pkgsrc/security/cyrus-sasl/Makefile.common

111 lines
3.5 KiB
Text
Raw Normal View History

# $NetBSD: Makefile.common,v 1.33 2020/05/14 14:31:16 nia Exp $
#
Update cyrus-sasl to 2.1.25. Take maintainership. New in 2.1.25 ------------- * Make sure that a failed authorization doesn't preclude further server-side SASL authentication attempts from working. * Fixed a crash caused by aborted SASL authentication and initiation of another one using the same SASL context. * (Windows) Fixed the random number generator to actually produce random output on each run. * Be protective against calling sasl_server_step once authentication has failed (multiple SASL plugins) * Fixed several bugs in the mech_avail callback handling in the server side code. * Added support for channel bindings * Added support for ordering SASL mechanisms by strength (on the client side), or using the "client_mech_list" option. * server_idle needs to obey server's SASL mechanism list from the server context. * Better server plugin API mismatch reporting * Build: - Updated config to the latest GNU snapshot - Fixed SASL's libtool MacOS/X 64-bit file magic * New SASL plugin: SCRAM * New SASL plugin: GS2 * DIGEST-MD5 plugin: - Allow DIGEST-MD5 plugin to be used for client-side and server-side HTTP Digest, including running over non-persistent connections (RFC 2617) - Use the same username for reauthentication cache lookup and update - Minimize the number of auxprop lookups in the server side DIGEST-MD5 plugin for the most common case when authentication and authorization identities are the same. - Updated digestmd5_server_mech_step2() to be more defensive against empty client input. - Fixed some memory leaks on failed plugin initialization. Prevent potential race condition when freeding plugin state. Set the freed reauthentication cache mutex to NULL, to make errors due to mutex access after free more obvious. - Test against broken UTF-8 based hashes if calculation using special ISO-8859-1 code fails. - Fixed an interop problem with some LDAP clients ignoring server advertised realm and providing their own. * GSSAPI plugin: - Fix to build GSSAPI with Heimdal - Properly set serveroutlen to 0 in one place. Don't send empty challenge once server context establishment is done, as this is in violation of the RFC 2222 and its successor. - Don't send maxbuf, if no security layer can be established. Added additional checks for buffer lengths. * LDAPDB plugin: - build fixes New in 2.1.24 ------------- * Order advertised server-side SASL mechanisms per the specified 'mech_list' option or by relative "strength" * Make sure that sasl_set_alloc() has no effect once sasl_client_init() or sasl_server_init() is called * Fixed sasl_set_mutex() to disallow changing mutex management functions once sasl_server_init()/sasl_client_init() is called (bug # 3083) * Removed unused mutexes in lib/client.c and lib/server.c (bug # 3141) * Added direct support for hashed password to auxprop API * Don't treat a constraint violation as an error to store an auxprop property * Extended libsasl (auxprop) to support user deletion * Extended SASL auxprop_lookup to return error code * Updated sasl_user_exists() so that it can handle passwordless accounts (e.g. disabled) * (Windows) Free handles of shared libraries on Windows that were loaded but are not SASL plugins (bug # 2089) * Prevent freeing of common state on a subsequent call to _sasl_common_init. Make sure that the last global callback always wins. * Implemented sasl_client_done()/sasl_server_done() * Added automatic hostname canonicalization inside libsasl * Made sasl_config_init() public * Strip trailing spaces from server config file option values (bug # 3139, bug # 3041) * Fixed potential buffer overflow in saslautd_verify_password(). * Fixed segfault in dlclose() on HPUX * Various bugfixes for 64bit platforms * Fixed bug # 2895 (passing LF to sasl_decode64) in sample/sample-client.c, sample/sample-server.c, utils/smtptest.c * pluginviewer: Code cleanup, improved human readable messages * Build: - (Windows) Updated makefiles to build with VC 8.0 (VC++ 2005) - (Windows) Added Windows64 build - Updated to use .plugin extension on MacOS - Changed 64bit HP-UX build to use .so for shared libraries * saslauthd: - Fixed bug counting double-quotes in username/password in auth_rimap.c. Also fixed bug zeroing password. - auth_krb.c: improved diagnostic in the k5support_verify_tgt() function. - auth_sasldb.c: pid_file_lock is created with a mask of 644 instead of 0644 - auth_shadow.c: Define _XOPEN_SOURCE before including unistd.h, so that crypt is correctly defined - auth_getpwent.c: Fixed Solaris build * SASLDB plugin: - Fixed spurious 'user not found' errors caused by an attempt to delete a non-existent property - Added direct support for hashed password to auxprop API - Sleepycat driver: Return SASL_NOUSER instead of SASL_FAIL when the database file doesn't exist - Ignore properties starting with '*' in the auxprop store function * SQL plugin: - Added support for SQLITE3 - Uninitialized variables can cause crash when the searched user is not found - Added direct support for hashed password - Ignore properties starting with '*' in the auxprop store function * LDAPDB plugin: - Added code to extend LDAPDB into a canon_user plugin in addition to its existing auxprop plugin functionality * PLAIN plugin: - Advertise SASL_SEC_PASS_CREDENTIALS feature * LOGIN plugin: - Advertise SASL_SEC_PASS_CREDENTIALS feature * DIGEST-MD5 plugin: - Fixed a memory leak in the DIGEST-MD5 security layer - Fixed memory leaks in client-side reauth and other places - More detailed error reporting. - Fixed parsing of challenges/responses with extra commas. - Allow for multiple qop options from the server and require a single qop option from the client. * GSSAPI plugin: - Check that params->serverFQDN is not NULL before using strlen on it - Make auxprop lookup calls optional * EXTERNAL plugin: - Make auxprop lookup calls optional * NTLM plugin: - allow a comma separated list of servernames in 'ntlm_server' option - Fixed crash in calculating NTv2 reponse * OTP plugin: - Don't use a stack variable for an OTP prompt (bug # 2822) - Downgrade the failure to store OTP secret to debug level * KERBEROS_V4 plugin: - Make auxprop lookup calls optional
2011-09-17 13:32:02 +02:00
# used by security/cyrus-sasl/Makefile
# used by security/cy2-anonymous/Makefile
# used by security/cy2-crammd5/Makefile
# used by security/cy2-digestmd5/Makefile
# used by security/cy2-gssapi/Makefile
# used by security/cy2-ldapdb/Makefile
# used by security/cy2-login/Makefile
# used by security/cy2-ntlm/Makefile
# used by security/cy2-otp/Makefile
# used by security/cy2-plain/Makefile
# used by security/cy2-scram/Makefile
# used by security/cy2-sql/Makefile
# used by security/cyrus-saslauthd/Makefile
#
# This Makefile fragment should be included _below_ any SASL_PLUGIN
# definition and _above_ any CONFIGURE_ARGS definitions.
DISTNAME= cyrus-sasl-2.1.27
DISTFILES= ${DISTNAME}-rc7${EXTRACT_SUFX}
CATEGORIES= security
MASTER_SITES= https://www.cyrusimap.org/releases/
MASTER_SITES+= https://www.cyrusimap.org/releases/old/
#MASTER_SITES+= ftp://ftp.cyrusimap.org/cyrus-sasl/OLD-VERSIONS/
#PATCHFILES+= cyrus-sasl-dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d.patch.v2
#SITES.cyrus-sasl-dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d.patch.v2= \
# -https://cgit.cyrus.foundation/cyrus-sasl/patch/?id=dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d
#PATCH_DIST_STRIP= -p1
2015-03-15 17:47:19 +01:00
MAINTAINER= pkgsrc-users@NetBSD.org
2019-06-10 00:12:16 +02:00
HOMEPAGE= https://www.cyrusimap.org/sasl/
2010-02-19 21:16:40 +01:00
LICENSE= original-bsd # CMU version
DISTINFO_FILE= ${.CURDIR}/../../security/cyrus-sasl/distinfo
PATCHDIR= ${.CURDIR}/../../security/cyrus-sasl/patches
PKG_SYSCONFSUBDIR= sasl2
.include "../../mk/bsd.prefs.mk"
.if defined(SASL_PLUGIN) && !empty(SASL_PLUGIN:M[yY][eE][sS])
BUILDLINK_ABI_DEPENDS.cyrus-sasl+= \
Update cyrus-sasl to 2.1.25. Take maintainership. New in 2.1.25 ------------- * Make sure that a failed authorization doesn't preclude further server-side SASL authentication attempts from working. * Fixed a crash caused by aborted SASL authentication and initiation of another one using the same SASL context. * (Windows) Fixed the random number generator to actually produce random output on each run. * Be protective against calling sasl_server_step once authentication has failed (multiple SASL plugins) * Fixed several bugs in the mech_avail callback handling in the server side code. * Added support for channel bindings * Added support for ordering SASL mechanisms by strength (on the client side), or using the "client_mech_list" option. * server_idle needs to obey server's SASL mechanism list from the server context. * Better server plugin API mismatch reporting * Build: - Updated config to the latest GNU snapshot - Fixed SASL's libtool MacOS/X 64-bit file magic * New SASL plugin: SCRAM * New SASL plugin: GS2 * DIGEST-MD5 plugin: - Allow DIGEST-MD5 plugin to be used for client-side and server-side HTTP Digest, including running over non-persistent connections (RFC 2617) - Use the same username for reauthentication cache lookup and update - Minimize the number of auxprop lookups in the server side DIGEST-MD5 plugin for the most common case when authentication and authorization identities are the same. - Updated digestmd5_server_mech_step2() to be more defensive against empty client input. - Fixed some memory leaks on failed plugin initialization. Prevent potential race condition when freeding plugin state. Set the freed reauthentication cache mutex to NULL, to make errors due to mutex access after free more obvious. - Test against broken UTF-8 based hashes if calculation using special ISO-8859-1 code fails. - Fixed an interop problem with some LDAP clients ignoring server advertised realm and providing their own. * GSSAPI plugin: - Fix to build GSSAPI with Heimdal - Properly set serveroutlen to 0 in one place. Don't send empty challenge once server context establishment is done, as this is in violation of the RFC 2222 and its successor. - Don't send maxbuf, if no security layer can be established. Added additional checks for buffer lengths. * LDAPDB plugin: - build fixes New in 2.1.24 ------------- * Order advertised server-side SASL mechanisms per the specified 'mech_list' option or by relative "strength" * Make sure that sasl_set_alloc() has no effect once sasl_client_init() or sasl_server_init() is called * Fixed sasl_set_mutex() to disallow changing mutex management functions once sasl_server_init()/sasl_client_init() is called (bug # 3083) * Removed unused mutexes in lib/client.c and lib/server.c (bug # 3141) * Added direct support for hashed password to auxprop API * Don't treat a constraint violation as an error to store an auxprop property * Extended libsasl (auxprop) to support user deletion * Extended SASL auxprop_lookup to return error code * Updated sasl_user_exists() so that it can handle passwordless accounts (e.g. disabled) * (Windows) Free handles of shared libraries on Windows that were loaded but are not SASL plugins (bug # 2089) * Prevent freeing of common state on a subsequent call to _sasl_common_init. Make sure that the last global callback always wins. * Implemented sasl_client_done()/sasl_server_done() * Added automatic hostname canonicalization inside libsasl * Made sasl_config_init() public * Strip trailing spaces from server config file option values (bug # 3139, bug # 3041) * Fixed potential buffer overflow in saslautd_verify_password(). * Fixed segfault in dlclose() on HPUX * Various bugfixes for 64bit platforms * Fixed bug # 2895 (passing LF to sasl_decode64) in sample/sample-client.c, sample/sample-server.c, utils/smtptest.c * pluginviewer: Code cleanup, improved human readable messages * Build: - (Windows) Updated makefiles to build with VC 8.0 (VC++ 2005) - (Windows) Added Windows64 build - Updated to use .plugin extension on MacOS - Changed 64bit HP-UX build to use .so for shared libraries * saslauthd: - Fixed bug counting double-quotes in username/password in auth_rimap.c. Also fixed bug zeroing password. - auth_krb.c: improved diagnostic in the k5support_verify_tgt() function. - auth_sasldb.c: pid_file_lock is created with a mask of 644 instead of 0644 - auth_shadow.c: Define _XOPEN_SOURCE before including unistd.h, so that crypt is correctly defined - auth_getpwent.c: Fixed Solaris build * SASLDB plugin: - Fixed spurious 'user not found' errors caused by an attempt to delete a non-existent property - Added direct support for hashed password to auxprop API - Sleepycat driver: Return SASL_NOUSER instead of SASL_FAIL when the database file doesn't exist - Ignore properties starting with '*' in the auxprop store function * SQL plugin: - Added support for SQLITE3 - Uninitialized variables can cause crash when the searched user is not found - Added direct support for hashed password - Ignore properties starting with '*' in the auxprop store function * LDAPDB plugin: - Added code to extend LDAPDB into a canon_user plugin in addition to its existing auxprop plugin functionality * PLAIN plugin: - Advertise SASL_SEC_PASS_CREDENTIALS feature * LOGIN plugin: - Advertise SASL_SEC_PASS_CREDENTIALS feature * DIGEST-MD5 plugin: - Fixed a memory leak in the DIGEST-MD5 security layer - Fixed memory leaks in client-side reauth and other places - More detailed error reporting. - Fixed parsing of challenges/responses with extra commas. - Allow for multiple qop options from the server and require a single qop option from the client. * GSSAPI plugin: - Check that params->serverFQDN is not NULL before using strlen on it - Make auxprop lookup calls optional * EXTERNAL plugin: - Make auxprop lookup calls optional * NTLM plugin: - allow a comma separated list of servernames in 'ntlm_server' option - Fixed crash in calculating NTv2 reponse * OTP plugin: - Don't use a stack variable for an OTP prompt (bug # 2822) - Downgrade the failure to store OTP secret to debug level * KERBEROS_V4 plugin: - Make auxprop lookup calls optional
2011-09-17 13:32:02 +02:00
cyrus-sasl>=${PKGVERSION_NOREV}
. include "../../security/cyrus-sasl/buildlink3.mk"
CPPFLAGS+= -I${BUILDLINK_PREFIX.cyrus-sasl}/include/sasl
.endif
GNU_CONFIGURE= yes
MAKE_JOBS_SAFE= no
USE_TOOLS+= gmake
TOOLS_BROKEN+= perl
USE_LIBTOOL= yes
DOCDIR= ${PREFIX}/share/doc/cyrus-sasl
PLUGINDIR= ${PREFIX}/lib/sasl2
CONFIGURE_ARGS+= --with-configdir=${PKG_SYSCONFDIR}
CONFIGURE_ARGS+= --with-plugindir=${PLUGINDIR:Q}
CONFIGURE_ARGS+= --disable-java
2016-02-26 10:41:05 +01:00
CONFIGURE_ARGS.Darwin+= --disable-macos-framework
.if ${OPSYS} == "SunOS"
CONFIGURE_ARGS+= --with-ipctype=doors
.endif
# Authentication mechanisms
CONFIGURE_ARGS+= --disable-anon # ANONYMOUS
CONFIGURE_ARGS+= --disable-checkapop # CHECKAPOP
CONFIGURE_ARGS+= --disable-cram # CRAM-MD5
Update cyrus-sasl to 2.1.25. Take maintainership. New in 2.1.25 ------------- * Make sure that a failed authorization doesn't preclude further server-side SASL authentication attempts from working. * Fixed a crash caused by aborted SASL authentication and initiation of another one using the same SASL context. * (Windows) Fixed the random number generator to actually produce random output on each run. * Be protective against calling sasl_server_step once authentication has failed (multiple SASL plugins) * Fixed several bugs in the mech_avail callback handling in the server side code. * Added support for channel bindings * Added support for ordering SASL mechanisms by strength (on the client side), or using the "client_mech_list" option. * server_idle needs to obey server's SASL mechanism list from the server context. * Better server plugin API mismatch reporting * Build: - Updated config to the latest GNU snapshot - Fixed SASL's libtool MacOS/X 64-bit file magic * New SASL plugin: SCRAM * New SASL plugin: GS2 * DIGEST-MD5 plugin: - Allow DIGEST-MD5 plugin to be used for client-side and server-side HTTP Digest, including running over non-persistent connections (RFC 2617) - Use the same username for reauthentication cache lookup and update - Minimize the number of auxprop lookups in the server side DIGEST-MD5 plugin for the most common case when authentication and authorization identities are the same. - Updated digestmd5_server_mech_step2() to be more defensive against empty client input. - Fixed some memory leaks on failed plugin initialization. Prevent potential race condition when freeding plugin state. Set the freed reauthentication cache mutex to NULL, to make errors due to mutex access after free more obvious. - Test against broken UTF-8 based hashes if calculation using special ISO-8859-1 code fails. - Fixed an interop problem with some LDAP clients ignoring server advertised realm and providing their own. * GSSAPI plugin: - Fix to build GSSAPI with Heimdal - Properly set serveroutlen to 0 in one place. Don't send empty challenge once server context establishment is done, as this is in violation of the RFC 2222 and its successor. - Don't send maxbuf, if no security layer can be established. Added additional checks for buffer lengths. * LDAPDB plugin: - build fixes New in 2.1.24 ------------- * Order advertised server-side SASL mechanisms per the specified 'mech_list' option or by relative "strength" * Make sure that sasl_set_alloc() has no effect once sasl_client_init() or sasl_server_init() is called * Fixed sasl_set_mutex() to disallow changing mutex management functions once sasl_server_init()/sasl_client_init() is called (bug # 3083) * Removed unused mutexes in lib/client.c and lib/server.c (bug # 3141) * Added direct support for hashed password to auxprop API * Don't treat a constraint violation as an error to store an auxprop property * Extended libsasl (auxprop) to support user deletion * Extended SASL auxprop_lookup to return error code * Updated sasl_user_exists() so that it can handle passwordless accounts (e.g. disabled) * (Windows) Free handles of shared libraries on Windows that were loaded but are not SASL plugins (bug # 2089) * Prevent freeing of common state on a subsequent call to _sasl_common_init. Make sure that the last global callback always wins. * Implemented sasl_client_done()/sasl_server_done() * Added automatic hostname canonicalization inside libsasl * Made sasl_config_init() public * Strip trailing spaces from server config file option values (bug # 3139, bug # 3041) * Fixed potential buffer overflow in saslautd_verify_password(). * Fixed segfault in dlclose() on HPUX * Various bugfixes for 64bit platforms * Fixed bug # 2895 (passing LF to sasl_decode64) in sample/sample-client.c, sample/sample-server.c, utils/smtptest.c * pluginviewer: Code cleanup, improved human readable messages * Build: - (Windows) Updated makefiles to build with VC 8.0 (VC++ 2005) - (Windows) Added Windows64 build - Updated to use .plugin extension on MacOS - Changed 64bit HP-UX build to use .so for shared libraries * saslauthd: - Fixed bug counting double-quotes in username/password in auth_rimap.c. Also fixed bug zeroing password. - auth_krb.c: improved diagnostic in the k5support_verify_tgt() function. - auth_sasldb.c: pid_file_lock is created with a mask of 644 instead of 0644 - auth_shadow.c: Define _XOPEN_SOURCE before including unistd.h, so that crypt is correctly defined - auth_getpwent.c: Fixed Solaris build * SASLDB plugin: - Fixed spurious 'user not found' errors caused by an attempt to delete a non-existent property - Added direct support for hashed password to auxprop API - Sleepycat driver: Return SASL_NOUSER instead of SASL_FAIL when the database file doesn't exist - Ignore properties starting with '*' in the auxprop store function * SQL plugin: - Added support for SQLITE3 - Uninitialized variables can cause crash when the searched user is not found - Added direct support for hashed password - Ignore properties starting with '*' in the auxprop store function * LDAPDB plugin: - Added code to extend LDAPDB into a canon_user plugin in addition to its existing auxprop plugin functionality * PLAIN plugin: - Advertise SASL_SEC_PASS_CREDENTIALS feature * LOGIN plugin: - Advertise SASL_SEC_PASS_CREDENTIALS feature * DIGEST-MD5 plugin: - Fixed a memory leak in the DIGEST-MD5 security layer - Fixed memory leaks in client-side reauth and other places - More detailed error reporting. - Fixed parsing of challenges/responses with extra commas. - Allow for multiple qop options from the server and require a single qop option from the client. * GSSAPI plugin: - Check that params->serverFQDN is not NULL before using strlen on it - Make auxprop lookup calls optional * EXTERNAL plugin: - Make auxprop lookup calls optional * NTLM plugin: - allow a comma separated list of servernames in 'ntlm_server' option - Fixed crash in calculating NTv2 reponse * OTP plugin: - Don't use a stack variable for an OTP prompt (bug # 2822) - Downgrade the failure to store OTP secret to debug level * KERBEROS_V4 plugin: - Make auxprop lookup calls optional
2011-09-17 13:32:02 +02:00
CONFIGURE_ARGS+= --disable-scram # SCRAM
CONFIGURE_ARGS+= --disable-digest # DIGEST-MD5
CONFIGURE_ARGS+= --disable-gssapi # GSSAPI
CONFIGURE_ARGS+= --disable-krb4 # KERBEROS_V4
CONFIGURE_ARGS+= --disable-ldapdb # LDAP
CONFIGURE_ARGS+= --disable-login # LOGIN
CONFIGURE_ARGS+= --disable-ntlm # NTLM
CONFIGURE_ARGS+= --disable-otp # OTP
CONFIGURE_ARGS+= --disable-passdss # PASSDSS
CONFIGURE_ARGS+= --disable-plain # PLAIN
CONFIGURE_ARGS+= --disable-sql # SQL
CONFIGURE_ARGS+= --disable-srp # SRP
CONFIGURE_ARGS+= --disable-srp-setpass
CONFIGURE_ARGS+= --with-dblib=none
CONFIGURE_ARGS+= --without-openssl
CONFIGURE_ARGS+= --without-pam
CONFIGURE_ARGS+= --without-saslauthd
Update cyrus-sasl to 2.1.26. New in 2.1.26 ------------- * Modernize SASL malloc/realloc callback prototypes * Added sasl_config_done() to plug a memory leak when using an application specific config file * Fixed PLAIN/LOGIN authentication failure when using saslauthd with no auxprop plugins (bug # 3590). * unlock the mutex in sasl_dispose if the context was freed by another thread * MINGW32 compatibility patches * Fixed broken logic in get_fqhostname() when abort_if_no_fqdn is 0 * Fixed some memory leaks in libsasl * GSSAPI plugin: - Fixed a segfault in gssapi.c introduced in 2.1.25. - Code refactoring - Added support for GSS-SPNEGO SASL mechanism (Unix only), which is also HTTP capable * GS2 plugin: - Updated GS2 plugin not to lose minor GSS-API status codes on errors * DIGEST-MD5 plugin: - Correctly send "stale" directive to prevent clients from (re)promtping for password - Better handling of HTTP reauthentication cases - fixed some memory leaks * SASLDB plugin: - Added support for BerkleyDB 5.X or later * OTP plugin: - Removed calling of EVP_cleanup() on plugin shutdown in order to prevent TLS from failing in calling applications * SRP plugin: - Removed calling of EVP_cleanup() on plugin shutdown in order to prevent TLS from failing in calling applications * saslauthd: - auth_rimap.c: qstring incorrectly appending the closing double quote, which might be causing crashes - auth_rimap.c: read the whole IMAP greeting - better error reporting from some drivers - fixed some memory leaks
2012-12-16 02:36:43 +01:00
PKGCONFIG_OVERRIDE+= libsasl2.pc.in
pre-build:
cd ${WRKSRC}/common && ${BUILD_MAKE_CMD} all
# Left here as reference for patch makers...
# clean up a bit to help package maintainer produce patch files
#
#USE_TOOLS+= automake
#
#post-extract:
# ${_PKG_SILENT}${_PKG_DEBUG} \
# ${FIND} ${WRKSRC} -type f -name "*.orig" -print | ${XARGS} ${RM} -f
#
#pre-configure:
# cd ${WRKSRC}; \
# aclocal -I cmulocal -I config; \
# autoheader; \
# automake -a --gnu -i ; \
# autoconf