libmhash and libgssglue: add new recipe
cover libmhash and libgssglue: add new recipe
From: Jackie Huang <[email protected]>
---
The following changes since commit 89683b4fee4616a08d249bc7afd7be55f3fa71a3:
apparmor: fix python packaging issue (2017-06-01 08:01:34 -0700)
are available in the git repository at:
https://github.com/jackiehjm/meta-security.git jhuang0/r_up_libmhash_libgssglue_170728_1
https://github.com//tree/jhuang0/r_up_libmhash_libgssglue_170728_1
Jackie Huang (2):
libgssglue: add new recipe
libmhash: add new recipe
.../libgssglue/files/libgssglue-canon-name.patch | 60 ++++++++++++++++++++++ .../files/libgssglue-fix-CVE-2011-2709.patch | 43 ++++++++++++++++ .../libgssglue/files/libgssglue-g-initialize.patch | 21 ++++++++ .../libgssglue/files/libgssglue-gss-inq-cred.patch | 27 ++++++++++ .../libgssglue/files/libgssglue-mglueP.patch | 21 ++++++++ recipes-security/libgssglue/libgssglue_0.4.bb | 51 ++++++++++++++++++ recipes-security/libmhash/files/Makefile.test | 13 +++++ recipes-security/libmhash/files/mhash.c | 32 ++++++++++++ recipes-security/libmhash/files/run-ptest | 12 +++++ recipes-security/libmhash/libmhash_0.9.9.9.bb | 37 +++++++++++++ 10 files changed, 317 insertions(+) create mode 100644 recipes-security/libgssglue/files/libgssglue-canon-name.patch create mode 100644 recipes-security/libgssglue/files/libgssglue-fix-CVE-2011-2709.patch create mode 100644 recipes-security/libgssglue/files/libgssglue-g-initialize.patch create mode 100644 recipes-security/libgssglue/files/libgssglue-gss-inq-cred.patch create mode 100644 recipes-security/libgssglue/files/libgssglue-mglueP.patch create mode 100644 recipes-security/libgssglue/libgssglue_0.4.bb create mode 100644 recipes-security/libmhash/files/Makefile.test create mode 100644 recipes-security/libmhash/files/mhash.c create mode 100644 recipes-security/libmhash/files/run-ptest create mode 100644 recipes-security/libmhash/libmhash_0.9.9.9.bb
Signature · 1 line
2.11.0
PATCH 1/2 libgssglue: add new recipe
From: Jackie Huang <[email protected]>
libgssglue exports a gssapi interface which calls
other gssapi libraries.
--- .../libgssglue/files/libgssglue-canon-name.patch | 60 ++++++++++++++++++++++ .../files/libgssglue-fix-CVE-2011-2709.patch | 43 ++++++++++++++++ .../libgssglue/files/libgssglue-g-initialize.patch | 21 ++++++++ .../libgssglue/files/libgssglue-gss-inq-cred.patch | 27 ++++++++++ .../libgssglue/files/libgssglue-mglueP.patch | 21 ++++++++ recipes-security/libgssglue/libgssglue_0.4.bb | 51 ++++++++++++++++++ 6 files changed, 223 insertions(+) create mode 100644 recipes-security/libgssglue/files/libgssglue-canon-name.patch create mode 100644 recipes-security/libgssglue/files/libgssglue-fix-CVE-2011-2709.patch create mode 100644 recipes-security/libgssglue/files/libgssglue-g-initialize.patch create mode 100644 recipes-security/libgssglue/files/libgssglue-gss-inq-cred.patch create mode 100644 recipes-security/libgssglue/files/libgssglue-mglueP.patch create mode 100644 recipes-security/libgssglue/libgssglue_0.4.bb
recipes-security/libgssglue/files/libgssglue-canon-name.patch new file +60 -0
@@ -0,0 +1,60 @@ +fix the bug: +g_canon_name.c:125:5: warning: passing argument 2 of '__gss_copy_namebuf' from incompatible pointer type [enabled by default] + +the 2nd argument of __gss_copy_namebuf should be address of *gss_buffer_t, \ +but a *gss_buffer_t is assigned. + +what __gss_copy_namebuf does is to alloc memory for a gss_buffer_desc and \ +copy from src and return its address. + +if following code failed, gss_release_name will free \ +union_canon_name->external_name.value if it is not NULL. + +OM_uint32 __gss_copy_namebuf(src, dest) + gss_buffer_t src; + gss_buffer_t *dest; + +typedef struct gss_union_name_t { + gss_mechanism gss_mech; + gss_OID name_type; + gss_buffer_desc external_name; + /* + * These last two fields are only filled in for mechanism + * names. + */ + gss_OID mech_type; + gss_name_t mech_name; +} gss_union_name_desc, *gss_union_name_t; + +typedef struct gss_buffer_desc_struct { + size_t length; + void FAR *value; +} gss_buffer_desc, FAR *gss_buffer_t; + +Upstream-Status: Pending +Signed-off-by: Yao Zhao <[email protected]> + +--- a/src/g_canon_name.c ++++ b/src/g_canon_name.c +@@ -121,11 +121,17 @@ gss_canonicalize_name (OM_uint32 *minor_ + + union_canon_name->mech_name = mech_name; + +- status = __gss_copy_namebuf(&union_input_name->external_name, +- &union_canon_name->external_name); +- if (status != GSS_S_COMPLETE) +- goto failure; ++ union_canon_name->external_name.value = (void*) malloc( ++ union_input_name->external_name.length + 1); ++ if (!union_canon_name->external_name.value) ++ goto failure; + ++ memcpy(union_canon_name->external_name.value, ++ union_input_name->external_name.value, ++ union_input_name->external_name.length); ++ union_canon_name->external_name.length = ++ union_input_name->external_name.length; ++ + if (union_input_name->name_type != GSS_C_NO_OID) { + status = generic_gss_copy_oid(minor_status, + union_input_name->name_type,
recipes-security/libgssglue/files/libgssglue-fix-CVE-2011-2709.patch new file +43 -0
43 lines not on this page · raw message
recipes-security/libgssglue/files/libgssglue-g-initialize.patch new file +21 -0
@@ -0,0 +1,21 @@ +Fix the warning for getuid, geteuid +g_initialize.c: In function 'linux_initialize': +g_initialize.c:275:5: warning: implicit declaration of function 'getuid' [-Wimplicit-function-declaration] +g_initialize.c:275:5: warning: implicit declaration of function 'geteuid' [-Wimplicit-function-declaration] + +Upstream-Status: Pending +Signed-off-by: Yao Zhao <[email protected]> + +diff --git a/src/g_initialize.c b/src1/g_initialize.c +index 82fcce1..200f173 100644 +--- a/src/g_initialize.c ++++ b/src/g_initialize.c +@@ -29,6 +29,8 @@ + #include "mglueP.h" + #include <stdlib.h> + ++#include <unistd.h> /*getuid, geteuid */ ++#include <sys/types.h> + #include <stdio.h> + #include <string.h> + #include <ctype.h>
recipes-security/libgssglue/files/libgssglue-gss-inq-cred.patch new file +27 -0
@@ -0,0 +1,27 @@ +1) add free if malloc failed for (*mechanisms)->elements +2) g_inq_cred.c: In function 'gss_inquire_cred': +g_inq_cred.c:161:8: warning: passing argument 3 of 'generic_gss_copy_oid' from incompatible pointer type [enabled by default] + +Upstream-Status: Pending +Signed-off-by: Yao Zhao <[email protected]> + +--- a/src/g_inq_cred.c ++++ b/src/g_inq_cred.c +@@ -152,13 +152,15 @@ gss_OID_set * mechanisms; + union_cred->count); + if ((*mechanisms)->elements == NULL) { + *minor_status = ENOMEM; ++ free(*mechanisms); ++ *mechanisms = GSS_C_NO_OID_SET; + return (GSS_S_FAILURE); + } + + for (i=0; i < union_cred->count; i++) { +- status = generic_gss_copy_oid(minor_status, ++ status = generic_gss_add_oid_set_member(minor_status, + &union_cred->mechs_array[i], +- &((*mechanisms)->elements[i])); ++ mechanisms); + if (status != GSS_S_COMPLETE) + break; + }
recipes-security/libgssglue/files/libgssglue-mglueP.patch new file +21 -0
@@ -0,0 +1,21 @@ +fix the warning: +warning: implicit declaration of function 'generic_gss_copy_oid_set' [-Wimplicit-function-declaration] + +Upstream-Status: Pending +Signed-off-by: Yao Zhao <[email protected]> + +--- a/src/mglueP.h ++++ b/src/mglueP.h +@@ -447,6 +447,12 @@ OM_uint32 generic_gss_copy_oid + gss_OID * /* new_oid */ + ); + ++OM_uint32 generic_gss_copy_oid_set ++ (OM_uint32 *minor_status, /* minor_status */ ++ const gss_OID_set_desc * const oidset, /* oid */ ++ gss_OID_set *new_oidset /* new_oid */ ++ ); ++ + OM_uint32 generic_gss_create_empty_oid_set + (OM_uint32 *, /* minor_status */ + gss_OID_set * /* oid_set */
recipes-security/libgssglue/libgssglue_0.4.bb new file +51 -0
51 lines not on this page · raw message
Signature · 1 line
2.11.0
PATCH 2/2 libmhash: add new recipe
In reply to [email protected]From: Jackie Huang <[email protected]>
Mhash is a free (under GNU Lesser GPL) library which provides a uniform interface to a large number of hash algorithms. These algorithms can be used to compute checksums, message digests, and other signatures.
--- recipes-security/libmhash/files/Makefile.test | 13 ++++++++++ recipes-security/libmhash/files/mhash.c | 32 +++++++++++++++++++++++ recipes-security/libmhash/files/run-ptest | 12 +++++++++ recipes-security/libmhash/libmhash_0.9.9.9.bb | 37 +++++++++++++++++++++++++++ 4 files changed, 94 insertions(+) create mode 100644 recipes-security/libmhash/files/Makefile.test create mode 100644 recipes-security/libmhash/files/mhash.c create mode 100644 recipes-security/libmhash/files/run-ptest create mode 100644 recipes-security/libmhash/libmhash_0.9.9.9.bb
recipes-security/libmhash/files/Makefile.test new file +13 -0
@@ -0,0 +1,13 @@ +# +# Makefile for compiling mhash tests +# + +ALL = mhash + +all: $(ALL) + +mhash: mhash.c + $(CC) $(CFLAGS) $(LDFLAGS) -o mhash mhash.c -lmhash + +clean: + rm -f *.debug $(ALL)
recipes-security/libmhash/files/mhash.c new file +32 -0
@@ -0,0 +1,32 @@ +#include <mhash.h> +#include <stdio.h> + +int main () +{ + +char password[] ="Jefe" ; +int keylen =4 ; +char data[] ="what do ya want for nothing?" ; +int datalen =28 ; +MHASH td; +unsigned char mac[16 ]; +int j; + + td =mhash_hmac_init (MHASH_MD5 , password, keylen,mhash_get_hash_pblock (MHASH_MD5 )); + +mhash (td, data, datalen); +mhash_hmac_deinit (td, mac); + +/* +* The output should be 0x750c783e6ab0b503eaa86e310a5db738 +* according to RFC 2104. +*/ + +printf ("0x" ); +for (j =0 ; j <mhash_get_block_size (MHASH_MD5 ); j++) { +printf ("%.2x" , mac[j]); + } +printf ("\n" ); + +exit (0 ); +}
recipes-security/libmhash/files/run-ptest new file +12 -0
@@ -0,0 +1,12 @@ +#!/bin/sh + +OUTPUT=$($(dirname $0)/mhash) +MHASH_MD5="0x750c783e6ab0b503eaa86e310a5db738" + +if [ x"$OUTPUT" = x"$MHASH_MD5" ]; then + echo "PASS: mhash ptest" + exit 0 +else + echo "FAIL: mhash ptest" + exit 1 +fi
recipes-security/libmhash/libmhash_0.9.9.9.bb new file +37 -0
@@ -0,0 +1,37 @@ +SUMMARY = "Library of hashing algorithms." +DESCRIPTION = "\ + Mhash is a free (under GNU Lesser GPL) library \ + which provides a uniform interface to a large number of hash \ + algorithms. These algorithms can be used to compute checksums, \ + message digests, and other signatures. \ + " +HOMEPAGE = "http://mhash.sourceforge.net/" + +LICENSE = "LGPLv2.0" +LIC_FILES_CHKSUM = "file://COPYING;md5=3bf50002aefd002f49e7bb854063f7e7" + +S = "${WORKDIR}/mhash-${PV}" + +SECTION = "libs" + +SRC_URI = "${SOURCEFORGE_MIRROR}/mhash/mhash-${PV}.tar.bz2 \ + file://Makefile.test \ + file://mhash.c \ + file://run-ptest \ + " + +SRC_URI[md5sum] = "f91c74f9ccab2b574a98be5bc31eb280" +SRC_URI[sha256sum] = "56521c52a9033779154432d0ae47ad7198914785265e1f570cee21ab248dfef0" + +inherit autotools-brokensep ptest + +do_compile_ptest() { + if [ ! -d ${S}/demo ]; then mkdir ${S}/demo; fi + cp ${WORKDIR}/Makefile.test ${S}/demo/Makefile + cp ${WORKDIR}/mhash.c ${S}/demo/ + make -C ${S}/demo CFLAGS="${CFLAGS} -I${S}/include/" LDFLAGS="${LDFLAGS} -L${S}/lib/.libs" +} + +do_install_ptest() { + install -m 0755 ${S}/demo/mhash ${D}${PTEST_PATH} +}
Signature · 1 line
2.11.0