Hello community, here is the log from the commit of package pesign for openSUSE:12.3 checked in at 2013-03-01 10:53:50 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:12.3/pesign (Old) and /work/SRC/openSUSE:12.3/.pesign.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "pesign", Maintainer is "[email protected]" Changes: -------- --- /work/SRC/openSUSE:12.3/pesign/pesign.changes 2013-02-25 21:41:19.000000000 +0100 +++ /work/SRC/openSUSE:12.3/.pesign.new/pesign.changes 2013-03-01 10:53:51.000000000 +0100 @@ -1,0 +2,7 @@ +Fri Mar 1 03:04:35 UTC 2013 - [email protected] + +- Update pesign-bnc805166-fix-signature-list.patch to avoid the + potential crash when inserting a signature (bnc#805166) +- Add pwdutils to PreReq + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ pesign.spec ++++++ --- /var/tmp/diff_new_pack.Sqs8Cn/_old 2013-03-01 10:53:52.000000000 +0100 +++ /var/tmp/diff_new_pack.Sqs8Cn/_new 2013-03-01 10:53:52.000000000 +0100 @@ -53,8 +53,7 @@ %{?systemd_requires} %define has_systemd 1 %endif -BuildRequires: pwdutils -Requires: pwdutils +PreReq: pwdutils BuildRoot: %{_tmppath}/%{name}-%{version}-build ExclusiveArch: ia64 %ix86 x86_64 ++++++ pesign-bnc805166-fix-signature-list.patch ++++++ --- /var/tmp/diff_new_pack.Sqs8Cn/_old 2013-03-01 10:53:52.000000000 +0100 +++ /var/tmp/diff_new_pack.Sqs8Cn/_new 2013-03-01 10:53:52.000000000 +0100 @@ -1,7 +1,7 @@ -From 4956251d79904be08c4012fa06c14434f8e706ed Mon Sep 17 00:00:00 2001 +From ee3ab396e8bc167d3b63f475c463cd4103b1ca6e Mon Sep 17 00:00:00 2001 From: Gary Ching-Pang Lin <[email protected]> -Date: Fri, 22 Feb 2013 15:13:08 +0800 -Subject: [PATCH 1/2] Backport patches to fix signature list +Date: Wed, 27 Feb 2013 15:48:06 +0800 +Subject: [PATCH] Backport patches to fix signature list Get cms_context out of wincert functions. ee357451be9968cedda57ce13b103eb82c590e67 @@ -18,36 +18,21 @@ Make implanting extracted certificates work again. 5ceddd2f80dfea70d211236190943746c2d2f77b -Add error handling macros to make code simpler. -0bafa814b49a9556550cfbc373e0ea5b9edb929e - -Add is_issuer_of(cert, cert) helper function. -7750aaeceb2655807788f8e45417e84cb5404a8e - -Add "find_named_certificate()" helper function. -c89c8dbf7929f8f8f36bc1c4045fcc17d5ce7e5c - -Make generate_certificate_list include the issuing certificate. -8c3d82ceb5029bedfee1577682fec5ff3669ff3c - Fix a casting problem on 32-bit. 9eb2814858270af2d7ecfbfa5ca131e7be2f9f53 --- libdpe/pe_addcert.c | 2 +- - libdpe/pe_updatefile.c | 13 ++++++- - src/actions.c | 12 +------ + libdpe/pe_updatefile.c | 13 +++++++++- + src/actions.c | 12 +-------- src/actions.h | 2 +- - src/cms_common.c | 93 ++++++++++++++++++++++++++++++++++++++++++++++++ - src/cms_common.h | 32 ++++++++++++++++- - src/daemon.c | 6 ++-- - src/pesign.c | 35 +++++++++++++++--- - src/peverify.c | 7 ++-- - src/siglist.c | 46 +++++++++++++++++++----- - src/siglist.h | 3 +- - src/signed_data.c | 53 +++++++++++++++++++++------ - src/wincert.c | 65 +++++++++++++++++++++++---------- - src/wincert.h | 8 +++-- - 14 files changed, 312 insertions(+), 65 deletions(-) + src/daemon.c | 6 +++-- + src/pesign.c | 35 ++++++++++++++++++++++---- + src/peverify.c | 7 ++++-- + src/siglist.c | 46 ++++++++++++++++++++++++++++------ + src/siglist.h | 3 ++- + src/wincert.c | 65 ++++++++++++++++++++++++++++++++++-------------- + src/wincert.h | 8 +++--- + 11 files changed, 146 insertions(+), 53 deletions(-) diff --git a/libdpe/pe_addcert.c b/libdpe/pe_addcert.c index e391242..b6ba969 100644 @@ -155,169 +140,6 @@ extern void insert_signature(cms_context *cms, int signum); #endif /* PESIGN_CRYPTO_H */ -diff --git a/src/cms_common.c b/src/cms_common.c -index 9ab2021..3b2e71a 100644 ---- a/src/cms_common.c -+++ b/src/cms_common.c -@@ -304,6 +304,17 @@ is_valid_cert(CERTCertificate *cert, void *data) - return SECFailure; - } - -+int -+is_issuer_of(CERTCertificate *c0, CERTCertificate *c1) -+{ -+ if (c0->derSubject.len != c1->derIssuer.len) -+ return 0; -+ -+ if (memcmp(c0->derSubject.data, c1->derIssuer.data, c0->derSubject.len)) -+ return 0; -+ return 1; -+} -+ - /* This is the dumbest function ever, but we need it anyway, because nss - * is garbage. */ - static void -@@ -448,6 +459,88 @@ err_slots: - return 0; - } - -+int -+find_named_certificate(cms_context *cms, char *name, CERTCertificate **cert) -+{ -+ if (!name) { -+ cms->log(cms, LOG_ERR, "no certificate name specified"); -+ return -1; -+ } -+ -+ secuPWData pwdata_val = { 0, 0 }; -+ void *pwdata = cms->pwdata ? cms->pwdata : &pwdata_val; -+ PK11_SetPasswordFunc(cms->func ? cms->func : SECU_GetModulePassword); -+ -+ PK11SlotList *slots = NULL; -+ slots = PK11_GetAllTokens(CKM_RSA_PKCS, PR_FALSE, PR_TRUE, pwdata); -+ if (!slots) -+ cmsreterr(-1, cms, "could not get pk11 token list"); -+ -+ PK11SlotListElement *psle = NULL; -+ psle = PK11_GetFirstSafe(slots); -+ if (!psle) { -+ save_port_err(PK11_FreeSlotList(slots)); -+ cmsreterr(-1, cms, "could not get pk11 safe"); -+ } -+ -+ while (psle) { -+ if (!strcmp(cms->tokenname, PK11_GetTokenName(psle->slot))) -+ break; -+ -+ psle = PK11_GetNextSafe(slots, psle, PR_FALSE); -+ } -+ -+ if (!psle) { -+ save_port_err(PK11_FreeSlotList(slots)); -+ cms->log(cms, LOG_ERR, "could not find token \"%s\"", -+ cms->tokenname); -+ return -1; -+ } -+ -+ SECStatus status; -+ if (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, pwdata)) { -+ status = PK11_Authenticate(psle->slot, PR_TRUE, pwdata); -+ if (status != SECSuccess) { -+ PK11_DestroySlotListElement(slots, &psle); -+ PK11_FreeSlotList(slots); -+ cms->log(cms, LOG_ERR, "authentication failed for " -+ "token \"%s\"", cms->tokenname); -+ return -1; -+ } -+ } -+ -+ CERTCertList *certlist = NULL; -+ certlist = PK11_ListCertsInSlot(psle->slot); -+ if (!certlist) { -+ save_port_err( -+ PK11_DestroySlotListElement(slots, &psle); -+ PK11_FreeSlotList(slots)); -+ cmsreterr(-1, cms, "could not get certificate list"); -+ } -+ -+ CERTCertListNode *node = NULL; -+ for (node = CERT_LIST_HEAD(certlist); !CERT_LIST_END(node,certlist); -+ node = CERT_LIST_NEXT(node)) { -+ if (!strcmp(node->cert->subjectName, name)) -+ break; -+ } -+ if (!node) { -+ PK11_DestroySlotListElement(slots, &psle); -+ PK11_FreeSlotList(slots); -+ CERT_DestroyCertList(certlist); -+ -+ return -1; -+ } -+ -+ *cert = CERT_DupCertificate(node->cert); -+ -+ PK11_DestroySlotListElement(slots, &psle); -+ PK11_FreeSlotList(slots); -+ CERT_DestroyCertList(certlist); -+ -+ return 0; -+} -+ - static SEC_ASN1Template EmptySequenceTemplate[] = { - { - .kind = SEC_ASN1_SEQUENCE, -diff --git a/src/cms_common.h b/src/cms_common.h -index a3848cd..2b2d619 100644 ---- a/src/cms_common.h -+++ b/src/cms_common.h -@@ -19,9 +19,35 @@ - #ifndef CMS_COMMON_H - #define CMS_COMMON_H 1 - --#include <stdarg.h> -+#include <errno.h> - #include <nss3/cert.h> - #include <nss3/secpkcs7.h> -+#include <signal.h> -+#include <stdarg.h> -+#include <syslog.h> -+#include <time.h> -+#include <unistd.h> -+ -+#define save_port_err(x) \ -+ ({ \ -+ int __saved_errno = PORT_GetError(); \ -+ x; \ -+ PORT_SetError(__saved_errno); \ -+ }) -+ -+#define cmserr(rv, cms, fmt, args...) ({ \ -+ (cms)->log((cms), LOG_ERR, "%s:%s:%d: " fmt ": %s", \ -+ __FILE__, __func__, __LINE__, ## args, \ -+ PORT_ErrorToString(PORT_GetError())); \ -+ exit(rv); \ -+ }) -+#define cmsreterr(rv, cms, fmt, args...) ({ \ -+ (cms)->log((cms), LOG_ERR, "%s:%s:%d: " fmt ": %s", \ -+ __FILE__, __func__, __LINE__, ## args, \ -+ PORT_ErrorToString(PORT_GetError())); \ -+ return rv; \ -+ }) -+ - - struct digest { - PK11Context *pk11ctx; -@@ -109,6 +135,10 @@ extern int generate_digest(cms_context *cms, Pe *pe); - extern int generate_signature(cms_context *ctx); - extern int unlock_nss_token(cms_context *ctx); - extern int find_certificate(cms_context *ctx); -+extern int is_issuer_of(CERTCertificate *c0, CERTCertificate *c1); -+ -+extern int find_named_certificate(cms_context *cms, char *name, -+ CERTCertificate **cert); - - extern SECOidTag digest_get_digest_oid(cms_context *cms); - extern SECOidTag digest_get_encryption_oid(cms_context *cms); diff --git a/src/daemon.c b/src/daemon.c index 4a9af87..92ae856 100644 --- a/src/daemon.c @@ -551,73 +373,6 @@ extern void signature_list_free(signature_list *sl); #endif /* SIGLIST_H */ -diff --git a/src/signed_data.c b/src/signed_data.c -index e676cb3..83957d6 100644 ---- a/src/signed_data.c -+++ b/src/signed_data.c -@@ -76,20 +76,51 @@ static int - generate_certificate_list(cms_context *cms, SECItem ***certificate_list_p) - { - SECItem **certificates = NULL; -+ void *mark = PORT_ArenaMark(cms->arena); - -- certificates = PORT_ArenaZAlloc(cms->arena, sizeof (SECItem *) * 2); -- if (!certificates) -- return -1; -- -- certificates[0] = PORT_ArenaZAlloc(cms->arena, sizeof (SECItem)); -- if (!certificates[0]) { -- int err = PORT_GetError(); -- PORT_ZFree(certificates, sizeof (SECItem) * 2); -- PORT_SetError(err); -- return -1; -+ certificates = PORT_ArenaZAlloc(cms->arena, sizeof (SECItem *) * 3); -+ if (!certificates) { -+ save_port_err(PORT_ArenaRelease(cms->arena, mark)); -+ cmsreterr(-1, cms, "could not allocate certificate list"); -+ } -+ int i = 0; -+ -+ certificates[i] = PORT_ArenaZAlloc(cms->arena, sizeof (SECItem)); -+ if (!certificates[i]) { -+ save_port_err(PORT_ArenaRelease(cms->arena, mark)); -+ cmsreterr(-1, cms, "could not allocate certificate entry"); -+ } -+ SECITEM_CopyItem(cms->arena, certificates[i++], &cms->cert->derCert); -+ -+ if (!is_issuer_of(cms->cert, cms->cert)) { -+ CERTCertificate *signer = NULL; -+ int rc = find_named_certificate(cms, cms->cert->issuerName, -+ &signer); -+ if (rc < 0) { -+ PORT_ArenaRelease(cms->arena, mark); -+ return -1; -+ } -+ -+ if (signer) { -+ if (signer->derCert.len != cms->cert->derCert.len || -+ memcmp(signer->derCert.data, -+ cms->cert->derCert.data, -+ signer->derCert.len)) { -+ certificates[i] = PORT_ArenaZAlloc(cms->arena, -+ sizeof (SECItem)); -+ if (!certificates[i]) { -+ save_port_err( -+ PORT_ArenaRelease(cms->arena, mark)); -+ cmsreterr(-1, cms,"could not allocate " -+ "certificate entry"); -+ } -+ SECITEM_CopyItem(cms->arena, certificates[i++], -+ &signer->derCert); -+ } -+ CERT_DestroyCertificate(signer); -+ } - } - -- SECITEM_CopyItem(cms->arena, certificates[0], &cms->cert->derCert); - *certificate_list_p = certificates; - return 0; - } diff --git a/src/wincert.c b/src/wincert.c index 4b5ba45..4197a87 100644 --- a/src/wincert.c @@ -796,30 +551,3 @@ -- 1.7.10.4 - -From 8d86f6db19be98538fd5397a9de5f7d06733746e Mon Sep 17 00:00:00 2001 -From: Gary Ching-Pang Lin <[email protected]> -Date: Mon, 25 Feb 2013 10:43:09 +0800 -Subject: [PATCH 2/2] Don't request the private key in - find_named_certificate() when importing a raw signature - ---- - src/cms_common.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/cms_common.c b/src/cms_common.c -index 3b2e71a..642cc86 100644 ---- a/src/cms_common.c -+++ b/src/cms_common.c -@@ -498,7 +498,7 @@ find_named_certificate(cms_context *cms, char *name, CERTCertificate **cert) - } - - SECStatus status; -- if (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, pwdata)) { -+ if (!cms->privkey_unneeded && PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, pwdata)) { - status = PK11_Authenticate(psle->slot, PR_TRUE, pwdata); - if (status != SECSuccess) { - PK11_DestroySlotListElement(slots, &psle); --- -1.7.10.4 - -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
