Skip to contentSkip to conversation

libmhash and libgssglue: add new recipe

PATCH Superseded [email protected] 1 participant 3 messages Jul 28, 2017

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore
#0 lore raw

cover libmhash and libgssglue: add new recipe

From: Jackie Huang <[email protected]>

---
The following changes since commit 89683b4fee4616a08d249bc7afd7be55f3fa71a3:

apparmor: fix python packaging issue (2017-06-01 08:01:34 -0700)

are available in the git repository at:

https://github.com/jackiehjm/meta-security.git jhuang0/r_up_libmhash_libgssglue_170728_1
https://github.com//tree/jhuang0/r_up_libmhash_libgssglue_170728_1

Jackie Huang (2):
libgssglue: add new recipe
libmhash: add new recipe

 .../libgssglue/files/libgssglue-canon-name.patch   | 60 ++++++++++++++++++++++
 .../files/libgssglue-fix-CVE-2011-2709.patch       | 43 ++++++++++++++++
 .../libgssglue/files/libgssglue-g-initialize.patch | 21 ++++++++
 .../libgssglue/files/libgssglue-gss-inq-cred.patch | 27 ++++++++++
 .../libgssglue/files/libgssglue-mglueP.patch       | 21 ++++++++
 recipes-security/libgssglue/libgssglue_0.4.bb      | 51 ++++++++++++++++++
 recipes-security/libmhash/files/Makefile.test      | 13 +++++
 recipes-security/libmhash/files/mhash.c            | 32 ++++++++++++
 recipes-security/libmhash/files/run-ptest          | 12 +++++
 recipes-security/libmhash/libmhash_0.9.9.9.bb      | 37 +++++++++++++
 10 files changed, 317 insertions(+)
 create mode 100644 recipes-security/libgssglue/files/libgssglue-canon-name.patch
 create mode 100644 recipes-security/libgssglue/files/libgssglue-fix-CVE-2011-2709.patch
 create mode 100644 recipes-security/libgssglue/files/libgssglue-g-initialize.patch
 create mode 100644 recipes-security/libgssglue/files/libgssglue-gss-inq-cred.patch
 create mode 100644 recipes-security/libgssglue/files/libgssglue-mglueP.patch
 create mode 100644 recipes-security/libgssglue/libgssglue_0.4.bb
 create mode 100644 recipes-security/libmhash/files/Makefile.test
 create mode 100644 recipes-security/libmhash/files/mhash.c
 create mode 100644 recipes-security/libmhash/files/run-ptest
 create mode 100644 recipes-security/libmhash/libmhash_0.9.9.9.bb
Signature · 1 line
2.11.0
#1 lore raw

PATCH 1/2 libgssglue: add new recipe

From: Jackie Huang <[email protected]>

libgssglue exports a gssapi interface which calls
other gssapi libraries.

---
 .../libgssglue/files/libgssglue-canon-name.patch   | 60 ++++++++++++++++++++++
 .../files/libgssglue-fix-CVE-2011-2709.patch       | 43 ++++++++++++++++
 .../libgssglue/files/libgssglue-g-initialize.patch | 21 ++++++++
 .../libgssglue/files/libgssglue-gss-inq-cred.patch | 27 ++++++++++
 .../libgssglue/files/libgssglue-mglueP.patch       | 21 ++++++++
 recipes-security/libgssglue/libgssglue_0.4.bb      | 51 ++++++++++++++++++
 6 files changed, 223 insertions(+)
 create mode 100644 recipes-security/libgssglue/files/libgssglue-canon-name.patch
 create mode 100644 recipes-security/libgssglue/files/libgssglue-fix-CVE-2011-2709.patch
 create mode 100644 recipes-security/libgssglue/files/libgssglue-g-initialize.patch
 create mode 100644 recipes-security/libgssglue/files/libgssglue-gss-inq-cred.patch
 create mode 100644 recipes-security/libgssglue/files/libgssglue-mglueP.patch
 create mode 100644 recipes-security/libgssglue/libgssglue_0.4.bb
recipes-security/libgssglue/files/libgssglue-canon-name.patch new file +60 -0
new file mode 100644
index 0000000..cb7c47b
@@ -0,0 +1,60 @@
+fix the bug:
+g_canon_name.c:125:5: warning: passing argument 2 of '__gss_copy_namebuf' from incompatible pointer type [enabled by default]
+
+the 2nd argument of __gss_copy_namebuf should be address of *gss_buffer_t, \
+but a *gss_buffer_t is assigned.
+
+what __gss_copy_namebuf does is to alloc memory for a gss_buffer_desc and \
+copy from src and return its address.
+
+if following code failed, gss_release_name will free \
+union_canon_name->external_name.value if it is not NULL.
+
+OM_uint32 __gss_copy_namebuf(src, dest)
+    gss_buffer_t   src;
+    gss_buffer_t   *dest;
+
+typedef struct gss_union_name_t {
+	gss_mechanism		gss_mech;
+	gss_OID			name_type;
+	gss_buffer_desc		external_name;
+	/*
+	 * These last two fields are only filled in for mechanism
+	 * names.
+	 */
+	gss_OID			mech_type;
+	gss_name_t		mech_name;
+} gss_union_name_desc, *gss_union_name_t;
+
+typedef struct gss_buffer_desc_struct {
+      size_t length;
+      void FAR *value;
+} gss_buffer_desc, FAR *gss_buffer_t;
+
+Upstream-Status: Pending
+Signed-off-by: Yao Zhao <[email protected]>
+
+--- a/src/g_canon_name.c
++++ b/src/g_canon_name.c
+@@ -121,11 +121,17 @@ gss_canonicalize_name (OM_uint32 *minor_
+ 
+     union_canon_name->mech_name = mech_name;
+ 
+-    status = __gss_copy_namebuf(&union_input_name->external_name,
+-				&union_canon_name->external_name);
+-    if (status != GSS_S_COMPLETE)
+-	goto failure;
++    union_canon_name->external_name.value = (void*) malloc(
++                      union_input_name->external_name.length + 1);
++    if (!union_canon_name->external_name.value)
++        goto failure;
+ 
++    memcpy(union_canon_name->external_name.value, 
++           union_input_name->external_name.value, 
++           union_input_name->external_name.length);
++    union_canon_name->external_name.length = 
++                      union_input_name->external_name.length; 
++   
+     if (union_input_name->name_type != GSS_C_NO_OID) {
+ 	status = generic_gss_copy_oid(minor_status,
+ 				      union_input_name->name_type,
recipes-security/libgssglue/files/libgssglue-fix-CVE-2011-2709.patch new file +43 -0

43 lines not on this page · raw message

recipes-security/libgssglue/files/libgssglue-g-initialize.patch new file +21 -0
new file mode 100644
index 0000000..4a9ba33
@@ -0,0 +1,21 @@
+Fix the warning for getuid, geteuid
+g_initialize.c: In function 'linux_initialize':
+g_initialize.c:275:5: warning: implicit declaration of function 'getuid' [-Wimplicit-function-declaration]
+g_initialize.c:275:5: warning: implicit declaration of function 'geteuid' [-Wimplicit-function-declaration]
+
+Upstream-Status: Pending
+Signed-off-by: Yao Zhao <[email protected]>
+
+diff --git a/src/g_initialize.c b/src1/g_initialize.c
+index 82fcce1..200f173 100644
+--- a/src/g_initialize.c
++++ b/src/g_initialize.c
+@@ -29,6 +29,8 @@
+ #include "mglueP.h"
+ #include <stdlib.h>
+ 
++#include <unistd.h>   /*getuid, geteuid */
++#include <sys/types.h>
+ #include <stdio.h>
+ #include <string.h>
+ #include <ctype.h>
recipes-security/libgssglue/files/libgssglue-gss-inq-cred.patch new file +27 -0
new file mode 100644
index 0000000..6dce3e7
@@ -0,0 +1,27 @@
+1) add free if malloc failed for (*mechanisms)->elements
+2) g_inq_cred.c: In function 'gss_inquire_cred':
+g_inq_cred.c:161:8: warning: passing argument 3 of 'generic_gss_copy_oid' from incompatible pointer type [enabled by default]
+
+Upstream-Status: Pending
+Signed-off-by: Yao Zhao <[email protected]>
+
+--- a/src/g_inq_cred.c
++++ b/src/g_inq_cred.c
+@@ -152,13 +152,15 @@ gss_OID_set *		mechanisms;
+ 			     union_cred->count);
+ 	if ((*mechanisms)->elements == NULL) {
+ 	    *minor_status = ENOMEM;
++	    free(*mechanisms);
++	    *mechanisms = GSS_C_NO_OID_SET;
+ 	    return (GSS_S_FAILURE);
+ 	}
+ 
+ 	for (i=0; i < union_cred->count; i++) {
+-	    status = generic_gss_copy_oid(minor_status,
++	    status = generic_gss_add_oid_set_member(minor_status,
+ 	    				  &union_cred->mechs_array[i],
+-					  &((*mechanisms)->elements[i]));
++					  mechanisms);
+ 	    if (status != GSS_S_COMPLETE)
+ 	        break;
+ 	}
recipes-security/libgssglue/files/libgssglue-mglueP.patch new file +21 -0
new file mode 100644
index 0000000..6c9ebf0
@@ -0,0 +1,21 @@
+fix the warning:
+warning: implicit declaration of function 'generic_gss_copy_oid_set' [-Wimplicit-function-declaration]
+
+Upstream-Status: Pending
+Signed-off-by: Yao Zhao <[email protected]>
+
+--- a/src/mglueP.h
++++ b/src/mglueP.h
+@@ -447,6 +447,12 @@ OM_uint32 generic_gss_copy_oid
+ 	    gss_OID *		/* new_oid */
+ 	    );
+ 
++OM_uint32 generic_gss_copy_oid_set
++	   (OM_uint32 *minor_status,	/* minor_status */
++	    const gss_OID_set_desc * const oidset,	/* oid */
++	    gss_OID_set *new_oidset			/* new_oid */
++	   );
++
+ OM_uint32 generic_gss_create_empty_oid_set
+ 	   (OM_uint32 *,	/* minor_status */
+ 	    gss_OID_set *	/* oid_set */
recipes-security/libgssglue/libgssglue_0.4.bb new file +51 -0

51 lines not on this page · raw message

Signature · 1 line
2.11.0
#2 lore raw

PATCH 2/2 libmhash: add new recipe

In reply to [email protected]

From: Jackie Huang <[email protected]>

Mhash is a free (under GNU Lesser GPL) library which provides a uniform interface to a large number of hash algorithms. These algorithms can be used to compute checksums, message digests, and other signatures.

---
 recipes-security/libmhash/files/Makefile.test | 13 ++++++++++
 recipes-security/libmhash/files/mhash.c       | 32 +++++++++++++++++++++++
 recipes-security/libmhash/files/run-ptest     | 12 +++++++++
 recipes-security/libmhash/libmhash_0.9.9.9.bb | 37 +++++++++++++++++++++++++++
 4 files changed, 94 insertions(+)
 create mode 100644 recipes-security/libmhash/files/Makefile.test
 create mode 100644 recipes-security/libmhash/files/mhash.c
 create mode 100644 recipes-security/libmhash/files/run-ptest
 create mode 100644 recipes-security/libmhash/libmhash_0.9.9.9.bb
recipes-security/libmhash/files/Makefile.test new file +13 -0
new file mode 100644
index 0000000..2e32626
@@ -0,0 +1,13 @@
+#
+# Makefile for compiling mhash tests
+#
+
+ALL = mhash
+
+all: $(ALL)
+
+mhash: mhash.c
+	$(CC) $(CFLAGS) $(LDFLAGS) -o mhash mhash.c -lmhash
+
+clean:
+	rm -f *.debug $(ALL)
recipes-security/libmhash/files/mhash.c new file +32 -0
new file mode 100644
index 0000000..5d123cc
@@ -0,0 +1,32 @@
+#include <mhash.h>
+#include <stdio.h>
+
+int main()
+{
+
+       char password[] = "Jefe";
+       int keylen = 4;
+       char data[] = "what do ya want for nothing?";
+       int datalen = 28;
+       MHASH td;
+       unsigned char mac[16];
+       int j;
+
+       td = mhash_hmac_init(MHASH_MD5, password, keylen, mhash_get_hash_pblock(MHASH_MD5));
+
+       mhash(td, data, datalen);
+       mhash_hmac_deinit(td, mac);
+
+/*
+ * The output should be 0x750c783e6ab0b503eaa86e310a5db738
+ * according to RFC 2104.
+ */
+
+       printf("0x");
+       for (j = 0; j < mhash_get_block_size(MHASH_MD5); j++) {
+               printf("%.2x", mac[j]);
+       }
+       printf("\n");
+
+       exit(0);
+}
recipes-security/libmhash/files/run-ptest new file +12 -0
new file mode 100644
index 0000000..2b0b94a
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+OUTPUT=$($(dirname $0)/mhash)
+MHASH_MD5="0x750c783e6ab0b503eaa86e310a5db738"
+
+if [ x"$OUTPUT" = x"$MHASH_MD5" ]; then
+    echo "PASS: mhash ptest"
+    exit 0
+else
+    echo "FAIL: mhash ptest"
+    exit 1
+fi
recipes-security/libmhash/libmhash_0.9.9.9.bb new file +37 -0
new file mode 100644
index 0000000..9b34cb1
@@ -0,0 +1,37 @@
+SUMMARY = "Library of hashing algorithms."
+DESCRIPTION = "\
+  Mhash is a free (under GNU Lesser GPL) library \
+  which provides a uniform interface to a large number of hash \
+  algorithms. These algorithms can be used to compute checksums, \
+  message digests, and other signatures. \
+  "
+HOMEPAGE = "http://mhash.sourceforge.net/"
+
+LICENSE = "LGPLv2.0"
+LIC_FILES_CHKSUM = "file://COPYING;md5=3bf50002aefd002f49e7bb854063f7e7"
+
+S = "${WORKDIR}/mhash-${PV}"
+
+SECTION = "libs"
+
+SRC_URI = "${SOURCEFORGE_MIRROR}/mhash/mhash-${PV}.tar.bz2 \
+    file://Makefile.test \
+    file://mhash.c \
+    file://run-ptest \
+    "
+
+SRC_URI[md5sum] = "f91c74f9ccab2b574a98be5bc31eb280"
+SRC_URI[sha256sum] = "56521c52a9033779154432d0ae47ad7198914785265e1f570cee21ab248dfef0"
+
+inherit autotools-brokensep ptest
+
+do_compile_ptest() {
+    if [ ! -d ${S}/demo ]; then mkdir ${S}/demo; fi
+    cp ${WORKDIR}/Makefile.test ${S}/demo/Makefile
+    cp ${WORKDIR}/mhash.c ${S}/demo/
+    make -C ${S}/demo CFLAGS="${CFLAGS} -I${S}/include/" LDFLAGS="${LDFLAGS} -L${S}/lib/.libs"
+}
+
+do_install_ptest() {
+    install -m 0755 ${S}/demo/mhash ${D}${PTEST_PATH}
+}
Signature · 1 line
2.11.0