diff --git a/.gitignore b/.gitignore index dbd1390..6c8702e 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,10 @@ +# Local build files +jss-*.src.rpm +jss-*/ +x86_64/ +.build-*.log + +# Releases jss-4.2.6.tar.gz /jss-4.2.6.tar.gz /jss-4.4.0.tar.gz @@ -13,3 +20,8 @@ jss-4.2.6.tar.gz /jss-4.5.0.tar.gz /jss-4.5.1.tar.gz /jss-4.5.2.tar.gz +/jss-4.5.3.tar.gz +/jss-4.6.1.tar.gz +/jss-4.6.2.tar.gz +/jss-4.6.3.tar.gz +/jss-4.6.4.tar.gz diff --git a/0001-Fix-NativeProxy-reference-tracker.patch b/0001-Fix-NativeProxy-reference-tracker.patch new file mode 100644 index 0000000..529b576 --- /dev/null +++ b/0001-Fix-NativeProxy-reference-tracker.patch @@ -0,0 +1,53 @@ +From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 29 Oct 2019 10:43:56 -0400 +Subject: [PATCH] Fix NativeProxy reference tracker + +In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by +setting mPointer after trying to add NativeProxy to the registry. In +most instances this won't matter, however, if another instance exists in +the HashSet with the same hash value, the equals comparator will be +used, triggering a NPE. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/util/NativeProxy.java | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java +index 1c6d1aa5..a0811f76 100644 +--- a/org/mozilla/jss/util/NativeProxy.java ++++ b/org/mozilla/jss/util/NativeProxy.java +@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable + */ + public NativeProxy(byte[] pointer) { + assert(pointer!=null); +- registry.add(this); + mPointer = pointer; ++ registry.add(this); + + if (saveStacktraces) { + mTrace = Arrays.toString(Thread.currentThread().getStackTrace()); +@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable + if( ! (obj instanceof NativeProxy) ) { + return false; + } +- if( ((NativeProxy)obj).mPointer.length != mPointer.length) { ++ if (((NativeProxy)obj).mPointer == null) { ++ /* If mPointer is null, we have no way to compare the values ++ * of the pointers, so assume they're unequal. */ + return false; + } +- for(int i=0; i < mPointer.length; i++) { +- if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) { +- return false; +- } +- } +- return true; ++ return Arrays.equals(((NativeProxy)obj).mPointer, mPointer); + } + + /** +-- +2.21.0 + diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch new file mode 100644 index 0000000..c535f6e --- /dev/null +++ b/0002-Fix-swapped-parameter-names-with-PBE.patch @@ -0,0 +1,80 @@ +From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:10:32 -0500 +Subject: [PATCH 7/8] Fix swapped parameter names with PBE + +Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression +related to extracting the parameter classes during PBE operations: +previously, the classes of the underlying encryption algorithm were +iterated over, instead of the classes of the PBE class itself. However, +this commit iterated over the PBE parameter classes; no PBE algorithm +accepts a IvParameterSpec, resulting in a null parameter passed to the +later encryption or key wrap operation. This resulted in stack traces +like the following: + +Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter + at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) + at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) + +Resolves: rh-bz#1807371 + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +index 084752c3..0344b14d 100644 +--- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +index a4709070..d85eb0d3 100644 +--- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( IVParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index b35714e3..ebd269f3 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +-- +2.24.1 + diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch new file mode 100644 index 0000000..d75534a --- /dev/null +++ b/0003-Use-specified-algorithm-for-KeyWrap.patch @@ -0,0 +1,60 @@ +From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:39:29 -0500 +Subject: [PATCH 8/8] Use specified algorithm for KeyWrap + +When the token-specified from of EncryptedPrivateKeyInfo.createPBE is +called, it would always request DES3_CBC_PAD as the key wrapping +algorithm, regardless of the input PBE key type. However, the other form +(with an implicit token) was correctly handling this case. + +Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER +instead of having to convert to/from a String form. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +index 3113f614..3a106977 100644 +--- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java ++++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { + + public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { + OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); ++ return fromOID(oid); ++ } + ++ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { + if (oid.equals(AES_KEY_WRAP_PAD_OID)) + return AES_KEY_WRAP_PAD; + +@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { + if (oid.equals(DES_CBC_PAD_OID)) + return DES_CBC_PAD; + +- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); ++ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); + } + } +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index ebd269f3..abfc39a7 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + } + } + +- KeyWrapper wrapper = token.getKeyWrapper( +- KeyWrapAlgorithm.DES3_CBC_PAD); ++ // wrap the key ++ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); + wrapper.initWrap(key, params); + byte encrypted[] = wrapper.wrap(pri); + +-- +2.24.1 + diff --git a/jss-pki-sync-netscape-security-util-Utils.patch b/jss-pki-sync-netscape-security-util-Utils.patch deleted file mode 100644 index 41545a8..0000000 --- a/jss-pki-sync-netscape-security-util-Utils.patch +++ /dev/null @@ -1,94 +0,0 @@ -From a5b0caf63837acfd876ee15e3823fbfdf5685432 Mon Sep 17 00:00:00 2001 -From: Dinesh Prasanth M K -Date: Wed, 30 Jan 2019 12:31:29 -0500 -Subject: [PATCH] Add exec method to execute shell commands with input - -- This is an effort to move duplicate code from PKI code - base to JSS code base - -- This chunk of code was originally introduced in PKI - code: https://github.com/dogtagpki/pki/pull/131 - -- This PR is a joined effort of: - https://github.com/dogtagpki/pki/pull/122 - -Signed-off-by: Dinesh Prasanth M K ---- - .../jss/netscape/security/util/Utils.java | 57 +++++++++++++++++++ - 1 file changed, 57 insertions(+) - -diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java -index b1a3c341..b45381ae 100644 ---- a/org/mozilla/jss/netscape/security/util/Utils.java -+++ b/org/mozilla/jss/netscape/security/util/Utils.java -@@ -25,6 +25,7 @@ - import java.io.FileWriter; - import java.io.IOException; - import java.io.InputStream; -+import java.io.InputStreamReader; - import java.io.OutputStream; - import java.io.OutputStreamWriter; - import java.io.PrintWriter; -@@ -96,6 +97,62 @@ public static boolean exec(String cmd) { - return false; - } - -+ public static String readFromStream(InputStream inputStream) throws IOException { -+ StringBuilder sb = new StringBuilder(); -+ BufferedReader br = null; -+ try { -+ br = new BufferedReader(new InputStreamReader(inputStream)); -+ String line = null; -+ while ((line = br.readLine()) != null) { -+ sb.append(line + System.getProperty("line.separator")); -+ } -+ } finally { -+ br.close(); -+ } -+ return sb.toString().trim(); -+ } -+ -+ public static void writeToStream(OutputStream outputStream, String input) throws IOException { -+ BufferedWriter writer = new BufferedWriter(new OutputStreamWriter(outputStream)); -+ writer.write(input); -+ writer.flush(); -+ writer.close(); -+ } -+ -+ /** -+ * Utility method to execute system commands -+ * -+ * @param cmd The command to be executed and its arguments -+ * @param input The stdin input to be passed to the cmd -+ * @return stdout or stderr of the command executed -+ * @throws IOException -+ * @throws InterruptedException -+ */ -+ public static String exec(String[] cmd, String input) throws IOException, InterruptedException { -+ -+ ProcessBuilder pb = new ProcessBuilder(cmd); -+ -+ Process p = pb.start(); -+ -+ if (input != null) { -+ writeToStream(p.getOutputStream(), input); -+ } -+ -+ p.waitFor(); -+ -+ String output; -+ if (p.exitValue() == 0) { -+ output = readFromStream(p.getInputStream()); -+ } else { -+ output = readFromStream(p.getErrorStream()); -+ } -+ p.destroy(); -+ -+ return output; -+ } -+ -+ -+ - public static String SpecialURLDecode(String s) { - if (s == null) - return null; diff --git a/jss.spec b/jss.spec index ae5c90b..20c08c4 100644 --- a/jss.spec +++ b/jss.spec @@ -6,18 +6,17 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.5.2 -Release: 3%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.4 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git # $ cd jss -# $ git archive \ -# --format=tar.gz \ -# --prefix jss-VERSION/ \ -# -o jss-VERSION.tar.gz \ -# +# $ git tag v4.5. +# $ git push origin v4.5. +# Then go to https://github.com/dogtagpki/jss/releases and download the source +# tarball. Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phase}/%{name}-%{version}%{?_phase}.tar.gz # To create a patch for all changes since a version tag: @@ -26,7 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch1: jss-pki-sync-netscape-security-util-Utils.patch ################################################################################ # Build Dependencies @@ -53,9 +51,7 @@ BuildRequires: slf4j-jdk14 BuildRequires: apache-commons-lang BuildRequires: apache-commons-codec -%if 0%{?fedora} >= 25 || 0%{?rhel} > 7 -BuildRequires: perl-interpreter -%endif +BuildRequires: junit Requires: nss >= 3.30 Requires: java-headless @@ -109,6 +105,9 @@ export BUILD_OPT=1 CFLAGS="-g $RPM_OPT_FLAGS" export CFLAGS +# Check if we're in FIPS mode +modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 + # The Makefile is not thread-safe rm -rf build && mkdir -p build && cd build %cmake \ @@ -116,7 +115,9 @@ rm -rf build && mkdir -p build && cd build -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ .. -%{__make} all test javadoc +%{__make} all +%{__make} javadoc || true +ctest --output-on-failure ################################################################################ %install @@ -158,7 +159,36 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog -* Fri Feb 01 2019 Dogtag PKI Team 4.5.2-3 +* Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 +- Rebase to JSS 4.6.4 +- Fixes memory leak present since v4.6.2 + +* Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 +- Fix for PBE errors + +* Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 +- Rebuild with new NSS to fix rhbz#1794814 + +* Tue Oct 29 2019 Dogtag PKI Team - 4.6.2-2 +- Fix for rhbz#1766451 + +* Tue Oct 15 2019 Dogtag PKI Team - 4.6.2-1 +- Rebase to JSS 4.6.2 +- Fixes CVE-2019-14823 + +* Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-2 +- Disable unnecessary tests to fix broken s390x + +* Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-1 +- Rebase to JSS 4.6.1 + +* Mon May 06 2019 Dogtag PKI Team - 4.5.3-2 +- Add AIA OCSP certificate checking patch + +* Tue Mar 19 2019 Dogtag PKI Team - 4.5.3-1 +- Rebase to JSS 4.5.3 + +* Fri Feb 01 2019 Dogtag PKI Team - 4.5.2-3 - Include nuxwdog patch for netscape.security.util.Utils from PKI * Fri Feb 01 2019 Fedora Release Engineering - 4.5.2-2 diff --git a/sources b/sources index a43c93f..25b6a59 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.5.2.tar.gz) = 344b31a218b7aebb15cc24e24d5697978889bf37856ddefc9521899d2a2a80b1bc9ed0b498a6e0cd19deed169fe1bc56f1ad42e7b8cfc188fadd28245d7bec31 +SHA512 (jss-4.6.4.tar.gz) = c0adc950e1ce5e0f3d846dcb158d831575be84176ded3eec7ce3569cfd96c872a2089a2eede249c5924e1eee58d88574accd3403623910343130cf90b504b348