Adding metadata

7 files changed, 183 insertions, 0 deletions

diff --git a/www-apache/mod_auth_kerb/Manifest b/www-apache/mod_auth_kerb/Manifest
new file mode 100644
index 000000000000..0d9857404b50
--- /dev/null
+++ b/www-apache/mod_auth_kerb/Manifest
@@ -0,0 +1,2 @@
+DIST mod_auth_kerb-5.4-gentoo-patchset.tar.bz2 8717 BLAKE2B 759ad350bb6c07226c86fa51e22f17023378928abed3fd80ff280bac54a472a8d918cba680b3c75ce93805a7f803bbd370a6bb1b73665f5a8d5fb7cdc6353d1c SHA512 3909c2677b30790cc17c0d8843feaa00d9acd14a012672443a887c0e88473d6b1572ba045e1491bcab53cbacff193c11cfe15e63ef1046cfcdf1f4ab60e0ac57
+DIST mod_auth_kerb-5.4.tar.gz 93033 BLAKE2B 2f5c2c26f0f9fa5919f879680e0b8f29087edd001c166655f8130e8d7efd527b0bb9bbb79fe3e508c14622ecefaa693a96dc7dd16a3298da8ae0ad4b69b48ca6 SHA512 93fdf0e43af1c24e8c8204d09240b708747068ef99dd8d21b45cb4d132d31e6d582d49ea5e23b905f55cb0d4a20b1ecb58de1bcbfdad1d016e536fc622b63214
diff --git a/www-apache/mod_auth_kerb/files/11_mod_auth_kerb.conf b/www-apache/mod_auth_kerb/files/11_mod_auth_kerb.conf
new file mode 100644
index 000000000000..e567274c7707
--- /dev/null
+++ b/www-apache/mod_auth_kerb/files/11_mod_auth_kerb.conf
@@ -0,0 +1,14 @@
+<IfDefine AUTH_KERB>
+LoadModule auth_kerb_module modules/mod_auth_kerb.so
+
+<Directory "/var/www/private">
+	AuthType Kerberos
+	AuthName "Kerberos Login"
+	# See the INSTALL file about howto create the keytab
+	Krb5Keytab conf/apache.keytab
+	KrbAuthRealms EXAMPLE.COM
+	Require valid-user
+</Directory>
+</IfDefine>
+
+# vim: ts=4 filetype=apache
diff --git a/www-apache/mod_auth_kerb/files/mod_auth_kerb-5.4-api-change-krb5.patch b/www-apache/mod_auth_kerb/files/mod_auth_kerb-5.4-api-change-krb5.patch
new file mode 100644
index 000000000000..fb402de44a8d
--- /dev/null
+++ b/www-apache/mod_auth_kerb/files/mod_auth_kerb-5.4-api-change-krb5.patch
@@ -0,0 +1,73 @@
+https://sources.debian.org/data/main/liba/libapache-mod-auth-kerb/5.4-2.5/debian/patches/0011-Always-use-NONE-replay-cache-type.patch
+https://bugs.gentoo.org/830208
+
+From: Sam Hartman <hartmans@debian.org>
+Date: Mon, 23 Nov 2020 09:30:22 -0500
+Subject: Always use NONE replay cache type
+
+It's 2020.  Any MIT Kerberos in the wild supports the none replay
+cache type.  The previous code used an internal function to detect
+that replay cache type; that function is no longer available.
+Instead, assume it is present.
+
+An alternative would be to enable the default replay cache.  It was
+originally disabled because of problems between Microsoft
+authenticators and 2004-era MIT Kerberos 1.3.  That's probably a good
+idea.  It probably closes off security attacks, although analyzing the
+impact of replays in cases where neither channel binding nor
+per-message services are used is difficult.  I believe that a replay
+cache is not strictly necessary in the common configuration where
+mod-auth-kerb is used over a TLS-protected connection where the client
+properly verifies the TLS certificate presented by the server prior to
+sending a GSS token.
+
+I have elected not to enable replay cache to affect a minimal change.
+--- a/src/mod_auth_kerb.c
++++ b/src/mod_auth_kerb.c
+@@ -2061,28 +2061,6 @@
+    return ret;
+ }
+ 
+-static int
+-have_rcache_type(const char *type)
+-{
+-   krb5_error_code ret;
+-   krb5_context context;
+-   krb5_rcache id = NULL;
+-   int found;
+-
+-   ret = krb5_init_context(&context);
+-   if (ret)
+-      return 0;
+-
+-   ret = krb5_rc_resolve_full(context, &id, "none:");
+-   found = (ret == 0);
+-
+-   if (ret == 0)
+-      krb5_rc_destroy(context, id);
+-   krb5_free_context(context);
+-
+-   return found;
+-}
+-
+ /*************************************************************************** 
+  Module Setup/Configuration
+  ***************************************************************************/
+@@ -2143,7 +2121,7 @@
+ #ifndef HEIMDAL
+    /* Suppress the MIT replay cache.  Requires MIT Kerberos 1.4.0 or later.
+       1.3.x are covered by the hack overiding the replay calls */
+-   if (getenv("KRB5RCACHETYPE") == NULL && have_rcache_type("none"))
++   if (getenv("KRB5RCACHETYPE") == NULL)
+       putenv(strdup("KRB5RCACHETYPE=none"));
+ #endif
+ }
+@@ -2185,7 +2163,7 @@
+ #ifndef HEIMDAL
+    /* Suppress the MIT replay cache.  Requires MIT Kerberos 1.4.0 or later.
+       1.3.x are covered by the hack overiding the replay calls */
+-   if (getenv("KRB5RCACHETYPE") == NULL && have_rcache_type("none"))
++   if (getenv("KRB5RCACHETYPE") == NULL)
+       putenv(strdup("KRB5RCACHETYPE=none"));
+ #endif
+ #ifdef STANDARD20_MODULE_STUFF
diff --git a/www-apache/mod_auth_kerb/files/mod_auth_kerb-5.4-krb5pwd-double-free.patch b/www-apache/mod_auth_kerb/files/mod_auth_kerb-5.4-krb5pwd-double-free.patch
new file mode 100644
index 000000000000..aa8ced49c103
--- /dev/null
+++ b/www-apache/mod_auth_kerb/files/mod_auth_kerb-5.4-krb5pwd-double-free.patch
@@ -0,0 +1,22 @@
+https://sources.debian.org/src/libapache-mod-auth-kerb/5.4-2.5/debian/patches/mod_auth_kerb-krb5_kt_close.patch/
+https://bugs.gentoo.org/673066
+
+Description: fix use after free in authenticate_user_krb5pwd()
+Origin: https://sourceforge.net/p/modauthkerb/bugs/61/attachment/mod_auth_kerb-krb5_kt_close.patch
+Bug: https://sourceforge.net/p/modauthkerb/bugs/61/
+Bug-Debian: https://bugs.debian.org/934043
+Author: Johan Ymerson (https://sourceforge.net/u/ymerson/)
+--- a/src/mod_auth_kerb.c
++++ b/src/mod_auth_kerb.c
+@@ -799,11 +799,9 @@
+ 	            "failed to verify krb5 credentials: %s",
+ 		          krb5_get_err_text(context, ret));
+          krb5_kt_end_seq_get(context, keytab, &cursor);
+-         krb5_kt_close(context, keytab);
+          goto end;
+        }
+        krb5_kt_end_seq_get(context, keytab, &cursor);
+-       krb5_kt_close(context, keytab);
+      }
+      else {
+        if ((ret = verify_krb5_init_creds(r, context, &creds, server, keytab))) {
diff --git a/www-apache/mod_auth_kerb/files/mod_auth_kerb.conf b/www-apache/mod_auth_kerb/files/mod_auth_kerb.conf
new file mode 100644
index 000000000000..b38a0f361e4d
--- /dev/null
+++ b/www-apache/mod_auth_kerb/files/mod_auth_kerb.conf
@@ -0,0 +1 @@
+d /run/httpd/krbcache 700 apache apache
diff --git a/www-apache/mod_auth_kerb/metadata.xml b/www-apache/mod_auth_kerb/metadata.xml
new file mode 100644
index 000000000000..5f33304011d5
--- /dev/null
+++ b/www-apache/mod_auth_kerb/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/www-apache/mod_auth_kerb/mod_auth_kerb-5.4-r5.ebuild b/www-apache/mod_auth_kerb/mod_auth_kerb-5.4-r5.ebuild
new file mode 100644
index 000000000000..0c1f5271ba76
--- /dev/null
+++ b/www-apache/mod_auth_kerb/mod_auth_kerb-5.4-r5.ebuild
@@ -0,0 +1,66 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit apache-module depend.apache tmpfiles
+
+DESCRIPTION="An Apache authentication module using Kerberos"
+HOMEPAGE="http://modauthkerb.sourceforge.net/"
+SRC_URI="https://downloads.sourceforge.net/project/modauthkerb/${PN}/${P}/${P}.tar.gz
+	https://dev.gentoo.org/~mgorny/dist/${P}-gentoo-patchset.tar.bz2"
+
+LICENSE="BSD openafs-krb5-a HPND"
+SLOT="0"
+KEYWORDS="amd64 x86"
+
+DEPEND="virtual/krb5"
+RDEPEND="${DEPEND}"
+
+APACHE2_MOD_CONF="11_${PN}"
+APACHE2_MOD_DEFINE="AUTH_KERB"
+
+DOCFILES="INSTALL README"
+
+need_apache2
+
+PATCHES=(
+	"${WORKDIR}/${P}-gentoo-patchset"/${P}-rcopshack.patch
+	"${WORKDIR}/${P}-gentoo-patchset"/${P}-fixes.patch
+	"${WORKDIR}/${P}-gentoo-patchset"/${P}-s4u2proxy.patch
+	"${WORKDIR}/${P}-gentoo-patchset"/${P}-httpd24.patch
+	"${WORKDIR}/${P}-gentoo-patchset"/${P}-delegation.patch
+	"${WORKDIR}/${P}-gentoo-patchset"/${P}-cachedir.patch
+	"${WORKDIR}/${P}-gentoo-patchset"/${P}-longuser.patch
+	"${WORKDIR}/${P}-gentoo-patchset"/${P}-handle-continue.patch
+	"${WORKDIR}/${P}-gentoo-patchset"/${P}-heimdal.patch
+
+	# bug #830208
+	"${FILESDIR}"/${P}-api-change-krb5.patch
+	# bug #673066
+	"${FILESDIR}"/${P}-krb5pwd-double-free.patch
+)
+
+# Work around Bug #616612
+pkg_setup() {
+	_init_apache2
+	_init_apache2_late
+}
+
+src_configure() {
+	CFLAGS="" APXS="${APXS}" econf --with-krb5=/usr --without-krb4
+}
+
+src_compile() {
+	emake
+}
+
+src_install() {
+	apache-module_src_install
+
+	dotmpfiles "${FILESDIR}"/${PN}.conf
+}
+
+pkg_postinst() {
+	tmpfiles_process ${PN}.conf
+}