unit-test => testsuite}/rpc_test.0/fullrun.exp (100%) + rename src/lib/rpc/{unit-test => testsuite}/rpc_test.0/gsserr.exp (100%) + rename src/lib/rpc/{unit-test => testsuite}/rpc_test.h (100%) + rename src/lib/rpc/{unit-test => testsuite}/rpc_test.x (100%) + rename src/lib/rpc/{unit-test => testsuite}/rpc_test_clnt.c (100%) + rename src/lib/rpc/{unit-test => testsuite}/rpc_test_svc.c (100%) + rename src/lib/rpc/{unit-test => testsuite}/server.c (100%) + +diff --git a/src/configure.ac b/src/configure.ac +index 37e36b76d..2a48aa83d 100644 +--- a/src/configure.ac ++++ b/src/configure.ac +@@ -1497,7 +1497,7 @@ V5_AC_OUTPUT_MAKEFILE(. + lib/gssapi lib/gssapi/generic lib/gssapi/krb5 lib/gssapi/spnego + lib/gssapi/mechglue + +- lib/rpc lib/rpc/unit-test ++ lib/rpc lib/rpc/testsuite + + lib/kadm5 lib/kadm5/clnt lib/kadm5/srv lib/kadm5/testsuite + lib/krad +diff --git a/src/lib/rpc/Makefile.in b/src/lib/rpc/Makefile.in +index 6b5f1e70a..78c7a1326 100644 +--- a/src/lib/rpc/Makefile.in ++++ b/src/lib/rpc/Makefile.in +@@ -2,7 +2,7 @@ mydir=lib$(S)rpc + BUILDTOP=$(REL)..$(S).. + DEFINES = -DGSSAPI_KRB5 -DDEBUG_GSSAPI=0 -DGSSRPC__IMPL + +-SUBDIRS=unit-test ++SUBDIRS=testsuite + + ##DOSBUILDTOP = ..\.. + ##DOSLIBNAME=libgssrpc.lib +diff --git a/src/lib/rpc/unit-test/Makefile.in b/src/lib/rpc/testsuite/Makefile.in +similarity index 93% +rename from src/lib/rpc/unit-test/Makefile.in +rename to src/lib/rpc/testsuite/Makefile.in +index 0b6e5203d..0fab26c10 100644 +--- a/src/lib/rpc/unit-test/Makefile.in ++++ b/src/lib/rpc/testsuite/Makefile.in +@@ -1,4 +1,4 @@ +-mydir=lib$(S)rpc$(S)unit-test ++mydir=lib$(S)rpc$(S)testsuite + BUILDTOP=$(REL)..$(S)..$(S).. + + OBJS= client.o rpc_test_clnt.o rpc_test_svc.o server.o +@@ -34,19 +34,19 @@ runenv.exp: Makefile + # rm -f rpc_test.h rpc_test_clnt.c rpc_test_svc.c + # + +-check unit-test: unit-test-@DO_TEST@ ++check testsuite: testsuite-@DO_TEST@ + +-unit-test-: ++testsuite-: + @echo "+++" + @echo "+++ WARNING: lib/rpc unit tests not run." + @echo "+++ Either tcl, runtest, or Perl is unavailable." + @echo "+++" + @echo 'Skipped rpc tests: runtest or Perl not found' >> $(SKIPTESTS) + +-unit-test-ok: unit-test-body ++testsuite-ok: testsuite-body + + PASS=@PASS@ +-unit-test-body: runenv.sh runenv.exp ++testsuite-body: runenv.sh runenv.exp + $(RM) krb5cc_rpc_test_* + $(ENV_SETUP) $(VALGRIND) $(START_SERVERS) + RPC_TEST_KEYTAB=/tmp/rpc_test_keytab.$$$$ ; export RPC_TEST_KEYTAB ; \ +diff --git a/src/lib/rpc/unit-test/client.c b/src/lib/rpc/testsuite/client.c +similarity index 100% +rename from src/lib/rpc/unit-test/client.c +rename to src/lib/rpc/testsuite/client.c +diff --git a/src/lib/rpc/unit-test/config/unix.exp b/src/lib/rpc/testsuite/config/unix.exp +similarity index 100% +rename from src/lib/rpc/unit-test/config/unix.exp +rename to src/lib/rpc/testsuite/config/unix.exp +diff --git a/src/lib/rpc/unit-test/deps b/src/lib/rpc/testsuite/deps +similarity index 100% +rename from src/lib/rpc/unit-test/deps +rename to src/lib/rpc/testsuite/deps +diff --git a/src/lib/rpc/unit-test/lib/helpers.exp b/src/lib/rpc/testsuite/lib/helpers.exp +similarity index 100% +rename from src/lib/rpc/unit-test/lib/helpers.exp +rename to src/lib/rpc/testsuite/lib/helpers.exp +diff --git a/src/lib/rpc/unit-test/rpc_test.0/expire.exp b/src/lib/rpc/testsuite/rpc_test.0/expire.exp +similarity index 100% +rename from src/lib/rpc/unit-test/rpc_test.0/expire.exp +rename to src/lib/rpc/testsuite/rpc_test.0/expire.exp +diff --git a/src/lib/rpc/unit-test/rpc_test.0/fullrun.exp b/src/lib/rpc/testsuite/rpc_test.0/fullrun.exp +similarity index 100% +rename from src/lib/rpc/unit-test/rpc_test.0/fullrun.exp +rename to src/lib/rpc/testsuite/rpc_test.0/fullrun.exp +diff --git a/src/lib/rpc/unit-test/rpc_test.0/gsserr.exp b/src/lib/rpc/testsuite/rpc_test.0/gsserr.exp +similarity index 100% +rename from src/lib/rpc/unit-test/rpc_test.0/gsserr.exp +rename to src/lib/rpc/testsuite/rpc_test.0/gsserr.exp +diff --git a/src/lib/rpc/unit-test/rpc_test.h b/src/lib/rpc/testsuite/rpc_test.h +similarity index 100% +rename from src/lib/rpc/unit-test/rpc_test.h +rename to src/lib/rpc/testsuite/rpc_test.h +diff --git a/src/lib/rpc/unit-test/rpc_test.x b/src/lib/rpc/testsuite/rpc_test.x +similarity index 100% +rename from src/lib/rpc/unit-test/rpc_test.x +rename to src/lib/rpc/testsuite/rpc_test.x +diff --git a/src/lib/rpc/unit-test/rpc_test_clnt.c b/src/lib/rpc/testsuite/rpc_test_clnt.c +similarity index 100% +rename from src/lib/rpc/unit-test/rpc_test_clnt.c +rename to src/lib/rpc/testsuite/rpc_test_clnt.c +diff --git a/src/lib/rpc/unit-test/rpc_test_svc.c b/src/lib/rpc/testsuite/rpc_test_svc.c +similarity index 100% +rename from src/lib/rpc/unit-test/rpc_test_svc.c +rename to src/lib/rpc/testsuite/rpc_test_svc.c +diff --git a/src/lib/rpc/unit-test/server.c b/src/lib/rpc/testsuite/server.c +similarity index 100% +rename from src/lib/rpc/unit-test/server.c +rename to src/lib/rpc/testsuite/server.c +-- +2.35.1 + diff --git a/SPECS/krb5.spec b/SPECS/krb5.spec index d969a61..895f9d3 100644 --- a/SPECS/krb5.spec +++ b/SPECS/krb5.spec @@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.18.2 # for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces) -Release: 17%{?dist} +Release: 20%{?dist} # lookaside-cached sources; two downloads and a build artifact Source0: https://web.mit.edu/kerberos/dist/krb5/1.18/krb5-%{version}%{prerelease}.tar.gz @@ -88,6 +88,9 @@ Patch142: Fix-KDC-null-deref-on-bad-encrypted-challenge.patch Patch143: Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch Patch144: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch Patch145: downstream-Use-newly-enforced-dejagnu-path-naming-convention.patch +Patch146: Make-kprop-work-for-dump-files-larger-than-4GB.patch +Patch147: Try-harder-to-avoid-password-change-replay-errors.patch +Patch148: downstream-Fix-dejagnu-unit-tests-directory-name-for-RPC-lib.patch License: MIT URL: http://web.mit.edu/kerberos/www/ @@ -698,6 +701,14 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Wed Apr 27 2022 Julien Rische - 1.18.2-19 +- Try harder to avoid password change replay errors +- Resolves: #2077563 + +* Wed Apr 13 2022 Julien Rische - 1.18.2-18 +- Fix kprop for propagating dump files larger than 4GB +- Resolves: #2026462 + * Mon Mar 21 2022 Julien Rische - 1.18.2-15 - Backport usage of SHA-256 instead of SHA-1 for PKINIT CMS digest - Resolves: #2066316