[cpp-sp] 09/37: Refresh patches

Scott Cantor cantor.2 at osu.edu
Thu Dec 20 19:47:35 EST 2018 

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to annotated tag debian/2.5.5+dfsg1-1
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=c5b1307fc4733019e1e9d21e4e93e44ecebc52ec

commit c5b1307fc4733019e1e9d21e4e93e44ecebc52ec
Author: Ferenc Wágner <wferi at niif.hu>
AuthorDate: Wed Jan 20 16:40:20 2016 +0100

    Refresh patches
    
    * delete backported security patch
    * omit patch numbers (rename files)
    * new git uses tighter indentation
---
 ...ecurity-fix-from-V2.5.4-for-CVE-2015-2684.patch | 56 ----------------------
 ...-flag.patch => Avoid-libtool-silent-flag.patch} |  4 +-
 ...patch => Default-native-logger-to-syslog.patch} |  2 +-
 ...cript.patch => Improve-shibd-init-script.patch} | 10 ++--
 ...atch => Remove-WSTrust-schema-references.patch} |  0
 ...ebian.patch => Shire-log-path-for-Debian.patch} |  6 +--
 ....patch => keygen-improvements-for-Debian.patch} |  0
 debian/patches/series                              | 13 +++--
 8 files changed, 17 insertions(+), 74 deletions(-)

diff --git a/debian/patches/0007-Security-fix-from-V2.5.4-for-CVE-2015-2684.patch b/debian/patches/0007-Security-fix-from-V2.5.4-for-CVE-2015-2684.patch
deleted file mode 100644
index a8e9f42..0000000
--- a/debian/patches/0007-Security-fix-from-V2.5.4-for-CVE-2015-2684.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From: =?utf-8?q?Ferenc_W=C3=A1gner?= <wferi at niif.hu>
-Date: Tue, 17 Mar 2015 15:09:39 +0100
-Subject: Security fix from V2.5.4 for CVE-2015-2684
-
-Shibboleth SP software crashes on malformed input messages
-===============================================================
-The SP software includes an authenticated denial of service
-vulnerability that results in a crash on certain kinds of malformed
-SAML messages. The vulnerability is only triggered when special
-conditions are met and after a message or assertion signature
-has been verified, so exploitation requires a message produced
-under a trusted key, limiting the impact.
-
-URL for the full Security Advisory:
-https://shibboleth.net/community/advisories/secadv_20150319.txt
----
- shibsp/handler/impl/SAML2Consumer.cpp      |    4 ++++
- shibsp/impl/StorageServiceSessionCache.cpp |    3 ++-
- 2 files changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/shibsp/handler/impl/SAML2Consumer.cpp b/shibsp/handler/impl/SAML2Consumer.cpp
-index ec62384..be2397c 100644
---- a/shibsp/handler/impl/SAML2Consumer.cpp
-+++ b/shibsp/handler/impl/SAML2Consumer.cpp
-@@ -44,6 +44,7 @@
- # include <xmltooling/XMLToolingConfig.h>
- # include <xmltooling/io/HTTPRequest.h>
- # include <xmltooling/util/DateTime.h>
-+# include <xmltooling/validation/ValidatorSuite.h>
- using namespace opensaml::saml2;
- using namespace opensaml::saml2p;
- using namespace opensaml::saml2md;
-@@ -312,6 +313,9 @@ void SAML2Consumer::implementProtocol(
-             if (!decrypted->getSignature() && requireSignedAssertions.first && requireSignedAssertions.second)
-                 throw SecurityPolicyException("The incoming assertion was unsigned, violating local security policy.");
- 
-+            // Run the schema validators against the assertion, since it was hidden by encryption.
-+            SchemaValidators.validate(decrypted.get());
-+
-             // We clear the security flag, so we can tell whether the token was secured on its own.
-             policy.setAuthenticated(false);
-             policy.reset(true);
-diff --git a/shibsp/impl/StorageServiceSessionCache.cpp b/shibsp/impl/StorageServiceSessionCache.cpp
-index 9e5d48d..b816624 100644
---- a/shibsp/impl/StorageServiceSessionCache.cpp
-+++ b/shibsp/impl/StorageServiceSessionCache.cpp
-@@ -1233,7 +1233,8 @@ void SSCache::insert(
-         throw FatalProfileException("Attempted to create a session with a duplicate key.");
- 
-     // Store the reverse mapping for logout.
--    if (nameid && m_reverseIndex && (m_excludedNames.size() == 0 || m_excludedNames.count(nameid->getName()) == 0)) {
-+    if (name.get() && *name.get() && m_reverseIndex
-+            && (m_excludedNames.size() == 0 || m_excludedNames.count(nameid->getName()) == 0)) {
-         try {
-             insert(key.get(), expires, name.get(), index.get());
-         }
diff --git a/debian/patches/0003-Avoid-libtool-silent-flag.patch b/debian/patches/Avoid-libtool-silent-flag.patch
similarity index 87%
rename from debian/patches/0003-Avoid-libtool-silent-flag.patch
rename to debian/patches/Avoid-libtool-silent-flag.patch
index 6ade3e1..ed6ce0f 100644
--- a/debian/patches/0003-Avoid-libtool-silent-flag.patch
+++ b/debian/patches/Avoid-libtool-silent-flag.patch
@@ -10,10 +10,10 @@ to the libtool flags in configure.ac.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/configure.ac b/configure.ac
-index 6c71412..2e17582 100644
+index 44598d5..08037d6 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1351,6 +1351,7 @@ if test -n "$APXS24_CC" && test "$APXS24_CC" != "$CC" ; then
+@@ -1376,6 +1376,7 @@ if test -n "$APXS24_CC" && test "$APXS24_CC" != "$CC" ; then
    echo "=================================================================="
  fi
  
diff --git a/debian/patches/0005-Default-native-logger-to-syslog.patch b/debian/patches/Default-native-logger-to-syslog.patch
similarity index 97%
rename from debian/patches/0005-Default-native-logger-to-syslog.patch
rename to debian/patches/Default-native-logger-to-syslog.patch
index 161f997..7c2fd4e 100644
--- a/debian/patches/0005-Default-native-logger-to-syslog.patch
+++ b/debian/patches/Default-native-logger-to-syslog.patch
@@ -6,7 +6,7 @@ Rather than generating a separate log in /var/log/apache2 by
 default, which needs permissions and rotation management, default
 the native.logger configuration to using syslog.
 ---
- configs/native.logger.in | 44 ++++++++++++++++++++++++++++++--------------
+ configs/native.logger.in |   44 ++++++++++++++++++++++++++++++--------------
  1 file changed, 30 insertions(+), 14 deletions(-)
 
 diff --git a/configs/native.logger.in b/configs/native.logger.in
diff --git a/debian/patches/0001-Improve-shibd-init-script.patch b/debian/patches/Improve-shibd-init-script.patch
similarity index 96%
rename from debian/patches/0001-Improve-shibd-init-script.patch
rename to debian/patches/Improve-shibd-init-script.patch
index 915f463..b07fa11 100644
--- a/debian/patches/0001-Improve-shibd-init-script.patch
+++ b/debian/patches/Improve-shibd-init-script.patch
@@ -11,7 +11,7 @@ private key.  Add a status command.
  1 file changed, 115 insertions(+), 28 deletions(-)
 
 diff --git a/configs/shibd-debian.in b/configs/shibd-debian.in
-index 59f0995..0eefbb2 100644
+index 37efca4..f51e35f 100644
 --- a/configs/shibd-debian.in
 +++ b/configs/shibd-debian.in
 @@ -1,18 +1,20 @@
@@ -44,17 +44,17 @@ index 59f0995..0eefbb2 100644
  # Based on the dh-make template written by:
  #
  # Written by Miquel van Smoorenburg <miquels at cistron.nl>.
-@@ -29,6 +31,7 @@ DAEMON=@-PREFIX-@/sbin/$NAME
+@@ -30,6 +32,7 @@ DAEMON=@-PREFIX-@/sbin/$NAME
  SCRIPTNAME=/etc/init.d/$NAME
  PIDFILE=@-PKGRUNDIR-@/$NAME.pid
  DAEMON_OPTS=""
 +DAEMON_USER=_shibd
  
- # Force removal of socket
- DAEMON_OPTS="$DAEMON_OPTS -f"
-@@ -48,38 +51,122 @@ DAEMON_OPTS="$DAEMON_OPTS -w 30"
  # Read configuration if it is present.
  [ -r /etc/default/$NAME ] && . /etc/default/$NAME
+@@ -49,38 +52,122 @@ DAEMON_OPTS="$DAEMON_OPTS -w $SHIBD_WAIT"
+ # Exit if the package is not installed.
+ [ -x "$DAEMON" ] || exit 0
  
 -# Get the setting of VERBOSE and other rcS variables.
 -[ -f /etc/default/rcS ] && . /etc/default/rcS
diff --git a/debian/patches/0006-Remove-WSTrust-schema-references.patch b/debian/patches/Remove-WSTrust-schema-references.patch
similarity index 100%
rename from debian/patches/0006-Remove-WSTrust-schema-references.patch
rename to debian/patches/Remove-WSTrust-schema-references.patch
diff --git a/debian/patches/0004-Shire-log-path-for-Debian.patch b/debian/patches/Shire-log-path-for-Debian.patch
similarity index 85%
rename from debian/patches/0004-Shire-log-path-for-Debian.patch
rename to debian/patches/Shire-log-path-for-Debian.patch
index 83c590c..816d4b3 100644
--- a/debian/patches/0004-Shire-log-path-for-Debian.patch
+++ b/debian/patches/Shire-log-path-for-Debian.patch
@@ -5,18 +5,18 @@ Subject: Shire log path for Debian
 Change the Apache module log path to /var/log/apache2, used on
 Debian, from the Red Hat /var/log/httpd.
 ---
- configs/Makefile.am | 2 +-
+ configs/Makefile.am |    2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/configs/Makefile.am b/configs/Makefile.am
-index ee90def..841f9de 100644
+index 19826d7..c3a6858 100644
 --- a/configs/Makefile.am
 +++ b/configs/Makefile.am
 @@ -4,7 +4,7 @@ AUTOMAKE_OPTIONS = foreign
  
  pkglibdir = ${libdir}/@PACKAGE_NAME@
  pkglogdir = ${localstatedir}/log/@PACKAGE_NAME@
--shirelogdir = ${localstatedir}/log/httpd
+-shirelogdir = ${localstatedir}/log/@PACKAGE_NAME at -www
 +shirelogdir = ${localstatedir}/log/apache2
  pkgxmldir = $(datadir)/xml/@PACKAGE_NAME@
  pkgwebdir = $(datadir)/@PACKAGE_NAME@
diff --git a/debian/patches/0002-keygen-improvements-for-Debian.patch b/debian/patches/keygen-improvements-for-Debian.patch
similarity index 100%
rename from debian/patches/0002-keygen-improvements-for-Debian.patch
rename to debian/patches/keygen-improvements-for-Debian.patch
diff --git a/debian/patches/series b/debian/patches/series
index 34f4537..4117494 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,7 +1,6 @@
-0001-Improve-shibd-init-script.patch
-0002-keygen-improvements-for-Debian.patch
-0003-Avoid-libtool-silent-flag.patch
-0004-Shire-log-path-for-Debian.patch
-0005-Default-native-logger-to-syslog.patch
-0006-Remove-WSTrust-schema-references.patch
-0007-Security-fix-from-V2.5.4-for-CVE-2015-2684.patch
+Improve-shibd-init-script.patch
+keygen-improvements-for-Debian.patch
+Avoid-libtool-silent-flag.patch
+Shire-log-path-for-Debian.patch
+Default-native-logger-to-syslog.patch
+Remove-WSTrust-schema-references.patch

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.

More information about the commits mailing list