Compare commits
No commits in common. "rawhide" and "f39" have entirely different histories.
5 changed files with 215 additions and 55 deletions
7
.gitignore
vendored
7
.gitignore
vendored
|
|
@ -27,10 +27,3 @@
|
|||
/sscg-3.0.2.tar.gz
|
||||
/sscg-3.0.3.tar.gz
|
||||
/sscg-3.0.5.tar.gz
|
||||
/sscg-3.0.6.tar.gz
|
||||
/sscg-3.0.7.tar.gz
|
||||
/sscg-3.0.8.tar.gz
|
||||
/sscg-4.0.0.tar.gz
|
||||
/sscg-4.0.1.tar.gz
|
||||
/sscg-4.0.2.tar.gz
|
||||
/sscg-4.0.3.tar.gz
|
||||
|
|
|
|||
|
|
@ -1,38 +0,0 @@
|
|||
From 0c37e7ace585cfb550a0ffd9d5c331d059fd687f Mon Sep 17 00:00:00 2001
|
||||
From: Stephen Gallagher <sgallagh@redhat.com>
|
||||
Date: Tue, 2 Dec 2025 12:12:26 -0500
|
||||
Subject: [PATCH] Avoid segfault on receiving bad CLI arguments
|
||||
|
||||
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
|
||||
---
|
||||
src/sscg.c | 7 +++++--
|
||||
1 file changed, 5 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/sscg.c b/src/sscg.c
|
||||
index b9b191f109300f6447262858f57a3a8321a14966..00e2862c2d6be5c44a4a362fc926e1a07d31d7bf 100644
|
||||
--- a/src/sscg.c
|
||||
+++ b/src/sscg.c
|
||||
@@ -59,7 +59,7 @@ int
|
||||
main (int argc, const char **argv)
|
||||
{
|
||||
int ret, sret;
|
||||
- struct sscg_options *options;
|
||||
+ struct sscg_options *options = NULL;
|
||||
bool build_client_cert = false;
|
||||
char *dhparams_file = NULL;
|
||||
|
||||
@@ -342,7 +342,10 @@ main (int argc, const char **argv)
|
||||
done:
|
||||
if (ret != EOK)
|
||||
{
|
||||
- sscg_io_utils_delete_output_files (options->streams);
|
||||
+ if (options)
|
||||
+ {
|
||||
+ sscg_io_utils_delete_output_files (options->streams);
|
||||
+ }
|
||||
}
|
||||
talloc_zfree (main_ctx);
|
||||
if (getenv ("SSCG_TALLOC_REPORT"))
|
||||
--
|
||||
2.52.0
|
||||
|
||||
205
0001-Extend-maximum-DNS-name-to-255.patch
Normal file
205
0001-Extend-maximum-DNS-name-to-255.patch
Normal file
|
|
@ -0,0 +1,205 @@
|
|||
From 00fb4ba6ae29ed94b88675fa752f1c3e5c6fa85f Mon Sep 17 00:00:00 2001
|
||||
From: Stephen Gallagher <sgallagh@redhat.com>
|
||||
Date: Wed, 15 Feb 2023 15:49:38 -0500
|
||||
Subject: [PATCH] Extend maximum DNS name to 255
|
||||
|
||||
The hostname part is still restricted to 63 characters
|
||||
|
||||
See RFC 1035, section 2.3.4
|
||||
|
||||
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
|
||||
---
|
||||
include/sscg.h | 3 +++
|
||||
src/arguments.c | 35 +++++++++++++++++++++++++++--------
|
||||
src/authority.c | 26 +++++++++++++++++++++++---
|
||||
src/cert.c | 5 +++++
|
||||
src/x509.c | 6 +++---
|
||||
5 files changed, 61 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/include/sscg.h b/include/sscg.h
|
||||
index 0f35631..f0c6d93 100644
|
||||
--- a/include/sscg.h
|
||||
+++ b/include/sscg.h
|
||||
@@ -313,6 +313,9 @@ enum sscg_cert_type
|
||||
#define SSCG_MIN_KEY_PASS_LEN 4
|
||||
#define SSCG_MAX_KEY_PASS_LEN 1023
|
||||
|
||||
+/* RFC 1035, section 2.3.4 (Size Limits) */
|
||||
+#define MAX_HOST_LEN 63
|
||||
+#define MAX_FQDN_LEN 255
|
||||
|
||||
int
|
||||
sscg_handle_arguments (TALLOC_CTX *mem_ctx,
|
||||
diff --git a/src/arguments.c b/src/arguments.c
|
||||
index 0b7a060..2f412be 100644
|
||||
--- a/src/arguments.c
|
||||
+++ b/src/arguments.c
|
||||
@@ -786,10 +786,19 @@ sscg_handle_arguments (TALLOC_CTX *mem_ctx,
|
||||
}
|
||||
CHECK_MEM (options->hostname);
|
||||
|
||||
- if (strnlen (options->hostname, MAXHOSTNAMELEN + 1) > MAXHOSTNAMELEN)
|
||||
+ if (strnlen (options->hostname, MAX_FQDN_LEN + 1) > MAX_FQDN_LEN)
|
||||
{
|
||||
- fprintf (
|
||||
- stderr, "Hostnames may not exceed %d characters\n", MAXHOSTNAMELEN);
|
||||
+ fprintf (stderr, "FQDNs may not exceed %d characters\n", MAX_FQDN_LEN);
|
||||
+ ret = EINVAL;
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
+ if ((strchr (options->hostname, '.') - options->hostname) > MAX_HOST_LEN + 4)
|
||||
+ {
|
||||
+ fprintf (stderr,
|
||||
+ "Hostnames may not exceed %d characters in Subject "
|
||||
+ "Alternative Names\n",
|
||||
+ MAX_HOST_LEN);
|
||||
ret = EINVAL;
|
||||
goto done;
|
||||
}
|
||||
@@ -798,25 +807,35 @@ sscg_handle_arguments (TALLOC_CTX *mem_ctx,
|
||||
options struct. It's not the most efficient approach, but
|
||||
it's only done one time, so there is no sense in optimizing
|
||||
it. */
|
||||
+ size_t i = 0;
|
||||
if (alternative_names)
|
||||
{
|
||||
- size_t i = 0;
|
||||
while (alternative_names[i] != NULL)
|
||||
{
|
||||
options->subject_alt_names = talloc_realloc (
|
||||
- options, options->subject_alt_names, char *, i + 2);
|
||||
+ options, options->subject_alt_names, char *, i + 1);
|
||||
CHECK_MEM (options->subject_alt_names);
|
||||
|
||||
options->subject_alt_names[i] =
|
||||
talloc_strdup (options->subject_alt_names, alternative_names[i]);
|
||||
CHECK_MEM (options->subject_alt_names[i]);
|
||||
-
|
||||
- /* Add a NULL terminator to the end */
|
||||
- options->subject_alt_names[i + 1] = NULL;
|
||||
i++;
|
||||
}
|
||||
}
|
||||
|
||||
+ /*
|
||||
+ The hostname must always be listed in SubjectAlternativeNames as well.
|
||||
+ Note that the realloc also adds an extra entry for the NULL terminator
|
||||
+ */
|
||||
+ options->subject_alt_names =
|
||||
+ talloc_realloc (options, options->subject_alt_names, char *, i + 2);
|
||||
+ CHECK_MEM (options->subject_alt_names);
|
||||
+ options->subject_alt_names[i] =
|
||||
+ talloc_strdup (options->subject_alt_names, options->hostname);
|
||||
+ CHECK_MEM (options->subject_alt_names[i]);
|
||||
+ /* Add a NULL terminator to the end */
|
||||
+ options->subject_alt_names[i + 1] = NULL;
|
||||
+
|
||||
if (options->key_strength < options->minimum_key_strength)
|
||||
{
|
||||
fprintf (stderr,
|
||||
diff --git a/src/authority.c b/src/authority.c
|
||||
index 4efaa9e..f509fd4 100644
|
||||
--- a/src/authority.c
|
||||
+++ b/src/authority.c
|
||||
@@ -56,6 +56,7 @@ create_private_CA (TALLOC_CTX *mem_ctx,
|
||||
char *name_constraint;
|
||||
char *san;
|
||||
char *tmp;
|
||||
+ char *dot;
|
||||
|
||||
tmp_ctx = talloc_new (NULL);
|
||||
CHECK_MEM (tmp_ctx);
|
||||
@@ -89,6 +90,26 @@ create_private_CA (TALLOC_CTX *mem_ctx,
|
||||
|
||||
ca_certinfo->cn = talloc_strdup (ca_certinfo, options->hostname);
|
||||
CHECK_MEM (ca_certinfo->cn);
|
||||
+ /* Truncate the CN at the first dot */
|
||||
+ if ((dot = strchr (ca_certinfo->cn, '.')))
|
||||
+ *dot = '\0';
|
||||
+
|
||||
+ if (options->subject_alt_names)
|
||||
+ {
|
||||
+ for (i = 0; options->subject_alt_names[i]; i++)
|
||||
+ {
|
||||
+ ca_certinfo->subject_alt_names = talloc_realloc (
|
||||
+ ca_certinfo, ca_certinfo->subject_alt_names, char *, i + 2);
|
||||
+ CHECK_MEM (ca_certinfo->subject_alt_names);
|
||||
+
|
||||
+ ca_certinfo->subject_alt_names[i] = talloc_strdup (
|
||||
+ ca_certinfo->subject_alt_names, options->subject_alt_names[i]);
|
||||
+ CHECK_MEM (ca_certinfo->subject_alt_names[i]);
|
||||
+
|
||||
+ /* Add a NULL terminator to the end */
|
||||
+ ca_certinfo->subject_alt_names[i + 1] = NULL;
|
||||
+ }
|
||||
+ }
|
||||
|
||||
/* Make this a CA certificate */
|
||||
|
||||
@@ -106,10 +127,9 @@ create_private_CA (TALLOC_CTX *mem_ctx,
|
||||
CHECK_MEM (ex);
|
||||
sk_X509_EXTENSION_push (ca_certinfo->extensions, ex);
|
||||
|
||||
- /* Restrict signing to the hostname and subjectAltNames of the
|
||||
- service certificate */
|
||||
+ /* Restrict signing to the CN and subjectAltNames of the service certificate */
|
||||
name_constraint =
|
||||
- talloc_asprintf (tmp_ctx, "permitted;DNS:%s", options->hostname);
|
||||
+ talloc_asprintf (tmp_ctx, "permitted;DNS:%s", ca_certinfo->cn);
|
||||
CHECK_MEM (name_constraint);
|
||||
|
||||
if (options->subject_alt_names)
|
||||
diff --git a/src/cert.c b/src/cert.c
|
||||
index 99d9109..e36de71 100644
|
||||
--- a/src/cert.c
|
||||
+++ b/src/cert.c
|
||||
@@ -31,6 +31,7 @@
|
||||
*/
|
||||
|
||||
|
||||
+#include <string.h>
|
||||
#include "include/sscg.h"
|
||||
#include "include/cert.h"
|
||||
#include "include/x509.h"
|
||||
@@ -52,6 +53,7 @@ create_cert (TALLOC_CTX *mem_ctx,
|
||||
struct sscg_x509_req *csr;
|
||||
struct sscg_evp_pkey *pkey;
|
||||
struct sscg_x509_cert *cert;
|
||||
+ char *dot;
|
||||
X509_EXTENSION *ex = NULL;
|
||||
EXTENDED_KEY_USAGE *extended;
|
||||
TALLOC_CTX *tmp_ctx = NULL;
|
||||
@@ -87,6 +89,9 @@ create_cert (TALLOC_CTX *mem_ctx,
|
||||
|
||||
certinfo->cn = talloc_strdup (certinfo, options->hostname);
|
||||
CHECK_MEM (certinfo->cn);
|
||||
+ /* Truncate the CN at the first dot */
|
||||
+ if ((dot = strchr (certinfo->cn, '.')))
|
||||
+ *dot = '\0';
|
||||
|
||||
if (options->subject_alt_names)
|
||||
{
|
||||
diff --git a/src/x509.c b/src/x509.c
|
||||
index 4f3f11c..9f6f21b 100644
|
||||
--- a/src/x509.c
|
||||
+++ b/src/x509.c
|
||||
@@ -290,12 +290,12 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
|
||||
}
|
||||
CHECK_MEM (san);
|
||||
|
||||
- if (strnlen (san, MAXHOSTNAMELEN + 5) > MAXHOSTNAMELEN + 4)
|
||||
+ if (strnlen (san, MAX_FQDN_LEN + 5) > MAX_FQDN_LEN + 4)
|
||||
{
|
||||
fprintf (stderr,
|
||||
- "Hostnames may not exceed %d characters in Subject "
|
||||
+ "FQDNs may not exceed %d characters in Subject "
|
||||
"Alternative Names\n",
|
||||
- MAXHOSTNAMELEN);
|
||||
+ MAX_FQDN_LEN);
|
||||
ret = EINVAL;
|
||||
goto done;
|
||||
}
|
||||
--
|
||||
2.41.0
|
||||
|
||||
2
sources
2
sources
|
|
@ -1 +1 @@
|
|||
SHA512 (sscg-4.0.3.tar.gz) = f629cf7e32d4d4e7c1f58c4a53be925b96980e6fb3106e3a36a72f85c723bd79fba6aecdbf092b50f915a8833297bc7c6c1ccbe04fef488db38bbdc1e3a95b96
|
||||
SHA512 (sscg-3.0.5.tar.gz) = da4db537096608683726084ea342cf3e06ec25da16c4475a29e83a466486a4ace8b58253520034eb263d8cefde14e21f3fe69d23fa75686cab5e3a7f8e170442
|
||||
|
|
|
|||
18
sscg.spec
18
sscg.spec
|
|
@ -9,26 +9,26 @@
|
|||
%{!?meson_test: %global meson_test %{__meson} test -C %{_vpath_builddir} --num-processes %{_smp_build_ncpus} --print-errorlogs}
|
||||
|
||||
Name: sscg
|
||||
Version: 4.0.3
|
||||
Version: 3.0.5
|
||||
Release: %autorelease
|
||||
Summary: Simple Signed Certificate Generator
|
||||
Summary: Simple SSL certificate generator
|
||||
|
||||
License: GPL-3.0-or-later WITH cryptsetup-OpenSSL-exception
|
||||
License: GPLv3+ with exceptions
|
||||
URL: https://%{provider_prefix}
|
||||
Source0: %{URL}/archive/refs/tags/sscg-%{version}.tar.gz
|
||||
Source0: sscg-3.0.5.tar.gz
|
||||
# Extend maximum DNS name to 255
|
||||
# Author: Stephen Gallagher <sgallagh@redhat.com>
|
||||
Patch1: 0001-Extend-maximum-DNS-name-to-255.patch
|
||||
BuildRequires: gcc
|
||||
BuildRequires: libtalloc-devel
|
||||
BuildRequires: openssl
|
||||
BuildRequires: openssl-devel
|
||||
BuildRequires: popt-devel
|
||||
BuildRequires: libpath_utils-devel
|
||||
BuildRequires: meson
|
||||
BuildRequires: ninja-build
|
||||
BuildRequires: help2man
|
||||
|
||||
# Upstream patch to avoid segfaults when receiving bad CLI arguments
|
||||
# https://github.com/sgallagher/sscg/commit/0c37e7ace585cfb550a0ffd9d5c331d059fd687f
|
||||
Patch: 0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch
|
||||
|
||||
|
||||
%description
|
||||
A utility to aid in the creation of more secure "self-signed"
|
||||
|
|
@ -39,7 +39,7 @@ up a full PKI environment and without exposing the machine to a risk of
|
|||
false signatures from the service certificate.
|
||||
|
||||
%prep
|
||||
%autosetup -p1 -n sscg-sscg-%{version}
|
||||
%autosetup -p1 -n sscg-3.0.5
|
||||
|
||||
|
||||
%build
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue