diff --git a/srcpkgs/libsasl/patches/0010_maintainer_mode.patch b/srcpkgs/libsasl/patches/0010_maintainer_mode.patch new file mode 100644 index 00000000000..cf3d02a08cb --- /dev/null +++ b/srcpkgs/libsasl/patches/0010_maintainer_mode.patch @@ -0,0 +1,19 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 0010_maintainer_mode.dpatch by +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Enable maintainer mode to avoid auto* problems. + +@DPATCH@ +diff -urNad trunk~/configure.in trunk/configure.in +--- trunk~/configure.in 2006-05-29 22:52:46.000000000 +0300 ++++ trunk/configure.in 2006-11-01 23:24:55.000000000 +0200 +@@ -62,6 +62,8 @@ + AM_INIT_AUTOMAKE(cyrus-sasl, 2.1.22) + CMU_INIT_AUTOMAKE + ++AM_MAINTAINER_MODE ++ + # and include our config dir scripts + ACLOCAL="$ACLOCAL -I \$(top_srcdir)/config" + diff --git a/srcpkgs/libsasl/patches/0011_saslauthd_ac_prog_libtool.patch b/srcpkgs/libsasl/patches/0011_saslauthd_ac_prog_libtool.patch new file mode 100644 index 00000000000..3805b4857c8 --- /dev/null +++ b/srcpkgs/libsasl/patches/0011_saslauthd_ac_prog_libtool.patch @@ -0,0 +1,15 @@ +0011_saslauthd_ac_prog_libtool.dpatch by + +Enable libtool use. + +diff -urNad trunk~/saslauthd/configure.in trunk/saslauthd/configure.in +--- trunk~/saslauthd/configure.in 2006-05-29 22:52:42.000000000 +0300 ++++ trunk/saslauthd/configure.in 2006-11-01 23:41:51.000000000 +0200 +@@ -25,6 +25,7 @@ + AC_PROG_MAKE_SET + AC_PROG_LN_S + AC_PROG_INSTALL ++AC_PROG_LIBTOOL + + dnl Checks for build foo + CMU_C___ATTRIBUTE__ diff --git a/srcpkgs/libsasl/patches/0025_ld_as_needed.patch b/srcpkgs/libsasl/patches/0025_ld_as_needed.patch new file mode 100644 index 00000000000..67b48b4a499 --- /dev/null +++ b/srcpkgs/libsasl/patches/0025_ld_as_needed.patch @@ -0,0 +1,27 @@ +Author: Matthias Klose +Desription: Fix FTBFS, add $(SASL_DB_LIB) as dependency to libsasldb, and use +it. +--- a/saslauthd/Makefile.am ++++ b/saslauthd/Makefile.am +@@ -16,7 +16,7 @@ EXTRA_saslauthd_sources = getaddrinfo.c + saslauthd_DEPENDENCIES = saslauthd-main.o @LTLIBOBJS@ + saslauthd_LDADD = @SASL_KRB_LIB@ \ + @GSSAPIBASE_LIBS@ @GSSAPI_LIBS@ @LIB_CRYPT@ @LIB_SIA@ \ +- @LIB_SOCKET@ @SASL_DB_LIB@ @LIB_PAM@ @LDAP_LIBS@ @LTLIBOBJS@ ++ @LIB_SOCKET@ ../sasldb/libsasldb.la @LIB_PAM@ @LDAP_LIBS@ @LTLIBOBJS@ + + testsaslauthd_SOURCES = testsaslauthd.c utils.c + testsaslauthd_LDADD = @LIB_SOCKET@ +--- a/sasldb/Makefile.am ++++ b/sasldb/Makefile.am +@@ -55,8 +55,8 @@ noinst_LIBRARIES = libsasldb.a + + libsasldb_la_SOURCES = allockey.c sasldb.h + EXTRA_libsasldb_la_SOURCES = $(extra_common_sources) +-libsasldb_la_DEPENDENCIES = $(SASL_DB_BACKEND) +-libsasldb_la_LIBADD = $(SASL_DB_BACKEND) ++libsasldb_la_DEPENDENCIES = $(SASL_DB_BACKEND) $(SASL_DB_LIB) ++libsasldb_la_LIBADD = $(SASL_DB_BACKEND) $(SASL_DB_LIB) + + # Prevent make dist stupidity + libsasldb_a_SOURCES = diff --git a/srcpkgs/libsasl/patches/0026_drop_krb5support_dependency.patch b/srcpkgs/libsasl/patches/0026_drop_krb5support_dependency.patch new file mode 100644 index 00000000000..cc00867ef04 --- /dev/null +++ b/srcpkgs/libsasl/patches/0026_drop_krb5support_dependency.patch @@ -0,0 +1,14 @@ +Author: Roberto C. Sanchez +Description: Drop gratuitous dependency on krb5support +--- a/cmulocal/sasl2.m4 ++++ b/cmulocal/sasl2.m4 +@@ -112,9 +112,6 @@ if test "$gssapi" != no; then + fi + + if test "$gss_impl" = "auto" -o "$gss_impl" = "mit"; then +- # check for libkrb5support first +- AC_CHECK_LIB(krb5support,krb5int_getspecific,K5SUP=-lkrb5support K5SUPSTATIC=$gssapi_dir/libkrb5support.a,,${LIB_SOCKET}) +- + gss_failed=0 + AC_CHECK_LIB(gssapi_krb5,gss_unwrap,gss_impl="mit",gss_failed=1, + ${GSSAPIBASE_LIBS} -lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err ${K5SUP} ${LIB_SOCKET}) diff --git a/srcpkgs/libsasl/patches/0030-dont_use_la_files_for_opening_plugins.patch b/srcpkgs/libsasl/patches/0030-dont_use_la_files_for_opening_plugins.patch index c815789026b..14a322496ea 100644 --- a/srcpkgs/libsasl/patches/0030-dont_use_la_files_for_opening_plugins.patch +++ b/srcpkgs/libsasl/patches/0030-dont_use_la_files_for_opening_plugins.patch @@ -1,5 +1,5 @@ ---- lib/dlopen.c -+++ lib/dlopen.c +--- a/lib/dlopen.c ++++ b/lib/dlopen.c @@ -247,105 +247,6 @@ static int _sasl_plugin_load(char *plugi return result; } diff --git a/srcpkgs/libsasl/patches/CVE-2013-4122.patch b/srcpkgs/libsasl/patches/CVE-2013-4122.patch new file mode 100644 index 00000000000..d6b9800e669 --- /dev/null +++ b/srcpkgs/libsasl/patches/CVE-2013-4122.patch @@ -0,0 +1,116 @@ +From dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d Mon Sep 17 00:00:00 2001 +From: mancha +Date: Thu, 11 Jul 2013 09:08:07 +0000 +Subject: Handle NULL returns from glibc 2.17+ crypt() + +Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL +(w/ NULL return) if the salt violates specifications. Additionally, +on FIPS-140 enabled Linux systems, DES/MD5-encrypted passwords +passed to crypt() fail with EPERM (w/ NULL return). + +When using glibc's crypt(), check return value to avoid a possible +NULL pointer dereference. + +Patch by mancha1@hush.com. +--- +diff --git a/pwcheck/pwcheck_getpwnam.c b/pwcheck/pwcheck_getpwnam.c +index 4b34222..400289c 100644 +--- a/pwcheck/pwcheck_getpwnam.c ++++ b/pwcheck/pwcheck_getpwnam.c +@@ -32,6 +32,7 @@ char *userid; + char *password; + { + char* r; ++ char* crpt_passwd; + struct passwd *pwd; + + pwd = getpwnam(userid); +@@ -41,7 +42,7 @@ char *password; + else if (pwd->pw_passwd[0] == '*') { + r = "Account disabled"; + } +- else if (strcmp(pwd->pw_passwd, crypt(password, pwd->pw_passwd)) != 0) { ++ else if (!(crpt_passwd = crypt(password, pwd->pw_passwd)) || strcmp(pwd->pw_passwd, (const char *)crpt_passwd) != 0) { + r = "Incorrect password"; + } + else { +diff --git a/pwcheck/pwcheck_getspnam.c b/pwcheck/pwcheck_getspnam.c +index 2b11286..6d607bb 100644 +--- a/pwcheck/pwcheck_getspnam.c ++++ b/pwcheck/pwcheck_getspnam.c +@@ -32,13 +32,15 @@ char *userid; + char *password; + { + struct spwd *pwd; ++ char *crpt_passwd; + + pwd = getspnam(userid); + if (!pwd) { + return "Userid not found"; + } + +- if (strcmp(pwd->sp_pwdp, crypt(password, pwd->sp_pwdp)) != 0) { ++ crpt_passwd = crypt(password, pwd->sp_pwdp); ++ if (!crpt_passwd || strcmp(pwd->sp_pwdp, (const char *)crpt_passwd) != 0) { + return "Incorrect password"; + } + else { +diff --git a/saslauthd/auth_getpwent.c b/saslauthd/auth_getpwent.c +index fc8029d..d4ebe54 100644 +--- a/saslauthd/auth_getpwent.c ++++ b/saslauthd/auth_getpwent.c +@@ -77,6 +77,7 @@ auth_getpwent ( + { + /* VARIABLES */ + struct passwd *pw; /* pointer to passwd file entry */ ++ char *crpt_passwd; /* encrypted password */ + int errnum; + /* END VARIABLES */ + +@@ -105,7 +106,8 @@ auth_getpwent ( + } + } + +- if (strcmp(pw->pw_passwd, (const char *)crypt(password, pw->pw_passwd))) { ++ crpt_passwd = crypt(password, pw->pw_passwd); ++ if (!crpt_passwd || strcmp(pw->pw_passwd, (const char *)crpt_passwd)) { + if (flags & VERBOSE) { + syslog(LOG_DEBUG, "DEBUG: auth_getpwent: %s: invalid password", login); + } +diff --git a/saslauthd/auth_shadow.c b/saslauthd/auth_shadow.c +index 677131b..1988afd 100644 +--- a/saslauthd/auth_shadow.c ++++ b/saslauthd/auth_shadow.c +@@ -210,8 +210,8 @@ auth_shadow ( + RETURN("NO Insufficient permission to access NIS authentication database (saslauthd)"); + } + +- cpw = strdup((const char *)crypt(password, sp->sp_pwdp)); +- if (strcmp(sp->sp_pwdp, cpw)) { ++ cpw = crypt(password, sp->sp_pwdp); ++ if (!cpw || strcmp(sp->sp_pwdp, (const char *)cpw)) { + if (flags & VERBOSE) { + /* + * This _should_ reveal the SHADOW_PW_LOCKED prefix to an +@@ -221,10 +221,8 @@ auth_shadow ( + syslog(LOG_DEBUG, "DEBUG: auth_shadow: pw mismatch: '%s' != '%s'", + sp->sp_pwdp, cpw); + } +- free(cpw); + RETURN("NO Incorrect password"); + } +- free(cpw); + + /* + * The following fields will be set to -1 if: +@@ -286,7 +284,7 @@ auth_shadow ( + RETURN("NO Invalid username"); + } + +- if (strcmp(upw->upw_passwd, crypt(password, upw->upw_passwd)) != 0) { ++ if (!(cpw = crypt(password, upw->upw_passwd)) || (strcmp(upw->upw_passwd, (const char *)cpw) != 0)) { + if (flags & VERBOSE) { + syslog(LOG_DEBUG, "auth_shadow: pw mismatch: %s != %s", + password, upw->upw_passwd); +-- +cgit v0.9.2 diff --git a/srcpkgs/libsasl/patches/cross-makemd5.patch b/srcpkgs/libsasl/patches/cross-makemd5.patch index c3f6390400c..21d2c608589 100644 --- a/srcpkgs/libsasl/patches/cross-makemd5.patch +++ b/srcpkgs/libsasl/patches/cross-makemd5.patch @@ -1,23 +1,11 @@ ---- include/Makefile.in.orig 2013-05-05 11:00:08.859341666 +0200 -+++ include/Makefile.in 2013-05-05 11:01:00.041995963 +0200 -@@ -113,14 +113,14 @@ DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top - depcomp = $(SHELL) $(top_srcdir)/config/depcomp - am__depfiles_maybe = depfiles - am__mv = mv -f --COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ -- $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -+COMPILE = cc $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ -+ $(CPPFLAGS) $(AM_CFLAGS) $(HOSTCFLAGS) - LTCOMPILE = $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ -- --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \ -- $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) --CCLD = $(CC) -+ --mode=compile cc $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \ -+ $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(HOSTCFLAGS) -+CCLD = cc - LINK = $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link \ -- $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) $(LDFLAGS) -o $@ -+ $(CCLD) $(AM_CFLAGS) $(HOSTCFLAGS) $(AM_LDFLAGS) -o $@ - SOURCES = $(makemd5_SOURCES) - DIST_SOURCES = $(makemd5_SOURCES) - am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; +--- a/include/Makefile.am.orig 2014-07-25 16:11:53.760645554 +0200 ++++ b/include/Makefile.am 2014-07-25 16:12:05.961050991 +0200 +@@ -49,6 +49,8 @@ saslinclude_HEADERS = hmac-md5.h md5.h m + + noinst_PROGRAMS = makemd5 + ++CC = cc ++CFLAGS = -O2 + makemd5_SOURCES = makemd5.c + + md5global.h: makemd5 diff --git a/srcpkgs/libsasl/patches/cyrus-sasl-2.1.22-qa.patch b/srcpkgs/libsasl/patches/cyrus-sasl-2.1.22-qa.patch new file mode 100644 index 00000000000..4f7b04f135a --- /dev/null +++ b/srcpkgs/libsasl/patches/cyrus-sasl-2.1.22-qa.patch @@ -0,0 +1,22 @@ +fix missing prototype warnings + +--- cyrus-sasl-2.1.22/lib/auxprop.c ++++ cyrus-sasl-2.1.22/lib/auxprop.c +@@ -43,6 +43,7 @@ + */ + + #include ++#include + #include + #include + #include +--- cyrus-sasl-2.1.22/pwcheck/pwcheck_getspnam.c ++++ cyrus-sasl-2.1.22/pwcheck/pwcheck_getspnam.c +@@ -24,6 +24,7 @@ OF OR IN CONNECTION WITH THE USE OR PERF + ******************************************************************/ + + #include ++#include + + extern char *crypt(); + diff --git a/srcpkgs/libsasl/patches/cyrus-sasl-2.1.26-size_t.patch b/srcpkgs/libsasl/patches/cyrus-sasl-2.1.26-size_t.patch new file mode 100644 index 00000000000..3a4820f16b8 --- /dev/null +++ b/srcpkgs/libsasl/patches/cyrus-sasl-2.1.26-size_t.patch @@ -0,0 +1,11 @@ +--- cyrus-sasl-2.1.26/include/sasl.h 2012-10-12 09:05:48.000000000 -0500 ++++ cyrus-sasl-2.1.26/include/sasl.h 2013-01-31 13:21:04.007739327 -0600 +@@ -223,6 +223,8 @@ extern "C" { + * they must be called before all other SASL functions: + */ + ++#include ++ + /* memory allocation functions which may optionally be replaced: + */ + typedef void *sasl_malloc_t(size_t); diff --git a/srcpkgs/libsasl/template b/srcpkgs/libsasl/template index fa00df3544c..ae768cf27cd 100644 --- a/srcpkgs/libsasl/template +++ b/srcpkgs/libsasl/template @@ -6,7 +6,9 @@ build_style=gnu-configure configure_args="--enable-cram --enable-digest --enable-auth-sasldb --enable-plain --enable-anon --enable-login --enable-gssapi --enable-ntlm --with-configdir=/etc/sasl2:/etc/sasl:/usr/lib/sasl2 - --with-devrandom=/dev/urandom LDFLAGS=-ldb" + --disable-otp --disable-srp --disable-srp-setpass --disable-krb4 + --with-devrandom=/dev/urandom" +hostmakedepends="automake libtool pkg-config" makedepends="db-devel>=5.3 mit-krb5-devel" wrksrc="cyrus-sasl-${version}" short_desc="Cyrus SASL - runtime shared libraries" @@ -16,8 +18,34 @@ license="BSD" distfiles="ftp://ftp.cyrusimap.org/cyrus-sasl/cyrus-sasl-${version}.tar.gz" checksum=8fbc5136512b59bb793657f36fadda6359cae3b08f01fd16b3d406f1345b7bc3 +patch_args="-Np1" disable_parallel_build=yes +pre_configure() { + # XXX + if [ "$CROSS_BUILD" ]; then + sed 's,AC_TRY_RUN,AC_TRY_LINK_FUNC,' -i cmulocal/sasl2.m4 + fi + rm -f config/config.guess config/config.sub + rm -f config/ltconfig config/ltmain.sh config/libtool.m4 + rm -fr autom4te.cache + libtoolize -c + aclocal -I config -I cmulocal + automake -a -c + autoheader + autoconf + + pushd saslauthd + rm -f config/config.guess config/config.sub + rm -f config/ltconfig config/ltmain.sh config/libtool.m4 + rm -fr autom4te.cache + libtoolize -c + aclocal -I config -I ../cmulocal -I ../config + automake -a -c + autoheader + autoconf + popd +} post_install() { # We are only interested in libsasl. rm -rf ${DESTDIR}/usr/{sbin,share,lib/sasl2}