[csw-devel] SF.net SVN: gar:[16357] csw/mgar/pkg/openssl/trunk

chninkel at users.sourceforge.net chninkel at users.sourceforge.net
Sun Dec 4 00:07:51 CET 2011


Revision: 16357
          http://gar.svn.sourceforge.net/gar/?rev=16357&view=rev
Author:   chninkel
Date:     2011-12-03 23:07:51 +0000 (Sat, 03 Dec 2011)
Log Message:
-----------
openssl: block Malaysian's Digicert Sdn. Bhd. certificates

Modified Paths:
--------------
    csw/mgar/pkg/openssl/trunk/Makefile

Added Paths:
-----------
    csw/mgar/pkg/openssl/trunk/files/block_bad_certificates.patch

Removed Paths:
-------------
    csw/mgar/pkg/openssl/trunk/files/block_diginotar.patch

Modified: csw/mgar/pkg/openssl/trunk/Makefile
===================================================================
--- csw/mgar/pkg/openssl/trunk/Makefile	2011-12-03 22:57:16 UTC (rev 16356)
+++ csw/mgar/pkg/openssl/trunk/Makefile	2011-12-03 23:07:51 UTC (rev 16357)
@@ -132,9 +132,9 @@
 # Update openssl.cnf path in man page to follow opencsw standard
 PATCHFILES += opencsw_paths.patch
 
-# Let's always block the compromised DigiNotar CA, whatever the CA configured
-# (patch taken from Debian Package)
-PATCHFILES += block_diginotar.patch
+# Let's always block some compromised CA, whatever the CA configured
+# (patchs taken from Debian Package)
+PATCHFILES += block_bad_certificates.patch
 
 LICENSE=LICENSE
 

Copied: csw/mgar/pkg/openssl/trunk/files/block_bad_certificates.patch (from rev 16350, csw/mgar/pkg/openssl/trunk/files/block_diginotar.patch)
===================================================================
--- csw/mgar/pkg/openssl/trunk/files/block_bad_certificates.patch	                        (rev 0)
+++ csw/mgar/pkg/openssl/trunk/files/block_bad_certificates.patch	2011-12-03 23:07:51 UTC (rev 16357)
@@ -0,0 +1,60 @@
+From: Raphael Geissert <geissert at debian.org>
+Description: make X509_verify_cert indicate that any certificate whose
+ name contains "DigiNotar" is revoked.
+Origin: vendor
+Forwarded: not-needed
+Last-Update: 2011-09-07
+Bug: http://bugs.debian.org/639744
+
+diff -urpN openssl-0.9.8o-4squeeze1.orig/crypto/x509/x509_vfy.c openssl-0.9.8o-4squeeze1/crypto/x509/x509_vfy.c
+--- openssl-0.9.8o-4squeeze1.orig/crypto/x509/x509_vfy.c	2009-06-26 06:34:21.000000000 -0500
++++ openssl-0.9.8o-4squeeze1/crypto/x509/x509_vfy.c	2011-09-07 21:23:58.000000000 -0500
+@@ -78,6 +78,7 @@ static int check_trust(X509_STORE_CTX *c
+ static int check_revocation(X509_STORE_CTX *ctx);
+ static int check_cert(X509_STORE_CTX *ctx);
+ static int check_policy(X509_STORE_CTX *ctx);
++static int check_ca_blacklist(X509_STORE_CTX *ctx);
+ static int internal_verify(X509_STORE_CTX *ctx);
+ const char X509_version[]="X.509" OPENSSL_VERSION_PTEXT;
+ 
+@@ -312,6 +313,9 @@ int X509_verify_cert(X509_STORE_CTX *ctx
+ 		ok=internal_verify(ctx);
+ 	if(!ok) goto end;
+ 
++	ok = check_ca_blacklist(ctx);
++	if(!ok) goto end;
++
+ #ifndef OPENSSL_NO_RFC3779
+ 	/* RFC 3779 path validation, now that CRL check has been done */
+ 	ok = v3_asid_validate_path(ctx);
+@@ -661,6 +665,29 @@ static int check_crl_time(X509_STORE_CTX
+ 	return 1;
+ 	}
+ 
++static int check_ca_blacklist(X509_STORE_CTX *ctx)
++	{
++	X509 *x;
++	int i;
++	/* Check all certificates against the blacklist */
++	for (i = sk_X509_num(ctx->chain) - 1; i >= 0; i--)
++		{
++		x = sk_X509_value(ctx->chain, i);
++		/* Mark certificates containing the following names as
++		 * revoked, no matter where in the chain they are.                                                                                                 
++		 */
++               if (x->name && (strstr(x->name, "DigiNotar") ||
++                       strstr(x->name, "Digicert Sdn. Bhd.")))
++			{
++			ctx->error = X509_V_ERR_CERT_REVOKED;
++			ctx->error_depth = i;
++			ctx->current_cert = x;
++			if (!ctx->verify_cb(0,ctx))
++				return 0;
++			}
++		}
++	return 1;
++	}
++
+ /* Lookup CRLs from the supplied list. Look for matching isser name
+  * and validity. If we can't find a valid CRL return the last one
+  * with matching name. This gives more meaningful error codes. Otherwise

Deleted: csw/mgar/pkg/openssl/trunk/files/block_diginotar.patch
===================================================================
--- csw/mgar/pkg/openssl/trunk/files/block_diginotar.patch	2011-12-03 22:57:16 UTC (rev 16356)
+++ csw/mgar/pkg/openssl/trunk/files/block_diginotar.patch	2011-12-03 23:07:51 UTC (rev 16357)
@@ -1,59 +0,0 @@
-From: Raphael Geissert <geissert at debian.org>
-Description: make X509_verify_cert indicate that any certificate whose
- name contains "DigiNotar" is revoked.
-Origin: vendor
-Forwarded: not-needed
-Last-Update: 2011-09-07
-Bug: http://bugs.debian.org/639744
-
-diff -urpN openssl-0.9.8o-4squeeze1.orig/crypto/x509/x509_vfy.c openssl-0.9.8o-4squeeze1/crypto/x509/x509_vfy.c
---- openssl-0.9.8o-4squeeze1.orig/crypto/x509/x509_vfy.c	2009-06-26 06:34:21.000000000 -0500
-+++ openssl-0.9.8o-4squeeze1/crypto/x509/x509_vfy.c	2011-09-07 21:23:58.000000000 -0500
-@@ -78,6 +78,7 @@ static int check_trust(X509_STORE_CTX *c
- static int check_revocation(X509_STORE_CTX *ctx);
- static int check_cert(X509_STORE_CTX *ctx);
- static int check_policy(X509_STORE_CTX *ctx);
-+static int check_ca_blacklist(X509_STORE_CTX *ctx);
- static int internal_verify(X509_STORE_CTX *ctx);
- const char X509_version[]="X.509" OPENSSL_VERSION_PTEXT;
- 
-@@ -312,6 +313,9 @@ int X509_verify_cert(X509_STORE_CTX *ctx
- 		ok=internal_verify(ctx);
- 	if(!ok) goto end;
- 
-+	ok = check_ca_blacklist(ctx);
-+	if(!ok) goto end;
-+
- #ifndef OPENSSL_NO_RFC3779
- 	/* RFC 3779 path validation, now that CRL check has been done */
- 	ok = v3_asid_validate_path(ctx);
-@@ -661,6 +665,29 @@ static int check_crl_time(X509_STORE_CTX
- 	return 1;
- 	}
- 
-+static int check_ca_blacklist(X509_STORE_CTX *ctx)
-+	{
-+	X509 *x;
-+	int i;
-+	/* Check all certificates against the blacklist */
-+	for (i = sk_X509_num(ctx->chain) - 1; i >= 0; i--)
-+		{
-+		x = sk_X509_value(ctx->chain, i);
-+		/* Mark DigiNotar certificates as revoked, no matter                                                                            
-+		 * where in the chain they are.                                                                                                 
-+		 */
-+		if (x->name && strstr(x->name, "DigiNotar"))
-+			{
-+			ctx->error = X509_V_ERR_CERT_REVOKED;
-+			ctx->error_depth = i;
-+			ctx->current_cert = x;
-+			if (!ctx->verify_cb(0,ctx))
-+				return 0;
-+			}
-+		}
-+	return 1;
-+	}
-+
- /* Lookup CRLs from the supplied list. Look for matching isser name
-  * and validity. If we can't find a valid CRL return the last one
-  * with matching name. This gives more meaningful error codes. Otherwise

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.



More information about the devel mailing list