From 458481976b4577a07d35b77d1206f6b2821d198f Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 15 Oct 2019 16:05:53 -0400 Subject: [PATCH 01/10] Rebase to upstream JSS v4.6.2 Fixes CVE-2019-14823 Signed-off-by: Alexander Scheel --- .gitignore | 1 + 0001-Disable-buffer-based-tests.patch | 78 --------------------------- jss.spec | 10 ++-- sources | 2 +- 4 files changed, 7 insertions(+), 84 deletions(-) delete mode 100644 0001-Disable-buffer-based-tests.patch diff --git a/.gitignore b/.gitignore index 1c7e1b3..5981ea6 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,4 @@ jss-4.2.6.tar.gz /jss-4.5.2.tar.gz /jss-4.5.3.tar.gz /jss-4.6.1.tar.gz +/jss-4.6.2.tar.gz diff --git a/0001-Disable-buffer-based-tests.patch b/0001-Disable-buffer-based-tests.patch deleted file mode 100644 index c432844..0000000 --- a/0001-Disable-buffer-based-tests.patch +++ /dev/null @@ -1,78 +0,0 @@ -From ab1ba593ac9965607e60a16f3e5e75ba9ccfb505 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Thu, 8 Aug 2019 12:35:28 -0400 -Subject: [PATCH] Disable failing tests on special arches - -Signed-off-by: Alexander Scheel ---- - cmake/JSSTests.cmake | 40 ---------------------------------------- - 1 file changed, 40 deletions(-) - -diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake -index 9397f45d..ae6b0d22 100644 ---- a/cmake/JSSTests.cmake -+++ b/cmake/JSSTests.cmake -@@ -78,19 +78,6 @@ macro(jss_tests) - NAME "BigObjectIdentifier" - COMMAND "org.mozilla.jss.tests.BigObjectIdentifier" - ) -- jss_test_java( -- NAME "JSS_Test_PR_FileDesc" -- COMMAND "org.mozilla.jss.tests.TestPRFD" -- ) -- jss_test_java( -- NAME "JSS_Test_Raw_SSL" -- COMMAND "org.mozilla.jss.tests.TestRawSSL" "${RESULTS_NSSDB_OUTPUT_DIR}" -- DEPENDS "Setup_DBs" -- ) -- jss_test_java( -- NAME "JSS_Test_Buffer" -- COMMAND "org.mozilla.jss.tests.TestBuffer" -- ) - if ((${Java_VERSION_MAJOR} EQUAL 1) AND (${Java_VERSION_MINOR} LESS 9)) - jss_test_java( - NAME "Test_PKCS11Constants.java_for_Sun_compatibility" -@@ -121,16 +108,6 @@ macro(jss_tests) - NAME "JUnit_UTF8StringTest" - COMMAND "org.junit.runner.JUnitCore" "org.mozilla.jss.tests.UTF8StringTest" - ) -- jss_test_exec( -- NAME "buffer_size_1" -- COMMAND "${BIN_OUTPUT_DIR}/buffer_size_1" -- DEPENDS "generate_c_buffer_size_1" -- ) -- jss_test_exec( -- NAME "buffer_size_4" -- COMMAND "${BIN_OUTPUT_DIR}/buffer_size_4" -- DEPENDS "generate_c_buffer_size_4" -- ) - jss_test_java( - NAME "JUnit_ChainSortingTest" - COMMAND "org.junit.runner.JUnitCore" "org.mozilla.jss.tests.ChainSortingTest" -@@ -253,23 +230,6 @@ macro(jss_tests) - DEPENDS "Setup_DBs" - ) - -- # SSL Engine related tests -- jss_test_exec( -- NAME "TestBufferPRFD_RSA" -- COMMAND "${BIN_OUTPUT_DIR}/TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" "Server_RSA" -- DEPENDS "List_CA_certs" "generate_c_TestBufferPRFD" -- ) -- jss_test_exec( -- NAME "TestBufferPRFD_ECDSA" -- COMMAND "${BIN_OUTPUT_DIR}/TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" "Server_ECDSA" -- DEPENDS "List_CA_certs" "generate_c_TestBufferPRFD" -- ) -- jss_test_java( -- NAME "JSS_Test_BufferPRFD" -- COMMAND "org.mozilla.jss.tests.TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" -- DEPENDS "List_CA_certs" -- ) -- - # FIPS-related tests - jss_test_java( - NAME "Enable_FipsMODE" --- -2.21.0 - diff --git a/jss.spec b/jss.spec index 40bbda1..7bcc899 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.1 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.2 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Disable-buffer-based-tests.patch ################################################################################ # Build Dependencies @@ -160,8 +159,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog -* Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-2 -- Disable unnecessary tests to fix broken s390x +* Tue Oct 15 2019 Dogtag PKI Team - 4.6.2-1 +- Rebase to JSS 4.6.2 +- Fixes CVE-2019-14823 * Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-1 - Rebase to JSS 4.6.1 diff --git a/sources b/sources index 99c1894..32f2840 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.1.tar.gz) = 7a7eb02e98a22d0817aec34cff32ac942545885c84992812d116b683fa31c12d0fb9b8aa3b8757ab234f9980993fb933d6556c959935cd5e09ca7468d8729c8a +SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd From 1d9e3f12dedb0d5d55fab4d31177a24cf1af662c Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 29 Oct 2019 10:56:50 -0400 Subject: [PATCH 02/10] Fix creation of NativeProxy Resolves: rhbz#1766451 Signed-off-by: Alexander Scheel --- 0001-Fix-NativeProxy-reference-tracker.patch | 53 ++ jss-aia-ocsp-1.patch | 659 ------------------- jss-aia-ocsp-2.patch | 141 ---- jss.spec | 6 +- 4 files changed, 58 insertions(+), 801 deletions(-) create mode 100644 0001-Fix-NativeProxy-reference-tracker.patch delete mode 100644 jss-aia-ocsp-1.patch delete mode 100644 jss-aia-ocsp-2.patch diff --git a/0001-Fix-NativeProxy-reference-tracker.patch b/0001-Fix-NativeProxy-reference-tracker.patch new file mode 100644 index 0000000..529b576 --- /dev/null +++ b/0001-Fix-NativeProxy-reference-tracker.patch @@ -0,0 +1,53 @@ +From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 29 Oct 2019 10:43:56 -0400 +Subject: [PATCH] Fix NativeProxy reference tracker + +In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by +setting mPointer after trying to add NativeProxy to the registry. In +most instances this won't matter, however, if another instance exists in +the HashSet with the same hash value, the equals comparator will be +used, triggering a NPE. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/util/NativeProxy.java | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java +index 1c6d1aa5..a0811f76 100644 +--- a/org/mozilla/jss/util/NativeProxy.java ++++ b/org/mozilla/jss/util/NativeProxy.java +@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable + */ + public NativeProxy(byte[] pointer) { + assert(pointer!=null); +- registry.add(this); + mPointer = pointer; ++ registry.add(this); + + if (saveStacktraces) { + mTrace = Arrays.toString(Thread.currentThread().getStackTrace()); +@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable + if( ! (obj instanceof NativeProxy) ) { + return false; + } +- if( ((NativeProxy)obj).mPointer.length != mPointer.length) { ++ if (((NativeProxy)obj).mPointer == null) { ++ /* If mPointer is null, we have no way to compare the values ++ * of the pointers, so assume they're unequal. */ + return false; + } +- for(int i=0; i < mPointer.length; i++) { +- if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) { +- return false; +- } +- } +- return true; ++ return Arrays.equals(((NativeProxy)obj).mPointer, mPointer); + } + + /** +-- +2.21.0 + diff --git a/jss-aia-ocsp-1.patch b/jss-aia-ocsp-1.patch deleted file mode 100644 index f20207c..0000000 --- a/jss-aia-ocsp-1.patch +++ /dev/null @@ -1,659 +0,0 @@ -From 8975c8ae1d0c8b916c5c73aff12046b01d3e6ef0 Mon Sep 17 00:00:00 2001 -From: Jack Magne -Date: Fri, 25 Jan 2019 14:54:11 -0800 -Subject: [PATCH] Resolve Bug 1666872 - CC: Enable AIA OCSP cert checking for - entire cert chain. - -This fix for jss, solves the one use case where the pki server is configured to perform ocsp checking ONLY with the contents of the AIA extension. Previously, jss could only check the ocsp server for the leaf node cert of the cert being verified. This fix allows the cert chain to be checked over ocsp for each cert in question. This is possible due to the fact that we have made a call in the PKIX library of nss to do the actual cert verfication. This call is made with all the needed flags to tell the PKIX library to make the ocsp verifications remotely over the network using the contents of the AIA extension. - -Later on we can use this code to handle the other cases, but for now we want to solve this one particular problem. If the server is configured in any other configuration than the one stated, the original verification code will be called as before. Below is an example of a configuration in server.xml, that will trigger this new code: - -< .... enableOCSP="true" ocspCacheSize="10000" ocspMinCacheEntryDuration="7200" .... > - -Note that due to ocsp caching, the cert chain verification may only be apparent after a restart of the server. A way to force an ocsp fetch every time is to set the value of ocspCacheSize=-1, which essentially disables the cache. - -Added a couple of minor fixes due to review comments. Possibly more to come. -Minor include directive change to compile on branch. ---- - org/mozilla/jss/CryptoManager.java | 48 +++++++ - org/mozilla/jss/PK11Finder.c | 95 ++++++++++++-- - org/mozilla/jss/ssl/callbacks.c | 67 ++++++++-- - org/mozilla/jss/ssl/common.c | 196 +++++++++++++++++++++++++++++ - org/mozilla/jss/ssl/jssl.h | 29 +++++ - org/mozilla/jss/util/java_ids.h | 9 ++ - 6 files changed, 422 insertions(+), 22 deletions(-) - -diff --git a/org/mozilla/jss/CryptoManager.java b/org/mozilla/jss/CryptoManager.java -index 9b86bf9e..c9a3fb2b 100644 ---- a/org/mozilla/jss/CryptoManager.java -+++ b/org/mozilla/jss/CryptoManager.java -@@ -1201,6 +1201,44 @@ private native boolean verifyCertTempNative(byte[] certPackage, - // OCSP management - /////////////////////////////////////////////////////////////////////// - -+ /* OCSP Policy related */ -+ -+ public enum OCSPPolicy { -+ NONE, -+ NORMAL, -+ LEAF_AND_CHAIN; -+ } -+ -+ private static OCSPPolicy ocspPolicy = OCSPPolicy.NONE; -+ -+ /** -+ * Gets the current ocsp Policy. -+ * Currently we only support 2 modes OCSP_LEAF_AND_CHAIN_POLICY. -+ * And OCSP_NORMAL_POLICY, which is current processing , by default. -+ * If we have AIA based OCSP enabled we will check all certs in the chain. -+ * using PKIX cert verfication calls in the various cert auth callbacks we -+ * have. -+ * @return - The current ocsp policy in effect. -+ */ -+ -+ public static synchronized int getOCSPPolicy() { -+ return ocspPolicy.ordinal(); -+ } -+ -+ /** -+ * Sets the current ocsp Policy. -+ * Currently we only support one mode OCSP_LEAF_AND_CHAIN_POLICY. -+ * If we have AIA based OCSP enabled we will check all certs in the chain. -+ * using PKIX cert verfication calls in the various cert auth callbacks we -+ * have. -+ * @param policy - Either cert and chain or normal default processing. -+ * -+ */ -+ -+ public static synchronized void setOCSPPolicy(OCSPPolicy policy) { -+ ocspPolicy = policy; -+ } -+ - /** - * Enables OCSP, note when you Initialize JSS for the first time, for - * backwards compatibility, the initialize will enable OCSP if you -@@ -1220,6 +1258,16 @@ public void configureOCSP( - String ocspResponderCertNickname ) - throws GeneralSecurityException - { -+ /* set the ocsp policy */ -+ -+ if(ocspCheckingEnabled && -+ ocspResponderURL == null && -+ ocspResponderCertNickname == null) { -+ setOCSPPolicy(OCSPPolicy.LEAF_AND_CHAIN); -+ } else { -+ setOCSPPolicy(OCSPPolicy.NORMAL); -+ } -+ - configureOCSPNative(ocspCheckingEnabled, - ocspResponderURL, - ocspResponderCertNickname ); -diff --git a/org/mozilla/jss/PK11Finder.c b/org/mozilla/jss/PK11Finder.c -index 45958181..0329e91d 100644 ---- a/org/mozilla/jss/PK11Finder.c -+++ b/org/mozilla/jss/PK11Finder.c -@@ -14,9 +14,9 @@ - #include - - #include -- - #include - #include "pk11util.h" -+#include "ssl/jssl.h" - #include - - /* -@@ -1574,6 +1574,9 @@ SECStatus verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString, - goto finish; - } - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ -+ - certificateUsage = required_certificateUsage; - - cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname); -@@ -1587,8 +1590,24 @@ SECStatus verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString, - /* 0 for certificateUsage in call to CERT_VerifyCertificateNow will - * retrieve the current valid usage into currUsage - */ -- rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certificateUsage, NULL, currUsage ); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( cert, certificateUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, currUsage); -+ -+ /* we need to do this just to get the cert usages, the pkix version -+ doesn't seem to honor the method to get the usages as of yet. -+ Let the PKIX call only determine the final fate. -+ */ -+ if(rv == SECSuccess) { -+ CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, currUsage ); -+ } -+ -+ } else { -+ rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, currUsage ); -+ } -+ - if ((rv == SECSuccess) && certificateUsage == 0x0000) { - if (*currUsage == - ( certUsageUserCertImport | -@@ -1639,6 +1658,8 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative(JNIEnv *env, - goto finish; - } - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - certificateUsage = required_certificateUsage; - - cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname); -@@ -1653,8 +1674,23 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative(JNIEnv *env, - * just get the current usage (which we are not passing back for now - * but will bypass the certificate usage check - */ -- rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certificateUsage, NULL, &currUsage ); -+ -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv= JSSL_verifyCertPKIX( cert, certificateUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, &currUsage); -+ -+ /* we need to do this just to get the cert usages, the pkix version -+ doesn't seem to honor the method to get the usages as of yet. -+ Let the PKIX call only determine the final fate. -+ */ -+ if(rv == SECSuccess) { -+ CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage ); -+ } -+ } else { -+ rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage ); -+ } - } - - finish: -@@ -1720,12 +1756,14 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative2(JNIEnv *env, - SECStatus rv = SECFailure; - CERTCertificate *cert = NULL; - char *nickname = NULL; -- -+ - if (nickString == NULL) { - JSS_throwMsg(env, INVALID_NICKNAME_EXCEPTION, "Missing certificate nickname"); - goto finish; - } - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - nickname = (char *) (*env)->GetStringUTFChars(env, nickString, NULL); - if (nickname == NULL) { - JSS_throwMsg(env, INVALID_NICKNAME_EXCEPTION, "Missing certificate nickname"); -@@ -1747,8 +1785,25 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative2(JNIEnv *env, - /* 0 for certificateUsage in call to CERT_VerifyCertificateNow will - * retrieve the current valid usage into currUsage - */ -- rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certificateUsage, NULL, &currUsage); -+ -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( cert, certificateUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, &currUsage); -+ -+ /* we need to do this just to get the cert usages, the pkix version -+ doesn't seem to honor the method to get the usages as of yet. -+ Let the PKIX call only determine the final fate. -+ */ -+ if(rv == SECSuccess) { -+ CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage ); -+ -+ } -+ -+ } else { -+ rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage); -+ } - - if (rv != SECSuccess) { - JSS_throwMsgPrErr(env, CERTIFICATE_EXCEPTION, "Invalid certificate"); -@@ -1803,6 +1858,9 @@ Java_org_mozilla_jss_CryptoManager_verifyCertNowNative(JNIEnv *env, - if( nickname == NULL ) { - goto finish; - } -+ -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - certUsage = cUsage; - cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname); - -@@ -1812,8 +1870,13 @@ Java_org_mozilla_jss_CryptoManager_verifyCertNowNative(JNIEnv *env, - PR_smprintf_free(message); - goto finish; - } else { -- rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certUsage, NULL ); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( cert, certUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, NULL); -+ } else { -+ rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certUsage, NULL ); -+ } - } - - finish: -@@ -1858,6 +1921,8 @@ Java_org_mozilla_jss_CryptoManager_verifyCertTempNative(JNIEnv *env, - derCerts[0] = JSS_ByteArrayToSECItem(env, packageArray); - derCerts[1] = NULL; - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - rv = CERT_ImportCerts(certdb, cUsage, - 1, derCerts, &certArray, PR_FALSE /*temp Certs*/, - PR_FALSE /*caOnly*/, NULL); -@@ -1869,8 +1934,14 @@ Java_org_mozilla_jss_CryptoManager_verifyCertTempNative(JNIEnv *env, - } - - certUsage = cUsage; -- rv = CERT_VerifyCertNow(certdb, certArray[0], -- checkSig, certUsage, NULL ); -+ -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( certArray[0], certUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, NULL); -+ } else { -+ rv = CERT_VerifyCertNow(certdb, certArray[0], -+ checkSig, certUsage, NULL ); -+ } - - finish: - /* this checks for NULL */ -diff --git a/org/mozilla/jss/ssl/callbacks.c b/org/mozilla/jss/ssl/callbacks.c -index 634f31ec..42594a14 100644 ---- a/org/mozilla/jss/ssl/callbacks.c -+++ b/org/mozilla/jss/ssl/callbacks.c -@@ -20,6 +20,40 @@ - #include - #include - -+int -+JSSL_getOCSPPolicy() { -+ JNIEnv *env; -+ jint policy = -1; -+ -+ jmethodID getOCSPPolicyID; -+ jclass cryptoManagerClass; -+ -+ /* get the JNI environment */ -+ if((*JSS_javaVM)->AttachCurrentThread(JSS_javaVM, (void**)&env, NULL) != 0){ -+ PR_ASSERT(PR_FALSE); -+ goto finish; -+ } -+ -+ cryptoManagerClass = (*env)->FindClass(env, CRYPTO_MANAGER_NAME); -+ if( cryptoManagerClass == NULL ) { -+ ASSERT_OUTOFMEM(env); -+ goto finish; -+ } -+ getOCSPPolicyID = (*env)->GetStaticMethodID(env, cryptoManagerClass, -+ GET_OCSP_POLICY_NAME,GET_OCSP_POLICY_SIG); -+ -+ if( getOCSPPolicyID == NULL ) { -+ ASSERT_OUTOFMEM(env); -+ goto finish; -+ } -+ -+ policy = (*env)->CallStaticIntMethod(env, cryptoManagerClass, -+ getOCSPPolicyID); -+ -+finish: -+ return (int) policy; -+} -+ - static SECStatus - secCmpCertChainWCANames(CERTCertificate *cert, CERTDistNames *caNames) - { -@@ -443,8 +477,9 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - SECCertUsage certUsage; - CERTCertificate *peerCert=NULL; - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; -- - - /* SSL_PeerCertificate() returns a shallow copy of the cert, so we - must destroy it before we exit this function */ -@@ -452,8 +487,13 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - peerCert = SSL_PeerCertificate(fd); - - if (peerCert) { -- rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert, -- checkSig, certUsage, NULL /*pinarg*/); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( peerCert, certUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, NULL); -+ } else { -+ rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert, -+ checkSig, certUsage, NULL /*pinarg*/); -+ } - } - - /* if we're a server, then we don't need to check the CN of the -@@ -569,6 +609,8 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - log.tail = NULL; - log.count = 0; - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - /* get the JNI environment */ - if((*JSS_javaVM)->AttachCurrentThread(JSS_javaVM, (void**)&env, NULL) != 0){ - PR_ASSERT(PR_FALSE); -@@ -589,13 +631,18 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - * logging parameter) - */ - -- verificationResult = CERT_VerifyCert( CERT_GetDefaultCertDB(), -- peerCert, -- checkSig, -- certUsage, -- PR_Now(), -- NULL /*pinarg*/, -- &log); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ verificationResult = JSSL_verifyCertPKIX( peerCert, certUsage, -+ NULL /* pin arg */, ocspPolicy, &log, NULL); -+ } else { -+ verificationResult = CERT_VerifyCert( CERT_GetDefaultCertDB(), -+ peerCert, -+ checkSig, -+ certUsage, -+ PR_Now(), -+ NULL /*pinarg*/, -+ &log); -+ } - - if (verificationResult == SECSuccess && log.count > 0) { - verificationResult = SECFailure; -diff --git a/org/mozilla/jss/ssl/common.c b/org/mozilla/jss/ssl/common.c -index 5c6efa85..aec88552 100644 ---- a/org/mozilla/jss/ssl/common.c -+++ b/org/mozilla/jss/ssl/common.c -@@ -15,6 +15,7 @@ - #include - #include "_jni/org_mozilla_jss_ssl_SSLSocket.h" - #include "jssl.h" -+#include "cert.h" - - #ifdef WIN32 - #include -@@ -889,3 +890,198 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv) - PR_ASSERT(ret == 0); - } - } -+ -+/* Get the trusted anchor for pkix */ -+ -+CERTCertificate * getRoot(CERTCertificate *cert, -+ SECCertificateUsage certUsage) -+{ -+ CERTCertificate *root = NULL; -+ CERTCertListNode *node = NULL; -+ -+ if( !cert ) { -+ goto finish; -+ } -+ -+ CERTCertList *certList = CERT_GetCertChainFromCert(cert, -+ PR_Now(), -+ certUsage); -+ -+ if( certList == NULL) { -+ goto finish; -+ } -+ -+ for (node = CERT_LIST_HEAD(certList); -+ !CERT_LIST_END(node, certList); -+ node = CERT_LIST_NEXT(node)) { -+ -+ /* try to find the root */ -+ if( node->cert && node->cert->isRoot ) { -+ root = CERT_DupCertificate(node->cert) ; -+ } -+ } -+ -+finish: -+ -+ CERT_DestroyCertList (certList); -+ return root; -+} -+ -+/* Verify a cert using explicit PKIX call. -+ * For now only used in OCSP AIA context. -+ * The result of this call will be a full chain -+ * and leaf network AIA ocsp validation. -+ * The policy param will be used in the future to -+ * handle more scenarios. -+ */ -+ -+SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, -+ SECCertificateUsage certUsage,secuPWData *pwdata, int ocspPolicy, -+ CERTVerifyLog *log, SECCertificateUsage *usage) -+{ -+ -+ /* put the first set of possible flags internally here first */ -+ /* later there could be a more complete list to choose from */ -+ /* support our hard core fetch aia ocsp policy for now */ -+ -+ static PRUint64 ocsp_Enabled_Hard_Policy_LeafFlags[2] = { -+ /* crl */ -+ 0, -+ /* ocsp */ -+ CERT_REV_M_TEST_USING_THIS_METHOD | -+ CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO -+ }; -+ -+ static PRUint64 ocsp_Enabled_Hard_Policy_ChainFlags[2] = { -+ /* crl */ -+ 0, -+ /* ocsp */ -+ CERT_REV_M_TEST_USING_THIS_METHOD | -+ CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO -+ }; -+ -+ static CERTRevocationMethodIndex -+ ocsp_Enabled_Hard_Policy_Method_Preference = { -+ cert_revocation_method_ocsp -+ }; -+ -+ static CERTRevocationFlags ocsp_Enabled_Hard_Policy = { -+ { /* leafTests */ -+ 2, -+ ocsp_Enabled_Hard_Policy_LeafFlags, -+ 1, -+ &ocsp_Enabled_Hard_Policy_Method_Preference, -+ 0 }, -+ { /* chainTests */ -+ 2, -+ ocsp_Enabled_Hard_Policy_ChainFlags, -+ 1, -+ &ocsp_Enabled_Hard_Policy_Method_Preference, -+ 0 } -+ }; -+ -+ /* for future expansion */ -+ -+ CERTValOutParam cvout[20] = {0}; -+ CERTValInParam cvin[20] = {0}; -+ -+ int inParamIndex = 0; -+ int outParamIndex = 0; -+ CERTRevocationFlags *rev = NULL; -+ -+ CERTCertList *trustedCertList = NULL; -+ -+ PRBool fetchCerts = PR_FALSE; -+ -+ SECStatus res = SECFailure; -+ if(cert == NULL) { -+ goto finish; -+ } -+ -+ if(ocspPolicy != OCSP_LEAF_AND_CHAIN_POLICY) { -+ goto finish; -+ } -+ -+ /* Force the strict ocsp network check on chain -+ and leaf. -+ */ -+ -+ fetchCerts = PR_TRUE; -+ rev = &ocsp_Enabled_Hard_Policy; -+ -+ /* fetch aia over net */ -+ -+ cvin[inParamIndex].type = cert_pi_useAIACertFetch; -+ cvin[inParamIndex].value.scalar.b = fetchCerts; -+ inParamIndex++; -+ -+ /* time */ -+ -+ cvin[inParamIndex].type = cert_pi_date; -+ cvin[inParamIndex].value.scalar.time = PR_Now(); -+ inParamIndex++; -+ -+ /* flags */ -+ -+ cvin[inParamIndex].type = cert_pi_revocationFlags; -+ cvin[inParamIndex].value.pointer.revocation = rev; -+ inParamIndex++; -+ -+ -+ /* establish trust anchor */ -+ -+ CERTCertificate *root = getRoot(cert,certUsage); -+ -+ /* Try to add the root as the trust anchor so all the -+ other memebers of the ca chain will get validated. -+ */ -+ -+ if( root != NULL ) { -+ trustedCertList = CERT_NewCertList(); -+ CERT_AddCertToListTail(trustedCertList, root); -+ -+ cvin[inParamIndex].type = cert_pi_trustAnchors; -+ cvin[inParamIndex].value.pointer.chain = trustedCertList; -+ -+ inParamIndex++; -+ } -+ -+ cvin[inParamIndex].type = cert_pi_end; -+ -+ if(log != NULL) { -+ cvout[outParamIndex].type = cert_po_errorLog; -+ cvout[outParamIndex].value.pointer.log = log; -+ outParamIndex ++; -+ } -+ -+ int usageIndex = 0; -+ if(usage != NULL) { -+ usageIndex = outParamIndex; -+ cvout[outParamIndex].type = cert_po_usages; -+ cvout[outParamIndex].value.scalar.usages = 0; -+ outParamIndex ++; -+ } -+ -+ cvout[outParamIndex].type = cert_po_end; -+ -+ res = CERT_PKIXVerifyCert(cert, certUsage, cvin, cvout, &pwdata); -+ -+finish: -+ /* clean up any trusted cert list */ -+ -+ if (trustedCertList) { -+ CERT_DestroyCertList(trustedCertList); -+ trustedCertList = NULL; -+ } -+ -+ if(root) { -+ CERT_DestroyCertificate(root); -+ root = NULL; -+ } -+ -+ if(res == SECSuccess && usage) { -+ *usage = cvout[usageIndex].value.scalar.usages; -+ } -+ -+ return res; -+} -diff --git a/org/mozilla/jss/ssl/jssl.h b/org/mozilla/jss/ssl/jssl.h -index c15acf87..0e93eebe 100644 ---- a/org/mozilla/jss/ssl/jssl.h -+++ b/org/mozilla/jss/ssl/jssl.h -@@ -5,8 +5,27 @@ - #ifndef ORG_MOZILLA_JSS_SSL_JSSL_H - #define ORG_MOZILLA_JSS_SSL_JSSL_H - -+/* ocsp policy constants */ -+ -+/* ocsp policy constants */ -+static const int OCSP_NO_POLICY = 0; -+static const int OCSP_NORMAL_POLICY = 1; -+static const int OCSP_LEAF_AND_CHAIN_POLICY = 2; -+ - #include - -+typedef struct -+{ -+ enum -+ { -+ PW_NONE = 0, -+ PW_FROMFILE = 1, -+ PW_PLAINTEXT = 2, -+ PW_EXTERNAL = 3 -+ } source; -+ char *data; -+} secuPWData; -+ - struct JSSL_SocketData { - PRFileDesc *fd; - jobject socketObject; /* weak global ref */ -@@ -120,4 +139,14 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv); - - void JSSL_throwSSLSocketException(JNIEnv *env, char *message); - -+int -+JSSL_getOCSPPolicy(); -+ -+ -+SECStatus -+JSSL_verifyCertPKIX(CERTCertificate *cert, -+ SECCertificateUsage certUsage, -+ secuPWData *pwdata, int ocspPolicy, -+ CERTVerifyLog *log,SECCertificateUsage *usage); -+ - #endif -diff --git a/org/mozilla/jss/util/java_ids.h b/org/mozilla/jss/util/java_ids.h -index 73b31fa9..4053d9a7 100644 ---- a/org/mozilla/jss/util/java_ids.h -+++ b/org/mozilla/jss/util/java_ids.h -@@ -276,6 +276,15 @@ PR_BEGIN_EXTERN_C - #define GET_RECV_BUF_SIZE "getReceiveBufferSize" - #define GET_BUF_SIZE_SIG "()I" - -+/* -+ * CryptoManager -+ * -+*/ -+ -+#define CRYPTO_MANAGER_NAME "org/mozilla/jss/CryptoManager" -+#define GET_OCSP_POLICY_NAME "getOCSPPolicy" -+#define GET_OCSP_POLICY_SIG "()I" -+ - /* - * SocketBase - */ diff --git a/jss-aia-ocsp-2.patch b/jss-aia-ocsp-2.patch deleted file mode 100644 index c6b2f1c..0000000 --- a/jss-aia-ocsp-2.patch +++ /dev/null @@ -1,141 +0,0 @@ -From 1fe6a451ec0c3ec960ac1119b39c406d999da5ec Mon Sep 17 00:00:00 2001 -From: Jack Magne -Date: Fri, 8 Feb 2019 11:21:48 -0800 -Subject: [PATCH] Additional: Resolve Bug 1666872 - CC: Enable AIA OCSP cert - checking for entire cert chain. - -Simple fix to make sure we are using the correct variant of the NSS cert usage quantity. - -It turns out some calls need a SECCertUsage and others need a SECCertificateUsage. -We also need to convert between the two in certain instances. - -Found and fixed double certificate object free issue. ---- - org/mozilla/jss/ssl/callbacks.c | 10 ++++++++-- - org/mozilla/jss/ssl/common.c | 19 ++++++++++++++----- - org/mozilla/jss/ssl/jssl.h | 2 +- - 3 files changed, 23 insertions(+), 8 deletions(-) - -diff --git a/org/mozilla/jss/ssl/callbacks.c b/org/mozilla/jss/ssl/callbacks.c -index 42594a14..4fe08a29 100644 ---- a/org/mozilla/jss/ssl/callbacks.c -+++ b/org/mozilla/jss/ssl/callbacks.c -@@ -481,6 +481,9 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - - certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; - -+ /* PKIX call needs a SECCertificate usage, convert */ -+ SECCertificateUsage certificateUsage = (SECCertificateUsage)1 << certUsage; -+ - /* SSL_PeerCertificate() returns a shallow copy of the cert, so we - must destroy it before we exit this function */ - -@@ -488,7 +491,7 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - - if (peerCert) { - if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -- rv = JSSL_verifyCertPKIX( peerCert, certUsage, -+ rv = JSSL_verifyCertPKIX( peerCert, certificateUsage, - NULL /* pin arg */, ocspPolicy, NULL, NULL); - } else { - rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert, -@@ -624,6 +627,9 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - if (peerCert == NULL) goto finish; - - certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; -+ /* PKIX call needs a SECCertificate usage, convert */ -+ SECCertificateUsage certificateUsage = (SECCertificateUsage)1 << certUsage; -+ - - /* - * verify it against current time - (can't use -@@ -632,7 +638,7 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - */ - - if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -- verificationResult = JSSL_verifyCertPKIX( peerCert, certUsage, -+ verificationResult = JSSL_verifyCertPKIX( peerCert, certificateUsage, - NULL /* pin arg */, ocspPolicy, &log, NULL); - } else { - verificationResult = CERT_VerifyCert( CERT_GetDefaultCertDB(), -diff --git a/org/mozilla/jss/ssl/common.c b/org/mozilla/jss/ssl/common.c -index aec88552..cb281798 100644 ---- a/org/mozilla/jss/ssl/common.c -+++ b/org/mozilla/jss/ssl/common.c -@@ -894,7 +894,7 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv) - /* Get the trusted anchor for pkix */ - - CERTCertificate * getRoot(CERTCertificate *cert, -- SECCertificateUsage certUsage) -+ SECCertUsage certUsage) - { - CERTCertificate *root = NULL; - CERTCertListNode *node = NULL; -@@ -936,7 +936,7 @@ CERTCertificate * getRoot(CERTCertificate *cert, - */ - - SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, -- SECCertificateUsage certUsage,secuPWData *pwdata, int ocspPolicy, -+ SECCertificateUsage certificateUsage,secuPWData *pwdata, int ocspPolicy, - CERTVerifyLog *log, SECCertificateUsage *usage) - { - -@@ -993,6 +993,8 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - - PRBool fetchCerts = PR_FALSE; - -+ SECCertUsage certUsage = certUsageSSLClient /* 0 */; -+ - SECStatus res = SECFailure; - if(cert == NULL) { - goto finish; -@@ -1027,9 +1029,15 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - cvin[inParamIndex].value.pointer.revocation = rev; - inParamIndex++; - -- - /* establish trust anchor */ - -+ /* We need to convert the SECCertificateUsage to a SECCertUsage to obtain -+ * the root. -+ */ -+ -+ SECCertificateUsage testUsage = certificateUsage; -+ while (0 != (testUsage = testUsage >> 1)) { certUsage++; } -+ - CERTCertificate *root = getRoot(cert,certUsage); - - /* Try to add the root as the trust anchor so all the -@@ -1064,7 +1072,7 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - - cvout[outParamIndex].type = cert_po_end; - -- res = CERT_PKIXVerifyCert(cert, certUsage, cvin, cvout, &pwdata); -+ res = CERT_PKIXVerifyCert(cert, certificateUsage, cvin, cvout, &pwdata); - - finish: - /* clean up any trusted cert list */ -@@ -1074,8 +1082,9 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - trustedCertList = NULL; - } - -+ /* CERT_DestroyCertList destroys interior certs for us. */ -+ - if(root) { -- CERT_DestroyCertificate(root); - root = NULL; - } - -diff --git a/org/mozilla/jss/ssl/jssl.h b/org/mozilla/jss/ssl/jssl.h -index 0e93eebe..925e1225 100644 ---- a/org/mozilla/jss/ssl/jssl.h -+++ b/org/mozilla/jss/ssl/jssl.h -@@ -145,7 +145,7 @@ JSSL_getOCSPPolicy(); - - SECStatus - JSSL_verifyCertPKIX(CERTCertificate *cert, -- SECCertificateUsage certUsage, -+ SECCertificateUsage certificateUsage, - secuPWData *pwdata, int ocspPolicy, - CERTVerifyLog *log,SECCertificateUsage *usage); - diff --git a/jss.spec b/jss.spec index 7bcc899..f403822 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.6.2 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 2%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,6 +25,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +Patch: 0001-Fix-NativeProxy-reference-tracker.patch ################################################################################ # Build Dependencies @@ -159,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Oct 29 2019 Dogtag PKI Team - 4.6.2-2 +- Fix for rhbz#1766451 + * Tue Oct 15 2019 Dogtag PKI Team - 4.6.2-1 - Rebase to JSS 4.6.2 - Fixes CVE-2019-14823 From f21007ede6ff9e8a7528e0188757e33cf1ae87b3 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 28 Jan 2020 10:48:11 -0500 Subject: [PATCH 03/10] Rebuild with new NSS Resolves: rhbz#1794814 Signed-off-by: Alexander Scheel --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index f403822..0c333df 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.6.2 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} +Release: 3%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 +- Rebuild with new NSS to fix rhbz#1794814 + * Tue Oct 29 2019 Dogtag PKI Team - 4.6.2-2 - Fix for rhbz#1766451 From ad19be35d3b948054d9787061ae0e3f3dbc297c5 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 4 Mar 2020 12:01:29 -0500 Subject: [PATCH 04/10] Add fixes for KRA issues Signed-off-by: Alexander Scheel --- ...Fix-swapped-parameter-names-with-PBE.patch | 80 +++++++++++++++++++ ...-Use-specified-algorithm-for-KeyWrap.patch | 60 ++++++++++++++ jss.spec | 9 ++- 3 files changed, 147 insertions(+), 2 deletions(-) create mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch create mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch new file mode 100644 index 0000000..c535f6e --- /dev/null +++ b/0002-Fix-swapped-parameter-names-with-PBE.patch @@ -0,0 +1,80 @@ +From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:10:32 -0500 +Subject: [PATCH 7/8] Fix swapped parameter names with PBE + +Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression +related to extracting the parameter classes during PBE operations: +previously, the classes of the underlying encryption algorithm were +iterated over, instead of the classes of the PBE class itself. However, +this commit iterated over the PBE parameter classes; no PBE algorithm +accepts a IvParameterSpec, resulting in a null parameter passed to the +later encryption or key wrap operation. This resulted in stack traces +like the following: + +Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter + at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) + at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) + +Resolves: rh-bz#1807371 + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +index 084752c3..0344b14d 100644 +--- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +index a4709070..d85eb0d3 100644 +--- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( IVParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index b35714e3..ebd269f3 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +-- +2.24.1 + diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch new file mode 100644 index 0000000..d75534a --- /dev/null +++ b/0003-Use-specified-algorithm-for-KeyWrap.patch @@ -0,0 +1,60 @@ +From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:39:29 -0500 +Subject: [PATCH 8/8] Use specified algorithm for KeyWrap + +When the token-specified from of EncryptedPrivateKeyInfo.createPBE is +called, it would always request DES3_CBC_PAD as the key wrapping +algorithm, regardless of the input PBE key type. However, the other form +(with an implicit token) was correctly handling this case. + +Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER +instead of having to convert to/from a String form. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +index 3113f614..3a106977 100644 +--- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java ++++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { + + public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { + OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); ++ return fromOID(oid); ++ } + ++ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { + if (oid.equals(AES_KEY_WRAP_PAD_OID)) + return AES_KEY_WRAP_PAD; + +@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { + if (oid.equals(DES_CBC_PAD_OID)) + return DES_CBC_PAD; + +- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); ++ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); + } + } +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index ebd269f3..abfc39a7 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + } + } + +- KeyWrapper wrapper = token.getKeyWrapper( +- KeyWrapAlgorithm.DES3_CBC_PAD); ++ // wrap the key ++ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); + wrapper.initWrap(key, params); + byte encrypted[] = wrapper.wrap(pri); + +-- +2.24.1 + diff --git a/jss.spec b/jss.spec index 0c333df..f6974c7 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.6.2 -Release: 3%{?_timestamp}%{?_commit_id}%{?dist} +Release: 4%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,9 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch: 0001-Fix-NativeProxy-reference-tracker.patch +Patch0: 0001-Fix-NativeProxy-reference-tracker.patch +Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch +Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch ################################################################################ # Build Dependencies @@ -160,6 +162,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 +- Fix for PBE errors + * Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 - Rebuild with new NSS to fix rhbz#1794814 From acbeca61d35277c75c8f99aee3d04a17c7076f0a Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Mon, 27 Apr 2020 11:18:32 -0400 Subject: [PATCH 05/10] Rebase to upstream JSS v4.6.4 Signed-off-by: Alexander Scheel --- .gitignore | 2 ++ jss.spec | 13 +++++++------ sources | 2 +- 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index 5981ea6..6c8702e 100644 --- a/.gitignore +++ b/.gitignore @@ -23,3 +23,5 @@ jss-4.2.6.tar.gz /jss-4.5.3.tar.gz /jss-4.6.1.tar.gz /jss-4.6.2.tar.gz +/jss-4.6.3.tar.gz +/jss-4.6.4.tar.gz diff --git a/jss.spec b/jss.spec index f6974c7..f2b6c0d 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.2 -Release: 4%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.4 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,9 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Fix-NativeProxy-reference-tracker.patch -Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch -Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch ################################################################################ # Build Dependencies @@ -162,7 +159,11 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog -* Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 +* Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 +- Rebase to JSS 4.6.4 +- Fixes memory leak present since v4.6.2 + +* Wed March 04 2020 Dogtag PKI Team - 4.6.2-4 - Fix for PBE errors * Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 diff --git a/sources b/sources index 32f2840..25b6a59 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd +SHA512 (jss-4.6.4.tar.gz) = c0adc950e1ce5e0f3d846dcb158d831575be84176ded3eec7ce3569cfd96c872a2089a2eede249c5924e1eee58d88574accd3403623910343130cf90b504b348 From 868043d230a3a647f64e48d3a4a2fbf717a1e29c Mon Sep 17 00:00:00 2001 From: Dinesh Prasanth M K Date: Wed, 10 Jun 2020 15:40:00 -0400 Subject: [PATCH 06/10] Rebase to latest upstream version 4.7.0-b2 Also, remove unused patch files Signed-off-by: Dinesh Prasanth M K --- .gitignore | 1 + ...Fix-swapped-parameter-names-with-PBE.patch | 80 ------------------- ...-Use-specified-algorithm-for-KeyWrap.patch | 60 -------------- jss.spec | 25 +++--- sources | 2 +- 5 files changed, 17 insertions(+), 151 deletions(-) delete mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch delete mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch diff --git a/.gitignore b/.gitignore index 6c8702e..de898e2 100644 --- a/.gitignore +++ b/.gitignore @@ -25,3 +25,4 @@ jss-4.2.6.tar.gz /jss-4.6.2.tar.gz /jss-4.6.3.tar.gz /jss-4.6.4.tar.gz +/jss-4.7.0-b2.tar.gz diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch deleted file mode 100644 index c535f6e..0000000 --- a/0002-Fix-swapped-parameter-names-with-PBE.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:10:32 -0500 -Subject: [PATCH 7/8] Fix swapped parameter names with PBE - -Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression -related to extracting the parameter classes during PBE operations: -previously, the classes of the underlying encryption algorithm were -iterated over, instead of the classes of the PBE class itself. However, -this commit iterated over the PBE parameter classes; no PBE algorithm -accepts a IvParameterSpec, resulting in a null parameter passed to the -later encryption or key wrap operation. This resulted in stack traces -like the following: - -Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter - at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) - at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) - -Resolves: rh-bz#1807371 - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 3 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -index 084752c3..0344b14d 100644 ---- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { -diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -index a4709070..d85eb0d3 100644 ---- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( IVParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index b35714e3..ebd269f3 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { --- -2.24.1 - diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch deleted file mode 100644 index d75534a..0000000 --- a/0003-Use-specified-algorithm-for-KeyWrap.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:39:29 -0500 -Subject: [PATCH 8/8] Use specified algorithm for KeyWrap - -When the token-specified from of EncryptedPrivateKeyInfo.createPBE is -called, it would always request DES3_CBC_PAD as the key wrapping -algorithm, regardless of the input PBE key type. However, the other form -(with an implicit token) was correctly handling this case. - -Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER -instead of having to convert to/from a String form. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 2 files changed, 6 insertions(+), 3 deletions(-) - -diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -index 3113f614..3a106977 100644 ---- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -+++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { - - public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { - OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); -+ return fromOID(oid); -+ } - -+ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { - if (oid.equals(AES_KEY_WRAP_PAD_OID)) - return AES_KEY_WRAP_PAD; - -@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { - if (oid.equals(DES_CBC_PAD_OID)) - return DES_CBC_PAD; - -- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); -+ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); - } - } -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index ebd269f3..abfc39a7 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - } - } - -- KeyWrapper wrapper = token.getKeyWrapper( -- KeyWrapAlgorithm.DES3_CBC_PAD); -+ // wrap the key -+ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); - wrapper.initWrap(key, params); - byte encrypted[] = wrapper.wrap(pri); - --- -2.24.1 - diff --git a/jss.spec b/jss.spec index f2b6c0d..3a764a2 100644 --- a/jss.spec +++ b/jss.spec @@ -6,9 +6,9 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.4 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} -# global _phase -a1 +Version: 4.7.0 +Release: 0.2%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -b2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -34,11 +34,13 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas BuildRequires: git BuildRequires: make BuildRequires: cmake +BuildRequires: zip +BuildRequires: unzip BuildRequires: gcc-c++ BuildRequires: nspr-devel >= 4.13.1 -BuildRequires: nss-devel >= 3.30 -BuildRequires: nss-tools >= 3.30 +BuildRequires: nss-devel >= 3.44 +BuildRequires: nss-tools >= 3.44 BuildRequires: java-devel BuildRequires: jpackage-utils BuildRequires: slf4j @@ -49,11 +51,10 @@ BuildRequires: glassfish-jaxb-api BuildRequires: slf4j-jdk14 %endif BuildRequires: apache-commons-lang -BuildRequires: apache-commons-codec BuildRequires: junit -Requires: nss >= 3.30 +Requires: nss >= 3.44 Requires: java-headless Requires: jpackage-utils Requires: slf4j @@ -64,7 +65,6 @@ Requires: glassfish-jaxb-api Requires: slf4j-jdk14 %endif Requires: apache-commons-lang -Requires: apache-commons-codec Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 @@ -116,7 +116,7 @@ rm -rf build && mkdir -p build && cd build .. %{__make} all -%{__make} javadoc || true +%{__make} javadoc ctest --output-on-failure ################################################################################ @@ -147,7 +147,8 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} %files %defattr(-,root,root,-) -%doc jss.html MPL-1.1.txt gpl.txt lgpl.txt +%doc jss.html +%license MPL-1.1.txt gpl.txt lgpl.txt %{_libdir}/* %{_jnidir}/* @@ -159,6 +160,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Jun 10 2020 Dogtag PKI Team - 4.7.0-0.2 +- Rebase to latest upstream JSS 4.7.0 +- JSS Provided SSLEngine + * Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 - Rebase to JSS 4.6.4 - Fixes memory leak present since v4.6.2 diff --git a/sources b/sources index 25b6a59..eaf917e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.4.tar.gz) = c0adc950e1ce5e0f3d846dcb158d831575be84176ded3eec7ce3569cfd96c872a2089a2eede249c5924e1eee58d88574accd3403623910343130cf90b504b348 +SHA512 (jss-4.7.0-b2.tar.gz) = 6bd5fd4823ea4b14bfd53dc64796b6fcb7018a6118b943b46be7a5caf874a386802f1e6e0e542743be505d73f2b9625b0f1d479b1292c7364ac62d8cee3e4e52 From 03683b7734cbb889e58b96667642f78c75a79660 Mon Sep 17 00:00:00 2001 From: Dinesh Prasanth M K Date: Tue, 30 Jun 2020 17:11:55 -0400 Subject: [PATCH 07/10] Rebased to upstream JSS v4.7.0-b4 --- .gitignore | 1 + jss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index de898e2..87c5030 100644 --- a/.gitignore +++ b/.gitignore @@ -26,3 +26,4 @@ jss-4.2.6.tar.gz /jss-4.6.3.tar.gz /jss-4.6.4.tar.gz /jss-4.7.0-b2.tar.gz +/jss-4.7.0-b4.tar.gz diff --git a/jss.spec b/jss.spec index 3a764a2..4566e5e 100644 --- a/jss.spec +++ b/jss.spec @@ -7,8 +7,8 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 0.2%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -b2 +Release: 0.4%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -b4 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Jun 30 2020 Dogtag PKI Team - 4.7.0-0.4 +- Rebase to latest upstream JSS v4.7.0-b4 + * Wed Jun 10 2020 Dogtag PKI Team - 4.7.0-0.2 - Rebase to latest upstream JSS 4.7.0 - JSS Provided SSLEngine diff --git a/sources b/sources index eaf917e..eae7417 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0-b2.tar.gz) = 6bd5fd4823ea4b14bfd53dc64796b6fcb7018a6118b943b46be7a5caf874a386802f1e6e0e542743be505d73f2b9625b0f1d479b1292c7364ac62d8cee3e4e52 +SHA512 (jss-4.7.0-b4.tar.gz) = 79c01fc513de479a63cbe164c772f9f685afe032a280f59eb3bb096a653424b3df1a9403c8cf443ffbe8b9a1d97a8aeb48064fbbe92e4c12e29767fb2a547d9f From a380f751d4268e8d1c5067c92635ffb6f51ee897 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 9 Jul 2020 12:55:29 -0400 Subject: [PATCH 08/10] Update to stable v4.7.0 release Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 87c5030..a9ae250 100644 --- a/.gitignore +++ b/.gitignore @@ -27,3 +27,4 @@ jss-4.2.6.tar.gz /jss-4.6.4.tar.gz /jss-4.7.0-b2.tar.gz /jss-4.7.0-b4.tar.gz +/jss-4.7.0.tar.gz diff --git a/jss.spec b/jss.spec index 4566e5e..a3a2d28 100644 --- a/jss.spec +++ b/jss.spec @@ -7,8 +7,8 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 0.4%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -b4 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +#global _phase -a1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Jul 09 2020 Dogtag PKI Team - 4.7.0-1 +- Rebase to upstream stable release JSS v4.7.0 + * Tue Jun 30 2020 Dogtag PKI Team - 4.7.0-0.4 - Rebase to latest upstream JSS v4.7.0-b4 diff --git a/sources b/sources index eae7417..7f6e516 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0-b4.tar.gz) = 79c01fc513de479a63cbe164c772f9f685afe032a280f59eb3bb096a653424b3df1a9403c8cf443ffbe8b9a1d97a8aeb48064fbbe92e4c12e29767fb2a547d9f +SHA512 (jss-4.7.0.tar.gz) = 91a6bbc2c9dde436fd07e2f2bf9e71bd0a40c643547f41a95152a51200d126a37e2e580ef78d9075dc349f5dfe613b04eaf2a32009da13889e824ee9db255a43 From c860b09f9f33a3d26e49ded03d744529a4891e2f Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 18 Aug 2020 13:56:49 -0400 Subject: [PATCH 09/10] Rebase to JSS v4.7.2 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 15 +++++++++------ sources | 2 +- 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index a9ae250..d7eb920 100644 --- a/.gitignore +++ b/.gitignore @@ -28,3 +28,4 @@ jss-4.2.6.tar.gz /jss-4.7.0-b2.tar.gz /jss-4.7.0-b4.tar.gz /jss-4.7.0.tar.gz +/jss-4.7.2.tar.gz diff --git a/jss.spec b/jss.spec index a3a2d28..22d91ff 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.0 +Version: 4.7.2 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 @@ -109,12 +109,12 @@ export CFLAGS modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 # The Makefile is not thread-safe -rm -rf build && mkdir -p build && cd build %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ - .. + -B %{_vpath_builddir} +cd %{_vpath_builddir} %{__make} all %{__make} javadoc ctest --output-on-failure @@ -126,19 +126,19 @@ ctest --output-on-failure # jars install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir} -install -m 644 build/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar +install -m 644 %{_vpath_builddir}/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar # We have to use the name libjss4.so because this is dynamically # loaded by the jar file. install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss -install -m 0755 build/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ +install -m 0755 %{_vpath_builddir}/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ pushd ${RPM_BUILD_ROOT}%{_libdir}/jss ln -fs %{_jnidir}/jss4.jar jss4.jar popd # javadoc install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} -cp -rp build/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} +cp -rp %{_vpath_builddir}/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Aug 18 2020 Dogtag PKI Team - 4.7.2-1 +- Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS + * Thu Jul 09 2020 Dogtag PKI Team - 4.7.0-1 - Rebase to upstream stable release JSS v4.7.0 diff --git a/sources b/sources index 7f6e516..1f22225 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0.tar.gz) = 91a6bbc2c9dde436fd07e2f2bf9e71bd0a40c643547f41a95152a51200d126a37e2e580ef78d9075dc349f5dfe613b04eaf2a32009da13889e824ee9db255a43 +SHA512 (jss-4.7.2.tar.gz) = 171b4c341b56c49eaedf0663cee7c949bd91f070781debc80b7b74f85eeacc5e4092cc5ab8eb3ace926493a7ea64d08c5c7a614dccd2e479f8b371b6075d6594 From f338e1034c7d99fd1744cbf7f59597478793b53d Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Fri, 11 Sep 2020 16:48:33 -0400 Subject: [PATCH 10/10] Rebase to JSS v4.7.3 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 18 +++++++++++++++++- sources | 2 +- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index d7eb920..349bfb5 100644 --- a/.gitignore +++ b/.gitignore @@ -29,3 +29,4 @@ jss-4.2.6.tar.gz /jss-4.7.0-b4.tar.gz /jss-4.7.0.tar.gz /jss-4.7.2.tar.gz +/jss-4.7.3.tar.gz diff --git a/jss.spec b/jss.spec index 22d91ff..368f582 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.2 +Version: 4.7.3 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 @@ -108,13 +108,26 @@ export CFLAGS # Check if we're in FIPS mode modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 +# RHEL's CMake doesn't support -B flag. +%if 0%{?rhel} +%{__mkdir_p} %{_vpath_builddir} +cd %{_vpath_builddir} +%endif + # The Makefile is not thread-safe %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ +%if 0%{?rhel} + .. +%else -B %{_vpath_builddir} +%endif +%if 0%{?fedora} cd %{_vpath_builddir} +%endif + %{__make} all %{__make} javadoc ctest --output-on-failure @@ -160,6 +173,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Fri Sep 11 2020 Dogtag PKI Team - 4.7.3-1 +- Rebase to upstream stable release JSS v4.7.3 + * Tue Aug 18 2020 Dogtag PKI Team - 4.7.2-1 - Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS diff --git a/sources b/sources index 1f22225..13d43e8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.2.tar.gz) = 171b4c341b56c49eaedf0663cee7c949bd91f070781debc80b7b74f85eeacc5e4092cc5ab8eb3ace926493a7ea64d08c5c7a614dccd2e479f8b371b6075d6594 +SHA512 (jss-4.7.3.tar.gz) = 9358cf78d99e5e32a07dd457d6b0c916bdf9bf6959efe889f1cb91af75aa79fc419c2d057a40bfbe4e2a4924bffc1cafa04d917622cafe07062bcb633f330f98