src/lib/libpam/modules, branch release/13.4.0

pam_krb5: Clarify a loop condition.

2023-09-07T17:27:55+00:00

The closing parenthesis was in the wrong location, so instead of assigning the return value to krbret and then comparing it to zero, we were assigning the result of the comparison to krbret and then comparing that to zero.  This has no practical significance since the value is not used after the loop terminates.

PR:		229719
Reviewed by:	cy
Differential Revision:	https://reviews.freebsd.org/D41299

(cherry picked from commit acc7cf8641dcedad295ff0e569c3f3a28939ada0)

pam_krb5: Rename a variable.

Reviewed by:	cy
Differential Revision:	https://reviews.freebsd.org/D41300

(cherry picked from commit 9c2823bae92c09e5356623118da2777bc3ed521d)

Remove $FreeBSD$: one-line nroff pattern

2023-08-23T17:43:32+00:00

Remove /^\.\\"\s*\$FreeBSD\$$\n/

Similar commit in main:
(cherry picked from commit b2c76c41be32)

Remove $FreeBSD$: two-line nroff pattern

2023-08-23T17:43:31+00:00

Remove /^\.\\"\n\.\\"\s*\$FreeBSD\$$\n/

Similar commit in main:
(cherry picked from commit fa9896e082a1)

Remove $FreeBSD$: one-line sh pattern

2023-08-23T17:43:30+00:00

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

Similar commit in main:
(cherry picked from commit d0b2dbfa0ecf)

Remove $FreeBSD$: one-line .c pattern

2023-08-23T17:43:26+00:00

Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/

Similar commit in main:
(cherry picked from commit 1d386b48a555)

Remove $FreeBSD$: two-line .h pattern

2023-08-23T17:43:21+00:00

Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/

Similar commit in main:
(cherry picked from commit b3e7694832e8)

spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD

2023-07-25T15:13:49+00:00

The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch
up to that fact and revert to their recommended match of BSD-2-Clause.

Discussed with:		pfg
MFC After:		3 days
Sponsored by:		Netflix

(cherry picked from commit 4d846d260e2b9a3d4d0a701462568268cbfe7a5b)

pam_krb5: Add missing patch

2023-07-08T05:44:29+00:00

Include a portion of the patch that was missed in 813847e49e35.

Reported by:	markj
Fixes:		813847e49e35

(cherry picked from commit bfa51318dee8afd9307f15e49a6a521938dccd06)

pam_krb5: Fix spoofing vulnerability

2023-06-21T05:25:18+00:00

An adversary on the network can log in via ssh as any user by spoofing
the KDC. When the machine has a keytab installed the keytab is used to
verify the service ticket. However, without a keytab there is no way
for pam_krb5 to verify the KDC's response and get a TGT with the
password.

If both the password _and_ the KDC are controlled by an adversary, the
adversary can provide a password that the adversary's spoofed KDC will
return a valid tgt for.  Currently, without a keytab, pam_krb5 is
vulnerable to this attack.

Reported by:	Taylor R Campbell  via emaste@
Reviewed by:	so
Approved by:	so
Security:	FreeBSD-SA-23:04.pam_krb5
Security:	CVE-2023-3326

(cherry picked from commit 813847e49e35439ba5d7bf16034b0691312068a4)

pam_unix: Fix mismatch in array bounds for make_salt().

2022-11-11T18:18:52+00:00

Reviewed by:	imp, emaste
Reported by:	GCC -Warray-parameter
Differential Revision:	https://reviews.freebsd.org/D36759

(cherry picked from commit 5ceec6c1054e6bde3b72672f33705a044fc0eb86)