.cyrus-sasl.metadata

@@ -0,0 +1 @@
+c9e6848d9cc6f9588e0e7a75423f9a3aed3f10db SOURCES/cyrus-sasl-2.1.27-nodlcompatorsrp.tar.gz

.gitignore

@@ -1 +1 @@
-cyrus-sasl-2.1.28-nodlcompatorsrp.tar.gz
+SOURCES/cyrus-sasl-2.1.27-nodlcompatorsrp.tar.gz

SOURCES/0001-CVE-2022-24407-Escape-password-for-SQL-insert-update.patch

@@ -0,0 +1,82 @@
+From 37f2e0f0658d78a1496dc277f402f8b577ce6aae Mon Sep 17 00:00:00 2001
+From: Klaus Espenlaub <klaus@espenlaub.com>
+Date: Tue, 8 Feb 2022 20:34:40 +0000
+Subject: [PATCH] CVE-2022-24407 Escape password for SQL insert/update
+ commands.
+
+Signed-off-by: Klaus Espenlaub <klaus@espenlaub.com>
+---
+ plugins/sql.c | 26 +++++++++++++++++++++++---
+ 1 file changed, 23 insertions(+), 3 deletions(-)
+
+diff --git a/plugins/sql.c b/plugins/sql.c
+index 31b54a78..6ac81c2f 100644
+--- a/plugins/sql.c
++++ b/plugins/sql.c
+@@ -1151,6 +1151,7 @@ static int sql_auxprop_store(void *glob_context,
+     char *statement = NULL;
+     char *escap_userid = NULL;
+     char *escap_realm = NULL;
++    char *escap_passwd = NULL;
+     const char *cmd;
+     
+     sql_settings_t *settings;
+@@ -1222,6 +1223,11 @@ static int sql_auxprop_store(void *glob_context,
+ 			    "Unable to begin transaction\n");
+     }
+     for (cur = to_store; ret == SASL_OK && cur->name; cur++) {
++	/* Free the buffer, current content is from previous loop. */
++	if (escap_passwd) {
++	    sparams->utils->free(escap_passwd);
++	    escap_passwd = NULL;
++	}
+ 
+ 	if (cur->name[0] == '*') {
+ 	    continue;
+@@ -1243,19 +1249,32 @@ static int sql_auxprop_store(void *glob_context,
+ 	}
+ 	sparams->utils->free(statement);
+ 
++	if (cur->values[0]) {
++	    escap_passwd = (char *)sparams->utils->malloc(strlen(cur->values[0])*2+1);
++	    if (!escap_passwd) {
++		ret = SASL_NOMEM;
++		break;
++	    }
++	    settings->sql_engine->sql_escape_str(escap_passwd, cur->values[0]);
++	}
++
+ 	/* create a statement that we will use */
+ 	statement = sql_create_statement(cmd, cur->name, escap_userid,
+ 					 escap_realm,
+-					 cur->values && cur->values[0] ?
+-					 cur->values[0] : SQL_NULL_VALUE,
++					 escap_passwd ?
++					 escap_passwd : SQL_NULL_VALUE,
+ 					 sparams->utils);
++	if (!statement) {
++	    ret = SASL_NOMEM;
++	    break;
++	}
+ 	
+ 	{
+ 	    char *log_statement =
+ 		sql_create_statement(cmd, cur->name,
+ 				     escap_userid,
+ 				     escap_realm,
+-				     cur->values && cur->values[0] ?
++				     escap_passwd ?
+ 				     "<omitted>" : SQL_NULL_VALUE,
+ 				     sparams->utils);
+ 	    sparams->utils->log(sparams->utils->conn, SASL_LOG_DEBUG,
+@@ -1288,6 +1307,7 @@ static int sql_auxprop_store(void *glob_context,
+   done:
+     if (escap_userid) sparams->utils->free(escap_userid);
+     if (escap_realm) sparams->utils->free(escap_realm);
++    if (escap_passwd) sparams->utils->free(escap_passwd);
+     if (conn) settings->sql_engine->sql_close(conn);
+     if (userid) sparams->utils->free(userid);
+     if (realm) sparams->utils->free(realm);
+-- 
+2.25.1
+

SOURCES/cyrus-sasl-2.1.25-no_rpath.patch

@@ -16,5 +16,5 @@ diff -up cyrus-sasl-2.1.25/m4/cyrus.m4.no_rpath cyrus-sasl-2.1.25/m4/cyrus.m4
 -    ])
 -  LDFLAGS="${SAVE_LDFLAGS}"
 -  ])])
-+    andrew_cv_runpath_switch="none"
++    andrew_runpath_switch="none"
 +  ])

SOURCES/cyrus-sasl-2.1.27-Add-Channel-Binding-support-for-GSSAPI-GSS-SPNEGO.patch

@@ -1,24 +1,24 @@
-Backport of commit ids (minor inline mods to make them apply):
-975edbb69070eba6b035f08776de771a129cfb57
-ea8eb892e44129ac3890298da91c868d5592ed20
-
-From 975edbb69070eba6b035f08776de771a129cfb57 Mon Sep 17 00:00:00 2001
+From aa8b6b2275fd14ba2cca3d2339ae61c7e7ddfa70 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
-Date: Fri, 20 Mar 2020 14:51:04 -0400
+Date: Tue, 5 May 2020 14:08:48 -0400
 Subject: [PATCH] Add Channel Binding support for GSSAPI/GSS-SPNEGO
 
+Backport of commit ids:
+829a6ed086432e26dafa9d1dcf892aef4c42cfbd
+944bd8a6205f840b105206ef83e8f6b9dff0138e
+
 Signed-off-by: Simo Sorce <simo@redhat.com>
 ---
  plugins/gssapi.c     | 30 +++++++++++---
  tests/runtests.py    | 93 ++++++++++++++++++++++++++++++++++++++++----
- tests/t_common.c     | 14 +++++++
- tests/t_common.h     |  2 +
- tests/t_gssapi_cli.c | 21 +++++++++-
- tests/t_gssapi_srv.c | 21 +++++++++-
- 6 files changed, 164 insertions(+), 17 deletions(-)
+ tests/t_common.c     | 24 ++++++++----
+ tests/t_common.h     |  5 ++-
+ tests/t_gssapi_cli.c | 24 ++++++++++--
+ tests/t_gssapi_srv.c | 24 ++++++++++--
+ 6 files changed, 172 insertions(+), 28 deletions(-)
 
 diff --git a/plugins/gssapi.c b/plugins/gssapi.c
-index ff663da7..5d900c5e 100644
+index ff663da..5d900c5 100644
 --- a/plugins/gssapi.c
 +++ b/plugins/gssapi.c
 @@ -830,7 +830,9 @@ gssapi_server_mech_authneg(context_t *text,
@@ -122,7 +122,7 @@ index ff663da7..5d900c5e 100644
  	gssapi_required_prompts,	/* required_prompts */
  	&gss_spnego_oid,		/* glob_context */
 diff --git a/tests/runtests.py b/tests/runtests.py
-index f645adf4..fc9cf244 100755
+index f645adf..fc9cf24 100755
 --- a/tests/runtests.py
 +++ b/tests/runtests.py
 @@ -1,6 +1,7 @@
@@ -245,163 +245,7 @@ index f645adf4..fc9cf244 100755
  
  
 diff --git a/tests/t_common.c b/tests/t_common.c
-index 7168b2f1..87875b48 100644
---- a/tests/t_common.c
-+++ b/tests/t_common.c
-@@ -65,4 +65,18 @@ int getpath(void *context __attribute__((unused)), const char **path)
-     return SASL_OK;
- }
- 
-+void parse_cb(sasl_channel_binding_t *cb, char *buf, unsigned max, char *in)
-+{
-+    unsigned len;
-+    int r;
- 
-+    r = sasl_decode64(in, strlen(in), buf, max, &len);
-+    if (r != SASL_OK) {
-+        saslerr(r, "failed to parse channel bindings");
-+        exit(-1);
-+    }
-+    cb->name = "TEST BINDINGS";
-+    cb->critical = 0;
-+    cb->data = (unsigned char *)buf;
-+    cb->len = len;
-+}
-diff --git a/tests/t_common.h b/tests/t_common.h
-index 4ee1976c..0d08d8ba 100644
---- a/tests/t_common.h
-+++ b/tests/t_common.h
-@@ -7,9 +7,11 @@
- #include <sys/socket.h>
- 
- #include <sasl.h>
-+#include <saslutil.h>
- 
- void s_error(const char *hdr, ssize_t ret, ssize_t len, int err);
- void send_string(int sd, const char *s, unsigned int l);
- void recv_string(int sd, char *buf, unsigned int *buflen);
- void saslerr(int why, const char *what);
- int getpath(void *context __attribute__((unused)), const char **path);
-+void parse_cb(sasl_channel_binding_t *cb, char *buf, unsigned max, char *in);
-diff --git a/tests/t_gssapi_cli.c b/tests/t_gssapi_cli.c
-index c833c055..6b5664eb 100644
---- a/tests/t_gssapi_cli.c
-+++ b/tests/t_gssapi_cli.c
-@@ -13,6 +13,7 @@
- 
- #include <arpa/inet.h>
- #include <saslplug.h>
-+#include <saslutil.h>
- 
- static int setup_socket(void)
- {
-@@ -32,7 +33,7 @@ static int setup_socket(void)
-     return sock;
- }
- 
--int main(int argc __attribute__((unused)), char *argv[] __attribute__((unused)))
-+int main(int argc, char *argv[])
- {
-     sasl_callback_t callbacks[2] = {};
-     char buf[8192];
-@@ -40,8 +41,20 @@ int main(int argc __attribute__((unused)), char *argv[] __attribute__((unused)))
-     sasl_conn_t *conn;
-     const char *data;
-     unsigned int len;
-+    sasl_channel_binding_t cb = {0};
-+    char cb_buf[256];
-     int sd;
--    int r;
-+    int c, r;
-+
-+    while ((c = getopt(argc, argv, "c:")) != EOF) {
-+        switch (c) {
-+        case 'c':
-+            parse_cb(&cb, cb_buf, 256, optarg);
-+            break;
-+        default:
-+            break;
-+        }
-+    }
- 
-     /* initialize the sasl library */
-     callbacks[0].id = SASL_CB_GETPATH;
-@@ -60,6 +73,10 @@ int main(int argc __attribute__((unused)), char *argv[] __attribute__((unused)))
-         exit(-1);
-     }
- 
-+    if (cb.name) {
-+        sasl_setprop(conn, SASL_CHANNEL_BINDING, &cb);
-+    }
-+
-     r = sasl_client_start(conn, "GSSAPI", NULL, &data, &len, &chosenmech);
-     if (r != SASL_OK && r != SASL_CONTINUE) {
- 	saslerr(r, "starting SASL negotiation");
-diff --git a/tests/t_gssapi_srv.c b/tests/t_gssapi_srv.c
-index 29f538dd..3a8a5d44 100644
---- a/tests/t_gssapi_srv.c
-+++ b/tests/t_gssapi_srv.c
-@@ -44,15 +44,28 @@ static int setup_socket(void)
-     return sd;
- }
- 
--int main(int argc __attribute__((unused)), char *argv[] __attribute__((unused)))
-+int main(int argc, char *argv[])
- {
-     sasl_callback_t callbacks[2] = {};
-     char buf[8192];
-     sasl_conn_t *conn;
-     const char *data;
-     unsigned int len;
-+    sasl_channel_binding_t cb = {0};
-+    unsigned char cb_buf[256];
-     int sd;
--    int r;
-+    int c, r;
-+
-+    while ((c = getopt(argc, argv, "c:")) != EOF) {
-+        switch (c) {
-+        case 'c':
-+            parse_cb(&cb, cb_buf, 256, optarg);
-+            break;
-+        default:
-+            break;
-+        }
-+    }
-+
- 
-     /* initialize the sasl library */
-     callbacks[0].id = SASL_CB_GETPATH;
-@@ -72,6 +85,10 @@ int main(int argc __attribute__((unused)), char *argv[] __attribute__((unused)))
-         exit(-1);
-     }
- 
-+    if (cb.name) {
-+        sasl_setprop(conn, SASL_CHANNEL_BINDING, &cb);
-+    }
-+
-     sd = setup_socket();
- 
-     len = 8192;
-
-From ea8eb892e44129ac3890298da91c868d5592ed20 Mon Sep 17 00:00:00 2001
-From: Simo Sorce <simo@redhat.com>
-Date: Fri, 20 Mar 2020 14:52:15 -0400
-Subject: [PATCH] Fixup minor issues in previous PR.
-
-Remove spurious debugging code, this was left in by mistake.
-Add C notices, this was omitted by mistake.
-
-Signed-off-by: Simo Sorce <simo@redhat.com>
----
- tests/t_common.c     | 10 ++--------
- tests/t_common.h     |  3 ++-
- tests/t_gssapi_cli.c |  3 ++-
- tests/t_gssapi_srv.c |  3 ++-
- 4 files changed, 8 insertions(+), 11 deletions(-)
-
-diff --git a/tests/t_common.c b/tests/t_common.c
-index 87875b48..478e6a1f 100644
+index 7168b2f..478e6a1 100644
 --- a/tests/t_common.c
 +++ b/tests/t_common.c
 @@ -1,4 +1,5 @@
@@ -439,8 +283,27 @@ index 87875b48..478e6a1f 100644
      *buflen = ret;
  }
  
+@@ -65,4 +59,18 @@ int getpath(void *context __attribute__((unused)), const char **path)
+     return SASL_OK;
+ }
+ 
++void parse_cb(sasl_channel_binding_t *cb, char *buf, unsigned max, char *in)
++{
++    unsigned len;
++    int r;
+ 
++    r = sasl_decode64(in, strlen(in), buf, max, &len);
++    if (r != SASL_OK) {
++        saslerr(r, "failed to parse channel bindings");
++        exit(-1);
++    }
++    cb->name = "TEST BINDINGS";
++    cb->critical = 0;
++    cb->data = (unsigned char *)buf;
++    cb->len = len;
++}
 diff --git a/tests/t_common.h b/tests/t_common.h
-index 0d08d8ba..a10def17 100644
+index 4ee1976..a10def1 100644
 --- a/tests/t_common.h
 +++ b/tests/t_common.h
 @@ -1,4 +1,5 @@
@@ -450,8 +313,20 @@ index 0d08d8ba..a10def17 100644
  
  #include "config.h"
  
+@@ -7,9 +8,11 @@
+ #include <sys/socket.h>
+ 
+ #include <sasl.h>
++#include <saslutil.h>
+ 
+ void s_error(const char *hdr, ssize_t ret, ssize_t len, int err);
+ void send_string(int sd, const char *s, unsigned int l);
+ void recv_string(int sd, char *buf, unsigned int *buflen);
+ void saslerr(int why, const char *what);
+ int getpath(void *context __attribute__((unused)), const char **path);
++void parse_cb(sasl_channel_binding_t *cb, char *buf, unsigned max, char *in);
 diff --git a/tests/t_gssapi_cli.c b/tests/t_gssapi_cli.c
-index 6b5664eb..a44a3f58 100644
+index c833c05..a44a3f5 100644
 --- a/tests/t_gssapi_cli.c
 +++ b/tests/t_gssapi_cli.c
 @@ -1,4 +1,5 @@
@@ -461,8 +336,58 @@ index 6b5664eb..a44a3f58 100644
  
  #include "t_common.h"
  
+@@ -13,6 +14,7 @@
+ 
+ #include <arpa/inet.h>
+ #include <saslplug.h>
++#include <saslutil.h>
+ 
+ static int setup_socket(void)
+ {
+@@ -32,7 +34,7 @@ static int setup_socket(void)
+     return sock;
+ }
+ 
+-int main(int argc __attribute__((unused)), char *argv[] __attribute__((unused)))
++int main(int argc, char *argv[])
+ {
+     sasl_callback_t callbacks[2] = {};
+     char buf[8192];
+@@ -40,8 +42,20 @@ int main(int argc __attribute__((unused)), char *argv[] __attribute__((unused)))
+     sasl_conn_t *conn;
+     const char *data;
+     unsigned int len;
++    sasl_channel_binding_t cb = {0};
++    char cb_buf[256];
+     int sd;
+-    int r;
++    int c, r;
++
++    while ((c = getopt(argc, argv, "c:")) != EOF) {
++        switch (c) {
++        case 'c':
++            parse_cb(&cb, cb_buf, 256, optarg);
++            break;
++        default:
++            break;
++        }
++    }
+ 
+     /* initialize the sasl library */
+     callbacks[0].id = SASL_CB_GETPATH;
+@@ -60,6 +74,10 @@ int main(int argc __attribute__((unused)), char *argv[] __attribute__((unused)))
+         exit(-1);
+     }
+ 
++    if (cb.name) {
++        sasl_setprop(conn, SASL_CHANNEL_BINDING, &cb);
++    }
++
+     r = sasl_client_start(conn, "GSSAPI", NULL, &data, &len, &chosenmech);
+     if (r != SASL_OK && r != SASL_CONTINUE) {
+ 	saslerr(r, "starting SASL negotiation");
 diff --git a/tests/t_gssapi_srv.c b/tests/t_gssapi_srv.c
-index 3a8a5d44..ef1217f6 100644
+index 29f538d..ef1217f 100644
 --- a/tests/t_gssapi_srv.c
 +++ b/tests/t_gssapi_srv.c
 @@ -1,4 +1,5 @@
@@ -472,4 +397,48 @@ index 3a8a5d44..ef1217f6 100644
  
  #include "t_common.h"
  
+@@ -44,15 +45,28 @@ static int setup_socket(void)
+     return sd;
+ }
+ 
+-int main(int argc __attribute__((unused)), char *argv[] __attribute__((unused)))
++int main(int argc, char *argv[])
+ {
+     sasl_callback_t callbacks[2] = {};
+     char buf[8192];
+     sasl_conn_t *conn;
+     const char *data;
+     unsigned int len;
++    sasl_channel_binding_t cb = {0};
++    unsigned char cb_buf[256];
+     int sd;
+-    int r;
++    int c, r;
++
++    while ((c = getopt(argc, argv, "c:")) != EOF) {
++        switch (c) {
++        case 'c':
++            parse_cb(&cb, cb_buf, 256, optarg);
++            break;
++        default:
++            break;
++        }
++    }
++
+ 
+     /* initialize the sasl library */
+     callbacks[0].id = SASL_CB_GETPATH;
+@@ -72,6 +86,10 @@ int main(int argc __attribute__((unused)), char *argv[] __attribute__((unused)))
+         exit(-1);
+     }
+ 
++    if (cb.name) {
++        sasl_setprop(conn, SASL_CHANNEL_BINDING, &cb);
++    }
++
+     sd = setup_socket();
+ 
+     len = 8192;
+-- 
+2.18.2
 

SOURCES/cyrus-sasl-2.1.27-Add-basic-test-infrastructure.patch

@@ -1,16 +1,14 @@
-Backport of 18ff41d5d18f61c2ded7235dad1d9618aa84784b with minor inline mods to
-make it apply.
-
-From 18ff41d5d18f61c2ded7235dad1d9618aa84784b Mon Sep 17 00:00:00 2001
+From 82e299e970461c153a036bb1fbc84e808f926e12 Mon Sep 17 00:00:00 2001
 From: Simo Sorce <simo@redhat.com>
-Date: Sat, 14 Mar 2020 10:50:19 -0400
+Date: Tue, 5 May 2020 14:06:57 -0400
 Subject: [PATCH] Add basic test infrastructure
 
 First test is for SASL/GSSAPI
 
-Signed-off-by: Simo Sorce <simo@redhat.com>
+Backport of upstream commit id:
+18ff41d5d18f61c2ded7235dad1d9618aa84784b
 
-:x
+Signed-off-by: Simo Sorce <simo@redhat.com>
 ---
  Makefile.am          |   2 +-
  configure.ac         |   3 +-
@@ -20,7 +18,7 @@ Signed-off-by: Simo Sorce <simo@redhat.com>
  tests/t_common.h     |  15 ++++
  tests/t_gssapi_cli.c |  95 +++++++++++++++++++++++
  tests/t_gssapi_srv.c | 111 +++++++++++++++++++++++++++
- 10 files changed, 559 insertions(+), 4 deletions(-)
+ 8 files changed, 550 insertions(+), 2 deletions(-)
  create mode 100644 tests/Makefile.am
  create mode 100755 tests/runtests.py
  create mode 100644 tests/t_common.c
@@ -29,36 +27,35 @@ Signed-off-by: Simo Sorce <simo@redhat.com>
  create mode 100644 tests/t_gssapi_srv.c
 
 diff --git a/Makefile.am b/Makefile.am
-index f7d3b22e..102e2a3e 100644
+index 83dae6f..fc24509 100644
 --- a/Makefile.am
 +++ b/Makefile.am
-@@ -65,7 +65,7 @@ else
+@@ -70,7 +70,7 @@ else
  INSTALLOSX = 
  endif
  
--SUBDIRS=include sasldb common lib plugins utils $(PWC) $(SAM) $(SAD)
-+SUBDIRS=include sasldb common lib plugins utils $(PWC) $(SAM) $(SAD) tests
+-SUBDIRS=include sasldb common lib plugins utils $(PWC) $(SAM) $(JAV) $(SAD)
++SUBDIRS=include sasldb common lib plugins utils $(PWC) $(SAM) $(JAV) $(SAD) tests
  EXTRA_DIST=config doc docsrc win32 mac dlcompat-20010505 NTMakefile \
      INSTALL.TXT libsasl2.pc.in
  
 diff --git a/configure.ac b/configure.ac
-index 3610671b..dd7908a3 100644
+index ca5936a..c1d2182 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1516,8 +1516,9 @@ plugins/Makefile
- lib/Makefile
- utils/Makefile
- sample/Makefile
--pwcheck/Makefile])
+@@ -1575,7 +1575,8 @@ java/javax/Makefile
+ java/javax/security/Makefile
+ java/javax/security/auth/Makefile
+ java/javax/security/auth/callback/Makefile
+-pwcheck/Makefile)
 +pwcheck/Makefile
-+tests/Makefile])
- AC_OUTPUT
++tests/Makefile)
  
  AC_MSG_NOTICE([
  
 diff --git a/tests/Makefile.am b/tests/Makefile.am
 new file mode 100644
-index 00000000..1edf010a
+index 0000000..1edf010
 --- /dev/null
 +++ b/tests/Makefile.am
 @@ -0,0 +1,79 @@
@@ -143,7 +140,7 @@ index 00000000..1edf010a
 +endif
 diff --git a/tests/runtests.py b/tests/runtests.py
 new file mode 100755
-index 00000000..f645adf4
+index 0000000..f645adf
 --- /dev/null
 +++ b/tests/runtests.py
 @@ -0,0 +1,179 @@
@@ -328,7 +325,7 @@ index 00000000..f645adf4
 +    gssapi_tests(T)
 diff --git a/tests/t_common.c b/tests/t_common.c
 new file mode 100644
-index 00000000..7168b2f1
+index 0000000..7168b2f
 --- /dev/null
 +++ b/tests/t_common.c
 @@ -0,0 +1,68 @@
@@ -402,7 +399,7 @@ index 00000000..7168b2f1
 +
 diff --git a/tests/t_common.h b/tests/t_common.h
 new file mode 100644
-index 00000000..4ee1976c
+index 0000000..4ee1976
 --- /dev/null
 +++ b/tests/t_common.h
 @@ -0,0 +1,15 @@
@@ -423,7 +420,7 @@ index 00000000..4ee1976c
 +int getpath(void *context __attribute__((unused)), const char **path);
 diff --git a/tests/t_gssapi_cli.c b/tests/t_gssapi_cli.c
 new file mode 100644
-index 00000000..c833c055
+index 0000000..c833c05
 --- /dev/null
 +++ b/tests/t_gssapi_cli.c
 @@ -0,0 +1,95 @@
@@ -524,7 +521,7 @@ index 00000000..c833c055
 +
 diff --git a/tests/t_gssapi_srv.c b/tests/t_gssapi_srv.c
 new file mode 100644
-index 00000000..29f538dd
+index 0000000..29f538d
 --- /dev/null
 +++ b/tests/t_gssapi_srv.c
 @@ -0,0 +1,111 @@
@@ -639,4 +636,6 @@ index 00000000..29f538dd
 +    return 0;
 +}
 +
+-- 
+2.18.2
 

SOURCES/cyrus-sasl-2.1.27-Add-support-for-setting-max-ssf-0-to-GSS-SPNEGO.patch

@@ -0,0 +1,435 @@
+From 49e965f41257a0ed299c58a7cf1c120ddf944aaa Mon Sep 17 00:00:00 2001
+From: Simo Sorce <simo@redhat.com>
+Date: Tue, 5 May 2020 14:51:36 -0400
+Subject: [PATCH] Add support for setting max ssf 0 to GSS-SPNEGO
+
+Bacport form this proposed PR (still open at bacport time):
+https://github.com/cyrusimap/cyrus-sasl/pull/603
+
+Signed-off-by: Simo Sorce <simo@redhat.com>
+---
+ m4/sasl2.m4          | 13 +++++++
+ plugins/gssapi.c     | 44 ++++++++++++++++++++-
+ tests/runtests.py    | 91 ++++++++++++++++++++++++++++++++++++++++----
+ tests/t_common.c     | 13 ++++---
+ tests/t_common.h     |  3 +-
+ tests/t_gssapi_cli.c | 25 ++++++++++--
+ tests/t_gssapi_srv.c | 28 +++++++++++---
+ 7 files changed, 194 insertions(+), 23 deletions(-)
+
+diff --git a/m4/sasl2.m4 b/m4/sasl2.m4
+index 56e0504..6effe99 100644
+--- a/m4/sasl2.m4
++++ b/m4/sasl2.m4
+@@ -287,6 +287,19 @@ if test "$gssapi" != no; then
+   AC_CHECK_FUNCS(gss_oid_equal)
+   LIBS="$cmu_save_LIBS"
+ 
++  cmu_save_LIBS="$LIBS"
++  LIBS="$LIBS $GSSAPIBASE_LIBS"
++  if test "$ac_cv_header_gssapi_gssapi_krb5_h" = "yes"; then
++    AC_CHECK_DECL(GSS_KRB5_CRED_NO_CI_FLAGS_X,
++                  [AC_DEFINE(HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X,1,
++                             [Define if your GSSAPI implementation supports GSS_KRB5_CRED_NO_CI_FLAGS_X])],,
++                  [
++                    AC_INCLUDES_DEFAULT
++                    #include <gssapi/gssapi_krb5.h>
++                    ])
++  fi
++  LIBS="$cmu_save_LIBS"
++
+   cmu_save_LIBS="$LIBS"
+   LIBS="$LIBS $GSSAPIBASE_LIBS"
+   AC_CHECK_FUNCS(gss_get_name_attribute)
+diff --git a/plugins/gssapi.c b/plugins/gssapi.c
+index 5d900c5..7480316 100644
+--- a/plugins/gssapi.c
++++ b/plugins/gssapi.c
+@@ -1783,7 +1783,49 @@ static int gssapi_client_mech_step(void *conn_context,
+ 		/* We want to try for privacy */
+ 		req_flags |= GSS_C_CONF_FLAG;
+ 	    }
+-	}
++#ifdef HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X
++        /* The krb5 mechanism automatically adds INTEG and CONF flags even when
++         * not specified, this has the effect of rendering explicit requests
++         * of no confidentiality and integrity via setting maxssf 0 moot.
++         * However to interoperate with Windows machines it needs to be
++         * possible to unset these flags as Windows machines refuse to allow
++         * two layers (say TLS and GSSAPI) to both provide these services.
++         * So if we do not suppress these flags a SASL/GSS-SPNEGO negotiation
++         * over, say, LDAPS will fail against Windows Servers */
++	} else if (params->props.max_ssf == 0) {
++            gss_buffer_desc empty_buffer = GSS_C_EMPTY_BUFFER;
++            if (client_creds == GSS_C_NO_CREDENTIAL) {
++                gss_OID_set_desc mechs = { 0 };
++                gss_OID_set desired_mechs = GSS_C_NO_OID_SET;
++                if (text->mech_type != GSS_C_NO_OID) {
++                    mechs.count = 1;
++                    mechs.elements = text->mech_type;
++                    desired_mechs = &mechs;
++                }
++
++                maj_stat = gss_acquire_cred(&min_stat, GSS_C_NO_NAME,
++                                            GSS_C_INDEFINITE, desired_mechs,
++                                            GSS_C_INITIATE,
++                                            &text->client_creds, NULL, NULL);
++                if (GSS_ERROR(maj_stat)) {
++                    sasl_gss_seterror(text->utils, maj_stat, min_stat);
++                    sasl_gss_free_context_contents(text);
++                    return SASL_FAIL;
++                }
++                client_creds = text->client_creds;
++            }
++
++            maj_stat = gss_set_cred_option(&min_stat, &client_creds,
++                                           (gss_OID)GSS_KRB5_CRED_NO_CI_FLAGS_X,
++                                            &empty_buffer);
++            if (GSS_ERROR(maj_stat)) {
++                sasl_gss_seterror(text->utils, maj_stat, min_stat);
++                sasl_gss_free_context_contents(text);
++                return SASL_FAIL;
++            }
++#endif
++        }
++
+ 
+ 	if (params->props.security_flags & SASL_SEC_PASS_CREDENTIALS) {
+ 	    req_flags = req_flags |  GSS_C_DELEG_FLAG;
+diff --git a/tests/runtests.py b/tests/runtests.py
+index fc9cf24..4106401 100755
+--- a/tests/runtests.py
++++ b/tests/runtests.py
+@@ -6,6 +6,7 @@ import os
+ import shutil
+ import signal
+ import subprocess
++import sys
+ import time
+ from string import Template
+ 
+@@ -149,11 +150,12 @@ def gssapi_basic_test(kenv):
+                 srv.returncode, srv.stderr.read().decode('utf-8')))
+     except Exception as e:
+         print("FAIL: {}".format(e))
+-        return
++        return 1
+ 
+     print("PASS: CLI({}) SRV({})".format(
+         cli.stdout.read().decode('utf-8').strip(),
+         srv.stdout.read().decode('utf-8').strip()))
++    return 0
+ 
+ def gssapi_channel_binding_test(kenv):
+     try:
+@@ -178,11 +180,12 @@ def gssapi_channel_binding_test(kenv):
+                 srv.returncode, srv.stderr.read().decode('utf-8')))
+     except Exception as e:
+         print("FAIL: {}".format(e))
+-        return
++        return 1
+ 
+     print("PASS: CLI({}) SRV({})".format(
+         cli.stdout.read().decode('utf-8').strip(),
+         srv.stdout.read().decode('utf-8').strip()))
++    return 0
+ 
+ def gssapi_channel_binding_mismatch_test(kenv):
+     result = "FAIL"
+@@ -212,11 +215,70 @@ def gssapi_channel_binding_mismatch_test(kenv):
+                 cli.returncode, cli_err, srv.returncode, srv_err))
+     except Exception as e:
+         print("{}: {}".format(result, e))
+-        return
++        return 0
+ 
+     print("FAIL: This test should fail [CLI({}) SRV({})]".format(
+         cli.stdout.read().decode('utf-8').strip(),
+         srv.stdout.read().decode('utf-8').strip()))
++    return 1
++
++def gss_spnego_basic_test(kenv):
++    try:
++        srv = subprocess.Popen(["../tests/t_gssapi_srv", "-N"],
++                               stdout=subprocess.PIPE,
++                               stderr=subprocess.PIPE, env=kenv)
++        srv.stdout.readline() # Wait for srv to say it is ready
++        cli = subprocess.Popen(["../tests/t_gssapi_cli", "-N"],
++                               stdout=subprocess.PIPE,
++                               stderr=subprocess.PIPE, env=kenv)
++        try:
++            cli.wait(timeout=5)
++            srv.wait(timeout=5)
++        except Exception as e:
++            print("Failed on {}".format(e));
++            cli.kill()
++            srv.kill()
++        if cli.returncode != 0 or srv.returncode != 0:
++            raise Exception("CLI ({}): {} --> SRV ({}): {}".format(
++                cli.returncode, cli.stderr.read().decode('utf-8'),
++                srv.returncode, srv.stderr.read().decode('utf-8')))
++    except Exception as e:
++        print("FAIL: {}".format(e))
++        return 1
++
++    print("PASS: CLI({}) SRV({})".format(
++        cli.stdout.read().decode('utf-8').strip(),
++        srv.stdout.read().decode('utf-8').strip()))
++    return 0
++
++def gss_spnego_zeromaxssf_test(kenv):
++    try:
++        srv = subprocess.Popen(["../tests/t_gssapi_srv", "-N", "-z"],
++                               stdout=subprocess.PIPE,
++                               stderr=subprocess.PIPE, env=kenv)
++        srv.stdout.readline() # Wait for srv to say it is ready
++        cli = subprocess.Popen(["../tests/t_gssapi_cli", "-N", "-z"],
++                               stdout=subprocess.PIPE,
++                               stderr=subprocess.PIPE, env=kenv)
++        try:
++            cli.wait(timeout=5)
++            srv.wait(timeout=5)
++        except Exception as e:
++            print("Failed on {}".format(e));
++            cli.kill()
++            srv.kill()
++        if cli.returncode != 0 or srv.returncode != 0:
++            raise Exception("CLI ({}): {} --> SRV ({}): {}".format(
++                cli.returncode, cli.stderr.read().decode('utf-8'),
++                srv.returncode, srv.stderr.read().decode('utf-8')))
++    except Exception as e:
++        print("FAIL: {}".format(e))
++        return 1
++
++    print("PASS: CLI({}) SRV({})".format(
++        cli.stdout.read().decode('utf-8').strip(),
++        srv.stdout.read().decode('utf-8').strip()))
++    return 0
+ 
+ def gssapi_tests(testdir):
+     """ SASL/GSSAPI Tests """
+@@ -225,20 +287,32 @@ def gssapi_tests(testdir):
+     #print("KDC: {}, ENV: {}".format(kdc, kenv))
+     kenv['KRB5_TRACE'] = os.path.join(testdir, 'trace.log')
+ 
++    err = 0
++
+     print('GSSAPI BASIC:')
+     print('    ', end='')
+-    gssapi_basic_test(kenv)
++    err += gssapi_basic_test(kenv)
+ 
+     print('GSSAPI CHANNEL BINDING:')
+     print('    ', end='')
+-    gssapi_channel_binding_test(kenv)
++    err += gssapi_channel_binding_test(kenv)
+ 
+     print('GSSAPI CHANNEL BINDING MISMTACH:')
+     print('    ', end='')
+-    gssapi_channel_binding_mismatch_test(kenv)
++    err += gssapi_channel_binding_mismatch_test(kenv)
++
++    print('GSS-SPNEGO BASIC:')
++    print('    ', end='')
++    err += gss_spnego_basic_test(kenv)
++
++    print('GSS-SPNEGO 0 MAXSSF:')
++    print('    ', end='')
++    err += gss_spnego_zeromaxssf_test(kenv)
+ 
+     os.killpg(kdc.pid, signal.SIGTERM)
+ 
++    return err
++
+ 
+ if __name__ == "__main__":
+ 
+@@ -253,4 +327,7 @@ if __name__ == "__main__":
+         shutil.rmtree(T)
+     os.makedirs(T)
+ 
+-    gssapi_tests(T)
++    err = gssapi_tests(T)
++    if err != 0:
++        print('{} test(s) FAILED'.format(err))
++        sys.exit(-1)
+diff --git a/tests/t_common.c b/tests/t_common.c
+index 478e6a1..f56098e 100644
+--- a/tests/t_common.c
++++ b/tests/t_common.c
+@@ -23,20 +23,21 @@ void send_string(int sd, const char *s, unsigned int l)
+     if (ret != l) s_error("send data", ret, l, errno);
+ }
+ 
+-void recv_string(int sd, char *buf, unsigned int *buflen)
++void recv_string(int sd, char *buf, unsigned int *buflen, bool allow_eof)
+ {
++    unsigned int bufsize = *buflen;
+     unsigned int l;
+     ssize_t ret;
+ 
++    *buflen = 0;
++
+     ret = recv(sd, &l, sizeof(l), MSG_WAITALL);
++    if (allow_eof && ret == 0) return;
+     if (ret != sizeof(l)) s_error("recv size", ret, sizeof(l), errno);
+ 
+-    if (l == 0) {
+-        *buflen = 0;
+-        return;
+-    }
++    if (l == 0) return;
+ 
+-    if (*buflen < l) s_error("recv len", l, *buflen, E2BIG);
++    if (bufsize < l) s_error("recv len", l, bufsize, E2BIG);
+ 
+     ret = recv(sd, buf, l, 0);
+     if (ret != l) s_error("recv data", ret, l, errno);
+diff --git a/tests/t_common.h b/tests/t_common.h
+index a10def1..be24a53 100644
+--- a/tests/t_common.h
++++ b/tests/t_common.h
+@@ -4,6 +4,7 @@
+ #include "config.h"
+ 
+ #include <errno.h>
++#include <stdbool.h>
+ #include <stdio.h>
+ #include <sys/socket.h>
+ 
+@@ -12,7 +13,7 @@
+ 
+ void s_error(const char *hdr, ssize_t ret, ssize_t len, int err);
+ void send_string(int sd, const char *s, unsigned int l);
+-void recv_string(int sd, char *buf, unsigned int *buflen);
++void recv_string(int sd, char *buf, unsigned int *buflen, bool allow_eof);
+ void saslerr(int why, const char *what);
+ int getpath(void *context __attribute__((unused)), const char **path);
+ void parse_cb(sasl_channel_binding_t *cb, char *buf, unsigned max, char *in);
+diff --git a/tests/t_gssapi_cli.c b/tests/t_gssapi_cli.c
+index a44a3f5..d9eafe1 100644
+--- a/tests/t_gssapi_cli.c
++++ b/tests/t_gssapi_cli.c
+@@ -46,12 +46,21 @@ int main(int argc, char *argv[])
+     char cb_buf[256];
+     int sd;
+     int c, r;
++    const char *sasl_mech = "GSSAPI";
++    bool spnego = false;
++    bool zeromaxssf = false;
+ 
+-    while ((c = getopt(argc, argv, "c:")) != EOF) {
++    while ((c = getopt(argc, argv, "c:zN")) != EOF) {
+         switch (c) {
+         case 'c':
+             parse_cb(&cb, cb_buf, 256, optarg);
+             break;
++        case 'z':
++            zeromaxssf = true;
++            break;
++        case 'N':
++            spnego = true;
++            break;
+         default:
+             break;
+         }
+@@ -78,7 +87,17 @@ int main(int argc, char *argv[])
+         sasl_setprop(conn, SASL_CHANNEL_BINDING, &cb);
+     }
+ 
+-    r = sasl_client_start(conn, "GSSAPI", NULL, &data, &len, &chosenmech);
++    if (spnego) {
++        sasl_mech = "GSS-SPNEGO";
++    }
++
++    if (zeromaxssf) {
++        /* set all security properties to 0 including maxssf */
++        sasl_security_properties_t secprops = { 0 };
++        sasl_setprop(conn, SASL_SEC_PROPS, &secprops);
++    }
++
++    r = sasl_client_start(conn, sasl_mech, NULL, &data, &len, &chosenmech);
+     if (r != SASL_OK && r != SASL_CONTINUE) {
+ 	saslerr(r, "starting SASL negotiation");
+ 	printf("\n%s\n", sasl_errdetail(conn));
+@@ -90,7 +109,7 @@ int main(int argc, char *argv[])
+     while (r == SASL_CONTINUE) {
+         send_string(sd, data, len);
+         len = 8192;
+-        recv_string(sd, buf, &len);
++        recv_string(sd, buf, &len, false);
+ 
+ 	r = sasl_client_step(conn, buf, len, NULL, &data, &len);
+ 	if (r != SASL_OK && r != SASL_CONTINUE) {
+diff --git a/tests/t_gssapi_srv.c b/tests/t_gssapi_srv.c
+index ef1217f..448a218 100644
+--- a/tests/t_gssapi_srv.c
++++ b/tests/t_gssapi_srv.c
+@@ -56,12 +56,21 @@ int main(int argc, char *argv[])
+     unsigned char cb_buf[256];
+     int sd;
+     int c, r;
++    const char *sasl_mech = "GSSAPI";
++    bool spnego = false;
++    bool zeromaxssf = false;
+ 
+-    while ((c = getopt(argc, argv, "c:")) != EOF) {
++    while ((c = getopt(argc, argv, "c:zN")) != EOF) {
+         switch (c) {
+         case 'c':
+             parse_cb(&cb, cb_buf, 256, optarg);
+             break;
++        case 'z':
++            zeromaxssf = true;
++            break;
++        case 'N':
++            spnego = true;
++            break;
+         default:
+             break;
+         }
+@@ -90,12 +99,22 @@ int main(int argc, char *argv[])
+         sasl_setprop(conn, SASL_CHANNEL_BINDING, &cb);
+     }
+ 
++    if (spnego) {
++        sasl_mech = "GSS-SPNEGO";
++    }
++
++    if (zeromaxssf) {
++        /* set all security properties to 0 including maxssf */
++        sasl_security_properties_t secprops = { 0 };
++        sasl_setprop(conn, SASL_SEC_PROPS, &secprops);
++    }
++
+     sd = setup_socket();
+ 
+     len = 8192;
+-    recv_string(sd, buf, &len);
++    recv_string(sd, buf, &len, false);
+ 
+-    r = sasl_server_start(conn, "GSSAPI", buf, len, &data, &len);
++    r = sasl_server_start(conn, sasl_mech, buf, len, &data, &len);
+     if (r != SASL_OK && r != SASL_CONTINUE) {
+ 	saslerr(r, "starting SASL negotiation");
+ 	printf("\n%s\n", sasl_errdetail(conn));
+@@ -105,7 +124,7 @@ int main(int argc, char *argv[])
+     while (r == SASL_CONTINUE) {
+         send_string(sd, data, len);
+         len = 8192;
+-        recv_string(sd, buf, &len);
++        recv_string(sd, buf, &len, true);
+ 
+ 	r = sasl_server_step(conn, buf, len, &data, &len);
+ 	if (r != SASL_OK && r != SASL_CONTINUE) {
+@@ -113,7 +132,6 @@ int main(int argc, char *argv[])
+ 	    printf("\n%s\n", sasl_errdetail(conn));
+ 	    exit(-1);
+ 	}
+-
+     }
+ 
+     if (r != SASL_OK) exit(-1);
+-- 
+2.18.2
+

SOURCES/cyrus-sasl-2.1.27-CVE-2019-19906.patch

@@ -0,0 +1,29 @@
+From bcb6c06ec17728f7c9c492dc257b1e541a6830da Mon Sep 17 00:00:00 2001
+From: Simo Sorce <simo@redhat.com>
+Date: Tue, 5 May 2020 14:41:06 -0400
+Subject: [PATCH] CVE-2019-19906
+
+Backport of commit id:
+dcc9f51cbd4ed622cfb0f9b1c141eb2ffe3b12f1
+
+Signed-off-by: Simo Sorce <simo@redhat.com>
+---
+ lib/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/common.c b/lib/common.c
+index bc3bf1d..9969d6a 100644
+--- a/lib/common.c
++++ b/lib/common.c
+@@ -190,7 +190,7 @@ int _sasl_add_string(char **out, size_t *alloclen,
+ 
+   if (add==NULL) add = "(null)";
+ 
+-  addlen=strlen(add); /* only compute once */
++  addlen=strlen(add)+1; /* only compute once */
+   if (_buf_alloc(out, alloclen, (*outlen)+addlen)!=SASL_OK)
+     return SASL_NOMEM;
+ 
+-- 
+2.18.2
+

SOURCES/cyrus-sasl-2.1.27-Emit-debug-log-only-in-case-of-errors.patch

@@ -0,0 +1,42 @@
+From ec070b2e83a4ee698c08d6d68c205aea4d90b0bb Mon Sep 17 00:00:00 2001
+From: Simo Sorce <simo@redhat.com>
+Date: Tue, 5 May 2020 14:31:10 -0400
+Subject: [PATCH] Emit debug log only in case of errors
+
+Backport of commit id:
+ccc5e547d4b40ee2b182a9945f8f6cc10b4fdf48
+
+Signed-off-by: Simo Sorce <simo@redhat.com>
+---
+ plugins/gssapi.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/plugins/gssapi.c b/plugins/gssapi.c
+index 7480316..6bcd78e 100644
+--- a/plugins/gssapi.c
++++ b/plugins/gssapi.c
+@@ -1444,9 +1444,6 @@ gssapi_server_mech_step(void *conn_context,
+ 
+     if (text == NULL) return SASL_BADPROT;
+ 
+-    params->utils->log(params->utils->conn, SASL_LOG_DEBUG,
+-		       "GSSAPI server step %d\n", text->state);
+-
+     switch (text->state) {
+ 
+     case SASL_GSSAPI_STATE_AUTHNEG:
+@@ -1496,8 +1493,10 @@ gssapi_server_mech_step(void *conn_context,
+ 	}
+ 
+ 	oparams->doneflag = 1;
++    } else {
++        params->utils->log(params->utils->conn, SASL_LOG_DEBUG,
++		           "GSSAPI server step failed: %d\n", text->state);
+     }
+-    
+     return ret;
+ }
+ 
+-- 
+2.18.2
+

SOURCES/cyrus-sasl-pr559-RC4-openssl.patch

@@ -0,0 +1,155 @@
+From 8aa9ae816ddf66921b4a8a0f422517e6f2e55ac6 Mon Sep 17 00:00:00 2001
+From: Simo Sorce <simo@redhat.com>
+Date: Wed, 27 Mar 2019 14:29:08 -0400
+Subject: [PATCH] Use Openssl RC4 when available
+
+Signed-off-by: Simo Sorce <simo@redhat.com>
+---
+ configure.ac        |   5 +--
+ plugins/digestmd5.c | 107 +++++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 108 insertions(+), 4 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 388f5d02..cfdee4a2 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1102,12 +1102,11 @@ AC_ARG_WITH(configdir, [   --with-configdir=DIR    set the directory where confi
+ AC_SUBST(configdir)
+ 
+-dnl look for rc4 libraries. we accept the CMU one or one from openSSL
+-AC_ARG_WITH(rc4, [  --with-rc4              use internal rc4 routines [[yes]] ],
++AC_ARG_WITH(rc4, [  --with-rc4              use rc4 routines [[yes]] ],
+ 	with_rc4=$withval,
+ 	with_rc4=yes)
+ 
+ if test "$with_rc4" != no; then
+-    AC_DEFINE(WITH_RC4,[],[Use internal RC4 implementation?])
++    AC_DEFINE(WITH_RC4,[],[Use RC4])
+ fi
+ 
+ building_for_macosx=no
+diff --git a/plugins/digestmd5.c b/plugins/digestmd5.c
+index df35093d..c6b54317 100644
+--- a/plugins/digestmd5.c
++++ b/plugins/digestmd5.c
+@@ -1117,6 +1117,111 @@ static void free_des(context_t *text)
+ #endif /* WITH_DES */
+ 
+ #ifdef WITH_RC4
++#ifdef HAVE_OPENSSL
++#include <openssl/evp.h>
++
++static void free_rc4(context_t *text)
++{
++    if (text->cipher_enc_context) {
++        EVP_CIPHER_CTX_free((EVP_CIPHER_CTX *)text->cipher_enc_context);
++        text->cipher_enc_context = NULL;
++    }
++    if (text->cipher_dec_context) {
++        EVP_CIPHER_CTX_free((EVP_CIPHER_CTX *)text->cipher_dec_context);
++        text->cipher_dec_context = NULL;
++    }
++}
++
++static int init_rc4(context_t *text,
++		    unsigned char enckey[16],
++		    unsigned char deckey[16])
++{
++    EVP_CIPHER_CTX *ctx;
++    int rc;
++
++    ctx = EVP_CIPHER_CTX_new();
++    if (ctx == NULL) return SASL_NOMEM;
++
++    rc = EVP_EncryptInit_ex(ctx, EVP_rc4(), NULL, enckey, NULL);
++    if (rc != 1) return SASL_FAIL;
++
++    text->cipher_enc_context = (void *)ctx;
++
++    ctx = EVP_CIPHER_CTX_new();
++    if (ctx == NULL) return SASL_NOMEM;
++
++    rc = EVP_DecryptInit_ex(ctx, EVP_rc4(), NULL, deckey, NULL);
++    if (rc != 1) return SASL_FAIL;
++
++    text->cipher_dec_context = (void *)ctx;
++
++    return SASL_OK;
++}
++
++static int dec_rc4(context_t *text,
++		   const char *input,
++		   unsigned inputlen,
++		   unsigned char digest[16] __attribute__((unused)),
++		   char *output,
++		   unsigned *outputlen)
++{
++    int len;
++    int rc;
++
++    /* decrypt the text part & HMAC */
++    rc = EVP_DecryptUpdate((EVP_CIPHER_CTX *)text->cipher_dec_context,
++                           (unsigned char *)output, &len,
++                           (const unsigned char *)input, inputlen);
++    if (rc != 1) return SASL_FAIL;
++
++    *outputlen = len;
++
++    rc = EVP_DecryptFinal_ex((EVP_CIPHER_CTX *)text->cipher_dec_context,
++                             (unsigned char *)output + len, &len);
++    if (rc != 1) return SASL_FAIL;
++
++    *outputlen += len;
++
++    /* subtract the HMAC to get the text length */
++    *outputlen -= 10;
++
++    return SASL_OK;
++}
++
++static int enc_rc4(context_t *text,
++		   const char *input,
++		   unsigned inputlen,
++		   unsigned char digest[16],
++		   char *output,
++		   unsigned *outputlen)
++{
++    int len;
++    int rc;
++    /* encrypt the text part */
++    rc = EVP_EncryptUpdate((EVP_CIPHER_CTX *)text->cipher_enc_context,
++                           (unsigned char *)output, &len,
++                           (const unsigned char *)input, inputlen);
++    if (rc != 1) return SASL_FAIL;
++
++    *outputlen = len;
++
++    /* encrypt the `MAC part */
++    rc = EVP_EncryptUpdate((EVP_CIPHER_CTX *)text->cipher_enc_context,
++                           (unsigned char *)output + *outputlen, &len,
++                           digest, 10);
++    if (rc != 1) return SASL_FAIL;
++
++    *outputlen += len;
++
++    rc = EVP_EncryptFinal_ex((EVP_CIPHER_CTX *)text->cipher_enc_context,
++                             (unsigned char *)output + *outputlen, &len);
++    if (rc != 1) return SASL_FAIL;
++
++    *outputlen += len;
++
++    return SASL_OK;
++}
++#else
+ /* quick generic implementation of RC4 */
+ struct rc4_context_s {
+     unsigned char sbox[256];
+@@ -1296,7 +1401,7 @@ static int enc_rc4(context_t *text,
+     
+     return SASL_OK;
+ }
+-
++#endif /* HAVE_OPENSSL */
+ #endif /* WITH_RC4 */
+ 
+ struct digest_cipher available_ciphers[] =

SOURCES/make-no-dlcompatorsrp-tarball.sh

@@ -1,6 +1,6 @@
 #!/bin/bash -e
 #
-#  See https://github.com/cyrusimap/cyrus-sasl/releases for unmodified sources.
+#  See ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/ for unmodified sources.
 #
 
 tmppath=`mktemp -d ${TMPDIR:-/tmp}/make-no-dlcompat-tarball-XXXXXX`

SOURCES/sasl-mechlist.c

@@ -34,7 +34,7 @@ main(int argc, char **argv)
 	int ret, i;
 	const char *mechs, **globals;
 	sasl_callback_t callbacks[] = {
-		{SASL_CB_GETOPT, (int (*)(void)) my_getopt, NULL},
+		{SASL_CB_GETOPT, my_getopt, NULL},
 		{SASL_CB_LIST_END},
 	};
 	sasl_conn_t *connection;

SPECS/cyrus-sasl.spec

@@ -1,30 +1,20 @@
-## START: Set by rpmautospec
-## (rpmautospec version 0.6.1)
-## RPMAUTOSPEC: autorelease, autochangelog
-%define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 22;
-    base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
-    print(release_number + base_release_number - 1);
-}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
-## END: Set by rpmautospec
-
 %global username    saslauth
+%global hint        Saslauthd user
+%global homedir     /run/saslauthd
 
 %global _plugindir2 %{_libdir}/sasl2
 %global bootstrap_cyrus_sasl 0
 
 Summary: The Cyrus SASL library
 Name: cyrus-sasl
-Version: 2.1.28
-Release: %autorelease
-License: BSD-Attribution-HPND-disclaimer
-URL: https://www.cyrusimap.org/sasl/
-
+Version: 2.1.27
+Release: 6%{?dist}
+License: BSD with advertising
+Group: System Environment/Libraries
 # Source0 originally comes from https://www.cyrusimap.org/releases/;
 # make-no-dlcompatorsrp-tarball.sh removes the "dlcompat" subdirectory and builds a
 # new tarball.
 Source0: cyrus-sasl-%{version}-nodlcompatorsrp.tar.gz
-Source3: saslauth.sysusers
 Source5: saslauthd.service
 Source7: sasl-mechlist.c
 Source9: saslauthd.sysconfig
@@ -32,42 +22,38 @@ Source10: make-no-dlcompatorsrp-tarball.sh
 # From upstream git, required for reconfigure after applying patches to configure.ac
 # https://raw.githubusercontent.com/cyrusimap/cyrus-sasl/master/autogen.sh
 Source11: autogen.sh
-
-
+URL: https://www.cyrusimap.org/sasl/
 Requires: %{name}-lib%{?_isa} = %{version}-%{release}
 Patch11: cyrus-sasl-2.1.25-no_rpath.patch
 Patch15: cyrus-sasl-2.1.20-saslauthd.conf-path.patch
 Patch23: cyrus-sasl-2.1.23-man.patch
 Patch24: cyrus-sasl-2.1.21-sizes.patch
-# The 64 bit *INT8 type is not used anywhere and other types match
 Patch49: cyrus-sasl-2.1.26-md5global.patch
+Patch60: cyrus-sasl-pr559-RC4-openssl.patch
+Patch830: cyrus-sasl-2.1.27-CVE-2019-19906.patch
+Patch831: cyrus-sasl-2.1.27-Add-basic-test-infrastructure.patch
+Patch832: cyrus-sasl-2.1.27-Add-Channel-Binding-support-for-GSSAPI-GSS-SPNEGO.patch
+Patch833: cyrus-sasl-2.1.27-Add-support-for-setting-max-ssf-0-to-GSS-SPNEGO.patch
+Patch834: cyrus-sasl-2.1.27-Emit-debug-log-only-in-case-of-errors.patch
 
-Patch101: cyrus-sasl-2.1.27-Add-basic-test-infrastructure.patch
-Patch102: cyrus-sasl-2.1.27-Add-Channel-Binding-support-for-GSSAPI-GSS-SPNEGO.patch
-#https://github.com/simo5/cyrus-sasl/commit/ebd2387f06c84c7f9aac3167ec041bb01e5c6e48
-Patch106: cyrus-sasl-2.1.27-nostrncpy.patch
-# Upstream PR: https://github.com/cyrusimap/cyrus-sasl/pull/635
-Patch107: cyrus-sasl-2.1.27-more-tests.patch
-Patch108: cyrus-sasl-2.1.27-Add-support-for-setting-max-ssf-0-to-GSS-SPNEGO.patch
-Patch500: cyrus-sasl-2.1.27-coverity.patch
-Patch501: cyrus-sasl-2.1.27-cumulative-digestmd5.patch
-Patch502: cyrus-sasl-2.1.27-cumulative-ossl3.patch
-Patch503: cyrus-sasl-2.1.28-SAST.patch
-
-Patch599: cyrus-sasl-2.1.28-fedora-c99.patch
+Patch900: 0001-CVE-2022-24407-Escape-password-for-SQL-insert-update.patch
 
+Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: autoconf, automake, libtool, gdbm-devel, groff
 BuildRequires: krb5-devel >= 1.2.2, openssl-devel, pam-devel, pkgconfig
-BuildRequires: mariadb-connector-c-devel, libpq-devel, zlib-devel
+BuildRequires: mariadb-connector-c-devel, postgresql-devel, zlib-devel
+BuildRequires: libdb-devel
 %if ! %{bootstrap_cyrus_sasl}
 BuildRequires: openldap-devel
 %endif
 #build reqs for make check
-BuildRequires: python3 nss_wrapper socket_wrapper krb5-server
-BuildRequires: make
+BuildRequires: python36 nss_wrapper socket_wrapper krb5-server
+%{?systemd_requires}
+Requires(post): chkconfig
 Requires(pre): /usr/sbin/useradd /usr/sbin/groupadd
 Requires(postun): /usr/sbin/userdel /usr/sbin/groupdel
 Requires: /sbin/nologin
+Requires: systemd >= 211
 Provides: user(%username)
 Provides: group(%username)
 
@@ -78,6 +64,7 @@ SASL is the Simple Authentication and Security Layer, a method for
 adding authentication support to connection-based protocols.
 
 %package lib
+Group: System Environment/Libraries
 Summary: Shared libraries needed by applications which use Cyrus SASL
 
 %description lib
@@ -88,6 +75,7 @@ applications which use the Cyrus SASL library.
 Requires: %{name}-lib%{?_isa} = %{version}-%{release}
 Requires: %{name}%{?_isa} = %{version}-%{release}
 Requires: pkgconfig
+Group: Development/Libraries
 Summary: Files needed for developing applications with Cyrus SASL
 
 %description devel
@@ -96,6 +84,7 @@ compiling applications which use the Cyrus SASL library.
 
 %package gssapi
 Requires: %{name}-lib%{?_isa} = %{version}-%{release}
+Group: System Environment/Libraries
 Summary: GSSAPI authentication support for Cyrus SASL
 
 %description gssapi
@@ -105,6 +94,7 @@ authentication.
 
 %package plain
 Requires: %{name}-lib%{?_isa} = %{version}-%{release}
+Group: System Environment/Libraries
 Summary: PLAIN and LOGIN authentication support for Cyrus SASL
 
 %description plain
@@ -113,15 +103,26 @@ PLAIN and LOGIN authentication schemes.
 
 %package md5
 Requires: %{name}-lib%{?_isa} = %{version}-%{release}
+Group: System Environment/Libraries
 Summary: CRAM-MD5 and DIGEST-MD5 authentication support for Cyrus SASL
 
 %description md5
 The %{name}-md5 package contains the Cyrus SASL plugins which support
 CRAM-MD5 and DIGEST-MD5 authentication schemes.
 
+%package ntlm
+Requires: %{name}-lib%{?_isa} = %{version}-%{release}
+Group: System Environment/Libraries
+Summary: NTLM authentication support for Cyrus SASL
+
+%description ntlm
+The %{name}-ntlm package contains the Cyrus SASL plugin which supports
+the NTLM authentication scheme.
+
 # This would more appropriately be named cyrus-sasl-auxprop-sql.
 %package sql
 Requires: %{name}-lib%{?_isa} = %{version}-%{release}
+Group: System Environment/Libraries
 Summary: SQL auxprop support for Cyrus SASL
 
 %description sql
@@ -132,6 +133,7 @@ using a RDBMS for storing shared secrets.
 # This was *almost* named cyrus-sasl-auxprop-ldapdb, but that's a lot of typing.
 %package ldap
 Requires: %{name}-lib%{?_isa} = %{version}-%{release}
+Group: System Environment/Libraries
 Summary: LDAP auxprop support for Cyrus SASL
 
 %description ldap
@@ -141,6 +143,7 @@ a directory server, accessed using LDAP, for storing shared secrets.
 
 %package scram
 Requires: %{name}-lib%{?_isa} = %{version}-%{release}
+Group: System Environment/Libraries
 Summary: SCRAM auxprop support for Cyrus SASL
 
 %description scram
@@ -149,6 +152,7 @@ the SCRAM authentication scheme.
 
 %package gs2
 Requires: %{name}-lib%{?_isa} = %{version}-%{release}
+Group: System Environment/Libraries
 Summary: GS2 support for Cyrus SASL
 
 %description gs2
@@ -165,16 +169,13 @@ the GS2 authentication scheme.
 %patch23 -p1 -b .man
 %patch24 -p1 -b .sizes
 %patch49 -p1 -b .md5global.h
-%patch101 -p1 -b .tests
-%patch102 -p1 -b .gssapi_cbs
-%patch106 -p1 -b .nostrncpy
-%patch107 -p1 -b .moretests
-%patch108 -p1 -b .maxssf0
-%patch500 -p1 -b .coverity
-%patch501 -p1 -b .digestmd5
-%patch502 -p1 -b .ossl3
-%patch503 -p1 -b .sast
-%patch599 -p1 -b .c99
+%patch60 -p1 -b .openssl_rc4
+%patch830 -p1 -b .CVE-2019-19906
+%patch831 -p1 -b .tests
+%patch832 -p1 -b .gssapi_cbs
+%patch833 -p1 -b .maxssf0
+%patch834 -p1 -b .nolog
+%patch900 -p1 -b .CVE-2022-24407
 
 %build
 # reconfigure
@@ -183,7 +184,6 @@ rm configure aclocal.m4 config/ltmain.sh Makefile.in
 export NOCONFIGURE=yes
 sh autogen.sh
 
-%set_build_flags
 # Find Kerberos.
 krb5_prefix=`krb5-config --prefix`
 if test x$krb5_prefix = x%{_prefix} ; then
@@ -220,8 +220,14 @@ if test x"$LIB_DIR" != "x-L%{_libdir}"; then
         LDFLAGS="$LIB_DIR $LDFLAGS"; export LDFLAGS
 fi
 
-# run "make check" against the built library rather than the one in buildroot
-LDFLAGS="-Wl,--enable-new-dtags $LDFLAGS"; export LDFLAGS
+# Patch config.sub to support ppc64p7 subarch (Fedora specific)
+# This is similar to what the config.sub from automake has
+for i in `find . -name config.sub`; do
+  perl -pi -e "s/ppc64-\*/ppc64-\* \| ppc64p7-\*/" $i
+done
+
+CFLAGS="$RPM_OPT_FLAGS $CFLAGS $CPPFLAGS -fPIC -pie -Wl,-z,relro -Wl,-z,now"; export CFLAGS
+LDFLAGS="$LDFLAGS -pie -Wl,-z,now"; export LDFLAGS
 
 echo "$CFLAGS"
 echo "$CPPFLAGS"
@@ -236,8 +242,8 @@ echo "$LDFLAGS"
         --enable-gssapi${krb5_prefix:+=${krb5_prefix}} \
         --with-gss_impl=mit \
         --with-rc4 \
-        --with-dblib=gdbm \
-        --with-dbpath=%{gdbm_db_file} \
+        --with-dblib=berkeley \
+        --with-bdb=db \
         --with-saslauthd=/run/saslauthd --without-pwcheck \
 %if ! %{bootstrap_cyrus_sasl}
         --with-ldap \
@@ -246,7 +252,7 @@ echo "$LDFLAGS"
         --enable-anon \
         --enable-cram \
         --enable-digest \
-        --disable-ntlm \
+        --enable-ntlm \
         --enable-plain \
         --enable-login \
         --enable-alwaystrue \
@@ -257,8 +263,8 @@ echo "$LDFLAGS"
 %endif
         --enable-sql --with-mysql=yes --with-pgsql=yes \
         --without-sqlite \
-        --enable-auth-sasldb \
         "$@"
+        # --enable-auth-sasldb -- EXPERIMENTAL
 make sasldir=%{_plugindir2}
 make -C saslauthd testsaslauthd
 make -C sample
@@ -288,8 +294,9 @@ install -m755 -d $RPM_BUILD_ROOT%{_mandir}/man8/
 install -m644 -p saslauthd/saslauthd.mdoc $RPM_BUILD_ROOT%{_mandir}/man8/saslauthd.8
 install -m644 -p saslauthd/testsaslauthd.8 $RPM_BUILD_ROOT%{_mandir}/man8/testsaslauthd.8
 
-# Install the systemd unit file for saslauthd and the config file.
-install -d -m755 $RPM_BUILD_ROOT/%{_unitdir} $RPM_BUILD_ROOT/etc/sysconfig
+# Install the init script for saslauthd and the init script's config file.
+install -m755 -d $RPM_BUILD_ROOT/etc/rc.d/init.d $RPM_BUILD_ROOT/etc/sysconfig
+install -d -m755 $RPM_BUILD_ROOT/%{_unitdir}
 install -m644 -p %{SOURCE5} $RPM_BUILD_ROOT/%{_unitdir}/saslauthd.service
 install -m644 -p %{SOURCE9} $RPM_BUILD_ROOT/etc/sysconfig/saslauthd
 
@@ -301,9 +308,6 @@ install -m755 -d $RPM_BUILD_ROOT/%{_plugindir2}
 ./libtool --mode=install \
 install -m755 lib/sasl2-shared-mechlist $RPM_BUILD_ROOT/%{_sbindir}/
 
-# Sysusers file
-install -p -D -m 0644 %{SOURCE3} %{buildroot}%{_sysusersdir}/cyrus-sasl.conf
-
 # Remove unpackaged files from the buildroot.
 rm -f $RPM_BUILD_ROOT%{_libdir}/sasl2/libotp.*
 rm -f $RPM_BUILD_ROOT%{_libdir}/sasl2/*.a
@@ -315,7 +319,8 @@ rm -f $RPM_BUILD_ROOT%{_mandir}/cat8/saslauthd.8
 make check %{?_smp_mflags}
 
 %pre
-%sysusers_create_compat %{SOURCE3}
+getent group %{username} >/dev/null || groupadd -g 76 -r %{username}
+getent passwd %{username} >/dev/null || useradd -r -g %{username} -d %{homedir} -s /sbin/nologin -c "%{hint}" %{username}
 
 %post
 %systemd_post saslauthd.service
@@ -326,9 +331,16 @@ make check %{?_smp_mflags}
 %postun
 %systemd_postun_with_restart saslauthd.service
 
-%ldconfig_scriptlets lib
+%triggerun -n cyrus-sasl -- cyrus-sasl < 2.1.23-32
+/usr/bin/systemd-sysv-convert --save saslauthd >/dev/null 2>&1 || :
+/sbin/chkconfig --del saslauthd >/dev/null 2>&1 || :
+/bin/systemctl try-restart saslauthd.service >/dev/null 2>&1 || :
+
+%post lib -p /sbin/ldconfig
+%postun lib -p /sbin/ldconfig
 
 %files
+%defattr(-,root,root)
 %doc saslauthd/LDAP_SASLAUTHD
 %{_mandir}/man8/*
 %{_sbindir}/pluginviewer
@@ -336,10 +348,10 @@ make check %{?_smp_mflags}
 %{_sbindir}/testsaslauthd
 %config(noreplace) /etc/sysconfig/saslauthd
 %{_unitdir}/saslauthd.service
-%ghost %attr(755,root,root) /run/saslauthd
-%{_sysusersdir}/cyrus-sasl.conf
+%ghost /run/saslauthd
 
 %files lib
+%defattr(-,root,root)
 %license COPYING
 %doc AUTHORS doc/html/*.html
 %{_libdir}/libsasl*.so.*
@@ -351,31 +363,43 @@ make check %{?_smp_mflags}
 %{_sbindir}/sasldblistusers2
 
 %files plain
+%defattr(-,root,root)
 %{_plugindir2}/*plain*.so*
 %{_plugindir2}/*login*.so*
 
 %if ! %{bootstrap_cyrus_sasl}
 %files ldap
+%defattr(-,root,root)
 %{_plugindir2}/*ldapdb*.so*
 %endif
 
 %files md5
+%defattr(-,root,root)
 %{_plugindir2}/*crammd5*.so*
 %{_plugindir2}/*digestmd5*.so*
 
+%files ntlm
+%defattr(-,root,root)
+%{_plugindir2}/*ntlm*.so*
+
 %files sql
+%defattr(-,root,root)
 %{_plugindir2}/*sql*.so*
 
 %files gssapi
+%defattr(-,root,root)
 %{_plugindir2}/*gssapi*.so*
 
 %files scram
+%defattr(-,root,root)
 %{_plugindir2}/libscram.so*
 
 %files gs2
+%defattr(-,root,root)
 %{_plugindir2}/libgs2.so*
 
 %files devel
+%defattr(-,root,root)
 %{_bindir}/sasl2-sample-client
 %{_bindir}/sasl2-sample-server
 %{_includedir}/*
@@ -385,149 +409,40 @@ make check %{?_smp_mflags}
 %{_sbindir}/sasl2-shared-mechlist
 
 %changelog
-## START: Generated by rpmautospec
-* Thu Jun 20 2024 Rob Crittenden <rcritten@redhat.com> - 2.1.28-22
-- Update license to BSD-Attribution-HPND-disclaimer
+* Thu Feb 17 2022 Simo Sorce <simo@redhat.com> - 2.1.27-6
+- Fix for CVE-2022-24407
+- Resolves: rhbz#2055846
 
-* Wed Jun 19 2024 Filip Janus <fjanus@redhat.com> - 2.1.28-21
-- Remove BerkeleyDB converting tool. It was intended to be removed in
-  RHEL10. Because There is no instance of BerkeleyDB in RHEL10/c10s
-  Resolves: RHEL-43136
-
-* Tue Jun 11 2024 Rob Crittenden <rcritten@redhat.com> - 2.1.28-20
-- Fix some issues uncovered by a static analyzer
-
-* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.28-19
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.28-18
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Wed Jan 17 2024 Florian Weimer <fweimer@redhat.com> - 2.1.28-17
-- sasl-mechlist.c: Cast function pointer to the expected type
-
-* Mon Jan 15 2024 Rob Crittenden <rcritten@redhat.com> - 2.1.28-16
-- Disable and drop the ntlm plugin as it is removed upstream
-
-* Thu Jan 11 2024 Rob Crittenden <rcritten@redhat.com> - 2.1.28-15
-- tests: Switch openldap database to the LMDB backend
-
-* Mon Jan 08 2024 Rob Crittenden <rcritten@redhat.com> - 2.1.28-14
-- Add a mode and ownership to the ghost /run/saslauthd directory
-
-* Fri Sep 08 2023 Simo Sorce <simo@redhat.com> - 2.1.28-13
-- Migrate license field to SPDX format
-
-* Wed Jul 19 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 2.1.28-12
-- Add --enable-new-dtags to LDFLAGS
-
-* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.28-11
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Thu Apr 20 2023 DJ Delorie <dj@redhat.com> - 2.1.28-10
-- Fix C99 compatibility issue
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.28-9
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Thu Aug 18 2022 Kalev Lember <klember@redhat.com> - 2.1.28-8
-- Avoid requires on systemd as well as per updated guidelines
-
-* Fri Aug 05 2022 Kalev Lember <klember@redhat.com> - 2.1.28-7
-- Avoid systemd_requires as per updated packaging guidelines
-
-* Mon Aug 01 2022 Simo Sorce <simo@redhat.com> - 2.1.28-6
-- Fix memory leak in digestmd5 patches
-
-* Wed Jul 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.28-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Thu Jun 09 2022 Simo Sorce <simo@redhat.com> - 2.1.28-4
-- Use systemd sysusers to create saslauth user
-
-* Thu Jun 09 2022 Simo Sorce <simo@redhat.com> - 2.1.28-3
-- Enable sasldb authentication mechanism
-
-* Wed May 11 2022 Simo Sorce <simo@redhat.com> - 2.1.28-2
-- Fix changelog section with correct syntax
-
-* Wed Feb 23 2022 Simo Sorce <simo@redhat.com> - 2.1.28-1
-- Update to 2.1.28
-
-* Wed Feb 23 2022 Simo Sorce <simo@redhat.com> - 2.1.27-49
-- Move to use autorelease macro
-
-* Tue Oct 12 2021 Simo Sorce <simo@redhat.com> - 2.1.27-16
-- Fix rpath patch
-- Resolves: rhbz#2012172
-
-* Wed Oct  6 2021 Simo Sorce <simo@redhat.com> - 2.1.27-15
-- More openssl 3 compatibility and digestmd5 updates.
-
-* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.1.27-14
-- Rebuilt with OpenSSL 3.0.0
-
-* Tue Aug 10 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 2.1.27-13
-- Preserve GDBM error to correctly deal with GDBM sasldb
-- Related: rhbz#1952926
-
-* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.27-12
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Mon May 03 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 2.1.27-11
-- Fix some coverity issues
-- Set default sasldb database to GDBM instead of BerkeleyDB
-- Add the migration tool from BerkeleyDB
-- Add some PLAIN auth tests
-
-* Tue Apr 06 2021 Simo Sorce <simo@redhat.com> - 2.1.27-10
-- Fix issues with autoconf 2.70+
-
-* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.1.27-9
-- Rebuilt for updated systemd-rpm-macros
-  See https://pagure.io/fesco/issue/2583.
-
-* Mon Feb 08 2021 Pavel Raiskup <praiskup@redhat.com> - 2.1.27-8
-- rebuild for libpq ABI fix rhbz#1908268
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.27-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.27-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Thu May  7 2020 Simo Sorce <simo@redhat.com> - 2.1.27-5
-- Backport GSSAPI Channel Bindings support
-- Add support for setting maxssf=0 in GSS-SPNEGO
+* Tue May  5 2020 Simo Sorce <simo@redhat.com> - 2.1.27-5
 - Reduce excessive GSSAPI plugin logging
+- Resolves: rhbz#1274734
 
-* Thu Mar 19 2020 Simo Sorce - 2.1.27-4
-- Fix CVE 2019 19906
+* Tue May  5 2020 Simo Sorce <simo@redhat.com> - 2.1.27-4
+- Add support for setting maxssf=0 in GSS-SPNEGO
+- Resolves: rhbz#1822133
 
-* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.27-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+* Tue May  5 2020 Simo Sorce <simo@redhat.com> - 2.1.27-3
+- Backport GSSAPI Channel Bindings support
+- Resolves: rhbz#1817054
 
-* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.27-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+* Tue May  5 2020 Simo Sorce <simo@redhat.com> - 2.1.27-2
+- Backport fix for CVE-2019-19906
+- Resolves: rhbz#1804036
 
-* Thu Jun 13 2019 Simo Sorce - 2.1.27-1
-- Update to final 2.1.27 sources
-- Also add patch to use OpenSSL RC4, currently proposed as PR 559
+* Fri Jun 14 2019 Simo Sorce <simo@redhat.com> - 2.1.27-1
+- Rc7 to final source
+- Resovles bz#1618744
 
-* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.27-0.6rc7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+* Thu Jun 13 2019 Simo Sorce <simo@redhat.com> - 2.1.27-0.4rc7
+- Add patch form Upstream PR559 to use RC4 implementation from OpenSSL
+- Resolves bz#1618744
+- Fix multilib issue bz#1663120
 
-* Mon Jan 14 2019 Björn Esser <besser82@fedoraproject.org> - 2.1.27-0.5rc7
-- Rebuilt for libcrypt.so.2 (#1666033)
+* Mon Jul 30 2018 Florian Weimer <fweimer@redhat.com> - 2.1.27-0.3rc7
+- Rebuild with fixed binutils
 
-* Sun Oct 14 2018 Peter Robinson <pbrobinson@fedoraproject.org> 2.1.27-0.4rc7
-- Clean up remanents of sys-v, spec cleanups
-
-* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.27-0.3rc7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Thu May 17 2018 Jakub Jelen <jjelen@redhat.com> - 2.1.27-0.2rc7
-- Avoid multilib conflicts between devel subpackages (#1577675)
+* Wed Jul 25 2018 Petr Kubat <pkubat@redhat.com> - 2.1.27-0.2rc7
+- Rebuilt for gdbm
 
 * Mon Mar 05 2018 Jakub Jelen <jjelen@redhat.com> - 2.1.27-0.1rc7
 - New upstream (pre-)release
@@ -1247,5 +1162,3 @@ make check %{?_smp_mflags}
 
 * Fri Aug 13 1999 Tim Powers <timp@redhat.com>
 - first build for Powertools
-
-## END: Generated by rpmautospec

cyrus-sasl-2.1.27-Add-support-for-setting-max-ssf-0-to-GSS-SPNEGO.patch

@@ -1,95 +0,0 @@
-Backport of part of Upstream PR#603 minimal part needed for interop
-
-From 0e722dd3266d5ebd0f889462cc23856fde3d21ed Mon Sep 17 00:00:00 2001
-From: Simo Sorce <simo@redhat.com>
-Date: Thu, 19 Sep 2019 15:58:04 -0400
-Subject: [PATCH] Add support for setting max ssf 0 to GSS-SPNEGO
-
-This is needed to interop with Windows within a TLS channel.
-
-Signed-off-by: Simo Sorce <simo@redhat.com>
----
- m4/sasl2.m4      | 13 +++++++++++++
- plugins/gssapi.c | 45 ++++++++++++++++++++++++++++++++++++++++++++-
- 2 files changed, 57 insertions(+), 1 deletion(-)
-
-diff --git a/m4/sasl2.m4 b/m4/sasl2.m4
-index 17f5d081..60306943 100644
---- a/m4/sasl2.m4
-+++ b/m4/sasl2.m4
-@@ -287,6 +287,19 @@ if test "$gssapi" != no; then
-   AC_CHECK_FUNCS(gss_oid_equal)
-   LIBS="$cmu_save_LIBS"
- 
-+  cmu_save_LIBS="$LIBS"
-+  LIBS="$LIBS $GSSAPIBASE_LIBS"
-+  if test "$ac_cv_header_gssapi_gssapi_krb5_h" = "yes"; then
-+    AC_CHECK_DECL(GSS_KRB5_CRED_NO_CI_FLAGS_X,
-+                  [AC_DEFINE(HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X,1,
-+                             [Define if your GSSAPI implementation supports GSS_KRB5_CRED_NO_CI_FLAGS_X])],,
-+                  [
-+                    AC_INCLUDES_DEFAULT
-+                    #include <gssapi/gssapi_krb5.h>
-+                    ])
-+  fi
-+  LIBS="$cmu_save_LIBS"
-+
-   cmu_save_LIBS="$LIBS"
-   LIBS="$LIBS $GSSAPIBASE_LIBS"
-   AC_CHECK_FUNCS(gss_get_name_attribute)
-diff --git a/plugins/gssapi.c b/plugins/gssapi.c
-index 46de7d48..cca6cc0a 100644
---- a/plugins/gssapi.c
-+++ b/plugins/gssapi.c
-@@ -2123,7 +2123,50 @@ static int gssapi_client_mech_step(void *conn_context,
- 		/* We want to try for privacy */
- 		req_flags |= GSS_C_CONF_FLAG;
- 	    }
--	}
-+#ifdef HAVE_GSS_KRB5_CRED_NO_CI_FLAGS_X
-+        /* The krb5 mechanism automatically adds INTEG and CONF flags even when
-+         * not specified, this has the effect of rendering explicit requests
-+         * of no confidentiality and integrity via setting maxssf 0 moot.
-+         * However to interoperate with Windows machines it needs to be
-+         * possible to unset these flags as Windows machines refuse to allow
-+         * two layers (say TLS and GSSAPI) to both provide these services.
-+         * So if we do not suppress these flags a SASL/GSS-SPNEGO negotiation
-+         * over, say, LDAPS will fail against Windows Servers */
-+	} else if (params->props.max_ssf == 0) {
-+            gss_buffer_desc empty_buffer = GSS_C_EMPTY_BUFFER;
-+            if (client_creds == GSS_C_NO_CREDENTIAL) {
-+                gss_OID_set_desc mechs = { 0 };
-+                gss_OID_set desired_mechs = GSS_C_NO_OID_SET;
-+                if (text->mech_type != GSS_C_NO_OID) {
-+                    mechs.count = 1;
-+                    mechs.elements = text->mech_type;
-+                    desired_mechs = &mechs;
-+                }
-+
-+                maj_stat = gss_acquire_cred(&min_stat, GSS_C_NO_NAME,
-+                                            GSS_C_INDEFINITE, desired_mechs,
-+                                            GSS_C_INITIATE,
-+                                            &text->client_creds, NULL, NULL);
-+                if (GSS_ERROR(maj_stat)) {
-+                    sasl_gss_seterror(text->utils, maj_stat, min_stat);
-+                    sasl_gss_free_context_contents(text);
-+                    return SASL_FAIL;
-+                }
-+                client_creds = text->client_creds;
-+            }
-+
-+            maj_stat = gss_set_cred_option(&min_stat, &client_creds,
-+                                           (gss_OID)GSS_KRB5_CRED_NO_CI_FLAGS_X,
-+                                            &empty_buffer);
-+            if (GSS_ERROR(maj_stat)) {
-+                sasl_gss_seterror(text->utils, maj_stat, min_stat);
-+                sasl_gss_free_context_contents(text);
-+                return SASL_FAIL;
-+            }
-+#endif
-+        }
-+
-+
-
-	if (params->props.security_flags & SASL_SEC_PASS_CREDENTIALS) {
-	    req_flags = req_flags |  GSS_C_DELEG_FLAG;

cyrus-sasl-2.1.27-coverity.patch

@@ -1,56 +0,0 @@
-diff -up cyrus-sasl-2.1.27/include/makemd5.c.coverity cyrus-sasl-2.1.27/include/makemd5.c
---- cyrus-sasl-2.1.27/include/makemd5.c.coverity	2021-04-12 15:10:25.421431535 +0200
-+++ cyrus-sasl-2.1.27/include/makemd5.c	2021-04-12 15:56:46.752827737 +0200
-@@ -107,7 +107,6 @@ my_strupr(char *s)
-     }	
- }
- 
--
- #define BITSIZE(TYPE)						\
- {								\
-     int b = 0; TYPE x = 1, zero = 0; char *pre = "U";		\
-@@ -129,6 +128,8 @@ my_strupr(char *s)
- static void
- try_signed(FILE *f, int len)
- {
-+/* Local macros for not-installed program. No coverity/compiler issues! */
-+#pragma GCC diagnostic ignored "-Wformat-overflow"
- #ifdef HAVE_INT8_T
-     BITSIZE(int8_t);
- #endif
-@@ -149,6 +150,7 @@ try_signed(FILE *f, int len)
-     BITSIZE(long long);
- #endif
-     fprintf(f, "/* There is no %d bit type */\n", len);
-+#pragma GCC pop
- }
- 
- static void
-diff -up cyrus-sasl-2.1.27/saslauthd/lak.c.coverity cyrus-sasl-2.1.27/saslauthd/lak.c
---- cyrus-sasl-2.1.27/saslauthd/lak.c.coverity	2018-11-08 18:29:57.000000000 +0100
-+++ cyrus-sasl-2.1.27/saslauthd/lak.c	2021-04-12 15:10:25.433431630 +0200
-@@ -337,9 +337,9 @@ static int lak_config_read(
-          EMPTY(conf->group_search_base) )
-         strlcpy(conf->group_search_base, conf->search_base, LAK_DN_LEN);
-         
--	fclose(infile);
-+    fclose(infile);
- 
--	return LAK_OK;
-+    return LAK_OK;
- }
- 
- static int lak_config_int(
-diff -up cyrus-sasl-2.1.27/saslauthd/saslauthd-main.c.coverity cyrus-sasl-2.1.27/saslauthd/saslauthd-main.c
---- cyrus-sasl-2.1.27/saslauthd/saslauthd-main.c.coverity	2018-01-19 15:13:40.000000000 +0100
-+++ cyrus-sasl-2.1.27/saslauthd/saslauthd-main.c	2021-04-12 15:10:25.433431630 +0200
-@@ -833,7 +833,8 @@ void detach_tty() {
-     }
-     
-     logger(L_INFO, L_FUNC, "master pid is: %lu", (unsigned long)master_pid);
--    
-+    /* null_fd expected to be more than 2, so it is closed after dups, no leaks occur */
-+    /* coverity[leaked_handle : FALSE]*/
-     return;
- }
- 

cyrus-sasl-2.1.27-cumulative-digestmd5.patch

@@ -1,554 +0,0 @@
-diff -uPr cyrus-sasl-2.1.27/plugins/digestmd5.c cyrus-sasl-2.1.27.digestmd5/plugins/digestmd5.c
---- cyrus-sasl-2.1.27/plugins/digestmd5.c	2021-09-30 17:13:06.573093526 -0400
-+++ cyrus-sasl-2.1.27.digestmd5/plugins/digestmd5.c	2021-09-30 17:26:31.818378442 -0400
-@@ -80,6 +80,12 @@
- # endif
- #endif /* WITH_DES */
- 
-+/* legacy provider with openssl 3.0 */
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+#  include <openssl/provider.h>
-+#  include <openssl/crypto.h>
-+#endif
-+
- #ifdef WIN32
- # include <winsock2.h>
- #else /* Unix */
-@@ -170,6 +176,12 @@
- 
- typedef struct cipher_context cipher_context_t;
- 
-+typedef struct crypto_context {
-+    void *libctx;
-+    cipher_context_t *enc_ctx;
-+    cipher_context_t *dec_ctx;
-+} crypto_context_t;
-+
- /* cached auth info used for fast reauth */
- typedef struct reauth_entry {
-     char *authid;
-@@ -254,12 +266,12 @@
-     decode_context_t decode_context;
- 
-     /* if privacy mode is used use these functions for encode and decode */
-+    char *cipher_name;
-     cipher_function_t *cipher_enc;
-     cipher_function_t *cipher_dec;
-     cipher_init_t *cipher_init;
-     cipher_free_t *cipher_free;
--    struct cipher_context *cipher_enc_context;
--    struct cipher_context *cipher_dec_context;
-+    crypto_context_t crypto;
- } context_t;
- 
- struct digest_cipher {
-@@ -888,7 +900,7 @@
- 		    char *output,
- 		    unsigned *outputlen)
- {
--    des_context_t *c = (des_context_t *) text->cipher_dec_context;
-+    des_context_t *c = (des_context_t *) text->crypto.dec_ctx;
-     int padding, p;
-     
-     des_ede2_cbc_encrypt((void *) input,
-@@ -925,7 +937,7 @@
- 		    char *output,
- 		    unsigned *outputlen)
- {
--    des_context_t *c = (des_context_t *) text->cipher_enc_context;
-+    des_context_t *c = (des_context_t *) text->crypto.enc_ctx;
-     int len;
-     int paddinglen;
-     
-@@ -973,7 +985,7 @@
- 	return SASL_FAIL;
-     memcpy(c->ivec, ((char *) enckey) + 8, 8);
- 
--    text->cipher_enc_context = (cipher_context_t *) c;
-+    text->crypto.enc_ctx = (cipher_context_t *) c;
- 
-     /* setup dec context */
-     c++;
-@@ -987,7 +999,7 @@
-     
-     memcpy(c->ivec, ((char *) deckey) + 8, 8);
- 
--    text->cipher_dec_context = (cipher_context_t *) c;
-+    text->crypto.dec_ctx = (cipher_context_t *) c;
-     
-     return SASL_OK;
- }
-@@ -1006,7 +1018,7 @@
- 		   char *output,
- 		   unsigned *outputlen)
- {
--    des_context_t *c = (des_context_t *) text->cipher_dec_context;
-+    des_context_t *c = (des_context_t *) text->crypto.dec_ctx;
-     int p, padding = 0;
-     
-     des_cbc_encrypt((void *) input,
-@@ -1046,7 +1058,7 @@
- 		   char *output,
- 		   unsigned *outputlen)
- {
--    des_context_t *c = (des_context_t *) text->cipher_enc_context;
-+    des_context_t *c = (des_context_t *) text->crypto.enc_ctx;
-     int len;
-     int paddinglen;
-   
-@@ -1093,7 +1105,7 @@
- 
-     memcpy(c->ivec, ((char *) enckey) + 8, 8);
-     
--    text->cipher_enc_context = (cipher_context_t *) c;
-+    text->crypto.enc_ctx = (cipher_context_t *) c;
- 
-     /* setup dec context */
-     c++;
-@@ -1102,60 +1114,143 @@
- 
-     memcpy(c->ivec, ((char *) deckey) + 8, 8);
-     
--    text->cipher_dec_context = (cipher_context_t *) c;
-+    text->crypto.dec_ctx = (cipher_context_t *) c;
- 
-     return SASL_OK;
- }
- 
- static void free_des(context_t *text)
- {
--    /* free des contextss. only cipher_enc_context needs to be free'd,
--       since cipher_dec_context was allocated at the same time. */
--    if (text->cipher_enc_context) text->utils->free(text->cipher_enc_context);
-+    /* free des contextss. only enc_ctx needs to be free'd,
-+       since dec_cxt was allocated at the same time. */
-+    if (text->crypto.enc_ctx) {
-+        text->utils->free(text->crypto.enc_ctx);
-+    }
- }
- 
- #endif /* WITH_DES */
- 
- #ifdef WITH_RC4
--#ifdef HAVE_OPENSSL
- #include <openssl/evp.h>
- 
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+typedef struct ossl3_library_context {
-+    OSSL_LIB_CTX *libctx;
-+    OSSL_PROVIDER *legacy_provider;
-+    OSSL_PROVIDER *default_provider;
-+} ossl3_context_t;
-+
-+static int init_ossl3_ctx(context_t *text)
-+{
-+    ossl3_context_t *ctx = text->utils->malloc(sizeof(ossl3_context_t));
-+    if (!ctx) return SASL_NOMEM;
-+
-+    ctx->libctx = OSSL_LIB_CTX_new();
-+    if (!ctx->libctx) {
-+        text->utils->free(ctx);
-+        return SASL_FAIL;
-+    }
-+
-+    /* Load both legacy and default provider as both may be needed */
-+    /* if they fail keep going and an error will be raised when we try to
-+     * fetch the cipher later */
-+    ctx->legacy_provider = OSSL_PROVIDER_load(ctx->libctx, "legacy");
-+    ctx->default_provider = OSSL_PROVIDER_load(ctx->libctx, "default");
-+    text->crypto.libctx = (void *)ctx;
-+
-+    return SASL_OK;
-+}
-+
-+static void free_ossl3_ctx(context_t *text)
-+{
-+    ossl3_context_t *ctx;
-+
-+    if (!text->crypto.libctx) return;
-+
-+    ctx = (ossl3_context_t *)text->crypto.libctx;
-+
-+    if (ctx->legacy_provider) OSSL_PROVIDER_unload(ctx->legacy_provider);
-+    if (ctx->default_provider) OSSL_PROVIDER_unload(ctx->default_provider);
-+    if (ctx->libctx) OSSL_LIB_CTX_free(ctx->libctx);
-+
-+    text->utils->free(ctx);
-+    text->crypto.libctx = NULL;
-+}
-+#endif
-+
- static void free_rc4(context_t *text)
- {
--    if (text->cipher_enc_context) {
--        EVP_CIPHER_CTX_free((EVP_CIPHER_CTX *)text->cipher_enc_context);
--        text->cipher_enc_context = NULL;
--    }
--    if (text->cipher_dec_context) {
--        EVP_CIPHER_CTX_free((EVP_CIPHER_CTX *)text->cipher_dec_context);
--        text->cipher_dec_context = NULL;
-+    if (text->crypto.enc_ctx) {
-+        EVP_CIPHER_CTX_free((EVP_CIPHER_CTX *)text->crypto.enc_ctx);
-+        text->crypto.enc_ctx = NULL;
-+    }
-+    if (text->crypto.dec_ctx) {
-+        EVP_CIPHER_CTX_free((EVP_CIPHER_CTX *)text->crypto.dec_ctx);
-+        text->crypto.dec_ctx = NULL;
-     }
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+    free_ossl3_ctx(text);
-+#endif
- }
- 
- static int init_rc4(context_t *text,
- 		    unsigned char enckey[16],
- 		    unsigned char deckey[16])
- {
-     EVP_CIPHER_CTX *ctx;
-     int rc;
- 
--    ctx = EVP_CIPHER_CTX_new();
--    if (ctx == NULL) return SASL_NOMEM;
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+    EVP_CIPHER *cipher;
-+    ossl3_context_t *ossl3_ctx;
- 
--    rc = EVP_EncryptInit_ex(ctx, EVP_rc4(), NULL, enckey, NULL);
--    if (rc != 1) return SASL_FAIL;
-+    rc = init_ossl3_ctx(text);
-+    if (rc != SASL_OK) return rc;
-+
-+    ossl3_ctx = (ossl3_context_t *)text->crypto.libctx;
-+    cipher = EVP_CIPHER_fetch(ossl3_ctx->libctx, "RC4", "");
-+#else
-+    const EVP_CIPHER *cipher;
-+    cipher = EVP_rc4();
-+#endif
- 
--    text->cipher_enc_context = (void *)ctx;
- 
-     ctx = EVP_CIPHER_CTX_new();
--    if (ctx == NULL) return SASL_NOMEM;
-+    if (ctx == NULL) {
-+        rc = SASL_NOMEM;
-+        goto done;
-+    }
- 
--    rc = EVP_DecryptInit_ex(ctx, EVP_rc4(), NULL, deckey, NULL);
--    if (rc != 1) return SASL_FAIL;
-+    rc = EVP_EncryptInit_ex(ctx, cipher, NULL, enckey, NULL);
-+    if (rc != 1) {
-+        rc = SASL_FAIL;
-+        goto done;
-+    }
-+    text->crypto.enc_ctx = (void *)ctx;
- 
--    text->cipher_dec_context = (void *)ctx;
-+    ctx = EVP_CIPHER_CTX_new();
-+    if (ctx == NULL) {
-+        rc = SASL_NOMEM;
-+        goto done;
-+    }
- 
--    return SASL_OK;
-+    rc = EVP_DecryptInit_ex(ctx, cipher, NULL, deckey, NULL);
-+    if (rc != 1) {
-+        rc = SASL_FAIL;
-+        goto done;
-+    }
-+    text->crypto.dec_ctx = (void *)ctx;
-+
-+    rc = SASL_OK;
-+
-+done:
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+    EVP_CIPHER_free(cipher);
-+#endif
-+    if (rc != SASL_OK) {
-+        free_rc4(text);
-+    }
-+    return rc;
- }
- 
- static int dec_rc4(context_t *text,
-@@ -1169,14 +1260,14 @@
-     int rc;
- 
-     /* decrypt the text part & HMAC */
--    rc = EVP_DecryptUpdate((EVP_CIPHER_CTX *)text->cipher_dec_context,
-+    rc = EVP_DecryptUpdate((EVP_CIPHER_CTX *)text->crypto.dec_ctx,
-                            (unsigned char *)output, &len,
-                            (const unsigned char *)input, inputlen);
-     if (rc != 1) return SASL_FAIL;
- 
-     *outputlen = len;
- 
--    rc = EVP_DecryptFinal_ex((EVP_CIPHER_CTX *)text->cipher_dec_context,
-+    rc = EVP_DecryptFinal_ex((EVP_CIPHER_CTX *)text->crypto.dec_ctx,
-                              (unsigned char *)output + len, &len);
-     if (rc != 1) return SASL_FAIL;
- 
-@@ -1198,7 +1289,7 @@
-     int len;
-     int rc;
-     /* encrypt the text part */
--    rc = EVP_EncryptUpdate((EVP_CIPHER_CTX *)text->cipher_enc_context,
-+    rc = EVP_EncryptUpdate((EVP_CIPHER_CTX *)text->crypto.enc_ctx,
-                            (unsigned char *)output, &len,
-                            (const unsigned char *)input, inputlen);
-     if (rc != 1) return SASL_FAIL;
-@@ -1206,14 +1297,14 @@
-     *outputlen = len;
- 
-     /* encrypt the `MAC part */
--    rc = EVP_EncryptUpdate((EVP_CIPHER_CTX *)text->cipher_enc_context,
-+    rc = EVP_EncryptUpdate((EVP_CIPHER_CTX *)text->crypto.enc_ctx,
-                            (unsigned char *)output + *outputlen, &len,
-                            digest, 10);
-     if (rc != 1) return SASL_FAIL;
- 
-     *outputlen += len;
- 
--    rc = EVP_EncryptFinal_ex((EVP_CIPHER_CTX *)text->cipher_enc_context,
-+    rc = EVP_EncryptFinal_ex((EVP_CIPHER_CTX *)text->crypto.enc_ctx,
-                              (unsigned char *)output + *outputlen, &len);
-     if (rc != 1) return SASL_FAIL;
- 
-@@ -1221,194 +1312,11 @@
- 
-     return SASL_OK;
- }
--#else
--/* quick generic implementation of RC4 */
--struct rc4_context_s {
--    unsigned char sbox[256];
--    int i, j;
--};
--
--typedef struct rc4_context_s rc4_context_t;
--
--static void rc4_init(rc4_context_t *text,
--		     const unsigned char *key,
--		     unsigned keylen)
--{
--    int i, j;
--    
--    /* fill in linearly s0=0 s1=1... */
--    for (i=0;i<256;i++)
--	text->sbox[i]=i;
--    
--    j=0;
--    for (i = 0; i < 256; i++) {
--	unsigned char tmp;
--	/* j = (j + Si + Ki) mod 256 */
--	j = (j + text->sbox[i] + key[i % keylen]) % 256;
--	
--	/* swap Si and Sj */
--	tmp = text->sbox[i];
--	text->sbox[i] = text->sbox[j];
--	text->sbox[j] = tmp;
--    }
--    
--    /* counters initialized to 0 */
--    text->i = 0;
--    text->j = 0;
--}
--
--static void rc4_encrypt(rc4_context_t *text,
--			const char *input,
--			char *output,
--			unsigned len)
--{
--    int tmp;
--    int i = text->i;
--    int j = text->j;
--    int t;
--    int K;
--    const char *input_end = input + len;
--    
--    while (input < input_end) {
--	i = (i + 1) % 256;
--	
--	j = (j + text->sbox[i]) % 256;
--	
--	/* swap Si and Sj */
--	tmp = text->sbox[i];
--	text->sbox[i] = text->sbox[j];
--	text->sbox[j] = tmp;
--	
--	t = (text->sbox[i] + text->sbox[j]) % 256;
--	
--	K = text->sbox[t];
--	
--	/* byte K is Xor'ed with plaintext */
--	*output++ = *input++ ^ K;
--    }
--    
--    text->i = i;
--    text->j = j;
--}
--
--static void rc4_decrypt(rc4_context_t *text,
--			const char *input,
--			char *output,
--			unsigned len)
--{
--    int tmp;
--    int i = text->i;
--    int j = text->j;
--    int t;
--    int K;
--    const char *input_end = input + len;
--    
--    while (input < input_end) {
--	i = (i + 1) % 256;
--	
--	j = (j + text->sbox[i]) % 256;
--	
--	/* swap Si and Sj */
--	tmp = text->sbox[i];
--	text->sbox[i] = text->sbox[j];
--	text->sbox[j] = tmp;
--	
--	t = (text->sbox[i] + text->sbox[j]) % 256;
--	
--	K = text->sbox[t];
--	
--	/* byte K is Xor'ed with plaintext */
--	*output++ = *input++ ^ K;
--    }
--    
--    text->i = i;
--    text->j = j;
--}
--
--static void free_rc4(context_t *text)
--{
--    /* free rc4 context structures */
--
--    if (text->cipher_enc_context) {
--        text->utils->free(text->cipher_enc_context);
--        text->cipher_enc_context = NULL;
--    }
--    if (text->cipher_dec_context) {
--        text->utils->free(text->cipher_dec_context);
--        text->cipher_dec_context = NULL;
--    }
--}
--
--static int init_rc4(context_t *text, 
--		    unsigned char enckey[16],
--		    unsigned char deckey[16])
--{
--    /* allocate rc4 context structures */
--    text->cipher_enc_context=
--	(cipher_context_t *) text->utils->malloc(sizeof(rc4_context_t));
--    if (text->cipher_enc_context == NULL) return SASL_NOMEM;
--    
--    text->cipher_dec_context=
--	(cipher_context_t *) text->utils->malloc(sizeof(rc4_context_t));
--    if (text->cipher_dec_context == NULL) return SASL_NOMEM;
--    
--    /* initialize them */
--    rc4_init((rc4_context_t *) text->cipher_enc_context,
--             (const unsigned char *) enckey, 16);
--    rc4_init((rc4_context_t *) text->cipher_dec_context,
--             (const unsigned char *) deckey, 16);
--    
--    return SASL_OK;
--}
--
--static int dec_rc4(context_t *text,
--		   const char *input,
--		   unsigned inputlen,
--		   unsigned char digest[16] __attribute__((unused)),
--		   char *output,
--		   unsigned *outputlen)
--{
--    /* decrypt the text part & HMAC */
--    rc4_decrypt((rc4_context_t *) text->cipher_dec_context, 
--                input, output, inputlen);
--
--    /* no padding so we just subtract the HMAC to get the text length */
--    *outputlen = inputlen - 10;
--    
--    return SASL_OK;
--}
--
--static int enc_rc4(context_t *text,
--		   const char *input,
--		   unsigned inputlen,
--		   unsigned char digest[16],
--		   char *output,
--		   unsigned *outputlen)
--{
--    /* pad is zero */
--    *outputlen = inputlen+10;
--    
--    /* encrypt the text part */
--    rc4_encrypt((rc4_context_t *) text->cipher_enc_context,
--                input,
--                output,
--                inputlen);
--    
--    /* encrypt the HMAC part */
--    rc4_encrypt((rc4_context_t *) text->cipher_enc_context, 
--                (const char *) digest, 
--		(output)+inputlen, 10);
--    
--    return SASL_OK;
--}
--#endif /* HAVE_OPENSSL */
- #endif /* WITH_RC4 */
- 
- struct digest_cipher available_ciphers[] =
- {
- #ifdef WITH_RC4
--    { "rc4-40", 40, 5, 0x01, &enc_rc4, &dec_rc4, &init_rc4, &free_rc4 },
--    { "rc4-56", 56, 7, 0x02, &enc_rc4, &dec_rc4, &init_rc4, &free_rc4 },
-     { "rc4", 128, 16, 0x04, &enc_rc4, &dec_rc4, &init_rc4, &free_rc4 },
- #endif
- #ifdef WITH_DES
-@@ -2815,6 +2729,7 @@
- 	}
- 	
- 	if (cptr->name) {
-+	    text->cipher_name = cptr->name;
- 	    text->cipher_enc = cptr->cipher_enc;
- 	    text->cipher_dec = cptr->cipher_dec;
- 	    text->cipher_init = cptr->cipher_init;
-@@ -2958,7 +2873,10 @@
- 	if (text->cipher_init) {
- 	    if (text->cipher_init(text, enckey, deckey) != SASL_OK) {
- 		sparams->utils->seterror(sparams->utils->conn, 0,
--					 "couldn't init cipher");
-+					 "couldn't init cipher '%s'",
-+                                         text->cipher_name);
-+                result = SASL_FAIL;
-+                goto FreeAllMem;
- 	    }
- 	}
-     }
-@@ -3509,6 +3427,7 @@
- 	oparams->mech_ssf = ctext->cipher->ssf;
- 
- 	nbits = ctext->cipher->n;
-+	text->cipher_name = ctext->cipher->name;
- 	text->cipher_enc = ctext->cipher->cipher_enc;
- 	text->cipher_dec = ctext->cipher->cipher_dec;
- 	text->cipher_free = ctext->cipher->cipher_free;
-@@ -3733,7 +3652,13 @@
- 	
- 	/* initialize cipher if need be */
- 	if (text->cipher_init) {
--	    text->cipher_init(text, enckey, deckey);
-+	    if (text->cipher_init(text, enckey, deckey) != SASL_OK) {
-+	        params->utils->seterror(params->utils->conn, 0,
-+		         "internal error: failed to init cipher '%s'",
-+                         text->cipher_name);
-+                result = SASL_FAIL;
-+                goto FreeAllocatedMem;
-+            }
- 	}
-     }
-     

cyrus-sasl-2.1.27-cumulative-ossl3.patch

@@ -1,109 +0,0 @@
-diff -uPr cyrus-sasl-2.1.27/configure.ac cyrus-sasl-2.1.27.ossl3/configure.ac
---- cyrus-sasl-2.1.27/configure.ac	2021-10-06 11:29:53.274375206 -0400
-+++ cyrus-sasl-2.1.27.ossl3/configure.ac	2021-10-06 11:31:19.966726775 -0400
-@@ -1115,7 +1115,11 @@
- 	with_rc4=yes)
- 
- if test "$with_rc4" != no; then
--    AC_DEFINE(WITH_RC4,[],[Use RC4])
-+    if test "$with_openssl" = no; then
-+        AC_WARN([OpenSSL not found -- RC4 will be disabled])
-+    else
-+        AC_DEFINE(WITH_RC4,[],[Use RC4])
-+    fi
- fi
- 
- building_for_macosx=no
-diff -uPr cyrus-sasl-2.1.27/plugins/scram.c cyrus-sasl-2.1.27.ossl3/plugins/scram.c
---- cyrus-sasl-2.1.27/plugins/scram.c	2018-11-08 12:29:57.000000000 -0500
-+++ cyrus-sasl-2.1.27.ossl3/plugins/scram.c	2021-10-06 11:31:04.407484201 -0400
-@@ -65,7 +65,9 @@
- 
- #include <openssl/sha.h>
- #include <openssl/evp.h>
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
- #include <openssl/hmac.h>
-+#endif
- 
- /*****************************  Common Section  *****************************/
- 
-@@ -291,6 +293,32 @@
- }
- #endif
- 
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-+
-+/* Decalre as void given functions never use the result */
-+void *HMAC(const EVP_MD *evp_md, const void *key, int key_len,
-+                     const unsigned char *data, size_t data_len,
-+                     unsigned char *md, unsigned int *md_len)
-+{
-+    const char *digest;
-+    size_t digest_size;
-+    size_t out_len;
-+    void *ret = NULL;
-+
-+    digest = EVP_MD_get0_name(evp_md);
-+    if (digest == NULL) {
-+        return NULL;
-+    }
-+    digest_size = EVP_MD_size(evp_md);
-+
-+    ret = EVP_Q_mac(NULL, "hmac", NULL, digest, NULL, key, key_len,
-+                    data, data_len, md, digest_size, &out_len);
-+    if (ret != NULL) {
-+        *md_len = (unsigned int)out_len;
-+    }
-+    return ret;
-+}
-+#endif
- 
- /* The result variable need to point to a buffer big enough for the [SHA-*] hash */
- static void
-diff -uPr cyrus-sasl-2.1.27/saslauthd/lak.c cyrus-sasl-2.1.27.ossl3/saslauthd/lak.c
---- cyrus-sasl-2.1.27/saslauthd/lak.c	2022-01-09 11:30:50.000000000 -0400
-+++ cyrus-sasl-2.1.27.ossl3/saslauthd/lak.c	2022-01-09 11:30:50.000000001 -0400
-@@ -1806,18 +1806,36 @@
- 		return rc;
- 	}
- 
--	EVP_DigestInit(mdctx, md);
--	EVP_DigestUpdate(mdctx, passwd, strlen(passwd));
-+	rc = EVP_DigestInit(mdctx, md);
-+	if (rc != 1) {
-+		rc = LAK_FAIL;
-+		goto done;
-+	}
-+	rc = EVP_DigestUpdate(mdctx, passwd, strlen(passwd));
-+	if (rc != 1) {
-+		rc = LAK_FAIL;
-+		goto done;
-+	}
- 	if (hrock->salted) {
--		EVP_DigestUpdate(mdctx, &cred[EVP_MD_size(md)],
--				 clen - EVP_MD_size(md));
-+		rc = EVP_DigestUpdate(mdctx, &cred[EVP_MD_size(md)],
-+				      clen - EVP_MD_size(md));
-+		if (rc != 1) {
-+		    rc = LAK_FAIL;
-+		    goto done;
-+		}
-+	}
-+	rc = EVP_DigestFinal(mdctx, digest, NULL);
-+	if (rc != 1) {
-+		rc = LAK_FAIL;
-+		goto done;
- 	}
--	EVP_DigestFinal(mdctx, digest, NULL);
--	EVP_MD_CTX_free(mdctx);
- 
- 	rc = memcmp((char *)cred, (char *)digest, EVP_MD_size(md));
-+	rc = rc ? LAK_INVALID_PASSWORD : LAK_OK;
-+done:
-+	EVP_MD_CTX_free(mdctx);
- 	free(cred);
--	return rc ? LAK_INVALID_PASSWORD : LAK_OK;
-+	return rc;
- }
- 
- #endif /* HAVE_OPENSSL */

cyrus-sasl-2.1.27-more-tests.patch

@@ -1,761 +0,0 @@
-From 10ac4d4822023b24734acde3c07186937ad52813 Mon Sep 17 00:00:00 2001
-From: Dmitry Belyavskiy <beldmit@gmail.com>
-Date: Wed, 6 Jan 2021 12:38:46 +0100
-Subject: [PATCH] Some basic PLAIN auth tests
-
-Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com>
----
- tests/runtests.py    | 91 +++++++++++++++++++++++++++++++++++++++++
- tests/t_gssapi_cli.c | 97 +++++++++++++++++++++++++++++++++++++++-----
- tests/t_gssapi_srv.c | 78 +++++++++++++++++++++++++++--------
- 3 files changed, 239 insertions(+), 27 deletions(-)
-
-diff --git a/tests/runtests.py b/tests/runtests.py
-index fc9cf244..513ed3ff 100755
---- a/tests/runtests.py
-+++ b/tests/runtests.py
-@@ -239,6 +239,96 @@ def gssapi_tests(testdir):
- 
-     os.killpg(kdc.pid, signal.SIGTERM)
- 
-+def setup_plain(testdir):
-+    """ Create sasldb file """
-+    sasldbfile = os.path.join(testdir, 'testsasldb.db')
-+
-+    sasldbenv = {'SASL_PATH': os.path.join(testdir, '../../plugins/.libs'),
-+                 'LD_LIBRARY_PATH' : os.path.join(testdir, '../../lib/.libs')}
-+
-+    passwdprog = os.path.join(testdir, '../../utils/saslpasswd2')
-+
-+    echo = subprocess.Popen(('echo', '1234567'), stdout=subprocess.PIPE)
-+    subprocess.check_call([
-+        passwdprog, "-f", sasldbfile, "-c", "test",
-+        "-u", "host.realm.test", "-p"
-+        ], stdin=echo.stdout, env=sasldbenv, timeout=5)
-+
-+    return (sasldbfile, sasldbenv)
-+
-+def plain_test(sasldbfile, sasldbenv):
-+    try:
-+        srv = subprocess.Popen(["../tests/t_gssapi_srv", "-P", sasldbfile],
-+                               stdout=subprocess.PIPE,
-+                               stderr=subprocess.PIPE, env=sasldbenv)
-+        srv.stdout.readline() # Wait for srv to say it is ready
-+        cli = subprocess.Popen(["../tests/t_gssapi_cli", "-P", "1234567"],
-+                               stdout=subprocess.PIPE,
-+                               stderr=subprocess.PIPE, env=sasldbenv)
-+        try:
-+            cli.wait(timeout=5)
-+            srv.wait(timeout=5)
-+        except Exception as e:
-+            print("Failed on {}".format(e));
-+            cli.kill()
-+            srv.kill()
-+        if cli.returncode != 0 or srv.returncode != 0:
-+            raise Exception("CLI ({}): {} --> SRV ({}): {}".format(
-+                cli.returncode, cli.stderr.read().decode('utf-8'),
-+                srv.returncode, srv.stderr.read().decode('utf-8')))
-+    except Exception as e:
-+        print("FAIL: {}".format(e))
-+        return
-+
-+    print("PASS: PLAIN CLI({}) SRV({})".format(
-+        cli.stdout.read().decode('utf-8').strip(),
-+        srv.stdout.read().decode('utf-8').strip()))
-+    return
-+
-+def plain_mismatch_test(sasldbfile, sasldbenv):
-+    result = "FAIL"
-+    try:
-+        srv = subprocess.Popen(["../tests/t_gssapi_srv", "-P", sasldbfile],
-+                               stdout=subprocess.PIPE,
-+                               stderr=subprocess.PIPE, env=sasldbenv)
-+        srv.stdout.readline() # Wait for srv to say it is ready
-+        bindings = base64.b64encode("CLI CBS".encode('utf-8'))
-+        cli = subprocess.Popen(["../tests/t_gssapi_cli", "-P", "12345678"],
-+                               stdout=subprocess.PIPE,
-+                               stderr=subprocess.PIPE, env=sasldbenv)
-+        try:
-+            cli.wait(timeout=5)
-+            srv.wait(timeout=5)
-+        except Exception as e:
-+            print("Failed on {}".format(e));
-+            cli.kill()
-+            srv.kill()
-+        if cli.returncode != 0 or srv.returncode != 0:
-+            cli_err = cli.stderr.read().decode('utf-8').strip()
-+            srv_err = srv.stderr.read().decode('utf-8').strip()
-+            if "authentication failure" in srv_err:
-+                result = "PASS"
-+            raise Exception("CLI ({}): {} --> SRV ({}): {}".format(
-+                cli.returncode, cli_err, srv.returncode, srv_err))
-+    except Exception as e:
-+        print("{}: {}".format(result, e))
-+        return
-+
-+    print("FAIL: This test should fail [CLI({}) SRV({})]".format(
-+        cli.stdout.read().decode('utf-8').strip(),
-+        srv.stdout.read().decode('utf-8').strip()))
-+    return
-+
-+def plain_tests(testdir):
-+    sasldbfile, sasldbenv = setup_plain(testdir)
-+    #print("DB file: {}, ENV: {}".format(sasldbfile, sasldbenv))
-+    print('SASLDB PLAIN:')
-+    print('    ', end='')
-+    plain_test(sasldbfile, sasldbenv)
-+
-+    print('SASLDB PLAIN PASSWORD MISMATCH:')
-+    print('    ', end='')
-+    plain_mismatch_test(sasldbfile, sasldbenv)
- 
- if __name__ == "__main__":
- 
-@@ -254,3 +344,4 @@ def gssapi_tests(testdir):
-     os.makedirs(T)
- 
-     gssapi_tests(T)
-+    plain_tests(T)
-diff --git a/tests/t_gssapi_cli.c b/tests/t_gssapi_cli.c
-index a44a3f58..20d22070 100644
---- a/tests/t_gssapi_cli.c
-+++ b/tests/t_gssapi_cli.c
-@@ -16,6 +16,8 @@
- #include <saslplug.h>
- #include <saslutil.h>
- 
-+const char *testpass = NULL;
-+
- static int setup_socket(void)
- {
-     struct sockaddr_in addr;
-@@ -34,9 +36,60 @@ static int setup_socket(void)
-     return sock;
- }
- 
-+static int get_user(void *context __attribute__((unused)),
-+                  int id,
-+                  const char **result,
-+                  unsigned *len)
-+{
-+    const char *testuser = "test@host.realm.test";
-+
-+    if (! result)
-+        return SASL_BADPARAM;
-+
-+    switch (id) {
-+    case SASL_CB_USER:
-+    case SASL_CB_AUTHNAME:
-+        *result = testuser;
-+        break;
-+    default:
-+        return SASL_BADPARAM;
-+    }
-+
-+    if (len) *len = strlen(*result);
-+
-+    return SASL_OK;
-+}
-+
-+static int get_pass(sasl_conn_t *conn __attribute__((unused)),
-+          void *context __attribute__((unused)),
-+          int id,
-+          sasl_secret_t **psecret)
-+{
-+    size_t len;
-+    static sasl_secret_t *x;
-+
-+    /* paranoia check */
-+    if (! conn || ! psecret || id != SASL_CB_PASS)
-+        return SASL_BADPARAM;
-+
-+    len = strlen(testpass);
-+
-+    x = (sasl_secret_t *) realloc(x, sizeof(sasl_secret_t) + len);
-+
-+    if (!x) {
-+        return SASL_NOMEM;
-+    }
-+
-+    x->len = len;
-+    strcpy((char *)x->data, testpass);
-+
-+    *psecret = x;
-+    return SASL_OK;
-+}
-+
- int main(int argc, char *argv[])
- {
--    sasl_callback_t callbacks[2] = {};
-+    sasl_callback_t callbacks[4] = {};
-     char buf[8192];
-     const char *chosenmech;
-     sasl_conn_t *conn;
-@@ -46,12 +99,18 @@ int main(int argc, char *argv[])
-     char cb_buf[256];
-     int sd;
-     int c, r;
-+    const char *sasl_mech = "GSSAPI";
-+    int plain = 0;
- 
--    while ((c = getopt(argc, argv, "c:")) != EOF) {
-+    while ((c = getopt(argc, argv, "c:P:")) != EOF) {
-         switch (c) {
-         case 'c':
-             parse_cb(&cb, cb_buf, 256, optarg);
-             break;
-+        case 'P':
-+            plain = 1;
-+            testpass = optarg;
-+            break;
-         default:
-             break;
-         }
-@@ -64,6 +123,22 @@ int main(int argc, char *argv[])
-     callbacks[1].id = SASL_CB_LIST_END;
-     callbacks[1].proc = NULL;
-     callbacks[1].context = NULL;
-+    callbacks[2].id = SASL_CB_LIST_END;
-+    callbacks[2].proc = NULL;
-+    callbacks[2].context = NULL;
-+    callbacks[3].id = SASL_CB_LIST_END;
-+    callbacks[3].proc = NULL;
-+    callbacks[3].context = NULL;
-+
-+    if (plain) {
-+        sasl_mech = "PLAIN";
-+
-+        callbacks[1].id = SASL_CB_AUTHNAME;
-+        callbacks[1].proc = (sasl_callback_ft)&get_user;
-+
-+        callbacks[2].id = SASL_CB_PASS;
-+        callbacks[2].proc = (sasl_callback_ft)&get_pass;
-+    }
- 
-     r = sasl_client_init(callbacks);
-     if (r != SASL_OK) exit(-1);
-@@ -78,11 +153,11 @@ int main(int argc, char *argv[])
-         sasl_setprop(conn, SASL_CHANNEL_BINDING, &cb);
-     }
- 
--    r = sasl_client_start(conn, "GSSAPI", NULL, &data, &len, &chosenmech);
-+    r = sasl_client_start(conn, sasl_mech, NULL, &data, &len, &chosenmech);
-     if (r != SASL_OK && r != SASL_CONTINUE) {
--	saslerr(r, "starting SASL negotiation");
--	printf("\n%s\n", sasl_errdetail(conn));
--	exit(-1);
-+        saslerr(r, "starting SASL negotiation");
-+        printf("\n%s\n", sasl_errdetail(conn));
-+        exit(-1);
-     }
- 
-     sd = setup_socket();
-@@ -92,11 +167,11 @@ int main(int argc, char *argv[])
-         len = 8192;
-         recv_string(sd, buf, &len);
- 
--	r = sasl_client_step(conn, buf, len, NULL, &data, &len);
--	if (r != SASL_OK && r != SASL_CONTINUE) {
--	    saslerr(r, "performing SASL negotiation");
--	    printf("\n%s\n", sasl_errdetail(conn));
--	    exit(-1);
-+        r = sasl_client_step(conn, buf, len, NULL, &data, &len);
-+        if (r != SASL_OK && r != SASL_CONTINUE) {
-+            saslerr(r, "performing SASL negotiation");
-+            printf("\n%s\n", sasl_errdetail(conn));
-+            exit(-1);
-         }
-     }
- 
-diff --git a/tests/t_gssapi_srv.c b/tests/t_gssapi_srv.c
-index ef1217f6..430cad65 100644
---- a/tests/t_gssapi_srv.c
-+++ b/tests/t_gssapi_srv.c
-@@ -1,4 +1,5 @@
--/* Copyright (C) Simo Sorce <simo@redhat.com>
-+/* Copyright (C) Simo Sorce <simo@redhat.com>,
-+ * Dmitry Belyavskiy <dbelyavs@redhat.com>
-  * See COPYING file for License */
- 
- #include "t_common.h"
-@@ -15,6 +16,10 @@
- #include <arpa/inet.h>
- #include <saslplug.h>
- 
-+const char *sasldb_path = NULL,
-+      *auxprop_plugin = "sasldb",
-+      *pwcheck_method = "auxprop-hashed";
-+
- static int setup_socket(void)
- {
-     struct sockaddr_in addr;
-@@ -45,9 +50,38 @@ static int setup_socket(void)
-     return sd;
- }
- 
-+static int test_getopt(void *context __attribute__((unused)),
-+                const char *plugin_name __attribute__((unused)),
-+                const char *option,
-+                const char **result,
-+                unsigned *len)
-+{
-+    if (sasldb_path && !strcmp(option, "sasldb_path")) {
-+        *result = sasldb_path;
-+        if (len)
-+            *len = (unsigned) strlen(sasldb_path);
-+        return SASL_OK;
-+    }
-+
-+    if (sasldb_path && !strcmp(option, "auxprop_plugin")) {
-+        *result = auxprop_plugin;
-+        if (len)
-+            *len = (unsigned) strlen(auxprop_plugin);
-+        return SASL_OK;
-+    }
-+
-+    if (sasldb_path && !strcmp(option, "pwcheck_method")) {
-+        *result = pwcheck_method;
-+        if (len)
-+            *len = (unsigned) strlen(pwcheck_method);
-+        return SASL_OK;
-+    }
-+    return SASL_FAIL;
-+}
-+
- int main(int argc, char *argv[])
- {
--    sasl_callback_t callbacks[2] = {};
-+    sasl_callback_t callbacks[3] = {};
-     char buf[8192];
-     sasl_conn_t *conn;
-     const char *data;
-@@ -56,25 +90,33 @@ int main(int argc, char *argv[])
-     unsigned char cb_buf[256];
-     int sd;
-     int c, r;
-+    const char *sasl_mech = "GSSAPI";
-+    int plain = 0;
- 
--    while ((c = getopt(argc, argv, "c:")) != EOF) {
-+    while ((c = getopt(argc, argv, "c:P:")) != EOF) {
-         switch (c) {
-         case 'c':
-             parse_cb(&cb, cb_buf, 256, optarg);
-             break;
-+        case 'P':
-+            plain = 1;
-+            sasldb_path = optarg;
-+            break;
-         default:
-             break;
-         }
-     }
- 
--
-     /* initialize the sasl library */
-     callbacks[0].id = SASL_CB_GETPATH;
-     callbacks[0].proc = (sasl_callback_ft)&getpath;
-     callbacks[0].context = NULL;
--    callbacks[1].id = SASL_CB_LIST_END;
--    callbacks[1].proc = NULL;
-+    callbacks[1].id = SASL_CB_GETOPT;
-+    callbacks[1].proc = (sasl_callback_ft)&test_getopt;
-     callbacks[1].context = NULL;
-+    callbacks[2].id = SASL_CB_LIST_END;
-+    callbacks[2].proc = NULL;
-+    callbacks[2].context = NULL;
- 
-     r = sasl_server_init(callbacks, "t_gssapi_srv");
-     if (r != SASL_OK) exit(-1);
-@@ -90,16 +132,20 @@ int main(int argc, char *argv[])
-         sasl_setprop(conn, SASL_CHANNEL_BINDING, &cb);
-     }
- 
-+    if (plain) {
-+        sasl_mech = "PLAIN";
-+    }
-+
-     sd = setup_socket();
- 
-     len = 8192;
-     recv_string(sd, buf, &len);
- 
--    r = sasl_server_start(conn, "GSSAPI", buf, len, &data, &len);
-+    r = sasl_server_start(conn, sasl_mech, buf, len, &data, &len);
-     if (r != SASL_OK && r != SASL_CONTINUE) {
--	saslerr(r, "starting SASL negotiation");
--	printf("\n%s\n", sasl_errdetail(conn));
--	exit(-1);
-+        saslerr(r, "starting SASL negotiation");
-+        printf("\n%s\n", sasl_errdetail(conn));
-+        exit(-1);
-     }
- 
-     while (r == SASL_CONTINUE) {
-@@ -107,12 +153,12 @@ int main(int argc, char *argv[])
-         len = 8192;
-         recv_string(sd, buf, &len);
- 
--	r = sasl_server_step(conn, buf, len, &data, &len);
--	if (r != SASL_OK && r != SASL_CONTINUE) {
--	    saslerr(r, "performing SASL negotiation");
--	    printf("\n%s\n", sasl_errdetail(conn));
--	    exit(-1);
--	}
-+        r = sasl_server_step(conn, buf, len, &data, &len);
-+        if (r != SASL_OK && r != SASL_CONTINUE) {
-+            saslerr(r, "performing SASL negotiation");
-+            printf("\n%s\n", sasl_errdetail(conn));
-+            exit(-1);
-+        }
- 
-     }
- 
-From d95b0afef1289194148090874799428e9e4f4cff Mon Sep 17 00:00:00 2001
-From: Simo Sorce <idra@samba.org>
-Date: Wed, 15 Apr 2020 11:57:17 -0400
-Subject: [PATCH] Test GSS-SPNEGO as well
-
-Signed-off-by: Simo Sorce <simo@redhat.com>
----
- tests/runtests.py    | 91 ++++++++++++++++++++++++++++++++++++++++----
- tests/t_common.c     | 13 ++++---
- tests/t_common.h     |  3 +-
- tests/t_gssapi_cli.c | 22 ++++++++++-
- tests/t_gssapi_srv.c | 25 ++++++++++--
- 5 files changed, 134 insertions(+), 20 deletions(-)
-
-diff --git a/tests/runtests.py b/tests/runtests.py
-index 513ed3ff..7be60745 100755
---- a/tests/runtests.py
-+++ b/tests/runtests.py
-@@ -6,6 +6,7 @@
- import shutil
- import signal
- import subprocess
-+import sys
- import time
- from string import Template
- 
-@@ -149,11 +150,12 @@ def gssapi_basic_test(kenv):
-                 srv.returncode, srv.stderr.read().decode('utf-8')))
-     except Exception as e:
-         print("FAIL: {}".format(e))
--        return
-+        return 1
- 
-     print("PASS: CLI({}) SRV({})".format(
-         cli.stdout.read().decode('utf-8').strip(),
-         srv.stdout.read().decode('utf-8').strip()))
-+    return 0
- 
- def gssapi_channel_binding_test(kenv):
-     try:
-@@ -178,11 +180,12 @@ def gssapi_channel_binding_test(kenv):
-                 srv.returncode, srv.stderr.read().decode('utf-8')))
-     except Exception as e:
-         print("FAIL: {}".format(e))
--        return
-+        return 1
- 
-     print("PASS: CLI({}) SRV({})".format(
-         cli.stdout.read().decode('utf-8').strip(),
-         srv.stdout.read().decode('utf-8').strip()))
-+    return 0
- 
- def gssapi_channel_binding_mismatch_test(kenv):
-     result = "FAIL"
-@@ -212,11 +215,70 @@ def gssapi_channel_binding_mismatch_test(kenv):
-                 cli.returncode, cli_err, srv.returncode, srv_err))
-     except Exception as e:
-         print("{}: {}".format(result, e))
--        return
-+        return 0
- 
-     print("FAIL: This test should fail [CLI({}) SRV({})]".format(
-         cli.stdout.read().decode('utf-8').strip(),
-         srv.stdout.read().decode('utf-8').strip()))
-+    return 1
-+
-+def gss_spnego_basic_test(kenv):
-+    try:
-+        srv = subprocess.Popen(["../tests/t_gssapi_srv", "-N"],
-+                               stdout=subprocess.PIPE,
-+                               stderr=subprocess.PIPE, env=kenv)
-+        srv.stdout.readline() # Wait for srv to say it is ready
-+        cli = subprocess.Popen(["../tests/t_gssapi_cli", "-N"],
-+                               stdout=subprocess.PIPE,
-+                               stderr=subprocess.PIPE, env=kenv)
-+        try:
-+            cli.wait(timeout=5)
-+            srv.wait(timeout=5)
-+        except Exception as e:
-+            print("Failed on {}".format(e));
-+            cli.kill()
-+            srv.kill()
-+        if cli.returncode != 0 or srv.returncode != 0:
-+            raise Exception("CLI ({}): {} --> SRV ({}): {}".format(
-+                cli.returncode, cli.stderr.read().decode('utf-8'),
-+                srv.returncode, srv.stderr.read().decode('utf-8')))
-+    except Exception as e:
-+        print("FAIL: {}".format(e))
-+        return 1
-+
-+    print("PASS: CLI({}) SRV({})".format(
-+        cli.stdout.read().decode('utf-8').strip(),
-+        srv.stdout.read().decode('utf-8').strip()))
-+    return 0
-+
-+def gss_spnego_zeromaxssf_test(kenv):
-+    try:
-+        srv = subprocess.Popen(["../tests/t_gssapi_srv", "-N", "-z"],
-+                               stdout=subprocess.PIPE,
-+                               stderr=subprocess.PIPE, env=kenv)
-+        srv.stdout.readline() # Wait for srv to say it is ready
-+        cli = subprocess.Popen(["../tests/t_gssapi_cli", "-N", "-z"],
-+                               stdout=subprocess.PIPE,
-+                               stderr=subprocess.PIPE, env=kenv)
-+        try:
-+            cli.wait(timeout=5)
-+            srv.wait(timeout=5)
-+        except Exception as e:
-+            print("Failed on {}".format(e));
-+            cli.kill()
-+            srv.kill()
-+        if cli.returncode != 0 or srv.returncode != 0:
-+            raise Exception("CLI ({}): {} --> SRV ({}): {}".format(
-+                cli.returncode, cli.stderr.read().decode('utf-8'),
-+                srv.returncode, srv.stderr.read().decode('utf-8')))
-+    except Exception as e:
-+        print("FAIL: {}".format(e))
-+        return 1
-+
-+    print("PASS: CLI({}) SRV({})".format(
-+        cli.stdout.read().decode('utf-8').strip(),
-+        srv.stdout.read().decode('utf-8').strip()))
-+    return 0
- 
- def gssapi_tests(testdir):
-     """ SASL/GSSAPI Tests """
-@@ -225,19 +287,30 @@ def gssapi_tests(testdir):
-     #print("KDC: {}, ENV: {}".format(kdc, kenv))
-     kenv['KRB5_TRACE'] = os.path.join(testdir, 'trace.log')
- 
-+    err = 0
-+
-     print('GSSAPI BASIC:')
-     print('    ', end='')
--    gssapi_basic_test(kenv)
-+    err += gssapi_basic_test(kenv)
- 
-     print('GSSAPI CHANNEL BINDING:')
-     print('    ', end='')
--    gssapi_channel_binding_test(kenv)
-+    err += gssapi_channel_binding_test(kenv)
- 
-     print('GSSAPI CHANNEL BINDING MISMTACH:')
-     print('    ', end='')
--    gssapi_channel_binding_mismatch_test(kenv)
-+    err += gssapi_channel_binding_mismatch_test(kenv)
-+
-+    print('GSS-SPNEGO BASIC:')
-+    print('    ', end='')
-+    err += gss_spnego_basic_test(kenv)
-+
-+    print('GSS-SPNEGO 0 MAXSSF:')
-+    print('    ', end='')
-+    err += gss_spnego_zeromaxssf_test(kenv)
- 
-     os.killpg(kdc.pid, signal.SIGTERM)
-+    return err
- 
- def setup_plain(testdir):
-     """ Create sasldb file """
-@@ -343,5 +416,9 @@ def plain_tests(testdir):
-         shutil.rmtree(T)
-     os.makedirs(T)
- 
--    gssapi_tests(T)
-     plain_tests(T)
-+
-+    err = gssapi_tests(T)
-+    if err != 0:
-+        print('{} test(s) FAILED'.format(err))
-+        sys.exit(-1)
-diff --git a/tests/t_common.c b/tests/t_common.c
-index 478e6a1f..f56098ef 100644
---- a/tests/t_common.c
-+++ b/tests/t_common.c
-@@ -23,20 +23,21 @@ void send_string(int sd, const char *s, unsigned int l)
-     if (ret != l) s_error("send data", ret, l, errno);
- }
- 
--void recv_string(int sd, char *buf, unsigned int *buflen)
-+void recv_string(int sd, char *buf, unsigned int *buflen, bool allow_eof)
- {
-+    unsigned int bufsize = *buflen;
-     unsigned int l;
-     ssize_t ret;
- 
-+    *buflen = 0;
-+
-     ret = recv(sd, &l, sizeof(l), MSG_WAITALL);
-+    if (allow_eof && ret == 0) return;
-     if (ret != sizeof(l)) s_error("recv size", ret, sizeof(l), errno);
- 
--    if (l == 0) {
--        *buflen = 0;
--        return;
--    }
-+    if (l == 0) return;
- 
--    if (*buflen < l) s_error("recv len", l, *buflen, E2BIG);
-+    if (bufsize < l) s_error("recv len", l, bufsize, E2BIG);
- 
-     ret = recv(sd, buf, l, 0);
-     if (ret != l) s_error("recv data", ret, l, errno);
-diff --git a/tests/t_common.h b/tests/t_common.h
-index a10def17..be24a53d 100644
---- a/tests/t_common.h
-+++ b/tests/t_common.h
-@@ -4,6 +4,7 @@
- #include "config.h"
- 
- #include <errno.h>
-+#include <stdbool.h>
- #include <stdio.h>
- #include <sys/socket.h>
- 
-@@ -12,7 +13,7 @@
- 
- void s_error(const char *hdr, ssize_t ret, ssize_t len, int err);
- void send_string(int sd, const char *s, unsigned int l);
--void recv_string(int sd, char *buf, unsigned int *buflen);
-+void recv_string(int sd, char *buf, unsigned int *buflen, bool allow_eof);
- void saslerr(int why, const char *what);
- int getpath(void *context __attribute__((unused)), const char **path);
- void parse_cb(sasl_channel_binding_t *cb, char *buf, unsigned max, char *in);
-diff --git a/tests/t_gssapi_cli.c b/tests/t_gssapi_cli.c
-index 20d22070..b1dd6ce0 100644
---- a/tests/t_gssapi_cli.c
-+++ b/tests/t_gssapi_cli.c
-@@ -101,8 +101,10 @@ int main(int argc, char *argv[])
-     int c, r;
-     const char *sasl_mech = "GSSAPI";
-     int plain = 0;
-+    bool spnego = false;
-+    bool zeromaxssf = false;
- 
--    while ((c = getopt(argc, argv, "c:P:")) != EOF) {
-+    while ((c = getopt(argc, argv, "c:P:zN")) != EOF) {
-         switch (c) {
-         case 'c':
-             parse_cb(&cb, cb_buf, 256, optarg);
-@@ -111,6 +113,12 @@ int main(int argc, char *argv[])
-             plain = 1;
-             testpass = optarg;
-             break;
-+        case 'z':
-+            zeromaxssf = true;
-+            break;
-+        case 'N':
-+            spnego = true;
-+            break;
-         default:
-             break;
-         }
-@@ -153,6 +161,16 @@ int main(int argc, char *argv[])
-         sasl_setprop(conn, SASL_CHANNEL_BINDING, &cb);
-     }
- 
-+    if (spnego) {
-+        sasl_mech = "GSS-SPNEGO";
-+    }
-+
-+    if (zeromaxssf) {
-+        /* set all security properties to 0 including maxssf */
-+        sasl_security_properties_t secprops = { 0 };
-+        sasl_setprop(conn, SASL_SEC_PROPS, &secprops);
-+    }
-+
-     r = sasl_client_start(conn, sasl_mech, NULL, &data, &len, &chosenmech);
-     if (r != SASL_OK && r != SASL_CONTINUE) {
-         saslerr(r, "starting SASL negotiation");
-@@ -165,7 +183,7 @@ int main(int argc, char *argv[])
-     while (r == SASL_CONTINUE) {
-         send_string(sd, data, len);
-         len = 8192;
--        recv_string(sd, buf, &len);
-+        recv_string(sd, buf, &len, false);
- 
-         r = sasl_client_step(conn, buf, len, NULL, &data, &len);
-         if (r != SASL_OK && r != SASL_CONTINUE) {
-diff --git a/tests/t_gssapi_srv.c b/tests/t_gssapi_srv.c
-index 430cad65..0adbd12f 100644
---- a/tests/t_gssapi_srv.c
-+++ b/tests/t_gssapi_srv.c
-@@ -92,8 +92,10 @@ int main(int argc, char *argv[])
-     int c, r;
-     const char *sasl_mech = "GSSAPI";
-     int plain = 0;
-+    bool spnego = false;
-+    bool zeromaxssf = false;
- 
--    while ((c = getopt(argc, argv, "c:P:")) != EOF) {
-+    while ((c = getopt(argc, argv, "c:P:zN")) != EOF) {
-         switch (c) {
-         case 'c':
-             parse_cb(&cb, cb_buf, 256, optarg);
-@@ -102,6 +104,12 @@ int main(int argc, char *argv[])
-             plain = 1;
-             sasldb_path = optarg;
-             break;
-+        case 'z':
-+            zeromaxssf = true;
-+            break;
-+        case 'N':
-+            spnego = true;
-+            break;
-         default:
-             break;
-         }
-@@ -136,10 +144,20 @@ int main(int argc, char *argv[])
-         sasl_mech = "PLAIN";
-     }
- 
-+    if (spnego) {
-+        sasl_mech = "GSS-SPNEGO";
-+    }
-+
-+    if (zeromaxssf) {
-+        /* set all security properties to 0 including maxssf */
-+        sasl_security_properties_t secprops = { 0 };
-+        sasl_setprop(conn, SASL_SEC_PROPS, &secprops);
-+    }
-+
-     sd = setup_socket();
- 
-     len = 8192;
--    recv_string(sd, buf, &len);
-+    recv_string(sd, buf, &len, false);
- 
-     r = sasl_server_start(conn, sasl_mech, buf, len, &data, &len);
-     if (r != SASL_OK && r != SASL_CONTINUE) {
-@@ -151,7 +169,7 @@ int main(int argc, char *argv[])
-     while (r == SASL_CONTINUE) {
-         send_string(sd, data, len);
-         len = 8192;
--        recv_string(sd, buf, &len);
-+        recv_string(sd, buf, &len, true);
- 
-         r = sasl_server_step(conn, buf, len, &data, &len);
-         if (r != SASL_OK && r != SASL_CONTINUE) {
-@@ -159,7 +177,6 @@ int main(int argc, char *argv[])
-             printf("\n%s\n", sasl_errdetail(conn));
-             exit(-1);
-         }
--
-     }
- 
-     if (r != SASL_OK) exit(-1);
-

cyrus-sasl-2.1.27-nostrncpy.patch

@@ -1,51 +0,0 @@
-diff --git a/plugins/gssapi.c b/plugins/gssapi.c
-index 5d900c5e..4688bb9a 100644
---- a/plugins/gssapi.c
-+++ b/plugins/gssapi.c
-@@ -1567,7 +1567,6 @@ int gssapiv2_server_plug_init(
- {
- #ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY
-     const char *keytab = NULL;
--    char keytab_path[1024];
-     unsigned int rl;
- #endif
-     
-@@ -1589,15 +1588,7 @@ int gssapiv2_server_plug_init(
- 	    return SASL_FAIL;
- 	}
- 	
--	if(strlen(keytab) > 1024) {
--	    utils->log(NULL, SASL_LOG_ERR,
--		       "path to keytab is > 1024 characters");
--	    return SASL_BUFOVER;
--	}
--	
--	strncpy(keytab_path, keytab, 1024);
--	
--	gsskrb5_register_acceptor_identity(keytab_path);
-+	gsskrb5_register_acceptor_identity(keytab);
-     }
- #endif
-     
-diff --git a/plugins/ntlm.c b/plugins/ntlm.c
-index aeb3ac34..8a7d9065 100644
---- a/plugins/ntlm.c
-+++ b/plugins/ntlm.c
-@@ -375,10 +375,15 @@ static unsigned char *P16_lm(unsigned char *P16, sasl_secret_t *passwd,
- 			     unsigned *buflen __attribute__((unused)),
- 			     int *result)
- {
--    char P14[14];
-+    char P14[14] = { 0 };
-+    int Plen;
-     unsigned char S8[] = { 0x4b, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25 };
- 
--    strncpy(P14, (const char *) passwd->data, sizeof(P14));
-+    Plen = sizeof(P14);
-+    if (passwd->len < Plen) {
-+        Plen = passwd->len;
-+    }
-+    memcpy(P14, (const char *) passwd->data, Plen);
-     ucase(P14, sizeof(P14));
- 
-     E(P16, (unsigned char *) P14, sizeof(P14), S8, sizeof(S8));

cyrus-sasl-2.1.28-SAST.patch

@@ -1,83 +0,0 @@
-From 5703f2a26b0a183079beb7f1b176a3c24ede7309 Mon Sep 17 00:00:00 2001
-From: Rob Crittenden <rcritten@redhat.com>
-Date: Wed, 15 May 2024 14:17:46 -0400
-Subject: [PATCH] Fix some issues uncovered by a static analyzer
-
-A few possible overruns and a memory leak.
-
-Signed-off-by: Rob Crittenden <rcritten@redhat.com>
----
- lib/common.c              | 13 +++++++------
- saslauthd/auth_krb5.c     |  1 +
- saslauthd/testsaslauthd.c |  6 +++---
- 3 files changed, 11 insertions(+), 9 deletions(-)
-
-diff --git a/lib/common.c b/lib/common.c
-index 6c5496a2..b9c8bf50 100644
---- a/lib/common.c
-+++ b/lib/common.c
-@@ -2395,18 +2395,19 @@ int _sasl_ipfromstring(const char *addr,
- 
-     /* Parse the address */
-     for (i = 0; addr[i] != '\0' && addr[i] != ';'; i++) {
--	if (i >= NI_MAXHOST)
-+	if (i >= NI_MAXHOST - 1)
- 	    return SASL_BADPARAM;
- 	hbuf[i] = addr[i];
-     }
-     hbuf[i] = '\0';
- 
--    if (addr[i] == ';')
-+    if (addr[i] == ';') {
- 	i++;
--    /* XXX: Do we need this check? */
--    for (j = i; addr[j] != '\0'; j++)
--	if (!isdigit((int)(addr[j])))
--	    return SASL_BADPARAM;
-+        /* XXX: Do we need this check? */
-+        for (j = i; addr[j] != '\0'; j++)
-+            if (!isdigit((int)(addr[j])))
-+                return SASL_BADPARAM;
-+    }
- 
-     memset(&hints, 0, sizeof(hints));
-     hints.ai_family = PF_UNSPEC;
-diff --git a/saslauthd/auth_krb5.c b/saslauthd/auth_krb5.c
-index c7cceeec..7750b55e 100644
---- a/saslauthd/auth_krb5.c
-+++ b/saslauthd/auth_krb5.c
-@@ -203,6 +203,7 @@ auth_krb5 (
- 
-     if (form_principal_name(user, service, realm, principalbuf, sizeof (principalbuf))) {
-         syslog(LOG_ERR, "auth_krb5: form_principal_name");
-+        krb5_free_context(context);
-         return strdup("NO saslauthd principal name error");
-     }
- 
-diff --git a/saslauthd/testsaslauthd.c b/saslauthd/testsaslauthd.c
-index 8a0e4d9c..9267c43d 100644
---- a/saslauthd/testsaslauthd.c
-+++ b/saslauthd/testsaslauthd.c
-@@ -70,8 +70,8 @@ int flags = LOG_USE_STDERR;
-  */
- int retry_read(int fd, void *inbuf, unsigned nbyte)
- {
--    int n;
--    int nread = 0;
-+    ssize_t n;
-+    size_t nread = 0;
-     char *buf = (char *)inbuf;
- 
-     if (nbyte == 0) return 0;
-@@ -233,7 +233,7 @@ static int saslauthd_verify_password(const char *saslauthd_path,
- 	return -1;
-     }
-   
--    count = (int)sizeof(response) < count ? sizeof(response) : count;
-+    count = (int)sizeof(response) <= count ? sizeof(response) - 1: count;
-     if (retry_read(s, response, count) < count) {
- 	close(s);
-         fprintf(stderr,"read failed\n");
--- 
-2.45.0
-

cyrus-sasl-2.1.28-fedora-c99.patch

@@ -1,53 +0,0 @@
-From 266f0acf7f5e029afbb3e263437039e50cd6c262 Mon Sep 17 00:00:00 2001
-From: Sam James <sam@gentoo.org>
-Date: Wed, 23 Feb 2022 00:45:15 +0000
-Subject: Fix <time.h> check
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-We're conditionally including based on HAVE_TIME_H in a bunch of places,
-but we're not actually checking for time.h, so that's never going to be defined.
-
-While at it, add in a missing include in the cram plugin.
-
-This fixes a bunch of implicit declaration warnings:
-```
- * cyrus-sasl-2.1.28/lib/saslutil.c:280:3: warning: implicit declaration of function ‘time’ [-Wimplicit-function-declaration]
- * cyrus-sasl-2.1.28/lib/saslutil.c:364:41: warning: implicit declaration of function ‘clock’ [-Wimplicit-function-declaration]
- * cyrus-sasl-2.1.28/plugins/cram.c:132:7: warning: implicit declaration of function ‘time’ [-Wimplicit-function-declaration]
- * cyrus-sasl-2.1.28/lib/saslutil.c:280:3: warning: implicit declaration of function ‘time’ [-Wimplicit-function-declaration]
- * cyrus-sasl-2.1.28/lib/saslutil.c:364:41: warning: implicit declaration of function ‘clock’ [-Wimplicit-function-declaration]
- * cyrus-sasl-2.1.28/plugins/cram.c:132:7: warning: implicit declaration of function ‘time’ [-Wimplicit-function-declaration]
-```
-
-Signed-off-by: Sam James <sam@gentoo.org>
-
-[Edited to apply to Fedora - DJ]
-diff -rup a/configure.ac b/configure.ac
---- a/configure.ac	2023-04-20 00:31:33.578596460 -0400
-+++ b/configure.ac	2023-04-20 01:17:40.877579628 -0400
-@@ -1239,6 +1239,7 @@ AC_CHECK_HEADERS_ONCE([sys/time.h])
- AC_HEADER_DIRENT
- AC_HEADER_SYS_WAIT
- AC_CHECK_HEADERS(crypt.h des.h dlfcn.h fcntl.h limits.h malloc.h paths.h strings.h sys/file.h sys/time.h syslog.h unistd.h inttypes.h sys/uio.h sys/param.h sysexits.h stdarg.h varargs.h krb5.h)
-+AC_CHECK_HEADERS(crypt.h des.h dlfcn.h fcntl.h limits.h malloc.h paths.h strings.h sys/file.h sys/time.h syslog.h time.h unistd.h inttypes.h sys/uio.h sys/param.h sysexits.h stdarg.h varargs.h krb5.h)
- AC_CHECK_TYPES([long long, int8_t, uint8_t, int16_t, uint16_t, int32_t, uint32_t, int64_t, uint64_t],,,[
- #ifdef HAVE_INTTYPES_H
- #include <inttypes.h>
-Only in b: configure.ac.orig
-Only in b: configure.ac.rej
-diff -rup a/plugins/cram.c b/plugins/cram.c
---- a/plugins/cram.c	2022-02-18 16:50:42.000000000 -0500
-+++ b/plugins/cram.c	2023-04-20 01:20:12.228312652 -0400
-@@ -53,6 +53,10 @@
- #endif
- #include <fcntl.h>
- 
-+#ifdef HAVE_TIME_H
-+#include <time.h>
-+#endif
-+
- #include <sasl.h>
- #include <saslplug.h>
- #include <saslutil.h>

saslauth.sysusers

@@ -1,4 +0,0 @@
-#Type Name       ID     GECOS              Home directory   Shell
-g     saslauth   76
-u     saslauth   -      "Saslauthd user"   /run/saslauthd   /sbin/nologin
-m     saslauth   saslauth

sources

@@ -1 +0,0 @@
-SHA512 (cyrus-sasl-2.1.28-nodlcompatorsrp.tar.gz) = 9a80b363718774ac5b9b8b71c7eba7c48d760296542b4d545010ba4fc463d0da807fc8efd314381467e4c44b3b055082882f3ac03e8f829db2a543e271d70cbc