diff --git a/.gitignore b/.gitignore index f46fa23..9d784f4 100644 --- a/.gitignore +++ b/.gitignore @@ -27,3 +27,10 @@ /sscg-3.0.2.tar.gz /sscg-3.0.3.tar.gz /sscg-3.0.5.tar.gz +/sscg-3.0.6.tar.gz +/sscg-3.0.7.tar.gz +/sscg-3.0.8.tar.gz +/sscg-4.0.0.tar.gz +/sscg-4.0.1.tar.gz +/sscg-4.0.2.tar.gz +/sscg-4.0.3.tar.gz diff --git a/0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch b/0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch new file mode 100644 index 0000000..c80dc87 --- /dev/null +++ b/0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch @@ -0,0 +1,38 @@ +From 0c37e7ace585cfb550a0ffd9d5c331d059fd687f Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Tue, 2 Dec 2025 12:12:26 -0500 +Subject: [PATCH] Avoid segfault on receiving bad CLI arguments + +Signed-off-by: Stephen Gallagher +--- + src/sscg.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/src/sscg.c b/src/sscg.c +index b9b191f109300f6447262858f57a3a8321a14966..00e2862c2d6be5c44a4a362fc926e1a07d31d7bf 100644 +--- a/src/sscg.c ++++ b/src/sscg.c +@@ -59,7 +59,7 @@ int + main (int argc, const char **argv) + { + int ret, sret; +- struct sscg_options *options; ++ struct sscg_options *options = NULL; + bool build_client_cert = false; + char *dhparams_file = NULL; + +@@ -342,7 +342,10 @@ main (int argc, const char **argv) + done: + if (ret != EOK) + { +- sscg_io_utils_delete_output_files (options->streams); ++ if (options) ++ { ++ sscg_io_utils_delete_output_files (options->streams); ++ } + } + talloc_zfree (main_ctx); + if (getenv ("SSCG_TALLOC_REPORT")) +-- +2.52.0 + diff --git a/0001-Extend-maximum-DNS-name-to-255.patch b/0001-Extend-maximum-DNS-name-to-255.patch deleted file mode 100644 index de809fa..0000000 --- a/0001-Extend-maximum-DNS-name-to-255.patch +++ /dev/null @@ -1,205 +0,0 @@ -From 00fb4ba6ae29ed94b88675fa752f1c3e5c6fa85f Mon Sep 17 00:00:00 2001 -From: Stephen Gallagher -Date: Wed, 15 Feb 2023 15:49:38 -0500 -Subject: [PATCH] Extend maximum DNS name to 255 - -The hostname part is still restricted to 63 characters - -See RFC 1035, section 2.3.4 - -Signed-off-by: Stephen Gallagher ---- - include/sscg.h | 3 +++ - src/arguments.c | 35 +++++++++++++++++++++++++++-------- - src/authority.c | 26 +++++++++++++++++++++++--- - src/cert.c | 5 +++++ - src/x509.c | 6 +++--- - 5 files changed, 61 insertions(+), 14 deletions(-) - -diff --git a/include/sscg.h b/include/sscg.h -index 0f35631..f0c6d93 100644 ---- a/include/sscg.h -+++ b/include/sscg.h -@@ -313,6 +313,9 @@ enum sscg_cert_type - #define SSCG_MIN_KEY_PASS_LEN 4 - #define SSCG_MAX_KEY_PASS_LEN 1023 - -+/* RFC 1035, section 2.3.4 (Size Limits) */ -+#define MAX_HOST_LEN 63 -+#define MAX_FQDN_LEN 255 - - int - sscg_handle_arguments (TALLOC_CTX *mem_ctx, -diff --git a/src/arguments.c b/src/arguments.c -index 0b7a060..2f412be 100644 ---- a/src/arguments.c -+++ b/src/arguments.c -@@ -786,10 +786,19 @@ sscg_handle_arguments (TALLOC_CTX *mem_ctx, - } - CHECK_MEM (options->hostname); - -- if (strnlen (options->hostname, MAXHOSTNAMELEN + 1) > MAXHOSTNAMELEN) -+ if (strnlen (options->hostname, MAX_FQDN_LEN + 1) > MAX_FQDN_LEN) - { -- fprintf ( -- stderr, "Hostnames may not exceed %d characters\n", MAXHOSTNAMELEN); -+ fprintf (stderr, "FQDNs may not exceed %d characters\n", MAX_FQDN_LEN); -+ ret = EINVAL; -+ goto done; -+ } -+ -+ if ((strchr (options->hostname, '.') - options->hostname) > MAX_HOST_LEN + 4) -+ { -+ fprintf (stderr, -+ "Hostnames may not exceed %d characters in Subject " -+ "Alternative Names\n", -+ MAX_HOST_LEN); - ret = EINVAL; - goto done; - } -@@ -798,25 +807,35 @@ sscg_handle_arguments (TALLOC_CTX *mem_ctx, - options struct. It's not the most efficient approach, but - it's only done one time, so there is no sense in optimizing - it. */ -+ size_t i = 0; - if (alternative_names) - { -- size_t i = 0; - while (alternative_names[i] != NULL) - { - options->subject_alt_names = talloc_realloc ( -- options, options->subject_alt_names, char *, i + 2); -+ options, options->subject_alt_names, char *, i + 1); - CHECK_MEM (options->subject_alt_names); - - options->subject_alt_names[i] = - talloc_strdup (options->subject_alt_names, alternative_names[i]); - CHECK_MEM (options->subject_alt_names[i]); -- -- /* Add a NULL terminator to the end */ -- options->subject_alt_names[i + 1] = NULL; - i++; - } - } - -+ /* -+ The hostname must always be listed in SubjectAlternativeNames as well. -+ Note that the realloc also adds an extra entry for the NULL terminator -+ */ -+ options->subject_alt_names = -+ talloc_realloc (options, options->subject_alt_names, char *, i + 2); -+ CHECK_MEM (options->subject_alt_names); -+ options->subject_alt_names[i] = -+ talloc_strdup (options->subject_alt_names, options->hostname); -+ CHECK_MEM (options->subject_alt_names[i]); -+ /* Add a NULL terminator to the end */ -+ options->subject_alt_names[i + 1] = NULL; -+ - if (options->key_strength < options->minimum_key_strength) - { - fprintf (stderr, -diff --git a/src/authority.c b/src/authority.c -index 4efaa9e..f509fd4 100644 ---- a/src/authority.c -+++ b/src/authority.c -@@ -56,6 +56,7 @@ create_private_CA (TALLOC_CTX *mem_ctx, - char *name_constraint; - char *san; - char *tmp; -+ char *dot; - - tmp_ctx = talloc_new (NULL); - CHECK_MEM (tmp_ctx); -@@ -89,6 +90,26 @@ create_private_CA (TALLOC_CTX *mem_ctx, - - ca_certinfo->cn = talloc_strdup (ca_certinfo, options->hostname); - CHECK_MEM (ca_certinfo->cn); -+ /* Truncate the CN at the first dot */ -+ if ((dot = strchr (ca_certinfo->cn, '.'))) -+ *dot = '\0'; -+ -+ if (options->subject_alt_names) -+ { -+ for (i = 0; options->subject_alt_names[i]; i++) -+ { -+ ca_certinfo->subject_alt_names = talloc_realloc ( -+ ca_certinfo, ca_certinfo->subject_alt_names, char *, i + 2); -+ CHECK_MEM (ca_certinfo->subject_alt_names); -+ -+ ca_certinfo->subject_alt_names[i] = talloc_strdup ( -+ ca_certinfo->subject_alt_names, options->subject_alt_names[i]); -+ CHECK_MEM (ca_certinfo->subject_alt_names[i]); -+ -+ /* Add a NULL terminator to the end */ -+ ca_certinfo->subject_alt_names[i + 1] = NULL; -+ } -+ } - - /* Make this a CA certificate */ - -@@ -106,10 +127,9 @@ create_private_CA (TALLOC_CTX *mem_ctx, - CHECK_MEM (ex); - sk_X509_EXTENSION_push (ca_certinfo->extensions, ex); - -- /* Restrict signing to the hostname and subjectAltNames of the -- service certificate */ -+ /* Restrict signing to the CN and subjectAltNames of the service certificate */ - name_constraint = -- talloc_asprintf (tmp_ctx, "permitted;DNS:%s", options->hostname); -+ talloc_asprintf (tmp_ctx, "permitted;DNS:%s", ca_certinfo->cn); - CHECK_MEM (name_constraint); - - if (options->subject_alt_names) -diff --git a/src/cert.c b/src/cert.c -index 99d9109..e36de71 100644 ---- a/src/cert.c -+++ b/src/cert.c -@@ -31,6 +31,7 @@ - */ - - -+#include - #include "include/sscg.h" - #include "include/cert.h" - #include "include/x509.h" -@@ -52,6 +53,7 @@ create_cert (TALLOC_CTX *mem_ctx, - struct sscg_x509_req *csr; - struct sscg_evp_pkey *pkey; - struct sscg_x509_cert *cert; -+ char *dot; - X509_EXTENSION *ex = NULL; - EXTENDED_KEY_USAGE *extended; - TALLOC_CTX *tmp_ctx = NULL; -@@ -87,6 +89,9 @@ create_cert (TALLOC_CTX *mem_ctx, - - certinfo->cn = talloc_strdup (certinfo, options->hostname); - CHECK_MEM (certinfo->cn); -+ /* Truncate the CN at the first dot */ -+ if ((dot = strchr (certinfo->cn, '.'))) -+ *dot = '\0'; - - if (options->subject_alt_names) - { -diff --git a/src/x509.c b/src/x509.c -index 4f3f11c..9f6f21b 100644 ---- a/src/x509.c -+++ b/src/x509.c -@@ -290,12 +290,12 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx, - } - CHECK_MEM (san); - -- if (strnlen (san, MAXHOSTNAMELEN + 5) > MAXHOSTNAMELEN + 4) -+ if (strnlen (san, MAX_FQDN_LEN + 5) > MAX_FQDN_LEN + 4) - { - fprintf (stderr, -- "Hostnames may not exceed %d characters in Subject " -+ "FQDNs may not exceed %d characters in Subject " - "Alternative Names\n", -- MAXHOSTNAMELEN); -+ MAX_FQDN_LEN); - ret = EINVAL; - goto done; - } --- -2.41.0 - diff --git a/sources b/sources index e51b29d..ebbdfd3 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sscg-3.0.5.tar.gz) = da4db537096608683726084ea342cf3e06ec25da16c4475a29e83a466486a4ace8b58253520034eb263d8cefde14e21f3fe69d23fa75686cab5e3a7f8e170442 +SHA512 (sscg-4.0.3.tar.gz) = f629cf7e32d4d4e7c1f58c4a53be925b96980e6fb3106e3a36a72f85c723bd79fba6aecdbf092b50f915a8833297bc7c6c1ccbe04fef488db38bbdc1e3a95b96 diff --git a/sscg.spec b/sscg.spec index ffb54d3..4a60e76 100644 --- a/sscg.spec +++ b/sscg.spec @@ -9,26 +9,26 @@ %{!?meson_test: %global meson_test %{__meson} test -C %{_vpath_builddir} --num-processes %{_smp_build_ncpus} --print-errorlogs} Name: sscg -Version: 3.0.5 +Version: 4.0.3 Release: %autorelease -Summary: Simple SSL certificate generator +Summary: Simple Signed Certificate Generator -License: GPLv3+ with exceptions +License: GPL-3.0-or-later WITH cryptsetup-OpenSSL-exception URL: https://%{provider_prefix} -Source0: sscg-3.0.5.tar.gz -# Extend maximum DNS name to 255 -# Author: Stephen Gallagher -Patch1: 0001-Extend-maximum-DNS-name-to-255.patch +Source0: %{URL}/archive/refs/tags/sscg-%{version}.tar.gz BuildRequires: gcc BuildRequires: libtalloc-devel BuildRequires: openssl BuildRequires: openssl-devel BuildRequires: popt-devel -BuildRequires: libpath_utils-devel BuildRequires: meson BuildRequires: ninja-build BuildRequires: help2man +# Upstream patch to avoid segfaults when receiving bad CLI arguments +# https://github.com/sgallagher/sscg/commit/0c37e7ace585cfb550a0ffd9d5c331d059fd687f +Patch: 0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch + %description A utility to aid in the creation of more secure "self-signed" @@ -39,7 +39,7 @@ up a full PKI environment and without exposing the machine to a risk of false signatures from the service certificate. %prep -%autosetup -p1 -n sscg-3.0.5 +%autosetup -p1 -n sscg-sscg-%{version} %build