From b25dab0464733ec174ed592bebe9c85f8c7801c9 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 28 Feb 2018 10:48:26 +0100 Subject: [PATCH 1/7] Update to 0.23.10-1 - Update to upstream 0.23.10 release --- .gitignore | 3 ++ p11-kit-server-eval-env.patch | 52 ----------------------------------- p11-kit.spec | 8 ++++-- sources | 2 +- 4 files changed, 9 insertions(+), 56 deletions(-) delete mode 100644 p11-kit-server-eval-env.patch diff --git a/.gitignore b/.gitignore index f2d8374..775a045 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,6 @@ /p11-kit-client.service /trust-extract-compat /p11-kit-0.23.9.tar.gz +/p11-kit-client.service +/trust-extract-compat +/p11-kit-0.23.10.tar.gz diff --git a/p11-kit-server-eval-env.patch b/p11-kit-server-eval-env.patch deleted file mode 100644 index cd2a812..0000000 --- a/p11-kit-server-eval-env.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 031912fa844c4f3da327c8b2578d9d9ce2a6473e Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Thu, 5 Oct 2017 10:59:02 +0200 -Subject: [PATCH] server: Make it possible to eval envvar settings - -Previously, calling "eval $(p11-kit server)" from shell hung because -the program didn't properly close stdout before forking. ---- - p11-kit/server.c | 20 +++++++++++--------- - 1 file changed, 11 insertions(+), 9 deletions(-) - -diff --git a/p11-kit/server.c b/p11-kit/server.c -index 97e18e2..96c77ec 100644 ---- a/p11-kit/server.c -+++ b/p11-kit/server.c -@@ -346,6 +346,17 @@ server_loop (Server *server, - if (server->socket == -1) - return 1; - -+ if (!quiet) { -+ char *path; -+ -+ path = p11_path_encode (server->socket_name); -+ printf ("P11_KIT_SERVER_ADDRESS=unix:path=%s\n", path); -+ free (path); -+ printf ("P11_KIT_SERVER_PID=%d\n", getpid ()); -+ fflush (stdout); -+ close (STDOUT_FILENO); -+ } -+ - /* run as daemon */ - if (!foreground) { - pid = fork (); -@@ -372,15 +383,6 @@ server_loop (Server *server, - - sigprocmask (SIG_BLOCK, &blockset, NULL); - -- if (!quiet) { -- char *path; -- -- path = p11_path_encode (server->socket_name); -- printf ("P11_KIT_SERVER_ADDRESS=unix:path=%s\n", path); -- free (path); -- printf ("P11_KIT_SERVER_PID=%d\n", getpid ()); -- } -- - /* accept connections */ - ret = 0; - for (;;) { --- -2.13.6 - diff --git a/p11-kit.spec b/p11-kit.spec index 6f2cb4c..3e7931d 100644 --- a/p11-kit.spec +++ b/p11-kit.spec @@ -1,7 +1,6 @@ # This spec file has been automatically updated -Version: 0.23.9 -Release: 3%{?dist} -Patch1: p11-kit-server-eval-env.patch +Version: 0.23.10 +Release: 1%{?dist} Name: p11-kit Summary: Library for loading and sharing PKCS#11 modules @@ -143,6 +142,9 @@ fi %changelog +* Wed Feb 28 2018 Daiki Ueno - 0.23.10-1 +- Update to upstream 0.23.10 release + * Thu Feb 08 2018 Fedora Release Engineering - 0.23.9-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild diff --git a/sources b/sources index e959f3c..3fa1635 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (p11-kit-client.service) = 0f08618851c6eafb35c630957044fc96324be4d3828cdd2aa9b5d6e1245549197ca5b969d6a2f735c893d73c02e885cdc3205bd43e37f6124ebc6cfa61970d3b SHA512 (trust-extract-compat) = 91210705f9bcf1a13c0de1ca9943e3ac68296bfcb7953fc59241de060247b470b39be6e914dd4d92e38a78d5df0962c83315ad78f8c0eade8e62d884b05fdd42 -SHA512 (p11-kit-0.23.9.tar.gz) = 6a8a569483763d3ffacadf669b8ba9b9be38a77dd8dc366ca0cb91c44753517fa1879d4422e4e8dfbcac594565727839a619566a170c0f94f8e112f18b0086ed +SHA512 (p11-kit-0.23.10.tar.gz) = 42a004613f951e4e18c10cd204bcba348267cc7b3ae0d9f26d69012b086af446947660575d5751539b8d4dd77fa9b684054ad5ac978119e0a2e94fcdf9842178 From 681bf8d74b730e57c6048ad605d6a14badbcf988 Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Thu, 8 Mar 2018 13:41:06 +0100 Subject: [PATCH 2/7] Add gcc to BuildRequires --- p11-kit.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/p11-kit.spec b/p11-kit.spec index 3e7931d..c224a27 100644 --- a/p11-kit.spec +++ b/p11-kit.spec @@ -10,6 +10,7 @@ Source0: https://github.com/p11-glue/p11-kit/releases/download/%{version} Source1: trust-extract-compat Source2: p11-kit-client.service +BuildRequires: gcc BuildRequires: libtasn1-devel >= 2.3 BuildRequires: libffi-devel BuildRequires: gtk-doc From 61ebbb0716115cec6ead7a6e5fafed123d95315a Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 30 May 2018 17:04:56 +0200 Subject: [PATCH 3/7] Update to 0.23.12-1 - Update to upstream 0.23.11 release --- .gitignore | 3 +++ p11-kit.spec | 6 ++++-- sources | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 775a045..13a4b49 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,6 @@ /p11-kit-client.service /trust-extract-compat /p11-kit-0.23.10.tar.gz +/p11-kit-client.service +/trust-extract-compat +/p11-kit-0.23.12.tar.gz diff --git a/p11-kit.spec b/p11-kit.spec index c224a27..7ba7277 100644 --- a/p11-kit.spec +++ b/p11-kit.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 0.23.10 +Version: 0.23.12 Release: 1%{?dist} Name: p11-kit Summary: Library for loading and sharing PKCS#11 modules @@ -10,7 +10,6 @@ Source0: https://github.com/p11-glue/p11-kit/releases/download/%{version} Source1: trust-extract-compat Source2: p11-kit-client.service -BuildRequires: gcc BuildRequires: libtasn1-devel >= 2.3 BuildRequires: libffi-devel BuildRequires: gtk-doc @@ -143,6 +142,9 @@ fi %changelog +* Wed May 30 2018 Daiki Ueno - 0.23.12-1 +- Update to upstream 0.23.11 release + * Wed Feb 28 2018 Daiki Ueno - 0.23.10-1 - Update to upstream 0.23.10 release diff --git a/sources b/sources index 3fa1635..477911e 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (p11-kit-client.service) = 0f08618851c6eafb35c630957044fc96324be4d3828cdd2aa9b5d6e1245549197ca5b969d6a2f735c893d73c02e885cdc3205bd43e37f6124ebc6cfa61970d3b SHA512 (trust-extract-compat) = 91210705f9bcf1a13c0de1ca9943e3ac68296bfcb7953fc59241de060247b470b39be6e914dd4d92e38a78d5df0962c83315ad78f8c0eade8e62d884b05fdd42 -SHA512 (p11-kit-0.23.10.tar.gz) = 42a004613f951e4e18c10cd204bcba348267cc7b3ae0d9f26d69012b086af446947660575d5751539b8d4dd77fa9b684054ad5ac978119e0a2e94fcdf9842178 +SHA512 (p11-kit-0.23.12.tar.gz) = ae43b1f6ba5400cf5ae7b64b8c93aa47e5c7ee927196828600fd88beb6fdf6bcb6a63bc822d356757255638f9fbf10896e0604e32a1332a9a833836fa0468726 From e7539200efe09c20eba3e5027cccbf9348ab63b9 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Thu, 7 Jun 2018 17:21:01 +0200 Subject: [PATCH 4/7] Restore BR: gcc, which was mistakenly removed --- p11-kit.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/p11-kit.spec b/p11-kit.spec index 7ba7277..6655950 100644 --- a/p11-kit.spec +++ b/p11-kit.spec @@ -10,6 +10,7 @@ Source0: https://github.com/p11-glue/p11-kit/releases/download/%{version} Source1: trust-extract-compat Source2: p11-kit-client.service +BuildRequires: gcc BuildRequires: libtasn1-devel >= 2.3 BuildRequires: libffi-devel BuildRequires: gtk-doc From efd69a0abe89155a3a0d1a300df5c5714758aa79 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 10 Sep 2018 10:45:35 +0200 Subject: [PATCH 5/7] Update to 0.23.14-1 - Update to upstream 0.23.14 release --- .gitignore | 3 +++ p11-kit.spec | 5 ++++- sources | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 13a4b49..092a8fb 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,6 @@ /p11-kit-client.service /trust-extract-compat /p11-kit-0.23.12.tar.gz +/p11-kit-client.service +/trust-extract-compat +/p11-kit-0.23.14.tar.gz diff --git a/p11-kit.spec b/p11-kit.spec index 6655950..4fa842f 100644 --- a/p11-kit.spec +++ b/p11-kit.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 0.23.12 +Version: 0.23.14 Release: 1%{?dist} Name: p11-kit Summary: Library for loading and sharing PKCS#11 modules @@ -143,6 +143,9 @@ fi %changelog +* Mon Sep 10 2018 Daiki Ueno - 0.23.14-1 +- Update to upstream 0.23.14 release + * Wed May 30 2018 Daiki Ueno - 0.23.12-1 - Update to upstream 0.23.11 release diff --git a/sources b/sources index 477911e..4a817b4 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (p11-kit-client.service) = 0f08618851c6eafb35c630957044fc96324be4d3828cdd2aa9b5d6e1245549197ca5b969d6a2f735c893d73c02e885cdc3205bd43e37f6124ebc6cfa61970d3b SHA512 (trust-extract-compat) = 91210705f9bcf1a13c0de1ca9943e3ac68296bfcb7953fc59241de060247b470b39be6e914dd4d92e38a78d5df0962c83315ad78f8c0eade8e62d884b05fdd42 -SHA512 (p11-kit-0.23.12.tar.gz) = ae43b1f6ba5400cf5ae7b64b8c93aa47e5c7ee927196828600fd88beb6fdf6bcb6a63bc822d356757255638f9fbf10896e0604e32a1332a9a833836fa0468726 +SHA512 (p11-kit-0.23.14.tar.gz) = fc7e7e0745d7f8e5d783a1f38bad9bbe65b56d54897b6ba2c3118a0d912451c2d48dd113a875e7f7bfcff8fbd6b4905472fcd120630661c12029a16d2b13add4 From 74f534411ed571e790678b7649c1917a25cb2662 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 21 Jan 2019 16:47:04 +0100 Subject: [PATCH 6/7] Update to 0.23.15-1 - Update to upstream 0.23.15 release --- .gitignore | 3 +++ p11-kit.spec | 5 ++++- sources | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 092a8fb..a6c0618 100644 --- a/.gitignore +++ b/.gitignore @@ -17,3 +17,6 @@ /p11-kit-client.service /trust-extract-compat /p11-kit-0.23.14.tar.gz +/p11-kit-client.service +/trust-extract-compat +/p11-kit-0.23.15.tar.gz diff --git a/p11-kit.spec b/p11-kit.spec index 4fa842f..ed5a050 100644 --- a/p11-kit.spec +++ b/p11-kit.spec @@ -1,5 +1,5 @@ # This spec file has been automatically updated -Version: 0.23.14 +Version: 0.23.15 Release: 1%{?dist} Name: p11-kit Summary: Library for loading and sharing PKCS#11 modules @@ -143,6 +143,9 @@ fi %changelog +* Mon Jan 21 2019 Daiki Ueno - 0.23.15-1 +- Update to upstream 0.23.15 release + * Mon Sep 10 2018 Daiki Ueno - 0.23.14-1 - Update to upstream 0.23.14 release diff --git a/sources b/sources index 4a817b4..cb7930a 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (p11-kit-client.service) = 0f08618851c6eafb35c630957044fc96324be4d3828cdd2aa9b5d6e1245549197ca5b969d6a2f735c893d73c02e885cdc3205bd43e37f6124ebc6cfa61970d3b SHA512 (trust-extract-compat) = 91210705f9bcf1a13c0de1ca9943e3ac68296bfcb7953fc59241de060247b470b39be6e914dd4d92e38a78d5df0962c83315ad78f8c0eade8e62d884b05fdd42 -SHA512 (p11-kit-0.23.14.tar.gz) = fc7e7e0745d7f8e5d783a1f38bad9bbe65b56d54897b6ba2c3118a0d912451c2d48dd113a875e7f7bfcff8fbd6b4905472fcd120630661c12029a16d2b13add4 +SHA512 (p11-kit-0.23.15.tar.gz) = d703eec12626b79551ce337521f7ea7b1a0b64c211d7a93d831dd28ec1de77c7b58358c1588bf82d70f047c01ad9433fa8a286d1a25ae3f6b0ee6016b8c42950 From 941acef772f9d5b99f596784ca08b331ac4e8c82 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 18 Feb 2019 18:33:49 +0100 Subject: [PATCH 7/7] trust: Ignore unreadable content in anchors Fixes rhbz#1675441 --- ...Ignore-unreadable-content-in-anchors.patch | 181 ++++++++++++++++++ p11-kit.spec | 6 +- 2 files changed, 186 insertions(+), 1 deletion(-) create mode 100644 0001-trust-Ignore-unreadable-content-in-anchors.patch diff --git a/0001-trust-Ignore-unreadable-content-in-anchors.patch b/0001-trust-Ignore-unreadable-content-in-anchors.patch new file mode 100644 index 0000000..cb65e24 --- /dev/null +++ b/0001-trust-Ignore-unreadable-content-in-anchors.patch @@ -0,0 +1,181 @@ +From e2170b295992cb7fdf115227a78028ac3780619f Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Mon, 18 Feb 2019 14:53:49 +0100 +Subject: [PATCH] trust: Ignore unreadable content in anchors + +This amends eb503f3a1467f21a5ecc9ae84ae23b216afc102f. Instead of +failing C_FindObjectsInit, treat any errors internally and accumulates +the successfully loaded certificates. + +Reported by Andrej Kvasnica in: +https://bugzilla.redhat.com/show_bug.cgi?id=1675441 +--- + trust/module.c | 3 +- + trust/test-module.c | 77 +++++++++++++++++++++++++++++++++++++++++++++ + trust/token.c | 23 ++++++-------- + 3 files changed, 88 insertions(+), 15 deletions(-) + +diff --git a/trust/module.c b/trust/module.c +index 1722340..ec3333d 100644 +--- a/trust/module.c ++++ b/trust/module.c +@@ -1198,8 +1198,7 @@ sys_C_FindObjectsInit (CK_SESSION_HANDLE handle, + indices[n++] = session->index; + if (want_token_objects) { + if (!session->loaded) +- if (p11_token_load (session->token) < 0) +- rv = CKR_FUNCTION_FAILED; ++ p11_token_load (session->token); + if (rv == CKR_OK) { + session->loaded = CK_TRUE; + indices[n++] = p11_token_index (session->token); +diff --git a/trust/test-module.c b/trust/test-module.c +index 1e8d812..4024d81 100644 +--- a/trust/test-module.c ++++ b/trust/test-module.c +@@ -163,6 +163,80 @@ setup_writable (void *unused) + p11_parser_formats (test.parser, p11_parser_format_persist, NULL); + } + ++/* This is similar to setup(), but it adds an unreadable content in ++ * the anchor directory. */ ++static void ++setup_unreadable (void *unused) ++{ ++ CK_C_INITIALIZE_ARGS args; ++ const char *paths; ++ char *p, *pp, *anchors; ++ FILE *f, *ff; ++ char buffer[4096]; ++ char *arguments; ++ CK_ULONG count; ++ CK_RV rv; ++ ++ memset (&test, 0, sizeof (test)); ++ ++ /* This is the entry point of the trust module, linked to this test */ ++ rv = C_GetFunctionList (&test.module); ++ assert (rv == CKR_OK); ++ ++ test.directory = p11_test_directory ("test-module"); ++ anchors = p11_path_build (test.directory, "anchors", NULL); ++#ifdef OS_UNIX ++ if (mkdir (anchors, S_IRWXU) < 0) ++#else ++ if (mkdir (anchors) < 0) ++#endif ++ assert_fail ("mkdir()", anchors); ++ ++ p = p11_path_build (anchors, "unreadable", NULL); ++ f = fopen (p, "w"); ++ fwrite ("foo", 3, 1, f); ++ fclose (f); ++ chmod (p, 0); ++ free (p); ++ ++ pp = p11_path_build (anchors, "thawte", NULL); ++ ff = fopen (pp, "w"); ++ f = fopen (SRCDIR "/trust/fixtures/thawte.pem", "r"); ++ while (!feof (f)) { ++ size_t size; ++ size = fread (buffer, 1, sizeof (buffer), f); ++ if (ferror (f)) ++ assert_fail ("fread()", ++ SRCDIR "/trust/fixtures/thawte.pem"); ++ fwrite (buffer, 1, size, ff); ++ if (ferror (ff)) ++ assert_fail ("write()", pp); ++ } ++ free (pp); ++ fclose (ff); ++ fclose (f); ++ free (anchors); ++ ++ memset (&args, 0, sizeof (args)); ++ paths = SRCDIR "/trust/input" P11_PATH_SEP \ ++ SRCDIR "/trust/fixtures/self-signed-with-ku.der"; ++ if (asprintf (&arguments, "paths='%s%c%s'", ++ paths, P11_PATH_SEP_C, test.directory) < 0) ++ assert (false && "not reached"); ++ args.pReserved = arguments; ++ args.flags = CKF_OS_LOCKING_OK; ++ ++ rv = test.module->C_Initialize (&args); ++ assert (rv == CKR_OK); ++ ++ free (arguments); ++ ++ count = NUM_SLOTS; ++ rv = test.module->C_GetSlotList (CK_TRUE, test.slots, &count); ++ assert (rv == CKR_OK); ++ assert (count == NUM_SLOTS); ++} ++ + static void + test_get_slot_list (void) + { +@@ -1324,5 +1398,8 @@ main (int argc, + p11_fixture (NULL, NULL); + p11_test (test_token_write_protected, "/module/token-write-protected"); + ++ p11_fixture (setup_unreadable, teardown); ++ p11_test (test_find_certificates, "/module/unreadable"); ++ + return p11_test_run (argc, argv); + } +diff --git a/trust/token.c b/trust/token.c +index b91a1d0..8c75d06 100644 +--- a/trust/token.c ++++ b/trust/token.c +@@ -266,8 +266,8 @@ loader_load_directory (p11_token *token, + return_val_if_fail (path != NULL, -1); + + ret = loader_load_if_file (token, path); +- return_val_if_fail (ret >=0, -1); +- total += ret; ++ if (ret >= 0) ++ total += ret; + + /* Make note that this file was seen */ + p11_dict_remove (present, path); +@@ -328,8 +328,8 @@ loader_load_path (p11_token *token, + p11_dict_iterate (present, &iter); + while (p11_dict_next (&iter, (void **)&filename, NULL)) { + ret = loader_load_if_file (token, filename); +- return_val_if_fail (ret >= 0, ret); +- total += ret; ++ if (ret >= 0) ++ total += ret; + } + } + +@@ -377,20 +377,17 @@ p11_token_load (p11_token *token) + int ret; + + ret = loader_load_path (token, token->path, &is_dir); +- if (ret < 0) +- return -1; +- total += ret; ++ if (ret >= 0) ++ total += ret; + + if (is_dir) { + ret = loader_load_path (token, token->anchors, &is_dir); +- if (ret < 0) +- return -1; +- total += ret; ++ if (ret >= 0) ++ total += ret; + + ret = loader_load_path (token, token->blacklist, &is_dir); +- if (ret < 0) +- return -1; +- total += ret; ++ if (ret >= 0) ++ total += ret; + } + + return total; +-- +2.20.1 + diff --git a/p11-kit.spec b/p11-kit.spec index ed5a050..1f8e3eb 100644 --- a/p11-kit.spec +++ b/p11-kit.spec @@ -1,6 +1,6 @@ # This spec file has been automatically updated Version: 0.23.15 -Release: 1%{?dist} +Release: 2%{?dist} Name: p11-kit Summary: Library for loading and sharing PKCS#11 modules @@ -9,6 +9,7 @@ URL: http://p11-glue.freedesktop.org/p11-kit.html Source0: https://github.com/p11-glue/p11-kit/releases/download/%{version}/p11-kit-%{version}.tar.gz Source1: trust-extract-compat Source2: p11-kit-client.service +Patch0: 0001-trust-Ignore-unreadable-content-in-anchors.patch BuildRequires: gcc BuildRequires: libtasn1-devel >= 2.3 @@ -143,6 +144,9 @@ fi %changelog +* Mon Feb 18 2019 Daiki Ueno - 0.23.15-2 +- trust: Ignore unreadable content in anchors + * Mon Jan 21 2019 Daiki Ueno - 0.23.15-1 - Update to upstream 0.23.15 release