Attachment 583056 Details for Bug 813387 – Correct creation of temporary file for replacing variables

[patch] Correct creation of temporary file for replacing variables

ipa-client.patch (text/plain), 4.86 KB, created by Rob Crittenden on 2012-05-08 18:28:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Rob Crittenden

Created: 2012-05-08 18:28:34 UTC

Size: 4.86 KB

patch

obsolete

>From 2df97339f10b3b888a0ba0f32afbbafddff35950 Mon Sep 17 00:00:00 2001
>From: Rob Crittenden <rcritten@redhat.com>
>Date: Tue, 1 May 2012 17:12:40 -0400
>Subject: [PATCH] Only warn if ipa-getkeytab doesn't get all requested enctypes (2.1.3-2)
>
>Resolves: #816693
>---
> freeipa-getkeys.patch |   83 +++++++++++++++++++++++++++++++++++++++++++++++++
> ipa-client.spec       |    7 +++-
> 2 files changed, 89 insertions(+), 1 deletions(-)
> create mode 100644 freeipa-getkeys.patch
>
>diff --git a/freeipa-getkeys.patch b/freeipa-getkeys.patch
>new file mode 100644
>index 0000000000000000000000000000000000000000..c6b8f0021bc52ae8b542d6409c152e3e0db3a898
>--- /dev/null
>+++ b/freeipa-getkeys.patch
>@@ -0,0 +1,83 @@
>+From b370e15beab9aba69929ba173b7c68fb58b8e331 Mon Sep 17 00:00:00 2001
>+From: Rob Crittenden <rcritten@redhat.com>
>+Date: Tue, 1 May 2012 16:59:28 -0400
>+Subject: [PATCH] Only warn if ipa-getkeytab doesn't get all requested enctypes.
>+
>+Older client machines may request DES keys not supported in newer
>+KDCs. Thsi was causing the entire request to fail as well as client
>+enrollment.
>+
>+https://fedorahosted.org/freeipa/ticket/2424
>+---
>+ ipa-client/ipa-getkeytab.c |   35 ++++++++++++++++++++++++++++++-----
>+ 1 files changed, 30 insertions(+), 5 deletions(-)
>+
>+diff --git a/ipa-client/ipa-getkeytab.c b/ipa-client/ipa-getkeytab.c
>+index 4c148aae1f8b96f4cbf52517483b9b32917d1b64..a8ab13e2edcabf52989dc54aa3349dfc4ebfde39 100644
>+--- a/ipa-client/ipa-getkeytab.c
>++++ b/ipa-client/ipa-getkeytab.c
>+@@ -538,6 +538,7 @@ static int ldap_set_keytab(krb5_context krbctx,
>+ 	int kvno, i;
>+ 	ber_tag_t rtag;
>+ 	ber_int_t *encs = NULL;
>++	int successful_keys = 0;
>+ 
>+ 	/* cant' return more than nkeys, sometimes less */
>+ 	encs = calloc(keys->nkeys + 1, sizeof(ber_int_t));
>+@@ -612,7 +613,13 @@ static int ldap_set_keytab(krb5_context krbctx,
>+ 						   LDAP_SASL_QUIET,
>+ 						   ldap_sasl_interact, princ);
>+ 		if (ret != LDAP_SUCCESS) {
>+-			fprintf(stderr, _("SASL Bind failed!\n"));
>++			char *msg=NULL;
>++#ifdef LDAP_OPT_DIAGNOSTIC_MESSAGE
>++			ldap_get_option(ld, LDAP_OPT_DIAGNOSTIC_MESSAGE,
>++				(void*)&msg);
>++#endif
>++			fprintf(stderr, "SASL Bind failed %s (%d) %s!\n",
>++				ldap_err2string(ret), ret, msg ? msg : "");
>+ 			goto error_out;
>+ 		}
>+ 	}
>+@@ -697,16 +704,34 @@ static int ldap_set_keytab(krb5_context krbctx,
>+ 
>+ 	rtag = ber_scanf(sctrl, "{i{", &kvno);
>+ 	if (rtag == LBER_ERROR) {
>+-		fprintf(stderr, _("ber_scanf() failed, Invalid control ?!\n"));
>++		fprintf(stderr, _("ber_scanf() failed, unable to find kvno ?!\n"));
>+ 		goto error_out;
>+ 	}
>+ 
>+ 	for (i = 0; i < keys->nkeys; i++) {
>+ 		ret = ber_scanf(sctrl, "{i}", &encs[i]);
>+ 		if (ret == LBER_ERROR) {
>+-                    fprintf(stderr, _("ber_scanf() failed, Invalid control ?!\n"));
>+-                    goto error_out;
>+-                }
>++			char enc[79]; /* fit std terminal or truncate */
>++			krb5_error_code krberr;
>++			krberr = krb5_enctype_to_string(
>++				keys->ksdata[i].enctype, enc, 79);
>++			if (krberr) {
>++				fprintf(stderr, _("Failed to retrieve "
>++					"encryption type type #%d\n"),
>++					keys->ksdata[i].enctype);
>++			} else {
>++				fprintf(stderr, _("Failed to retrieve "
>++					"encryption type %s (#%d)\n"),
>++					enc, keys->ksdata[i].enctype);
>++			}
>++                } else {
>++			successful_keys++;
>++		}
>++	}
>++
>++	if (successful_keys == 0) {
>++		fprintf(stderr, _("Failed to retrieve any keys"));
>++		goto error_out;
>+ 	}
>+ 
>+ 	ret = filter_keys(krbctx, keys, encs);
>+-- 
>+1.6.0.6
>+
>diff --git a/ipa-client.spec b/ipa-client.spec
>index 7da349cb3a29bf61483c43148e4a294a6cfe180e..39da0c18e1308f591eb0ed5aaa402b94bdc9814f 100644
>--- a/ipa-client.spec
>+++ b/ipa-client.spec
>@@ -6,7 +6,7 @@
> 
> Name:           ipa-client
> Version:        2.1.3
>-Release:        1%{?date}%{?dist}
>+Release:        2%{?date}%{?dist}
> Summary:        IPA authentication for use on clients
> 
> Group:          System Environment/Base
>@@ -18,6 +18,7 @@ Patch2:         ipa-python24.patch
> Patch3:         ipa-client-kinit.patch
> Patch4:         ipa-openldap.patch
> Patch5:         freeipa-refer.patch
>+Patch6:         freeipa-getkeys.patch
> 
> BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
> 
>@@ -73,6 +74,7 @@ logs, analysis thereof).
> %patch3 -p1 -b .kinit
> %patch4 -p1 -b .openldap
> %patch5 -p1 -b .refer
>+%patch6 -p1 -b .getkeys
> 
> # RHEL 5 uses an old libtool, so we need to reconfigure
> for i in libtool ltmain.sh aclocal.m4 libtool.m4  lt~obsolete.m4  ltoptions.m4  ltsugar.m4  ltversion.m4
>@@ -150,6 +152,9 @@ rm -rf %{buildroot}
> %ghost %config(noreplace) %{_sysconfdir}/ipa/default.conf
> 
> %changelog
>+* Tue May  1 2012 Rob Crittenden <rcritten@redhat.com> - 2.1.3-2
>+- Only warn if ipa-getkeytab doesn't get all requested enctypes. (#816693)
>+
> * Thu Nov 10 2011 Rob Crittenden <rcritten@redhat.com> - 2.1.3-1
> - Rebase to upstream 2.1.3 (#753936)
> - Updated patch for CVE-2011-3636 to include CR in the HTTP headers.
>-- 
>1.6.0.6
>

Actions: View | Diff

Attachments on bug 813387: 583056 | 583270