The package rpms/krb5.git has added or updated architecture specific content in its
spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s):
https://src.fedoraproject.org/cgit/rpms/krb5.git/commit/?id=0f2af40d1e257....
Change:
-%ifarch ppc64le
Thanks.
Full change:
============
commit 0d402dae7fcf08a80b7ea6b7c27f7675a954707e
Author: Robbie Harwood <rharwood(a)redhat.com>
Date: Mon Aug 7 20:42:47 2017 +0000
Display an error message if ocsp pkinit is requested
diff --git a/Remove-incomplete-PKINIT-OCSP-support.patch
b/Remove-incomplete-PKINIT-OCSP-support.patch
new file mode 100644
index 0000000..780353e
--- /dev/null
+++ b/Remove-incomplete-PKINIT-OCSP-support.patch
@@ -0,0 +1,134 @@
+From 3a9d6156a57fb17285e238ec0633ea2b24db91d6 Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood(a)redhat.com>
+Date: Mon, 31 Jul 2017 16:03:41 -0400
+Subject: [PATCH] Remove incomplete PKINIT OCSP support
+
+pkinit_kdc_ocsp is non-functional in the PKINIT OpenSSL crypto
+implementation, so remove most traces of it, including its man page
+entry. If it is present in kdc.conf, error out of PKINIT
+initialization instead of silently ignoring the realm entirely.
+
+ticket: 8603 (new)
+(cherry picked from commit 3ff426b9048a8024e5c175256c63cd0ad0572320)
+---
+ doc/admin/conf_files/kdc_conf.rst | 3 ---
+ src/man/kdc.conf.man | 3 ---
+ src/plugins/preauth/pkinit/pkinit.h | 2 +-
+ src/plugins/preauth/pkinit/pkinit_identity.c | 11 -----------
+ src/plugins/preauth/pkinit/pkinit_srv.c | 12 ++++++++++--
+ 5 files changed, 11 insertions(+), 20 deletions(-)
+
+diff --git a/doc/admin/conf_files/kdc_conf.rst b/doc/admin/conf_files/kdc_conf.rst
+index 13077ecf4..a4b2a5432 100644
+--- a/doc/admin/conf_files/kdc_conf.rst
++++ b/doc/admin/conf_files/kdc_conf.rst
+@@ -765,9 +765,6 @@ For information about the syntax of some of these options, see
+ pkinit is used to authenticate. This option may be specified
+ multiple times. (New in release 1.14.)
+
+-**pkinit_kdc_ocsp**
+- Specifies the location of the KDC's OCSP.
+-
+ **pkinit_pool**
+ Specifies the location of intermediate certificates which may be
+ used by the KDC to complete the trust chain between a client's
+diff --git a/src/man/kdc.conf.man b/src/man/kdc.conf.man
+index 10b333c38..166e68f9a 100644
+--- a/src/man/kdc.conf.man
++++ b/src/man/kdc.conf.man
+@@ -886,9 +886,6 @@ Specifies an authentication indicator to include in the ticket if
+ pkinit is used to authenticate. This option may be specified
+ multiple times. (New in release 1.14.)
+ .TP
+-.B \fBpkinit_kdc_ocsp\fP
+-Specifies the location of the KDC\(aqs OCSP.
+-.TP
+ .B \fBpkinit_pool\fP
+ Specifies the location of intermediate certificates which may be
+ used by the KDC to complete the trust chain between a client\(aqs
+diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h
+index 876db94c3..a49f3078e 100644
+--- a/src/plugins/preauth/pkinit/pkinit.h
++++ b/src/plugins/preauth/pkinit/pkinit.h
+@@ -73,6 +73,7 @@
+ #define KRB5_CONF_PKINIT_IDENTITIES "pkinit_identities"
+ #define KRB5_CONF_PKINIT_IDENTITY "pkinit_identity"
+ #define KRB5_CONF_PKINIT_KDC_HOSTNAME "pkinit_kdc_hostname"
++/* pkinit_kdc_ocsp has been removed */
+ #define KRB5_CONF_PKINIT_KDC_OCSP "pkinit_kdc_ocsp"
+ #define KRB5_CONF_PKINIT_POOL "pkinit_pool"
+ #define KRB5_CONF_PKINIT_REQUIRE_CRL_CHECKING "pkinit_require_crl_checking"
+@@ -173,7 +174,6 @@ typedef struct _pkinit_identity_opts {
+ char **anchors;
+ char **intermediates;
+ char **crls;
+- char *ocsp;
+ int idtype;
+ char *cert_filename;
+ char *key_filename;
+diff --git a/src/plugins/preauth/pkinit/pkinit_identity.c
b/src/plugins/preauth/pkinit/pkinit_identity.c
+index 177a2cad8..a897efa25 100644
+--- a/src/plugins/preauth/pkinit/pkinit_identity.c
++++ b/src/plugins/preauth/pkinit/pkinit_identity.c
+@@ -125,7 +125,6 @@ pkinit_init_identity_opts(pkinit_identity_opts **idopts)
+ opts->anchors = NULL;
+ opts->intermediates = NULL;
+ opts->crls = NULL;
+- opts->ocsp = NULL;
+
+ opts->cert_filename = NULL;
+ opts->key_filename = NULL;
+@@ -174,12 +173,6 @@ pkinit_dup_identity_opts(pkinit_identity_opts *src_opts,
+ if (retval)
+ goto cleanup;
+
+- if (src_opts->ocsp != NULL) {
+- newopts->ocsp = strdup(src_opts->ocsp);
+- if (newopts->ocsp == NULL)
+- goto cleanup;
+- }
+-
+ if (src_opts->cert_filename != NULL) {
+ newopts->cert_filename = strdup(src_opts->cert_filename);
+ if (newopts->cert_filename == NULL)
+@@ -674,10 +667,6 @@ pkinit_identity_prompt(krb5_context context,
+ if (retval)
+ goto errout;
+ }
+- if (idopts->ocsp != NULL) {
+- retval = ENOTSUP;
+- goto errout;
+- }
+
+ errout:
+ return retval;
+diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c
b/src/plugins/preauth/pkinit/pkinit_srv.c
+index 731d14eb8..32ca122f2 100644
+--- a/src/plugins/preauth/pkinit/pkinit_srv.c
++++ b/src/plugins/preauth/pkinit/pkinit_srv.c
+@@ -1252,7 +1252,7 @@ static krb5_error_code
+ pkinit_init_kdc_profile(krb5_context context, pkinit_kdc_context plgctx)
+ {
+ krb5_error_code retval;
+- char *eku_string = NULL;
++ char *eku_string = NULL, *ocsp_check = NULL;
+
+ pkiDebug("%s: entered for realm %s\n", __FUNCTION__,
plgctx->realmname);
+ retval = pkinit_kdcdefault_string(context, plgctx->realmname,
+@@ -1287,7 +1287,15 @@ pkinit_init_kdc_profile(krb5_context context, pkinit_kdc_context
plgctx)
+
+ pkinit_kdcdefault_string(context, plgctx->realmname,
+ KRB5_CONF_PKINIT_KDC_OCSP,
+- &plgctx->idopts->ocsp);
++ &ocsp_check);
++ if (ocsp_check != NULL) {
++ free(ocsp_check);
++ retval = ENOTSUP;
++ krb5_set_error_message(context, retval,
++ _("OCSP is not supported: (realm: %s)"),
++ plgctx->realmname);
++ goto errout;
++ }
+
+ pkinit_kdcdefault_integer(context, plgctx->realmname,
+ KRB5_CONF_PKINIT_DH_MIN_BITS,
diff --git a/krb5.spec b/krb5.spec
index 122aacf..91e1088 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system
Name: krb5
Version: 1.15.1
# for prerelease, should be e.g., 0.3.beta2%{?dist}
-Release: 20%{?dist}
+Release: 21%{?dist}
# - Maybe we should explode from the now-available-to-everybody tarball instead?
#
http://web.mit.edu/kerberos/dist/krb5/1.13/krb5-1.13.2-signed.tar
# - The sources below are stored in a lookaside cache. Upload with
@@ -80,6 +80,7 @@ Patch51: Add-k5test-expected_msg-expected_trace.patch
Patch52: Fix-leaks-in-gss_inquire_cred_by_oid.patch
Patch53: Add-support-to-query-the-SSF-of-a-GSS-context.patch
Patch54: Prevent-KDC-unset-status-assertion-failures.patch
+Patch55: Remove-incomplete-PKINIT-OCSP-support.patch
License: MIT
URL:
http://web.mit.edu/kerberos/www/
@@ -736,6 +737,9 @@ exit 0
%{_libdir}/libkadm5srv_mit.so.*
%changelog
+* Mon Aug 07 2017 Robbie Harwood <rharwood(a)redhat.com> - 1.15.1-21
+- Display an error message if ocsp pkinit is requested
+
* Wed Aug 02 2017 Robbie Harwood <rharwood(a)redhat.com> - 1.15.1-20
- Disable dns_canonicalize_hostname. This may break some setups.
commit ccd78d8ee908015ca558e7428c27151cb1af5579
Author: Robbie Harwood <rharwood(a)redhat.com>
Date: Wed Aug 2 17:02:46 2017 +0000
Disable dns_canonicalize_hostname. This may break some setups.
diff --git a/krb5.conf b/krb5.conf
index cf23f53..a588211 100644
--- a/krb5.conf
+++ b/krb5.conf
@@ -8,6 +8,7 @@ includedir /etc/krb5.conf.d/
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
+ dns_canonicalize_hostname = false
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
diff --git a/krb5.spec b/krb5.spec
index 1db9bdb..122aacf 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system
Name: krb5
Version: 1.15.1
# for prerelease, should be e.g., 0.3.beta2%{?dist}
-Release: 19%{?dist}
+Release: 20%{?dist}
# - Maybe we should explode from the now-available-to-everybody tarball instead?
#
http://web.mit.edu/kerberos/dist/krb5/1.13/krb5-1.13.2-signed.tar
# - The sources below are stored in a lookaside cache. Upload with
@@ -520,13 +520,12 @@ rm --
"$RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth/test.so"
%post libs -p /sbin/ldconfig
-%triggerun libs -- krb5-libs < 1.15.1-5
-# Previously, there was logic to make this conditional in order to
-# (effectively) allow for multiple triggers. However, RPM doesn't keep the
-# database consistent during upgrades.
-#
-# When a second trigger is needed, this will be made unconditional.
+%triggerun libs -- krb5-libs < 1.15.1-20
+if ! grep -q 'dns_canonicalize_hostname' /etc/krb5.conf ; then
+ sed -i 's/\[libdefaults\]/\[libdefaults\]\n dns_canonicalize_hostname =
false/' /etc/krb5.conf
+fi
+# Correct trigger would be krb5-libs < 1.15.1-5
if ! grep -q 'includedir /etc/krb5.conf.d' /etc/krb5.conf ; then
sed -i '1i # To opt out of the system crypto-policies configuration of krb5,
remove the\n# symlink at /etc/krb5.conf.d/crypto-policies which will not be
recreated.\nincludedir /etc/krb5.conf.d/\n' /etc/krb5.conf
fi
@@ -737,6 +736,9 @@ exit 0
%{_libdir}/libkadm5srv_mit.so.*
%changelog
+* Wed Aug 02 2017 Robbie Harwood <rharwood(a)redhat.com> - 1.15.1-20
+- Disable dns_canonicalize_hostname. This may break some setups.
+
* Wed Aug 02 2017 Robbie Harwood <rharwood(a)redhat.com> - 1.15.1-19
- Re-enable test suite on ppc64le (no other changes)
commit 0f2af40d1e257aabbf2ad6b505dfcb18aae60479
Author: Robbie Harwood <rharwood(a)redhat.com>
Date: Wed Aug 2 14:42:28 2017 +0000
Re-enable test suite on ppc64le (no other changes)
diff --git a/krb5.spec b/krb5.spec
index 17b4ff2..1db9bdb 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system
Name: krb5
Version: 1.15.1
# for prerelease, should be e.g., 0.3.beta2%{?dist}
-Release: 18%{?dist}
+Release: 19%{?dist}
# - Maybe we should explode from the now-available-to-everybody tarball instead?
#
http://web.mit.edu/kerberos/dist/krb5/1.13/krb5-1.13.2-signed.tar
# - The sources below are stored in a lookaside cache. Upload with
@@ -373,11 +373,6 @@ tar -cf "krb5-%{version}-pdfs.tar.new" build-pdf/*.pdf
%{__cc} -fPIC -shared -o noport.so -Wall -Wextra $RPM_SOURCE_DIR/noport.c
%check
-%ifarch ppc64le
-#
https://bugzilla.redhat.com/show_bug.cgi?id=1465147
-exit 0
-%endif
-
mkdir nss_wrapper
# Set things up to use the test wrappers.
@@ -742,6 +737,9 @@ exit 0
%{_libdir}/libkadm5srv_mit.so.*
%changelog
+* Wed Aug 02 2017 Robbie Harwood <rharwood(a)redhat.com> - 1.15.1-19
+- Re-enable test suite on ppc64le (no other changes)
+
* Wed Jul 26 2017 Fedora Release Engineering <releng(a)fedoraproject.org> -
1.15.1-18
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
commit e2a7f10a2f152fa244c5872f272bc22ce0eca03e
Author: Fedora Release Engineering <releng(a)fedoraproject.org>
Date: Wed Jul 26 17:59:47 2017 +0000
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
diff --git a/krb5.spec b/krb5.spec
index 9f37d98..17b4ff2 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system
Name: krb5
Version: 1.15.1
# for prerelease, should be e.g., 0.3.beta2%{?dist}
-Release: 17%{?dist}
+Release: 18%{?dist}
# - Maybe we should explode from the now-available-to-everybody tarball instead?
#
http://web.mit.edu/kerberos/dist/krb5/1.13/krb5-1.13.2-signed.tar
# - The sources below are stored in a lookaside cache. Upload with
@@ -742,6 +742,9 @@ exit 0
%{_libdir}/libkadm5srv_mit.so.*
%changelog
+* Wed Jul 26 2017 Fedora Release Engineering <releng(a)fedoraproject.org> -
1.15.1-18
+- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
* Thu Jul 20 2017 Robbie Harwood <rharwood(a)redhat.com> - 1.15.1-17
- Fix CVE-2017-11368 (remote triggerable assertion failure)