From 62ce4a23415abd55fc876bd3c700b9451e5546e7 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 29 Nov 2018 15:50:39 -0500 Subject: [PATCH 01/11] Rebased to JSS v4.5.1 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 56 +++++++++++++++++++++--------------------------------- sources | 2 +- 3 files changed, 24 insertions(+), 35 deletions(-) diff --git a/.gitignore b/.gitignore index 521c173..f89e975 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ jss-4.2.6.tar.gz /jss-4.5.0-a4.tar.gz /jss-4.5.0-b1.tar.gz /jss-4.5.0.tar.gz +/jss-4.5.1.tar.gz diff --git a/jss.spec b/jss.spec index 8e63e81..b829d3c 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.5.0 +Version: 4.5.1 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 @@ -33,6 +33,8 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # autosetup BuildRequires: git +BuildRequires: make +BuildRequires: cmake BuildRequires: gcc-c++ BuildRequires: nspr-devel >= 4.13.1 @@ -41,6 +43,7 @@ BuildRequires: nss-tools >= 3.28.4-6 BuildRequires: java-devel BuildRequires: jpackage-utils BuildRequires: slf4j +BuildRequires: glassfish-jaxb-api %if 0%{?rhel} && 0%{?rhel} <= 7 # no slf4j-jdk14 %else @@ -57,6 +60,7 @@ Requires: nss >= 3.28.4-6 Requires: java-headless Requires: jpackage-utils Requires: slf4j +Requires: glassfish-jaxb-api %if 0%{?rhel} && 0%{?rhel} <= 7 # no slf4j-jdk14 %else @@ -97,43 +101,22 @@ This package contains the API documentation for JSS. %set_build_flags [ -z "$JAVA_HOME" ] && export JAVA_HOME=%{_jvmdir}/java -[ -z "$USE_INSTALLED_NSPR" ] && export USE_INSTALLED_NSPR=1 -[ -z "$USE_INSTALLED_NSS" ] && export USE_INSTALLED_NSS=1 # Enable compiler optimizations export BUILD_OPT=1 # Generate symbolic info for debuggers -XCFLAGS="-g $RPM_OPT_FLAGS" -export XCFLAGS - -PKG_CONFIG_ALLOW_SYSTEM_LIBS=1 -PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1 - -export PKG_CONFIG_ALLOW_SYSTEM_LIBS -export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS - -NSPR_INCLUDE_DIR=`/usr/bin/pkg-config --cflags-only-I nspr | sed 's/-I//'` -NSPR_LIB_DIR=`/usr/bin/pkg-config --libs-only-L nspr | sed 's/-L//'` - -NSS_INCLUDE_DIR=`/usr/bin/pkg-config --cflags-only-I nss | sed 's/-I//'` -NSS_LIB_DIR=`/usr/bin/pkg-config --libs-only-L nss | sed 's/-L//'` - -export NSPR_INCLUDE_DIR -export NSPR_LIB_DIR -export NSS_INCLUDE_DIR -export NSS_LIB_DIR - -%if 0%{?__isa_bits} == 64 -USE_64=1 -export USE_64 -%endif +CFLAGS="-g $RPM_OPT_FLAGS" +export CFLAGS # The Makefile is not thread-safe -make -C coreconf -make -make javadoc -make test_jss +rm -rf build && mkdir -p build && cd build +%cmake \ + -DJAVA_HOME=%{java_home} \ + -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ + .. + +%{__make} all test javadoc ################################################################################ %install @@ -142,19 +125,19 @@ make test_jss # jars install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir} -install -m 644 ../dist/xpclass.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar +install -m 644 build/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar # We have to use the name libjss4.so because this is dynamically # loaded by the jar file. install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss -install -m 0755 ../dist/Linux*.OBJ/lib/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ +install -m 0755 build/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ pushd ${RPM_BUILD_ROOT}%{_libdir}/jss ln -fs %{_jnidir}/jss4.jar jss4.jar popd # javadoc install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} -cp -rp ../dist/jssdoc/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} +cp -rp build/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} @@ -175,6 +158,11 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Nov 29 2018 Dogtag PKI Team 4.5.1-1 +- Rebased to JSS 4.5.1 +- Red Hat Bugzilla #1582323 - DER encoding error for enumerated types with a value of zero +- Red Hat Bugzilla #1534765 - javadoc for org.mozilla.jss.pkix.cms.SignedData.getSignerInfos() is incorrect + * Fri Aug 10 2018 Dogtag PKI Team 4.5.0-1 - Rebased to JSS 4.5.0 diff --git a/sources b/sources index e88e6d8..9d27161 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.5.0.tar.gz) = abebd75104f747a95dc3160dc6218c549235f5c9ee2d416299bfe132072b76fb7f0fec4ce2664931bf971280836ab0eb26746f964c13300393fa6a5937f81cda +SHA512 (jss-4.5.1.tar.gz) = b16c422853fad83b750775633315278becfe2156a5c1ee6e6000a345a77dbfd6c1c059d458edf9fe770a4a66f58727568d268853220ffa7f4acb57a40c2f7f96 From bd4b4e947dfb2e18de463c9a702228126d6433a8 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Mon, 14 Jan 2019 15:12:05 -0500 Subject: [PATCH 02/11] Rebased to JSS v4.5.2 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index f89e975..dbd1390 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ jss-4.2.6.tar.gz /jss-4.5.0-b1.tar.gz /jss-4.5.0.tar.gz /jss-4.5.1.tar.gz +/jss-4.5.2.tar.gz diff --git a/jss.spec b/jss.spec index b829d3c..7f52e74 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.5.1 +Version: 4.5.2 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 @@ -158,6 +158,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Mon Jan 14 2019 Dogtag PKI Team 4.5.2-1 +- Rebased to JSS 4.5.2 + * Thu Nov 29 2018 Dogtag PKI Team 4.5.1-1 - Rebased to JSS 4.5.1 - Red Hat Bugzilla #1582323 - DER encoding error for enumerated types with a value of zero diff --git a/sources b/sources index 9d27161..a43c93f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.5.1.tar.gz) = b16c422853fad83b750775633315278becfe2156a5c1ee6e6000a345a77dbfd6c1c059d458edf9fe770a4a66f58727568d268853220ffa7f4acb57a40c2f7f96 +SHA512 (jss-4.5.2.tar.gz) = 344b31a218b7aebb15cc24e24d5697978889bf37856ddefc9521899d2a2a80b1bc9ed0b498a6e0cd19deed169fe1bc56f1ad42e7b8cfc188fadd28245d7bec31 From 7fec70e653f6ab3e6c6a4bc3203f9d3ff98b8d14 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Fri, 1 Feb 2019 11:14:43 -0500 Subject: [PATCH 03/11] Add nuxwdog patch from PKI Signed-off-by: Alexander Scheel --- ...ki-sync-netscape-security-util-Utils.patch | 94 +++++++++++++++++++ jss.spec | 12 ++- 2 files changed, 102 insertions(+), 4 deletions(-) create mode 100644 jss-pki-sync-netscape-security-util-Utils.patch diff --git a/jss-pki-sync-netscape-security-util-Utils.patch b/jss-pki-sync-netscape-security-util-Utils.patch new file mode 100644 index 0000000..41545a8 --- /dev/null +++ b/jss-pki-sync-netscape-security-util-Utils.patch @@ -0,0 +1,94 @@ +From a5b0caf63837acfd876ee15e3823fbfdf5685432 Mon Sep 17 00:00:00 2001 +From: Dinesh Prasanth M K +Date: Wed, 30 Jan 2019 12:31:29 -0500 +Subject: [PATCH] Add exec method to execute shell commands with input + +- This is an effort to move duplicate code from PKI code + base to JSS code base + +- This chunk of code was originally introduced in PKI + code: https://github.com/dogtagpki/pki/pull/131 + +- This PR is a joined effort of: + https://github.com/dogtagpki/pki/pull/122 + +Signed-off-by: Dinesh Prasanth M K +--- + .../jss/netscape/security/util/Utils.java | 57 +++++++++++++++++++ + 1 file changed, 57 insertions(+) + +diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java +index b1a3c341..b45381ae 100644 +--- a/org/mozilla/jss/netscape/security/util/Utils.java ++++ b/org/mozilla/jss/netscape/security/util/Utils.java +@@ -25,6 +25,7 @@ + import java.io.FileWriter; + import java.io.IOException; + import java.io.InputStream; ++import java.io.InputStreamReader; + import java.io.OutputStream; + import java.io.OutputStreamWriter; + import java.io.PrintWriter; +@@ -96,6 +97,62 @@ public static boolean exec(String cmd) { + return false; + } + ++ public static String readFromStream(InputStream inputStream) throws IOException { ++ StringBuilder sb = new StringBuilder(); ++ BufferedReader br = null; ++ try { ++ br = new BufferedReader(new InputStreamReader(inputStream)); ++ String line = null; ++ while ((line = br.readLine()) != null) { ++ sb.append(line + System.getProperty("line.separator")); ++ } ++ } finally { ++ br.close(); ++ } ++ return sb.toString().trim(); ++ } ++ ++ public static void writeToStream(OutputStream outputStream, String input) throws IOException { ++ BufferedWriter writer = new BufferedWriter(new OutputStreamWriter(outputStream)); ++ writer.write(input); ++ writer.flush(); ++ writer.close(); ++ } ++ ++ /** ++ * Utility method to execute system commands ++ * ++ * @param cmd The command to be executed and its arguments ++ * @param input The stdin input to be passed to the cmd ++ * @return stdout or stderr of the command executed ++ * @throws IOException ++ * @throws InterruptedException ++ */ ++ public static String exec(String[] cmd, String input) throws IOException, InterruptedException { ++ ++ ProcessBuilder pb = new ProcessBuilder(cmd); ++ ++ Process p = pb.start(); ++ ++ if (input != null) { ++ writeToStream(p.getOutputStream(), input); ++ } ++ ++ p.waitFor(); ++ ++ String output; ++ if (p.exitValue() == 0) { ++ output = readFromStream(p.getInputStream()); ++ } else { ++ output = readFromStream(p.getErrorStream()); ++ } ++ p.destroy(); ++ ++ return output; ++ } ++ ++ ++ + public static String SpecialURLDecode(String s) { + if (s == null) + return null; diff --git a/jss.spec b/jss.spec index 7f52e74..a2536e0 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.5.2 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 3%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -26,6 +26,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +Patch1: jss-pki-sync-netscape-security-util-Utils.patch ################################################################################ # Build Dependencies @@ -38,8 +39,8 @@ BuildRequires: cmake BuildRequires: gcc-c++ BuildRequires: nspr-devel >= 4.13.1 -BuildRequires: nss-devel >= 3.28.4-6 -BuildRequires: nss-tools >= 3.28.4-6 +BuildRequires: nss-devel >= 3.30 +BuildRequires: nss-tools >= 3.30 BuildRequires: java-devel BuildRequires: jpackage-utils BuildRequires: slf4j @@ -56,7 +57,7 @@ BuildRequires: apache-commons-codec BuildRequires: perl-interpreter %endif -Requires: nss >= 3.28.4-6 +Requires: nss >= 3.30 Requires: java-headless Requires: jpackage-utils Requires: slf4j @@ -158,6 +159,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Fri Feb 01 2019 Dogtag PKI Team 4.5.2-3 +- Include nuxwdog patch for netscape.security.util.Utils from PKI + * Mon Jan 14 2019 Dogtag PKI Team 4.5.2-1 - Rebased to JSS 4.5.2 From 1e3db9c6d864acabf2af0b4a1b4531fd03ead95e Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 19 Mar 2019 14:14:43 -0400 Subject: [PATCH 04/11] Rebase to JSS v4.5.3 Signed-off-by: Alexander Scheel --- .gitignore | 1 + ...ki-sync-netscape-security-util-Utils.patch | 94 ------------------- jss.spec | 6 +- sources | 2 +- 4 files changed, 5 insertions(+), 98 deletions(-) delete mode 100644 jss-pki-sync-netscape-security-util-Utils.patch diff --git a/.gitignore b/.gitignore index dbd1390..d1f14a6 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ jss-4.2.6.tar.gz /jss-4.5.0.tar.gz /jss-4.5.1.tar.gz /jss-4.5.2.tar.gz +/jss-4.5.3.tar.gz diff --git a/jss-pki-sync-netscape-security-util-Utils.patch b/jss-pki-sync-netscape-security-util-Utils.patch deleted file mode 100644 index 41545a8..0000000 --- a/jss-pki-sync-netscape-security-util-Utils.patch +++ /dev/null @@ -1,94 +0,0 @@ -From a5b0caf63837acfd876ee15e3823fbfdf5685432 Mon Sep 17 00:00:00 2001 -From: Dinesh Prasanth M K -Date: Wed, 30 Jan 2019 12:31:29 -0500 -Subject: [PATCH] Add exec method to execute shell commands with input - -- This is an effort to move duplicate code from PKI code - base to JSS code base - -- This chunk of code was originally introduced in PKI - code: https://github.com/dogtagpki/pki/pull/131 - -- This PR is a joined effort of: - https://github.com/dogtagpki/pki/pull/122 - -Signed-off-by: Dinesh Prasanth M K ---- - .../jss/netscape/security/util/Utils.java | 57 +++++++++++++++++++ - 1 file changed, 57 insertions(+) - -diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java -index b1a3c341..b45381ae 100644 ---- a/org/mozilla/jss/netscape/security/util/Utils.java -+++ b/org/mozilla/jss/netscape/security/util/Utils.java -@@ -25,6 +25,7 @@ - import java.io.FileWriter; - import java.io.IOException; - import java.io.InputStream; -+import java.io.InputStreamReader; - import java.io.OutputStream; - import java.io.OutputStreamWriter; - import java.io.PrintWriter; -@@ -96,6 +97,62 @@ public static boolean exec(String cmd) { - return false; - } - -+ public static String readFromStream(InputStream inputStream) throws IOException { -+ StringBuilder sb = new StringBuilder(); -+ BufferedReader br = null; -+ try { -+ br = new BufferedReader(new InputStreamReader(inputStream)); -+ String line = null; -+ while ((line = br.readLine()) != null) { -+ sb.append(line + System.getProperty("line.separator")); -+ } -+ } finally { -+ br.close(); -+ } -+ return sb.toString().trim(); -+ } -+ -+ public static void writeToStream(OutputStream outputStream, String input) throws IOException { -+ BufferedWriter writer = new BufferedWriter(new OutputStreamWriter(outputStream)); -+ writer.write(input); -+ writer.flush(); -+ writer.close(); -+ } -+ -+ /** -+ * Utility method to execute system commands -+ * -+ * @param cmd The command to be executed and its arguments -+ * @param input The stdin input to be passed to the cmd -+ * @return stdout or stderr of the command executed -+ * @throws IOException -+ * @throws InterruptedException -+ */ -+ public static String exec(String[] cmd, String input) throws IOException, InterruptedException { -+ -+ ProcessBuilder pb = new ProcessBuilder(cmd); -+ -+ Process p = pb.start(); -+ -+ if (input != null) { -+ writeToStream(p.getOutputStream(), input); -+ } -+ -+ p.waitFor(); -+ -+ String output; -+ if (p.exitValue() == 0) { -+ output = readFromStream(p.getInputStream()); -+ } else { -+ output = readFromStream(p.getErrorStream()); -+ } -+ p.destroy(); -+ -+ return output; -+ } -+ -+ -+ - public static String SpecialURLDecode(String s) { - if (s == null) - return null; diff --git a/jss.spec b/jss.spec index a2536e0..d1757c0 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.5.2 -Release: 3%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.5.3 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -26,7 +26,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch1: jss-pki-sync-netscape-security-util-Utils.patch +# Patch1: jss-pki-sync-netscape-security-util-Utils.patch ################################################################################ # Build Dependencies diff --git a/sources b/sources index a43c93f..8c326c0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.5.2.tar.gz) = 344b31a218b7aebb15cc24e24d5697978889bf37856ddefc9521899d2a2a80b1bc9ed0b498a6e0cd19deed169fe1bc56f1ad42e7b8cfc188fadd28245d7bec31 +SHA512 (jss-4.5.3.tar.gz) = 6a5d5065803a36a42f15c19fa870edf4844d650911c690a8033288ee0e2e6e115868de39a7c9c955e068568a859baf5fb3e8e970b4167dfc19782bb661ab6d71 From 9a3ad2714b58c6ab7bb5f4c47ab251a0b47847c8 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 19 Mar 2019 14:18:07 -0400 Subject: [PATCH 05/11] Updates to spec file from upstream Also adds changelog entry for the release of 4.5.3. Signed-off-by: Alexander Scheel --- jss.spec | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/jss.spec b/jss.spec index d1757c0..f2fb9a3 100644 --- a/jss.spec +++ b/jss.spec @@ -26,7 +26,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -# Patch1: jss-pki-sync-netscape-security-util-Utils.patch ################################################################################ # Build Dependencies @@ -53,9 +52,7 @@ BuildRequires: slf4j-jdk14 BuildRequires: apache-commons-lang BuildRequires: apache-commons-codec -%if 0%{?fedora} >= 25 || 0%{?rhel} > 7 -BuildRequires: perl-interpreter -%endif +BuildRequires: junit Requires: nss >= 3.30 Requires: java-headless @@ -117,7 +114,8 @@ rm -rf build && mkdir -p build && cd build -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ .. -%{__make} all test javadoc +%{__make} all javadoc +ctest --output-on-failure ################################################################################ %install @@ -159,7 +157,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog -* Fri Feb 01 2019 Dogtag PKI Team 4.5.2-3 +* Tue Mar 19 2019 Dogtag PKI Team - 4.5.3-1 +- Rebase to JSS 4.5.3 + +* Fri Feb 01 2019 Dogtag PKI Team - 4.5.2-3 - Include nuxwdog patch for netscape.security.util.Utils from PKI * Mon Jan 14 2019 Dogtag PKI Team 4.5.2-1 From 1b1954ffdcce5a77b7f60d1981c212d896fe825c Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Mon, 6 May 2019 16:24:58 -0400 Subject: [PATCH 06/11] Add fedpkg local artifacts to .gitignore Signed-off-by: Alexander Scheel --- .gitignore | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.gitignore b/.gitignore index d1f14a6..fcc1b5d 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,10 @@ +# Local build files +jss-*.src.rpm +jss-*/ +x86_64/ +.build-*.log + +# Releases jss-4.2.6.tar.gz /jss-4.2.6.tar.gz /jss-4.4.0.tar.gz From f208f4666f9f0b6e7a5d644e29e52115d5431582 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Mon, 6 May 2019 16:25:02 -0400 Subject: [PATCH 07/11] Add AIA OCSP extended certificate checking patches Signed-off-by: Alexander Scheel --- jss-aia-ocsp-1.patch | 659 +++++++++++++++++++++++++++++++++++++++++++ jss-aia-ocsp-2.patch | 141 +++++++++ jss.spec | 7 +- 3 files changed, 806 insertions(+), 1 deletion(-) create mode 100644 jss-aia-ocsp-1.patch create mode 100644 jss-aia-ocsp-2.patch diff --git a/jss-aia-ocsp-1.patch b/jss-aia-ocsp-1.patch new file mode 100644 index 0000000..f20207c --- /dev/null +++ b/jss-aia-ocsp-1.patch @@ -0,0 +1,659 @@ +From 8975c8ae1d0c8b916c5c73aff12046b01d3e6ef0 Mon Sep 17 00:00:00 2001 +From: Jack Magne +Date: Fri, 25 Jan 2019 14:54:11 -0800 +Subject: [PATCH] Resolve Bug 1666872 - CC: Enable AIA OCSP cert checking for + entire cert chain. + +This fix for jss, solves the one use case where the pki server is configured to perform ocsp checking ONLY with the contents of the AIA extension. Previously, jss could only check the ocsp server for the leaf node cert of the cert being verified. This fix allows the cert chain to be checked over ocsp for each cert in question. This is possible due to the fact that we have made a call in the PKIX library of nss to do the actual cert verfication. This call is made with all the needed flags to tell the PKIX library to make the ocsp verifications remotely over the network using the contents of the AIA extension. + +Later on we can use this code to handle the other cases, but for now we want to solve this one particular problem. If the server is configured in any other configuration than the one stated, the original verification code will be called as before. Below is an example of a configuration in server.xml, that will trigger this new code: + +< .... enableOCSP="true" ocspCacheSize="10000" ocspMinCacheEntryDuration="7200" .... > + +Note that due to ocsp caching, the cert chain verification may only be apparent after a restart of the server. A way to force an ocsp fetch every time is to set the value of ocspCacheSize=-1, which essentially disables the cache. + +Added a couple of minor fixes due to review comments. Possibly more to come. +Minor include directive change to compile on branch. +--- + org/mozilla/jss/CryptoManager.java | 48 +++++++ + org/mozilla/jss/PK11Finder.c | 95 ++++++++++++-- + org/mozilla/jss/ssl/callbacks.c | 67 ++++++++-- + org/mozilla/jss/ssl/common.c | 196 +++++++++++++++++++++++++++++ + org/mozilla/jss/ssl/jssl.h | 29 +++++ + org/mozilla/jss/util/java_ids.h | 9 ++ + 6 files changed, 422 insertions(+), 22 deletions(-) + +diff --git a/org/mozilla/jss/CryptoManager.java b/org/mozilla/jss/CryptoManager.java +index 9b86bf9e..c9a3fb2b 100644 +--- a/org/mozilla/jss/CryptoManager.java ++++ b/org/mozilla/jss/CryptoManager.java +@@ -1201,6 +1201,44 @@ private native boolean verifyCertTempNative(byte[] certPackage, + // OCSP management + /////////////////////////////////////////////////////////////////////// + ++ /* OCSP Policy related */ ++ ++ public enum OCSPPolicy { ++ NONE, ++ NORMAL, ++ LEAF_AND_CHAIN; ++ } ++ ++ private static OCSPPolicy ocspPolicy = OCSPPolicy.NONE; ++ ++ /** ++ * Gets the current ocsp Policy. ++ * Currently we only support 2 modes OCSP_LEAF_AND_CHAIN_POLICY. ++ * And OCSP_NORMAL_POLICY, which is current processing , by default. ++ * If we have AIA based OCSP enabled we will check all certs in the chain. ++ * using PKIX cert verfication calls in the various cert auth callbacks we ++ * have. ++ * @return - The current ocsp policy in effect. ++ */ ++ ++ public static synchronized int getOCSPPolicy() { ++ return ocspPolicy.ordinal(); ++ } ++ ++ /** ++ * Sets the current ocsp Policy. ++ * Currently we only support one mode OCSP_LEAF_AND_CHAIN_POLICY. ++ * If we have AIA based OCSP enabled we will check all certs in the chain. ++ * using PKIX cert verfication calls in the various cert auth callbacks we ++ * have. ++ * @param policy - Either cert and chain or normal default processing. ++ * ++ */ ++ ++ public static synchronized void setOCSPPolicy(OCSPPolicy policy) { ++ ocspPolicy = policy; ++ } ++ + /** + * Enables OCSP, note when you Initialize JSS for the first time, for + * backwards compatibility, the initialize will enable OCSP if you +@@ -1220,6 +1258,16 @@ public void configureOCSP( + String ocspResponderCertNickname ) + throws GeneralSecurityException + { ++ /* set the ocsp policy */ ++ ++ if(ocspCheckingEnabled && ++ ocspResponderURL == null && ++ ocspResponderCertNickname == null) { ++ setOCSPPolicy(OCSPPolicy.LEAF_AND_CHAIN); ++ } else { ++ setOCSPPolicy(OCSPPolicy.NORMAL); ++ } ++ + configureOCSPNative(ocspCheckingEnabled, + ocspResponderURL, + ocspResponderCertNickname ); +diff --git a/org/mozilla/jss/PK11Finder.c b/org/mozilla/jss/PK11Finder.c +index 45958181..0329e91d 100644 +--- a/org/mozilla/jss/PK11Finder.c ++++ b/org/mozilla/jss/PK11Finder.c +@@ -14,9 +14,9 @@ + #include + + #include +- + #include + #include "pk11util.h" ++#include "ssl/jssl.h" + #include + + /* +@@ -1574,6 +1574,9 @@ SECStatus verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString, + goto finish; + } + ++ int ocspPolicy = JSSL_getOCSPPolicy(); ++ ++ + certificateUsage = required_certificateUsage; + + cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname); +@@ -1587,8 +1590,24 @@ SECStatus verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString, + /* 0 for certificateUsage in call to CERT_VerifyCertificateNow will + * retrieve the current valid usage into currUsage + */ +- rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, +- checkSig, certificateUsage, NULL, currUsage ); ++ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { ++ rv = JSSL_verifyCertPKIX( cert, certificateUsage, ++ NULL /* pin arg */, ocspPolicy, NULL, currUsage); ++ ++ /* we need to do this just to get the cert usages, the pkix version ++ doesn't seem to honor the method to get the usages as of yet. ++ Let the PKIX call only determine the final fate. ++ */ ++ if(rv == SECSuccess) { ++ CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, ++ checkSig, certificateUsage, NULL, currUsage ); ++ } ++ ++ } else { ++ rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, ++ checkSig, certificateUsage, NULL, currUsage ); ++ } ++ + if ((rv == SECSuccess) && certificateUsage == 0x0000) { + if (*currUsage == + ( certUsageUserCertImport | +@@ -1639,6 +1658,8 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative(JNIEnv *env, + goto finish; + } + ++ int ocspPolicy = JSSL_getOCSPPolicy(); ++ + certificateUsage = required_certificateUsage; + + cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname); +@@ -1653,8 +1674,23 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative(JNIEnv *env, + * just get the current usage (which we are not passing back for now + * but will bypass the certificate usage check + */ +- rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, +- checkSig, certificateUsage, NULL, &currUsage ); ++ ++ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { ++ rv= JSSL_verifyCertPKIX( cert, certificateUsage, ++ NULL /* pin arg */, ocspPolicy, NULL, &currUsage); ++ ++ /* we need to do this just to get the cert usages, the pkix version ++ doesn't seem to honor the method to get the usages as of yet. ++ Let the PKIX call only determine the final fate. ++ */ ++ if(rv == SECSuccess) { ++ CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, ++ checkSig, certificateUsage, NULL, &currUsage ); ++ } ++ } else { ++ rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, ++ checkSig, certificateUsage, NULL, &currUsage ); ++ } + } + + finish: +@@ -1720,12 +1756,14 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative2(JNIEnv *env, + SECStatus rv = SECFailure; + CERTCertificate *cert = NULL; + char *nickname = NULL; +- ++ + if (nickString == NULL) { + JSS_throwMsg(env, INVALID_NICKNAME_EXCEPTION, "Missing certificate nickname"); + goto finish; + } + ++ int ocspPolicy = JSSL_getOCSPPolicy(); ++ + nickname = (char *) (*env)->GetStringUTFChars(env, nickString, NULL); + if (nickname == NULL) { + JSS_throwMsg(env, INVALID_NICKNAME_EXCEPTION, "Missing certificate nickname"); +@@ -1747,8 +1785,25 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative2(JNIEnv *env, + /* 0 for certificateUsage in call to CERT_VerifyCertificateNow will + * retrieve the current valid usage into currUsage + */ +- rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, +- checkSig, certificateUsage, NULL, &currUsage); ++ ++ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { ++ rv = JSSL_verifyCertPKIX( cert, certificateUsage, ++ NULL /* pin arg */, ocspPolicy, NULL, &currUsage); ++ ++ /* we need to do this just to get the cert usages, the pkix version ++ doesn't seem to honor the method to get the usages as of yet. ++ Let the PKIX call only determine the final fate. ++ */ ++ if(rv == SECSuccess) { ++ CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, ++ checkSig, certificateUsage, NULL, &currUsage ); ++ ++ } ++ ++ } else { ++ rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, ++ checkSig, certificateUsage, NULL, &currUsage); ++ } + + if (rv != SECSuccess) { + JSS_throwMsgPrErr(env, CERTIFICATE_EXCEPTION, "Invalid certificate"); +@@ -1803,6 +1858,9 @@ Java_org_mozilla_jss_CryptoManager_verifyCertNowNative(JNIEnv *env, + if( nickname == NULL ) { + goto finish; + } ++ ++ int ocspPolicy = JSSL_getOCSPPolicy(); ++ + certUsage = cUsage; + cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname); + +@@ -1812,8 +1870,13 @@ Java_org_mozilla_jss_CryptoManager_verifyCertNowNative(JNIEnv *env, + PR_smprintf_free(message); + goto finish; + } else { +- rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), cert, +- checkSig, certUsage, NULL ); ++ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { ++ rv = JSSL_verifyCertPKIX( cert, certUsage, ++ NULL /* pin arg */, ocspPolicy, NULL, NULL); ++ } else { ++ rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), cert, ++ checkSig, certUsage, NULL ); ++ } + } + + finish: +@@ -1858,6 +1921,8 @@ Java_org_mozilla_jss_CryptoManager_verifyCertTempNative(JNIEnv *env, + derCerts[0] = JSS_ByteArrayToSECItem(env, packageArray); + derCerts[1] = NULL; + ++ int ocspPolicy = JSSL_getOCSPPolicy(); ++ + rv = CERT_ImportCerts(certdb, cUsage, + 1, derCerts, &certArray, PR_FALSE /*temp Certs*/, + PR_FALSE /*caOnly*/, NULL); +@@ -1869,8 +1934,14 @@ Java_org_mozilla_jss_CryptoManager_verifyCertTempNative(JNIEnv *env, + } + + certUsage = cUsage; +- rv = CERT_VerifyCertNow(certdb, certArray[0], +- checkSig, certUsage, NULL ); ++ ++ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { ++ rv = JSSL_verifyCertPKIX( certArray[0], certUsage, ++ NULL /* pin arg */, ocspPolicy, NULL, NULL); ++ } else { ++ rv = CERT_VerifyCertNow(certdb, certArray[0], ++ checkSig, certUsage, NULL ); ++ } + + finish: + /* this checks for NULL */ +diff --git a/org/mozilla/jss/ssl/callbacks.c b/org/mozilla/jss/ssl/callbacks.c +index 634f31ec..42594a14 100644 +--- a/org/mozilla/jss/ssl/callbacks.c ++++ b/org/mozilla/jss/ssl/callbacks.c +@@ -20,6 +20,40 @@ + #include + #include + ++int ++JSSL_getOCSPPolicy() { ++ JNIEnv *env; ++ jint policy = -1; ++ ++ jmethodID getOCSPPolicyID; ++ jclass cryptoManagerClass; ++ ++ /* get the JNI environment */ ++ if((*JSS_javaVM)->AttachCurrentThread(JSS_javaVM, (void**)&env, NULL) != 0){ ++ PR_ASSERT(PR_FALSE); ++ goto finish; ++ } ++ ++ cryptoManagerClass = (*env)->FindClass(env, CRYPTO_MANAGER_NAME); ++ if( cryptoManagerClass == NULL ) { ++ ASSERT_OUTOFMEM(env); ++ goto finish; ++ } ++ getOCSPPolicyID = (*env)->GetStaticMethodID(env, cryptoManagerClass, ++ GET_OCSP_POLICY_NAME,GET_OCSP_POLICY_SIG); ++ ++ if( getOCSPPolicyID == NULL ) { ++ ASSERT_OUTOFMEM(env); ++ goto finish; ++ } ++ ++ policy = (*env)->CallStaticIntMethod(env, cryptoManagerClass, ++ getOCSPPolicyID); ++ ++finish: ++ return (int) policy; ++} ++ + static SECStatus + secCmpCertChainWCANames(CERTCertificate *cert, CERTDistNames *caNames) + { +@@ -443,8 +477,9 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, + SECCertUsage certUsage; + CERTCertificate *peerCert=NULL; + ++ int ocspPolicy = JSSL_getOCSPPolicy(); ++ + certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; +- + + /* SSL_PeerCertificate() returns a shallow copy of the cert, so we + must destroy it before we exit this function */ +@@ -452,8 +487,13 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, + peerCert = SSL_PeerCertificate(fd); + + if (peerCert) { +- rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert, +- checkSig, certUsage, NULL /*pinarg*/); ++ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { ++ rv = JSSL_verifyCertPKIX( peerCert, certUsage, ++ NULL /* pin arg */, ocspPolicy, NULL, NULL); ++ } else { ++ rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert, ++ checkSig, certUsage, NULL /*pinarg*/); ++ } + } + + /* if we're a server, then we don't need to check the CN of the +@@ -569,6 +609,8 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, + log.tail = NULL; + log.count = 0; + ++ int ocspPolicy = JSSL_getOCSPPolicy(); ++ + /* get the JNI environment */ + if((*JSS_javaVM)->AttachCurrentThread(JSS_javaVM, (void**)&env, NULL) != 0){ + PR_ASSERT(PR_FALSE); +@@ -589,13 +631,18 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, + * logging parameter) + */ + +- verificationResult = CERT_VerifyCert( CERT_GetDefaultCertDB(), +- peerCert, +- checkSig, +- certUsage, +- PR_Now(), +- NULL /*pinarg*/, +- &log); ++ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { ++ verificationResult = JSSL_verifyCertPKIX( peerCert, certUsage, ++ NULL /* pin arg */, ocspPolicy, &log, NULL); ++ } else { ++ verificationResult = CERT_VerifyCert( CERT_GetDefaultCertDB(), ++ peerCert, ++ checkSig, ++ certUsage, ++ PR_Now(), ++ NULL /*pinarg*/, ++ &log); ++ } + + if (verificationResult == SECSuccess && log.count > 0) { + verificationResult = SECFailure; +diff --git a/org/mozilla/jss/ssl/common.c b/org/mozilla/jss/ssl/common.c +index 5c6efa85..aec88552 100644 +--- a/org/mozilla/jss/ssl/common.c ++++ b/org/mozilla/jss/ssl/common.c +@@ -15,6 +15,7 @@ + #include + #include "_jni/org_mozilla_jss_ssl_SSLSocket.h" + #include "jssl.h" ++#include "cert.h" + + #ifdef WIN32 + #include +@@ -889,3 +890,198 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv) + PR_ASSERT(ret == 0); + } + } ++ ++/* Get the trusted anchor for pkix */ ++ ++CERTCertificate * getRoot(CERTCertificate *cert, ++ SECCertificateUsage certUsage) ++{ ++ CERTCertificate *root = NULL; ++ CERTCertListNode *node = NULL; ++ ++ if( !cert ) { ++ goto finish; ++ } ++ ++ CERTCertList *certList = CERT_GetCertChainFromCert(cert, ++ PR_Now(), ++ certUsage); ++ ++ if( certList == NULL) { ++ goto finish; ++ } ++ ++ for (node = CERT_LIST_HEAD(certList); ++ !CERT_LIST_END(node, certList); ++ node = CERT_LIST_NEXT(node)) { ++ ++ /* try to find the root */ ++ if( node->cert && node->cert->isRoot ) { ++ root = CERT_DupCertificate(node->cert) ; ++ } ++ } ++ ++finish: ++ ++ CERT_DestroyCertList (certList); ++ return root; ++} ++ ++/* Verify a cert using explicit PKIX call. ++ * For now only used in OCSP AIA context. ++ * The result of this call will be a full chain ++ * and leaf network AIA ocsp validation. ++ * The policy param will be used in the future to ++ * handle more scenarios. ++ */ ++ ++SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, ++ SECCertificateUsage certUsage,secuPWData *pwdata, int ocspPolicy, ++ CERTVerifyLog *log, SECCertificateUsage *usage) ++{ ++ ++ /* put the first set of possible flags internally here first */ ++ /* later there could be a more complete list to choose from */ ++ /* support our hard core fetch aia ocsp policy for now */ ++ ++ static PRUint64 ocsp_Enabled_Hard_Policy_LeafFlags[2] = { ++ /* crl */ ++ 0, ++ /* ocsp */ ++ CERT_REV_M_TEST_USING_THIS_METHOD | ++ CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO ++ }; ++ ++ static PRUint64 ocsp_Enabled_Hard_Policy_ChainFlags[2] = { ++ /* crl */ ++ 0, ++ /* ocsp */ ++ CERT_REV_M_TEST_USING_THIS_METHOD | ++ CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO ++ }; ++ ++ static CERTRevocationMethodIndex ++ ocsp_Enabled_Hard_Policy_Method_Preference = { ++ cert_revocation_method_ocsp ++ }; ++ ++ static CERTRevocationFlags ocsp_Enabled_Hard_Policy = { ++ { /* leafTests */ ++ 2, ++ ocsp_Enabled_Hard_Policy_LeafFlags, ++ 1, ++ &ocsp_Enabled_Hard_Policy_Method_Preference, ++ 0 }, ++ { /* chainTests */ ++ 2, ++ ocsp_Enabled_Hard_Policy_ChainFlags, ++ 1, ++ &ocsp_Enabled_Hard_Policy_Method_Preference, ++ 0 } ++ }; ++ ++ /* for future expansion */ ++ ++ CERTValOutParam cvout[20] = {0}; ++ CERTValInParam cvin[20] = {0}; ++ ++ int inParamIndex = 0; ++ int outParamIndex = 0; ++ CERTRevocationFlags *rev = NULL; ++ ++ CERTCertList *trustedCertList = NULL; ++ ++ PRBool fetchCerts = PR_FALSE; ++ ++ SECStatus res = SECFailure; ++ if(cert == NULL) { ++ goto finish; ++ } ++ ++ if(ocspPolicy != OCSP_LEAF_AND_CHAIN_POLICY) { ++ goto finish; ++ } ++ ++ /* Force the strict ocsp network check on chain ++ and leaf. ++ */ ++ ++ fetchCerts = PR_TRUE; ++ rev = &ocsp_Enabled_Hard_Policy; ++ ++ /* fetch aia over net */ ++ ++ cvin[inParamIndex].type = cert_pi_useAIACertFetch; ++ cvin[inParamIndex].value.scalar.b = fetchCerts; ++ inParamIndex++; ++ ++ /* time */ ++ ++ cvin[inParamIndex].type = cert_pi_date; ++ cvin[inParamIndex].value.scalar.time = PR_Now(); ++ inParamIndex++; ++ ++ /* flags */ ++ ++ cvin[inParamIndex].type = cert_pi_revocationFlags; ++ cvin[inParamIndex].value.pointer.revocation = rev; ++ inParamIndex++; ++ ++ ++ /* establish trust anchor */ ++ ++ CERTCertificate *root = getRoot(cert,certUsage); ++ ++ /* Try to add the root as the trust anchor so all the ++ other memebers of the ca chain will get validated. ++ */ ++ ++ if( root != NULL ) { ++ trustedCertList = CERT_NewCertList(); ++ CERT_AddCertToListTail(trustedCertList, root); ++ ++ cvin[inParamIndex].type = cert_pi_trustAnchors; ++ cvin[inParamIndex].value.pointer.chain = trustedCertList; ++ ++ inParamIndex++; ++ } ++ ++ cvin[inParamIndex].type = cert_pi_end; ++ ++ if(log != NULL) { ++ cvout[outParamIndex].type = cert_po_errorLog; ++ cvout[outParamIndex].value.pointer.log = log; ++ outParamIndex ++; ++ } ++ ++ int usageIndex = 0; ++ if(usage != NULL) { ++ usageIndex = outParamIndex; ++ cvout[outParamIndex].type = cert_po_usages; ++ cvout[outParamIndex].value.scalar.usages = 0; ++ outParamIndex ++; ++ } ++ ++ cvout[outParamIndex].type = cert_po_end; ++ ++ res = CERT_PKIXVerifyCert(cert, certUsage, cvin, cvout, &pwdata); ++ ++finish: ++ /* clean up any trusted cert list */ ++ ++ if (trustedCertList) { ++ CERT_DestroyCertList(trustedCertList); ++ trustedCertList = NULL; ++ } ++ ++ if(root) { ++ CERT_DestroyCertificate(root); ++ root = NULL; ++ } ++ ++ if(res == SECSuccess && usage) { ++ *usage = cvout[usageIndex].value.scalar.usages; ++ } ++ ++ return res; ++} +diff --git a/org/mozilla/jss/ssl/jssl.h b/org/mozilla/jss/ssl/jssl.h +index c15acf87..0e93eebe 100644 +--- a/org/mozilla/jss/ssl/jssl.h ++++ b/org/mozilla/jss/ssl/jssl.h +@@ -5,8 +5,27 @@ + #ifndef ORG_MOZILLA_JSS_SSL_JSSL_H + #define ORG_MOZILLA_JSS_SSL_JSSL_H + ++/* ocsp policy constants */ ++ ++/* ocsp policy constants */ ++static const int OCSP_NO_POLICY = 0; ++static const int OCSP_NORMAL_POLICY = 1; ++static const int OCSP_LEAF_AND_CHAIN_POLICY = 2; ++ + #include + ++typedef struct ++{ ++ enum ++ { ++ PW_NONE = 0, ++ PW_FROMFILE = 1, ++ PW_PLAINTEXT = 2, ++ PW_EXTERNAL = 3 ++ } source; ++ char *data; ++} secuPWData; ++ + struct JSSL_SocketData { + PRFileDesc *fd; + jobject socketObject; /* weak global ref */ +@@ -120,4 +139,14 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv); + + void JSSL_throwSSLSocketException(JNIEnv *env, char *message); + ++int ++JSSL_getOCSPPolicy(); ++ ++ ++SECStatus ++JSSL_verifyCertPKIX(CERTCertificate *cert, ++ SECCertificateUsage certUsage, ++ secuPWData *pwdata, int ocspPolicy, ++ CERTVerifyLog *log,SECCertificateUsage *usage); ++ + #endif +diff --git a/org/mozilla/jss/util/java_ids.h b/org/mozilla/jss/util/java_ids.h +index 73b31fa9..4053d9a7 100644 +--- a/org/mozilla/jss/util/java_ids.h ++++ b/org/mozilla/jss/util/java_ids.h +@@ -276,6 +276,15 @@ PR_BEGIN_EXTERN_C + #define GET_RECV_BUF_SIZE "getReceiveBufferSize" + #define GET_BUF_SIZE_SIG "()I" + ++/* ++ * CryptoManager ++ * ++*/ ++ ++#define CRYPTO_MANAGER_NAME "org/mozilla/jss/CryptoManager" ++#define GET_OCSP_POLICY_NAME "getOCSPPolicy" ++#define GET_OCSP_POLICY_SIG "()I" ++ + /* + * SocketBase + */ diff --git a/jss-aia-ocsp-2.patch b/jss-aia-ocsp-2.patch new file mode 100644 index 0000000..c6b2f1c --- /dev/null +++ b/jss-aia-ocsp-2.patch @@ -0,0 +1,141 @@ +From 1fe6a451ec0c3ec960ac1119b39c406d999da5ec Mon Sep 17 00:00:00 2001 +From: Jack Magne +Date: Fri, 8 Feb 2019 11:21:48 -0800 +Subject: [PATCH] Additional: Resolve Bug 1666872 - CC: Enable AIA OCSP cert + checking for entire cert chain. + +Simple fix to make sure we are using the correct variant of the NSS cert usage quantity. + +It turns out some calls need a SECCertUsage and others need a SECCertificateUsage. +We also need to convert between the two in certain instances. + +Found and fixed double certificate object free issue. +--- + org/mozilla/jss/ssl/callbacks.c | 10 ++++++++-- + org/mozilla/jss/ssl/common.c | 19 ++++++++++++++----- + org/mozilla/jss/ssl/jssl.h | 2 +- + 3 files changed, 23 insertions(+), 8 deletions(-) + +diff --git a/org/mozilla/jss/ssl/callbacks.c b/org/mozilla/jss/ssl/callbacks.c +index 42594a14..4fe08a29 100644 +--- a/org/mozilla/jss/ssl/callbacks.c ++++ b/org/mozilla/jss/ssl/callbacks.c +@@ -481,6 +481,9 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, + + certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; + ++ /* PKIX call needs a SECCertificate usage, convert */ ++ SECCertificateUsage certificateUsage = (SECCertificateUsage)1 << certUsage; ++ + /* SSL_PeerCertificate() returns a shallow copy of the cert, so we + must destroy it before we exit this function */ + +@@ -488,7 +491,7 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, + + if (peerCert) { + if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { +- rv = JSSL_verifyCertPKIX( peerCert, certUsage, ++ rv = JSSL_verifyCertPKIX( peerCert, certificateUsage, + NULL /* pin arg */, ocspPolicy, NULL, NULL); + } else { + rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert, +@@ -624,6 +627,9 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, + if (peerCert == NULL) goto finish; + + certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; ++ /* PKIX call needs a SECCertificate usage, convert */ ++ SECCertificateUsage certificateUsage = (SECCertificateUsage)1 << certUsage; ++ + + /* + * verify it against current time - (can't use +@@ -632,7 +638,7 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, + */ + + if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { +- verificationResult = JSSL_verifyCertPKIX( peerCert, certUsage, ++ verificationResult = JSSL_verifyCertPKIX( peerCert, certificateUsage, + NULL /* pin arg */, ocspPolicy, &log, NULL); + } else { + verificationResult = CERT_VerifyCert( CERT_GetDefaultCertDB(), +diff --git a/org/mozilla/jss/ssl/common.c b/org/mozilla/jss/ssl/common.c +index aec88552..cb281798 100644 +--- a/org/mozilla/jss/ssl/common.c ++++ b/org/mozilla/jss/ssl/common.c +@@ -894,7 +894,7 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv) + /* Get the trusted anchor for pkix */ + + CERTCertificate * getRoot(CERTCertificate *cert, +- SECCertificateUsage certUsage) ++ SECCertUsage certUsage) + { + CERTCertificate *root = NULL; + CERTCertListNode *node = NULL; +@@ -936,7 +936,7 @@ CERTCertificate * getRoot(CERTCertificate *cert, + */ + + SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, +- SECCertificateUsage certUsage,secuPWData *pwdata, int ocspPolicy, ++ SECCertificateUsage certificateUsage,secuPWData *pwdata, int ocspPolicy, + CERTVerifyLog *log, SECCertificateUsage *usage) + { + +@@ -993,6 +993,8 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, + + PRBool fetchCerts = PR_FALSE; + ++ SECCertUsage certUsage = certUsageSSLClient /* 0 */; ++ + SECStatus res = SECFailure; + if(cert == NULL) { + goto finish; +@@ -1027,9 +1029,15 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, + cvin[inParamIndex].value.pointer.revocation = rev; + inParamIndex++; + +- + /* establish trust anchor */ + ++ /* We need to convert the SECCertificateUsage to a SECCertUsage to obtain ++ * the root. ++ */ ++ ++ SECCertificateUsage testUsage = certificateUsage; ++ while (0 != (testUsage = testUsage >> 1)) { certUsage++; } ++ + CERTCertificate *root = getRoot(cert,certUsage); + + /* Try to add the root as the trust anchor so all the +@@ -1064,7 +1072,7 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, + + cvout[outParamIndex].type = cert_po_end; + +- res = CERT_PKIXVerifyCert(cert, certUsage, cvin, cvout, &pwdata); ++ res = CERT_PKIXVerifyCert(cert, certificateUsage, cvin, cvout, &pwdata); + + finish: + /* clean up any trusted cert list */ +@@ -1074,8 +1082,9 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, + trustedCertList = NULL; + } + ++ /* CERT_DestroyCertList destroys interior certs for us. */ ++ + if(root) { +- CERT_DestroyCertificate(root); + root = NULL; + } + +diff --git a/org/mozilla/jss/ssl/jssl.h b/org/mozilla/jss/ssl/jssl.h +index 0e93eebe..925e1225 100644 +--- a/org/mozilla/jss/ssl/jssl.h ++++ b/org/mozilla/jss/ssl/jssl.h +@@ -145,7 +145,7 @@ JSSL_getOCSPPolicy(); + + SECStatus + JSSL_verifyCertPKIX(CERTCertificate *cert, +- SECCertificateUsage certUsage, ++ SECCertificateUsage certificateUsage, + secuPWData *pwdata, int ocspPolicy, + CERTVerifyLog *log,SECCertificateUsage *usage); + diff --git a/jss.spec b/jss.spec index f2fb9a3..3350170 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.5.3 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 2%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -26,6 +26,8 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +Patch0: jss-aia-ocsp-1.patch +Patch1: jss-aia-ocsp-2.patch ################################################################################ # Build Dependencies @@ -157,6 +159,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Mon May 06 2019 Dogtag PKI Team - 4.5.3-2 +- Add AIA OCSP certificate checking patch + * Tue Mar 19 2019 Dogtag PKI Team - 4.5.3-1 - Rebase to JSS 4.5.3 From 95aa5c2e25915e005addbee418f0f654d69c03d3 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 8 Aug 2019 12:04:10 -0400 Subject: [PATCH 08/11] Rebase to upstream JSS v4.6.1 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 24 ++++++++++++++---------- sources | 2 +- 3 files changed, 16 insertions(+), 11 deletions(-) diff --git a/.gitignore b/.gitignore index fcc1b5d..1c7e1b3 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,4 @@ jss-4.2.6.tar.gz /jss-4.5.1.tar.gz /jss-4.5.2.tar.gz /jss-4.5.3.tar.gz +/jss-4.6.1.tar.gz diff --git a/jss.spec b/jss.spec index 3350170..6221c3d 100644 --- a/jss.spec +++ b/jss.spec @@ -6,18 +6,17 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.5.3 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.1 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git # $ cd jss -# $ git archive \ -# --format=tar.gz \ -# --prefix jss-VERSION/ \ -# -o jss-VERSION.tar.gz \ -# +# $ git tag v4.5. +# $ git push origin v4.5. +# Then go to https://github.com/dogtagpki/jss/releases and download the source +# tarball. Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phase}/%{name}-%{version}%{?_phase}.tar.gz # To create a patch for all changes since a version tag: @@ -26,8 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: jss-aia-ocsp-1.patch -Patch1: jss-aia-ocsp-2.patch ################################################################################ # Build Dependencies @@ -109,6 +106,9 @@ export BUILD_OPT=1 CFLAGS="-g $RPM_OPT_FLAGS" export CFLAGS +# Check if we're in FIPS mode +modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 + # The Makefile is not thread-safe rm -rf build && mkdir -p build && cd build %cmake \ @@ -116,7 +116,8 @@ rm -rf build && mkdir -p build && cd build -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ .. -%{__make} all javadoc +%{__make} all +%{__make} javadoc || true ctest --output-on-failure ################################################################################ @@ -159,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-1 +- Rebase to JSS 4.6.1 + * Mon May 06 2019 Dogtag PKI Team - 4.5.3-2 - Add AIA OCSP certificate checking patch diff --git a/sources b/sources index 8c326c0..99c1894 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.5.3.tar.gz) = 6a5d5065803a36a42f15c19fa870edf4844d650911c690a8033288ee0e2e6e115868de39a7c9c955e068568a859baf5fb3e8e970b4167dfc19782bb661ab6d71 +SHA512 (jss-4.6.1.tar.gz) = 7a7eb02e98a22d0817aec34cff32ac942545885c84992812d116b683fa31c12d0fb9b8aa3b8757ab234f9980993fb933d6556c959935cd5e09ca7468d8729c8a From 7185dd301145c717e3d1989d76d74bb1144b8544 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 8 Aug 2019 12:48:44 -0400 Subject: [PATCH 09/11] Disable async io tests NSS on s390x is broken: https://bugzilla.redhat.com/show_bug.cgi?id=1730109 Ignore the problem by disabling some tests. Signed-off-by: Alexander Scheel --- 0001-Disable-buffer-based-tests.patch | 78 +++++++++++++++++++++++++++ jss.spec | 6 ++- 2 files changed, 83 insertions(+), 1 deletion(-) create mode 100644 0001-Disable-buffer-based-tests.patch diff --git a/0001-Disable-buffer-based-tests.patch b/0001-Disable-buffer-based-tests.patch new file mode 100644 index 0000000..c432844 --- /dev/null +++ b/0001-Disable-buffer-based-tests.patch @@ -0,0 +1,78 @@ +From ab1ba593ac9965607e60a16f3e5e75ba9ccfb505 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Thu, 8 Aug 2019 12:35:28 -0400 +Subject: [PATCH] Disable failing tests on special arches + +Signed-off-by: Alexander Scheel +--- + cmake/JSSTests.cmake | 40 ---------------------------------------- + 1 file changed, 40 deletions(-) + +diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake +index 9397f45d..ae6b0d22 100644 +--- a/cmake/JSSTests.cmake ++++ b/cmake/JSSTests.cmake +@@ -78,19 +78,6 @@ macro(jss_tests) + NAME "BigObjectIdentifier" + COMMAND "org.mozilla.jss.tests.BigObjectIdentifier" + ) +- jss_test_java( +- NAME "JSS_Test_PR_FileDesc" +- COMMAND "org.mozilla.jss.tests.TestPRFD" +- ) +- jss_test_java( +- NAME "JSS_Test_Raw_SSL" +- COMMAND "org.mozilla.jss.tests.TestRawSSL" "${RESULTS_NSSDB_OUTPUT_DIR}" +- DEPENDS "Setup_DBs" +- ) +- jss_test_java( +- NAME "JSS_Test_Buffer" +- COMMAND "org.mozilla.jss.tests.TestBuffer" +- ) + if ((${Java_VERSION_MAJOR} EQUAL 1) AND (${Java_VERSION_MINOR} LESS 9)) + jss_test_java( + NAME "Test_PKCS11Constants.java_for_Sun_compatibility" +@@ -121,16 +108,6 @@ macro(jss_tests) + NAME "JUnit_UTF8StringTest" + COMMAND "org.junit.runner.JUnitCore" "org.mozilla.jss.tests.UTF8StringTest" + ) +- jss_test_exec( +- NAME "buffer_size_1" +- COMMAND "${BIN_OUTPUT_DIR}/buffer_size_1" +- DEPENDS "generate_c_buffer_size_1" +- ) +- jss_test_exec( +- NAME "buffer_size_4" +- COMMAND "${BIN_OUTPUT_DIR}/buffer_size_4" +- DEPENDS "generate_c_buffer_size_4" +- ) + jss_test_java( + NAME "JUnit_ChainSortingTest" + COMMAND "org.junit.runner.JUnitCore" "org.mozilla.jss.tests.ChainSortingTest" +@@ -253,23 +230,6 @@ macro(jss_tests) + DEPENDS "Setup_DBs" + ) + +- # SSL Engine related tests +- jss_test_exec( +- NAME "TestBufferPRFD_RSA" +- COMMAND "${BIN_OUTPUT_DIR}/TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" "Server_RSA" +- DEPENDS "List_CA_certs" "generate_c_TestBufferPRFD" +- ) +- jss_test_exec( +- NAME "TestBufferPRFD_ECDSA" +- COMMAND "${BIN_OUTPUT_DIR}/TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" "Server_ECDSA" +- DEPENDS "List_CA_certs" "generate_c_TestBufferPRFD" +- ) +- jss_test_java( +- NAME "JSS_Test_BufferPRFD" +- COMMAND "org.mozilla.jss.tests.TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" +- DEPENDS "List_CA_certs" +- ) +- + # FIPS-related tests + jss_test_java( + NAME "Enable_FipsMODE" +-- +2.21.0 + diff --git a/jss.spec b/jss.spec index 6221c3d..3411d0d 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.6.1 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 2%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,6 +25,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +Patch0: 0001-Disable-buffer-based-tests.patch ################################################################################ # Build Dependencies @@ -160,6 +161,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-2 +- Disable unnecessary tests to fix broken s390x + * Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-1 - Rebase to JSS 4.6.1 From af85f4b8bd4ce5598ccd6e92eac4e57389a2ba4d Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 15 Oct 2019 16:18:11 -0400 Subject: [PATCH 10/11] Rebase to upstream JSS v4.6.2 Fixes CVE-2019-14823 Signed-off-by: Alexander Scheel --- .gitignore | 1 + 0001-Disable-buffer-based-tests.patch | 78 --------------------------- jss.spec | 9 ++-- sources | 2 +- 4 files changed, 8 insertions(+), 82 deletions(-) delete mode 100644 0001-Disable-buffer-based-tests.patch diff --git a/.gitignore b/.gitignore index 1c7e1b3..5981ea6 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,4 @@ jss-4.2.6.tar.gz /jss-4.5.2.tar.gz /jss-4.5.3.tar.gz /jss-4.6.1.tar.gz +/jss-4.6.2.tar.gz diff --git a/0001-Disable-buffer-based-tests.patch b/0001-Disable-buffer-based-tests.patch deleted file mode 100644 index c432844..0000000 --- a/0001-Disable-buffer-based-tests.patch +++ /dev/null @@ -1,78 +0,0 @@ -From ab1ba593ac9965607e60a16f3e5e75ba9ccfb505 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Thu, 8 Aug 2019 12:35:28 -0400 -Subject: [PATCH] Disable failing tests on special arches - -Signed-off-by: Alexander Scheel ---- - cmake/JSSTests.cmake | 40 ---------------------------------------- - 1 file changed, 40 deletions(-) - -diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake -index 9397f45d..ae6b0d22 100644 ---- a/cmake/JSSTests.cmake -+++ b/cmake/JSSTests.cmake -@@ -78,19 +78,6 @@ macro(jss_tests) - NAME "BigObjectIdentifier" - COMMAND "org.mozilla.jss.tests.BigObjectIdentifier" - ) -- jss_test_java( -- NAME "JSS_Test_PR_FileDesc" -- COMMAND "org.mozilla.jss.tests.TestPRFD" -- ) -- jss_test_java( -- NAME "JSS_Test_Raw_SSL" -- COMMAND "org.mozilla.jss.tests.TestRawSSL" "${RESULTS_NSSDB_OUTPUT_DIR}" -- DEPENDS "Setup_DBs" -- ) -- jss_test_java( -- NAME "JSS_Test_Buffer" -- COMMAND "org.mozilla.jss.tests.TestBuffer" -- ) - if ((${Java_VERSION_MAJOR} EQUAL 1) AND (${Java_VERSION_MINOR} LESS 9)) - jss_test_java( - NAME "Test_PKCS11Constants.java_for_Sun_compatibility" -@@ -121,16 +108,6 @@ macro(jss_tests) - NAME "JUnit_UTF8StringTest" - COMMAND "org.junit.runner.JUnitCore" "org.mozilla.jss.tests.UTF8StringTest" - ) -- jss_test_exec( -- NAME "buffer_size_1" -- COMMAND "${BIN_OUTPUT_DIR}/buffer_size_1" -- DEPENDS "generate_c_buffer_size_1" -- ) -- jss_test_exec( -- NAME "buffer_size_4" -- COMMAND "${BIN_OUTPUT_DIR}/buffer_size_4" -- DEPENDS "generate_c_buffer_size_4" -- ) - jss_test_java( - NAME "JUnit_ChainSortingTest" - COMMAND "org.junit.runner.JUnitCore" "org.mozilla.jss.tests.ChainSortingTest" -@@ -253,23 +230,6 @@ macro(jss_tests) - DEPENDS "Setup_DBs" - ) - -- # SSL Engine related tests -- jss_test_exec( -- NAME "TestBufferPRFD_RSA" -- COMMAND "${BIN_OUTPUT_DIR}/TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" "Server_RSA" -- DEPENDS "List_CA_certs" "generate_c_TestBufferPRFD" -- ) -- jss_test_exec( -- NAME "TestBufferPRFD_ECDSA" -- COMMAND "${BIN_OUTPUT_DIR}/TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" "Server_ECDSA" -- DEPENDS "List_CA_certs" "generate_c_TestBufferPRFD" -- ) -- jss_test_java( -- NAME "JSS_Test_BufferPRFD" -- COMMAND "org.mozilla.jss.tests.TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" -- DEPENDS "List_CA_certs" -- ) -- - # FIPS-related tests - jss_test_java( - NAME "Enable_FipsMODE" --- -2.21.0 - diff --git a/jss.spec b/jss.spec index 3411d0d..66ad7ad 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.1 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.2 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Disable-buffer-based-tests.patch ################################################################################ # Build Dependencies @@ -161,6 +160,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Oct 15 2019 Dogtag PKI Team - 4.6.2-1 +- Rebase to JSS 4.6.2 +- Fixes CVE-2019-14823 + * Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-2 - Disable unnecessary tests to fix broken s390x diff --git a/sources b/sources index 99c1894..32f2840 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.1.tar.gz) = 7a7eb02e98a22d0817aec34cff32ac942545885c84992812d116b683fa31c12d0fb9b8aa3b8757ab234f9980993fb933d6556c959935cd5e09ca7468d8729c8a +SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd From 7595f5dbe07fc66adfd084192112a1e85534d7b2 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 29 Oct 2019 10:56:50 -0400 Subject: [PATCH 11/11] Fix creation of NativeProxy Resolves: rhbz#1766451 Signed-off-by: Alexander Scheel --- 0001-Fix-NativeProxy-reference-tracker.patch | 53 ++ jss-aia-ocsp-1.patch | 659 ------------------- jss-aia-ocsp-2.patch | 141 ---- jss.spec | 6 +- 4 files changed, 58 insertions(+), 801 deletions(-) create mode 100644 0001-Fix-NativeProxy-reference-tracker.patch delete mode 100644 jss-aia-ocsp-1.patch delete mode 100644 jss-aia-ocsp-2.patch diff --git a/0001-Fix-NativeProxy-reference-tracker.patch b/0001-Fix-NativeProxy-reference-tracker.patch new file mode 100644 index 0000000..529b576 --- /dev/null +++ b/0001-Fix-NativeProxy-reference-tracker.patch @@ -0,0 +1,53 @@ +From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 29 Oct 2019 10:43:56 -0400 +Subject: [PATCH] Fix NativeProxy reference tracker + +In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by +setting mPointer after trying to add NativeProxy to the registry. In +most instances this won't matter, however, if another instance exists in +the HashSet with the same hash value, the equals comparator will be +used, triggering a NPE. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/util/NativeProxy.java | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java +index 1c6d1aa5..a0811f76 100644 +--- a/org/mozilla/jss/util/NativeProxy.java ++++ b/org/mozilla/jss/util/NativeProxy.java +@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable + */ + public NativeProxy(byte[] pointer) { + assert(pointer!=null); +- registry.add(this); + mPointer = pointer; ++ registry.add(this); + + if (saveStacktraces) { + mTrace = Arrays.toString(Thread.currentThread().getStackTrace()); +@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable + if( ! (obj instanceof NativeProxy) ) { + return false; + } +- if( ((NativeProxy)obj).mPointer.length != mPointer.length) { ++ if (((NativeProxy)obj).mPointer == null) { ++ /* If mPointer is null, we have no way to compare the values ++ * of the pointers, so assume they're unequal. */ + return false; + } +- for(int i=0; i < mPointer.length; i++) { +- if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) { +- return false; +- } +- } +- return true; ++ return Arrays.equals(((NativeProxy)obj).mPointer, mPointer); + } + + /** +-- +2.21.0 + diff --git a/jss-aia-ocsp-1.patch b/jss-aia-ocsp-1.patch deleted file mode 100644 index f20207c..0000000 --- a/jss-aia-ocsp-1.patch +++ /dev/null @@ -1,659 +0,0 @@ -From 8975c8ae1d0c8b916c5c73aff12046b01d3e6ef0 Mon Sep 17 00:00:00 2001 -From: Jack Magne -Date: Fri, 25 Jan 2019 14:54:11 -0800 -Subject: [PATCH] Resolve Bug 1666872 - CC: Enable AIA OCSP cert checking for - entire cert chain. - -This fix for jss, solves the one use case where the pki server is configured to perform ocsp checking ONLY with the contents of the AIA extension. Previously, jss could only check the ocsp server for the leaf node cert of the cert being verified. This fix allows the cert chain to be checked over ocsp for each cert in question. This is possible due to the fact that we have made a call in the PKIX library of nss to do the actual cert verfication. This call is made with all the needed flags to tell the PKIX library to make the ocsp verifications remotely over the network using the contents of the AIA extension. - -Later on we can use this code to handle the other cases, but for now we want to solve this one particular problem. If the server is configured in any other configuration than the one stated, the original verification code will be called as before. Below is an example of a configuration in server.xml, that will trigger this new code: - -< .... enableOCSP="true" ocspCacheSize="10000" ocspMinCacheEntryDuration="7200" .... > - -Note that due to ocsp caching, the cert chain verification may only be apparent after a restart of the server. A way to force an ocsp fetch every time is to set the value of ocspCacheSize=-1, which essentially disables the cache. - -Added a couple of minor fixes due to review comments. Possibly more to come. -Minor include directive change to compile on branch. ---- - org/mozilla/jss/CryptoManager.java | 48 +++++++ - org/mozilla/jss/PK11Finder.c | 95 ++++++++++++-- - org/mozilla/jss/ssl/callbacks.c | 67 ++++++++-- - org/mozilla/jss/ssl/common.c | 196 +++++++++++++++++++++++++++++ - org/mozilla/jss/ssl/jssl.h | 29 +++++ - org/mozilla/jss/util/java_ids.h | 9 ++ - 6 files changed, 422 insertions(+), 22 deletions(-) - -diff --git a/org/mozilla/jss/CryptoManager.java b/org/mozilla/jss/CryptoManager.java -index 9b86bf9e..c9a3fb2b 100644 ---- a/org/mozilla/jss/CryptoManager.java -+++ b/org/mozilla/jss/CryptoManager.java -@@ -1201,6 +1201,44 @@ private native boolean verifyCertTempNative(byte[] certPackage, - // OCSP management - /////////////////////////////////////////////////////////////////////// - -+ /* OCSP Policy related */ -+ -+ public enum OCSPPolicy { -+ NONE, -+ NORMAL, -+ LEAF_AND_CHAIN; -+ } -+ -+ private static OCSPPolicy ocspPolicy = OCSPPolicy.NONE; -+ -+ /** -+ * Gets the current ocsp Policy. -+ * Currently we only support 2 modes OCSP_LEAF_AND_CHAIN_POLICY. -+ * And OCSP_NORMAL_POLICY, which is current processing , by default. -+ * If we have AIA based OCSP enabled we will check all certs in the chain. -+ * using PKIX cert verfication calls in the various cert auth callbacks we -+ * have. -+ * @return - The current ocsp policy in effect. -+ */ -+ -+ public static synchronized int getOCSPPolicy() { -+ return ocspPolicy.ordinal(); -+ } -+ -+ /** -+ * Sets the current ocsp Policy. -+ * Currently we only support one mode OCSP_LEAF_AND_CHAIN_POLICY. -+ * If we have AIA based OCSP enabled we will check all certs in the chain. -+ * using PKIX cert verfication calls in the various cert auth callbacks we -+ * have. -+ * @param policy - Either cert and chain or normal default processing. -+ * -+ */ -+ -+ public static synchronized void setOCSPPolicy(OCSPPolicy policy) { -+ ocspPolicy = policy; -+ } -+ - /** - * Enables OCSP, note when you Initialize JSS for the first time, for - * backwards compatibility, the initialize will enable OCSP if you -@@ -1220,6 +1258,16 @@ public void configureOCSP( - String ocspResponderCertNickname ) - throws GeneralSecurityException - { -+ /* set the ocsp policy */ -+ -+ if(ocspCheckingEnabled && -+ ocspResponderURL == null && -+ ocspResponderCertNickname == null) { -+ setOCSPPolicy(OCSPPolicy.LEAF_AND_CHAIN); -+ } else { -+ setOCSPPolicy(OCSPPolicy.NORMAL); -+ } -+ - configureOCSPNative(ocspCheckingEnabled, - ocspResponderURL, - ocspResponderCertNickname ); -diff --git a/org/mozilla/jss/PK11Finder.c b/org/mozilla/jss/PK11Finder.c -index 45958181..0329e91d 100644 ---- a/org/mozilla/jss/PK11Finder.c -+++ b/org/mozilla/jss/PK11Finder.c -@@ -14,9 +14,9 @@ - #include - - #include -- - #include - #include "pk11util.h" -+#include "ssl/jssl.h" - #include - - /* -@@ -1574,6 +1574,9 @@ SECStatus verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString, - goto finish; - } - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ -+ - certificateUsage = required_certificateUsage; - - cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname); -@@ -1587,8 +1590,24 @@ SECStatus verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString, - /* 0 for certificateUsage in call to CERT_VerifyCertificateNow will - * retrieve the current valid usage into currUsage - */ -- rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certificateUsage, NULL, currUsage ); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( cert, certificateUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, currUsage); -+ -+ /* we need to do this just to get the cert usages, the pkix version -+ doesn't seem to honor the method to get the usages as of yet. -+ Let the PKIX call only determine the final fate. -+ */ -+ if(rv == SECSuccess) { -+ CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, currUsage ); -+ } -+ -+ } else { -+ rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, currUsage ); -+ } -+ - if ((rv == SECSuccess) && certificateUsage == 0x0000) { - if (*currUsage == - ( certUsageUserCertImport | -@@ -1639,6 +1658,8 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative(JNIEnv *env, - goto finish; - } - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - certificateUsage = required_certificateUsage; - - cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname); -@@ -1653,8 +1674,23 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative(JNIEnv *env, - * just get the current usage (which we are not passing back for now - * but will bypass the certificate usage check - */ -- rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certificateUsage, NULL, &currUsage ); -+ -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv= JSSL_verifyCertPKIX( cert, certificateUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, &currUsage); -+ -+ /* we need to do this just to get the cert usages, the pkix version -+ doesn't seem to honor the method to get the usages as of yet. -+ Let the PKIX call only determine the final fate. -+ */ -+ if(rv == SECSuccess) { -+ CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage ); -+ } -+ } else { -+ rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage ); -+ } - } - - finish: -@@ -1720,12 +1756,14 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative2(JNIEnv *env, - SECStatus rv = SECFailure; - CERTCertificate *cert = NULL; - char *nickname = NULL; -- -+ - if (nickString == NULL) { - JSS_throwMsg(env, INVALID_NICKNAME_EXCEPTION, "Missing certificate nickname"); - goto finish; - } - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - nickname = (char *) (*env)->GetStringUTFChars(env, nickString, NULL); - if (nickname == NULL) { - JSS_throwMsg(env, INVALID_NICKNAME_EXCEPTION, "Missing certificate nickname"); -@@ -1747,8 +1785,25 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative2(JNIEnv *env, - /* 0 for certificateUsage in call to CERT_VerifyCertificateNow will - * retrieve the current valid usage into currUsage - */ -- rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certificateUsage, NULL, &currUsage); -+ -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( cert, certificateUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, &currUsage); -+ -+ /* we need to do this just to get the cert usages, the pkix version -+ doesn't seem to honor the method to get the usages as of yet. -+ Let the PKIX call only determine the final fate. -+ */ -+ if(rv == SECSuccess) { -+ CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage ); -+ -+ } -+ -+ } else { -+ rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage); -+ } - - if (rv != SECSuccess) { - JSS_throwMsgPrErr(env, CERTIFICATE_EXCEPTION, "Invalid certificate"); -@@ -1803,6 +1858,9 @@ Java_org_mozilla_jss_CryptoManager_verifyCertNowNative(JNIEnv *env, - if( nickname == NULL ) { - goto finish; - } -+ -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - certUsage = cUsage; - cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname); - -@@ -1812,8 +1870,13 @@ Java_org_mozilla_jss_CryptoManager_verifyCertNowNative(JNIEnv *env, - PR_smprintf_free(message); - goto finish; - } else { -- rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certUsage, NULL ); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( cert, certUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, NULL); -+ } else { -+ rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certUsage, NULL ); -+ } - } - - finish: -@@ -1858,6 +1921,8 @@ Java_org_mozilla_jss_CryptoManager_verifyCertTempNative(JNIEnv *env, - derCerts[0] = JSS_ByteArrayToSECItem(env, packageArray); - derCerts[1] = NULL; - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - rv = CERT_ImportCerts(certdb, cUsage, - 1, derCerts, &certArray, PR_FALSE /*temp Certs*/, - PR_FALSE /*caOnly*/, NULL); -@@ -1869,8 +1934,14 @@ Java_org_mozilla_jss_CryptoManager_verifyCertTempNative(JNIEnv *env, - } - - certUsage = cUsage; -- rv = CERT_VerifyCertNow(certdb, certArray[0], -- checkSig, certUsage, NULL ); -+ -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( certArray[0], certUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, NULL); -+ } else { -+ rv = CERT_VerifyCertNow(certdb, certArray[0], -+ checkSig, certUsage, NULL ); -+ } - - finish: - /* this checks for NULL */ -diff --git a/org/mozilla/jss/ssl/callbacks.c b/org/mozilla/jss/ssl/callbacks.c -index 634f31ec..42594a14 100644 ---- a/org/mozilla/jss/ssl/callbacks.c -+++ b/org/mozilla/jss/ssl/callbacks.c -@@ -20,6 +20,40 @@ - #include - #include - -+int -+JSSL_getOCSPPolicy() { -+ JNIEnv *env; -+ jint policy = -1; -+ -+ jmethodID getOCSPPolicyID; -+ jclass cryptoManagerClass; -+ -+ /* get the JNI environment */ -+ if((*JSS_javaVM)->AttachCurrentThread(JSS_javaVM, (void**)&env, NULL) != 0){ -+ PR_ASSERT(PR_FALSE); -+ goto finish; -+ } -+ -+ cryptoManagerClass = (*env)->FindClass(env, CRYPTO_MANAGER_NAME); -+ if( cryptoManagerClass == NULL ) { -+ ASSERT_OUTOFMEM(env); -+ goto finish; -+ } -+ getOCSPPolicyID = (*env)->GetStaticMethodID(env, cryptoManagerClass, -+ GET_OCSP_POLICY_NAME,GET_OCSP_POLICY_SIG); -+ -+ if( getOCSPPolicyID == NULL ) { -+ ASSERT_OUTOFMEM(env); -+ goto finish; -+ } -+ -+ policy = (*env)->CallStaticIntMethod(env, cryptoManagerClass, -+ getOCSPPolicyID); -+ -+finish: -+ return (int) policy; -+} -+ - static SECStatus - secCmpCertChainWCANames(CERTCertificate *cert, CERTDistNames *caNames) - { -@@ -443,8 +477,9 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - SECCertUsage certUsage; - CERTCertificate *peerCert=NULL; - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; -- - - /* SSL_PeerCertificate() returns a shallow copy of the cert, so we - must destroy it before we exit this function */ -@@ -452,8 +487,13 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - peerCert = SSL_PeerCertificate(fd); - - if (peerCert) { -- rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert, -- checkSig, certUsage, NULL /*pinarg*/); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( peerCert, certUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, NULL); -+ } else { -+ rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert, -+ checkSig, certUsage, NULL /*pinarg*/); -+ } - } - - /* if we're a server, then we don't need to check the CN of the -@@ -569,6 +609,8 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - log.tail = NULL; - log.count = 0; - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - /* get the JNI environment */ - if((*JSS_javaVM)->AttachCurrentThread(JSS_javaVM, (void**)&env, NULL) != 0){ - PR_ASSERT(PR_FALSE); -@@ -589,13 +631,18 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - * logging parameter) - */ - -- verificationResult = CERT_VerifyCert( CERT_GetDefaultCertDB(), -- peerCert, -- checkSig, -- certUsage, -- PR_Now(), -- NULL /*pinarg*/, -- &log); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ verificationResult = JSSL_verifyCertPKIX( peerCert, certUsage, -+ NULL /* pin arg */, ocspPolicy, &log, NULL); -+ } else { -+ verificationResult = CERT_VerifyCert( CERT_GetDefaultCertDB(), -+ peerCert, -+ checkSig, -+ certUsage, -+ PR_Now(), -+ NULL /*pinarg*/, -+ &log); -+ } - - if (verificationResult == SECSuccess && log.count > 0) { - verificationResult = SECFailure; -diff --git a/org/mozilla/jss/ssl/common.c b/org/mozilla/jss/ssl/common.c -index 5c6efa85..aec88552 100644 ---- a/org/mozilla/jss/ssl/common.c -+++ b/org/mozilla/jss/ssl/common.c -@@ -15,6 +15,7 @@ - #include - #include "_jni/org_mozilla_jss_ssl_SSLSocket.h" - #include "jssl.h" -+#include "cert.h" - - #ifdef WIN32 - #include -@@ -889,3 +890,198 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv) - PR_ASSERT(ret == 0); - } - } -+ -+/* Get the trusted anchor for pkix */ -+ -+CERTCertificate * getRoot(CERTCertificate *cert, -+ SECCertificateUsage certUsage) -+{ -+ CERTCertificate *root = NULL; -+ CERTCertListNode *node = NULL; -+ -+ if( !cert ) { -+ goto finish; -+ } -+ -+ CERTCertList *certList = CERT_GetCertChainFromCert(cert, -+ PR_Now(), -+ certUsage); -+ -+ if( certList == NULL) { -+ goto finish; -+ } -+ -+ for (node = CERT_LIST_HEAD(certList); -+ !CERT_LIST_END(node, certList); -+ node = CERT_LIST_NEXT(node)) { -+ -+ /* try to find the root */ -+ if( node->cert && node->cert->isRoot ) { -+ root = CERT_DupCertificate(node->cert) ; -+ } -+ } -+ -+finish: -+ -+ CERT_DestroyCertList (certList); -+ return root; -+} -+ -+/* Verify a cert using explicit PKIX call. -+ * For now only used in OCSP AIA context. -+ * The result of this call will be a full chain -+ * and leaf network AIA ocsp validation. -+ * The policy param will be used in the future to -+ * handle more scenarios. -+ */ -+ -+SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, -+ SECCertificateUsage certUsage,secuPWData *pwdata, int ocspPolicy, -+ CERTVerifyLog *log, SECCertificateUsage *usage) -+{ -+ -+ /* put the first set of possible flags internally here first */ -+ /* later there could be a more complete list to choose from */ -+ /* support our hard core fetch aia ocsp policy for now */ -+ -+ static PRUint64 ocsp_Enabled_Hard_Policy_LeafFlags[2] = { -+ /* crl */ -+ 0, -+ /* ocsp */ -+ CERT_REV_M_TEST_USING_THIS_METHOD | -+ CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO -+ }; -+ -+ static PRUint64 ocsp_Enabled_Hard_Policy_ChainFlags[2] = { -+ /* crl */ -+ 0, -+ /* ocsp */ -+ CERT_REV_M_TEST_USING_THIS_METHOD | -+ CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO -+ }; -+ -+ static CERTRevocationMethodIndex -+ ocsp_Enabled_Hard_Policy_Method_Preference = { -+ cert_revocation_method_ocsp -+ }; -+ -+ static CERTRevocationFlags ocsp_Enabled_Hard_Policy = { -+ { /* leafTests */ -+ 2, -+ ocsp_Enabled_Hard_Policy_LeafFlags, -+ 1, -+ &ocsp_Enabled_Hard_Policy_Method_Preference, -+ 0 }, -+ { /* chainTests */ -+ 2, -+ ocsp_Enabled_Hard_Policy_ChainFlags, -+ 1, -+ &ocsp_Enabled_Hard_Policy_Method_Preference, -+ 0 } -+ }; -+ -+ /* for future expansion */ -+ -+ CERTValOutParam cvout[20] = {0}; -+ CERTValInParam cvin[20] = {0}; -+ -+ int inParamIndex = 0; -+ int outParamIndex = 0; -+ CERTRevocationFlags *rev = NULL; -+ -+ CERTCertList *trustedCertList = NULL; -+ -+ PRBool fetchCerts = PR_FALSE; -+ -+ SECStatus res = SECFailure; -+ if(cert == NULL) { -+ goto finish; -+ } -+ -+ if(ocspPolicy != OCSP_LEAF_AND_CHAIN_POLICY) { -+ goto finish; -+ } -+ -+ /* Force the strict ocsp network check on chain -+ and leaf. -+ */ -+ -+ fetchCerts = PR_TRUE; -+ rev = &ocsp_Enabled_Hard_Policy; -+ -+ /* fetch aia over net */ -+ -+ cvin[inParamIndex].type = cert_pi_useAIACertFetch; -+ cvin[inParamIndex].value.scalar.b = fetchCerts; -+ inParamIndex++; -+ -+ /* time */ -+ -+ cvin[inParamIndex].type = cert_pi_date; -+ cvin[inParamIndex].value.scalar.time = PR_Now(); -+ inParamIndex++; -+ -+ /* flags */ -+ -+ cvin[inParamIndex].type = cert_pi_revocationFlags; -+ cvin[inParamIndex].value.pointer.revocation = rev; -+ inParamIndex++; -+ -+ -+ /* establish trust anchor */ -+ -+ CERTCertificate *root = getRoot(cert,certUsage); -+ -+ /* Try to add the root as the trust anchor so all the -+ other memebers of the ca chain will get validated. -+ */ -+ -+ if( root != NULL ) { -+ trustedCertList = CERT_NewCertList(); -+ CERT_AddCertToListTail(trustedCertList, root); -+ -+ cvin[inParamIndex].type = cert_pi_trustAnchors; -+ cvin[inParamIndex].value.pointer.chain = trustedCertList; -+ -+ inParamIndex++; -+ } -+ -+ cvin[inParamIndex].type = cert_pi_end; -+ -+ if(log != NULL) { -+ cvout[outParamIndex].type = cert_po_errorLog; -+ cvout[outParamIndex].value.pointer.log = log; -+ outParamIndex ++; -+ } -+ -+ int usageIndex = 0; -+ if(usage != NULL) { -+ usageIndex = outParamIndex; -+ cvout[outParamIndex].type = cert_po_usages; -+ cvout[outParamIndex].value.scalar.usages = 0; -+ outParamIndex ++; -+ } -+ -+ cvout[outParamIndex].type = cert_po_end; -+ -+ res = CERT_PKIXVerifyCert(cert, certUsage, cvin, cvout, &pwdata); -+ -+finish: -+ /* clean up any trusted cert list */ -+ -+ if (trustedCertList) { -+ CERT_DestroyCertList(trustedCertList); -+ trustedCertList = NULL; -+ } -+ -+ if(root) { -+ CERT_DestroyCertificate(root); -+ root = NULL; -+ } -+ -+ if(res == SECSuccess && usage) { -+ *usage = cvout[usageIndex].value.scalar.usages; -+ } -+ -+ return res; -+} -diff --git a/org/mozilla/jss/ssl/jssl.h b/org/mozilla/jss/ssl/jssl.h -index c15acf87..0e93eebe 100644 ---- a/org/mozilla/jss/ssl/jssl.h -+++ b/org/mozilla/jss/ssl/jssl.h -@@ -5,8 +5,27 @@ - #ifndef ORG_MOZILLA_JSS_SSL_JSSL_H - #define ORG_MOZILLA_JSS_SSL_JSSL_H - -+/* ocsp policy constants */ -+ -+/* ocsp policy constants */ -+static const int OCSP_NO_POLICY = 0; -+static const int OCSP_NORMAL_POLICY = 1; -+static const int OCSP_LEAF_AND_CHAIN_POLICY = 2; -+ - #include - -+typedef struct -+{ -+ enum -+ { -+ PW_NONE = 0, -+ PW_FROMFILE = 1, -+ PW_PLAINTEXT = 2, -+ PW_EXTERNAL = 3 -+ } source; -+ char *data; -+} secuPWData; -+ - struct JSSL_SocketData { - PRFileDesc *fd; - jobject socketObject; /* weak global ref */ -@@ -120,4 +139,14 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv); - - void JSSL_throwSSLSocketException(JNIEnv *env, char *message); - -+int -+JSSL_getOCSPPolicy(); -+ -+ -+SECStatus -+JSSL_verifyCertPKIX(CERTCertificate *cert, -+ SECCertificateUsage certUsage, -+ secuPWData *pwdata, int ocspPolicy, -+ CERTVerifyLog *log,SECCertificateUsage *usage); -+ - #endif -diff --git a/org/mozilla/jss/util/java_ids.h b/org/mozilla/jss/util/java_ids.h -index 73b31fa9..4053d9a7 100644 ---- a/org/mozilla/jss/util/java_ids.h -+++ b/org/mozilla/jss/util/java_ids.h -@@ -276,6 +276,15 @@ PR_BEGIN_EXTERN_C - #define GET_RECV_BUF_SIZE "getReceiveBufferSize" - #define GET_BUF_SIZE_SIG "()I" - -+/* -+ * CryptoManager -+ * -+*/ -+ -+#define CRYPTO_MANAGER_NAME "org/mozilla/jss/CryptoManager" -+#define GET_OCSP_POLICY_NAME "getOCSPPolicy" -+#define GET_OCSP_POLICY_SIG "()I" -+ - /* - * SocketBase - */ diff --git a/jss-aia-ocsp-2.patch b/jss-aia-ocsp-2.patch deleted file mode 100644 index c6b2f1c..0000000 --- a/jss-aia-ocsp-2.patch +++ /dev/null @@ -1,141 +0,0 @@ -From 1fe6a451ec0c3ec960ac1119b39c406d999da5ec Mon Sep 17 00:00:00 2001 -From: Jack Magne -Date: Fri, 8 Feb 2019 11:21:48 -0800 -Subject: [PATCH] Additional: Resolve Bug 1666872 - CC: Enable AIA OCSP cert - checking for entire cert chain. - -Simple fix to make sure we are using the correct variant of the NSS cert usage quantity. - -It turns out some calls need a SECCertUsage and others need a SECCertificateUsage. -We also need to convert between the two in certain instances. - -Found and fixed double certificate object free issue. ---- - org/mozilla/jss/ssl/callbacks.c | 10 ++++++++-- - org/mozilla/jss/ssl/common.c | 19 ++++++++++++++----- - org/mozilla/jss/ssl/jssl.h | 2 +- - 3 files changed, 23 insertions(+), 8 deletions(-) - -diff --git a/org/mozilla/jss/ssl/callbacks.c b/org/mozilla/jss/ssl/callbacks.c -index 42594a14..4fe08a29 100644 ---- a/org/mozilla/jss/ssl/callbacks.c -+++ b/org/mozilla/jss/ssl/callbacks.c -@@ -481,6 +481,9 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - - certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; - -+ /* PKIX call needs a SECCertificate usage, convert */ -+ SECCertificateUsage certificateUsage = (SECCertificateUsage)1 << certUsage; -+ - /* SSL_PeerCertificate() returns a shallow copy of the cert, so we - must destroy it before we exit this function */ - -@@ -488,7 +491,7 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - - if (peerCert) { - if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -- rv = JSSL_verifyCertPKIX( peerCert, certUsage, -+ rv = JSSL_verifyCertPKIX( peerCert, certificateUsage, - NULL /* pin arg */, ocspPolicy, NULL, NULL); - } else { - rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert, -@@ -624,6 +627,9 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - if (peerCert == NULL) goto finish; - - certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; -+ /* PKIX call needs a SECCertificate usage, convert */ -+ SECCertificateUsage certificateUsage = (SECCertificateUsage)1 << certUsage; -+ - - /* - * verify it against current time - (can't use -@@ -632,7 +638,7 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - */ - - if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -- verificationResult = JSSL_verifyCertPKIX( peerCert, certUsage, -+ verificationResult = JSSL_verifyCertPKIX( peerCert, certificateUsage, - NULL /* pin arg */, ocspPolicy, &log, NULL); - } else { - verificationResult = CERT_VerifyCert( CERT_GetDefaultCertDB(), -diff --git a/org/mozilla/jss/ssl/common.c b/org/mozilla/jss/ssl/common.c -index aec88552..cb281798 100644 ---- a/org/mozilla/jss/ssl/common.c -+++ b/org/mozilla/jss/ssl/common.c -@@ -894,7 +894,7 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv) - /* Get the trusted anchor for pkix */ - - CERTCertificate * getRoot(CERTCertificate *cert, -- SECCertificateUsage certUsage) -+ SECCertUsage certUsage) - { - CERTCertificate *root = NULL; - CERTCertListNode *node = NULL; -@@ -936,7 +936,7 @@ CERTCertificate * getRoot(CERTCertificate *cert, - */ - - SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, -- SECCertificateUsage certUsage,secuPWData *pwdata, int ocspPolicy, -+ SECCertificateUsage certificateUsage,secuPWData *pwdata, int ocspPolicy, - CERTVerifyLog *log, SECCertificateUsage *usage) - { - -@@ -993,6 +993,8 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - - PRBool fetchCerts = PR_FALSE; - -+ SECCertUsage certUsage = certUsageSSLClient /* 0 */; -+ - SECStatus res = SECFailure; - if(cert == NULL) { - goto finish; -@@ -1027,9 +1029,15 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - cvin[inParamIndex].value.pointer.revocation = rev; - inParamIndex++; - -- - /* establish trust anchor */ - -+ /* We need to convert the SECCertificateUsage to a SECCertUsage to obtain -+ * the root. -+ */ -+ -+ SECCertificateUsage testUsage = certificateUsage; -+ while (0 != (testUsage = testUsage >> 1)) { certUsage++; } -+ - CERTCertificate *root = getRoot(cert,certUsage); - - /* Try to add the root as the trust anchor so all the -@@ -1064,7 +1072,7 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - - cvout[outParamIndex].type = cert_po_end; - -- res = CERT_PKIXVerifyCert(cert, certUsage, cvin, cvout, &pwdata); -+ res = CERT_PKIXVerifyCert(cert, certificateUsage, cvin, cvout, &pwdata); - - finish: - /* clean up any trusted cert list */ -@@ -1074,8 +1082,9 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - trustedCertList = NULL; - } - -+ /* CERT_DestroyCertList destroys interior certs for us. */ -+ - if(root) { -- CERT_DestroyCertificate(root); - root = NULL; - } - -diff --git a/org/mozilla/jss/ssl/jssl.h b/org/mozilla/jss/ssl/jssl.h -index 0e93eebe..925e1225 100644 ---- a/org/mozilla/jss/ssl/jssl.h -+++ b/org/mozilla/jss/ssl/jssl.h -@@ -145,7 +145,7 @@ JSSL_getOCSPPolicy(); - - SECStatus - JSSL_verifyCertPKIX(CERTCertificate *cert, -- SECCertificateUsage certUsage, -+ SECCertificateUsage certificateUsage, - secuPWData *pwdata, int ocspPolicy, - CERTVerifyLog *log,SECCertificateUsage *usage); - diff --git a/jss.spec b/jss.spec index 66ad7ad..84ff66f 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.6.2 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 2%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,6 +25,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +Patch: 0001-Fix-NativeProxy-reference-tracker.patch ################################################################################ # Build Dependencies @@ -160,6 +161,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Oct 29 2019 Dogtag PKI Team - 4.6.2-2 +- Fix for rhbz#1766451 + * Tue Oct 15 2019 Dogtag PKI Team - 4.6.2-1 - Rebase to JSS 4.6.2 - Fixes CVE-2019-14823