Compare commits

...
Sign in to create a new pull request.

2 commits

Author SHA1 Message Date
Patrick Monnerat
ac87b08d92 Fix crashes
Patch "pastekey" fixes a crash pasting an encrypted private key.
Patch "revokedel" fixes a freeze when deleting a certificate.
Patch "delete_after_revoke" fixes a crash deleting+revoking a certificate.
2024-01-25 08:45:44 +01:00
Patrick Monnerat
8fbcdf0907 New upstream release.
Build using cmake.
Doc file "README.IMPORTANT" for needed passord reset.
2023-10-07 00:54:15 +02:00
12 changed files with 226 additions and 4639 deletions

1
.gitignore vendored
View file

@ -13,3 +13,4 @@ xca-0.8.1.tar.gz
/xca-2.2.1.tar.gz
/xca-2.3.0.tar.gz
/xca-2.4.0.tar.gz
/xca-2.5.0.tar.gz

View file

@ -1 +1 @@
SHA512 (xca-2.4.0.tar.gz) = e93e2cf9dc48ed43ee9b51e977f825d81ff08835eb4d77fcbe8f9dc8ce31c77c1da879b48c25ab535717542d1fe84faa6e46c410c116edbee02072040c59667c
SHA512 (xca-2.5.0.tar.gz) = 36b9b97ff0649934fbe78e38048e75883555aab5d86ee2cbd629f9789326d16463f182cf0bbcc76b1ac8f631b24fa187f1b64c466e04de010724ea5f9ebfa11e

File diff suppressed because it is too large Load diff

View file

@ -1,312 +0,0 @@
From 36abc2b4980980d92a1acb697340c36b8cce6e64 Mon Sep 17 00:00:00 2001
From: albanobattistella <34811668+albanobattistella@users.noreply.github.com>
Date: Mon, 24 May 2021 17:52:22 +0200
Subject: [PATCH] Update xca_it.ts
---
lang/xca_it.ts | 80 +++++++++++++++++++++++++-------------------------
1 file changed, 40 insertions(+), 40 deletions(-)
diff --git a/lang/xca_it.ts b/lang/xca_it.ts
index 0bf93bc9..ba06ec62 100644
--- a/lang/xca_it.ts
+++ b/lang/xca_it.ts
@@ -180,7 +180,7 @@
</message>
<message>
<source>Revoked: </source>
- <translation type="vanished">Revocato: </translation>
+ <translation>Revocato: </translation>
</message>
<message>
<location line="+5"/>
@@ -1133,7 +1133,7 @@ Ciò eliminerà la chiave &apos;%1&apos; e la renderà non esportabile</translat
</message>
<message>
<source>No deleted items found</source>
- <translation type="vanished">Non trovati elementi cancellati</translation>
+ <translation>Non trovati elementi cancellati</translation>
</message>
<message>
<location filename="../widgets/MW_menu.cpp" line="-49"/>
@@ -1228,11 +1228,11 @@ Ciò eliminerà la chiave &apos;%1&apos; e la renderà non esportabile</translat
</message>
<message>
<source>&amp;New DataBase</source>
- <translation type="vanished">&amp;Nuovo database</translation>
+ <translation>&amp;Nuovo database</translation>
</message>
<message>
<source>&amp;Open DataBase</source>
- <translation type="vanished">&amp;Apri database</translation>
+ <translation>&amp;Apri database</translation>
</message>
<message>
<location line="+7"/>
@@ -1246,7 +1246,7 @@ Ciò eliminerà la chiave &apos;%1&apos; e la renderà non esportabile</translat
</message>
<message>
<source>&amp;Close DataBase</source>
- <translation type="vanished">&amp;Chiudi database</translation>
+ <translation>&amp;Chiudi database</translation>
</message>
<message>
<location line="-10"/>
@@ -1408,7 +1408,7 @@ Ciò eliminerà la chiave &apos;%1&apos; e la renderà non esportabile</translat
</message>
<message>
<source>&amp;Content</source>
- <translation type="vanished">&amp;Contenuti</translation>
+ <translation>&amp;Contenuti</translation>
</message>
<message>
<location line="+3"/>
@@ -1417,7 +1417,7 @@ Ciò eliminerà la chiave &apos;%1&apos; e la renderà non esportabile</translat
</message>
<message>
<source>no such option: %1</source>
- <translation type="vanished">opzione inesistente: %1</translation>
+ <translation>opzione inesistente: %1</translation>
</message>
<message>
<location filename="../widgets/MainWindow.cpp" line="-336"/>
@@ -1483,30 +1483,30 @@ Ciò eliminerà la chiave &apos;%1&apos; e la renderà non esportabile</translat
<message>
<source>Please enter a password, that will be used to encrypt your private keys in the database:
%1</source>
- <translation type="vanished">Prego inserire una password che verrà utilizzata per crittare le chiavi private nel database:
+ <translation>Prego inserire una password che verrà utilizzata per crittare le chiavi private nel database:
%1</translation>
</message>
<message>
<source>Password verify error, please try again</source>
- <translation type="vanished">Errore di verifica password, prego riprovare</translation>
+ <translation>Errore di verifica password, prego riprovare</translation>
</message>
<message>
<source>Password</source>
- <translation type="vanished">Password</translation>
+ <translation>Password</translation>
</message>
<message>
<source>Please enter the password for unlocking the database:
%1</source>
- <translation type="vanished">Prego inserire la password per sbloccare il database:
+ <translation>Prego inserire la password per sbloccare il database:
%1</translation>
</message>
<message>
<source>The following error occurred:</source>
- <translation type="vanished">Incontrato l&apos;errore seguente:</translation>
+ <translation>Incontrato l&apos;errore seguente:</translation>
</message>
<message>
<source>Copy to Clipboard</source>
- <translation type="vanished">Copia negli appunti</translation>
+ <translation>Copia negli appunti</translation>
</message>
<message>
<location line="+158"/>
@@ -1533,7 +1533,7 @@ Prego inserire i bit dei parametri DH</translation>
</message>
<message>
<source>Error opening file: &apos;%1&apos;: %2</source>
- <translation type="vanished">Errore in apertura file: &apos;%1&apos;: %2</translation>
+ <translation>Errore in apertura file: &apos;%1&apos;: %2</translation>
</message>
</context>
<context>
@@ -1769,7 +1769,7 @@ Prego inserire i bit dei parametri DH</translation>
<message>
<location line="+16"/>
<source>Distinguished name</source>
- <translation>Distinguished name</translation>
+ <translation>Nome distinto</translation>
</message>
<message>
<location line="+26"/>
@@ -2279,12 +2279,12 @@ nonostante siano stati dichiarati come obbligatori nel menu opzioni.</translatio
<message>
<location line="+10"/>
<source>Hostname</source>
- <translation></translation>
+ <translation>Nome host</translation>
</message>
<message>
<location line="+10"/>
<source>Username</source>
- <translation></translation>
+ <translation>Nome utente</translation>
</message>
<message>
<location line="+10"/>
@@ -2309,11 +2309,11 @@ nonostante siano stati dichiarati come obbligatori nel menu opzioni.</translatio
</message>
<message>
<source>Please enter the password to access the database server %2 as user &apos;%1&apos;.</source>
- <translation type="vanished">Prego inserire la password di accesso al database server %2 come utente: &apos;%1&apos;.</translation>
+ <translation>Prego inserire la password di accesso al database server %2 come utente: &apos;%1&apos;.</translation>
</message>
<message>
<source>The database driver does not support transactions. This may happen if the client and server have different versions. Continue with care.</source>
- <translation type="vanished">Il driver database non supporta le transazioni. Questo può succedere se il client e il server hanno versioni differenti. Continuare con attenzione.</translation>
+ <translation>Il driver database non supporta le transazioni. Questo può succedere se il client e il server hanno versioni differenti. Continuare con attenzione.</translation>
</message>
</context>
<context>
@@ -2524,7 +2524,7 @@ Nello specifico EC e DSA sono definiti solo con SHA1 nelle specifiche PKCS#11.</
</message>
<message>
<source>E&amp;xit</source>
- <translation type="vanished">E&amp;sci</translation>
+ <translation>E&amp;sci</translation>
</message>
</context>
<context>
@@ -2614,15 +2614,15 @@ Nello specifico EC e DSA sono definiti solo con SHA1 nelle specifiche PKCS#11.</
</message>
<message>
<source>DB: Rename: &apos;%1&apos; already in use</source>
- <translation type="vanished">DB: Rinomina: &apos;%1&apos; già in uso</translation>
+ <translation>DB: Rinomina: &apos;%1&apos; già in uso</translation>
</message>
<message>
<source>DB: Entry to rename not found: %1</source>
- <translation type="vanished">DB: Elemento da rinominare non trovato: %1</translation>
+ <translation>DB: Elemento da rinominare non trovato: %1</translation>
</message>
<message>
<source>DB: Write error %1 - %2</source>
- <translation type="vanished">DB: Errore di scrittura %1 - %2</translation>
+ <translation>DB: Errore di scrittura %1 - %2</translation>
</message>
<message>
<location filename="../lib/db.cpp" line="+280"/>
@@ -2991,7 +2991,7 @@ Nello specifico EC e DSA sono definiti solo con SHA1 nelle specifiche PKCS#11.</
</message>
<message>
<source>Failed to open PKCS11 library: %1</source>
- <translation type="vanished">Impossibile aprire libreria PKCS#11: %1</translation>
+ <translation>Impossibile aprire libreria PKCS#11: %1</translation>
</message>
<message>
<location filename="../lib/pkcs11_lib.cpp" line="+69"/>
@@ -3456,7 +3456,7 @@ nella libreria %3
<name>db_base</name>
<message>
<source>Error opening file: &apos;%1&apos;: %2</source>
- <translation type="vanished">Errore in apertura file: &apos;%1&apos;: %2</translation>
+ <translation>Errore in apertura file: &apos;%1&apos;: %2</translation>
</message>
<message>
<location filename="../lib/db_base.cpp" line="+170"/>
@@ -3607,15 +3607,15 @@ quindi non è stata importata</translation>
</message>
<message>
<source>There are no CA certificates for CRL generation</source>
- <translation type="vanished">Non esistono certificati CA per generare la CRL</translation>
+ <translation>Non esistono certificati CA per generare la CRL</translation>
</message>
<message>
<source>Select CA certificate</source>
- <translation type="vanished">Seleziona un certificato CA</translation>
+ <translation>Seleziona un certificato CA</translation>
</message>
<message>
<source>Create CRL</source>
- <translation type="vanished">Crea CRL</translation>
+ <translation>Crea CRL</translation>
</message>
<message>
<location line="+63"/>
@@ -3873,11 +3873,11 @@ e sarà completata con la nuova parte privata della chiave</translation>
</message>
<message>
<source>Plain View</source>
- <translation type="vanished">Visualizzazione semplice</translation>
+ <translation>Visualizzazione semplice</translation>
</message>
<message>
<source>Tree View</source>
- <translation type="vanished">Visualizzazione ad albero</translation>
+ <translation>Visualizzazione ad albero</translation>
</message>
<message>
<location line="+219"/>
@@ -4000,7 +4000,7 @@ pertanto non è stato importato</translation>
</message>
<message>
<source>X509 Certificates ( *.pem *.cer *.crt *.p12 *.p7b )</source>
- <translation type="vanished">Certificati x509 ( *.pem *.cer *.crt *.p12 *.p7b )</translation>
+ <translation>Certificati x509 ( *.pem *.cer *.crt *.p12 *.p7b )</translation>
</message>
<message>
<location line="+65"/>
@@ -4015,7 +4015,7 @@ pertanto non è stato importato</translation>
</message>
<message>
<source>Error opening file: &apos;%1&apos;: %2</source>
- <translation type="vanished">Errore in apertura file: &apos;%1&apos;: %2</translation>
+ <translation>Errore in apertura file: &apos;%1&apos;: %2</translation>
</message>
<message>
<location line="+69"/>
@@ -4024,7 +4024,7 @@ pertanto non è stato importato</translation>
</message>
<message>
<source> days</source>
- <translation type="vanished"> giorni</translation>
+ <translation> giorni</translation>
</message>
</context>
<context>
@@ -4202,11 +4202,11 @@ pertanto non è stata salvata</translation>
<name>pki_base</name>
<message>
<source>Error opening file: &apos;%1&apos;: %2</source>
- <translation type="vanished">Errore in apertura file: &apos;%1&apos;: %2</translation>
+ <translation>Errore in apertura file: &apos;%1&apos;: %2</translation>
</message>
<message>
<source>Error writing to file: &apos;%1&apos;: %2</source>
- <translation type="vanished">Errore scrittura file: &apos;%1&apos;: %2</translation>
+ <translation>Errore scrittura file: &apos;%1&apos;: %2</translation>
</message>
<message>
<location filename="../lib/pki_base.cpp" line="+289"/>
@@ -4312,7 +4312,7 @@ Si trova nel database XCA &apos;%5&apos;</translation>
</message>
<message>
<source>unknown</source>
- <translation type="vanished">Sconosciuto</translation>
+ <translation>Sconosciuto</translation>
</message>
<message>
<location line="-1"/>
@@ -4322,22 +4322,22 @@ Si trova nel database XCA &apos;%5&apos;</translation>
<message>
<source>The XCA CRL &apos;%1&apos;, issued by the CA &apos;%2&apos; on %3 will expire on %4.
It is stored in the XCA database &apos;%5&apos;</source>
- <translation type="vanished">La CRL XCA &apos;%1&apos;, rilasciata dalla CA &apos;%2&apos; il %3, scadrà il %4. E&apos; mantenuta nel database XCA &apos;%5&apos;</translation>
+ <translation>La CRL XCA &apos;%1&apos;, rilasciata dalla CA &apos;%2&apos; il %3, scadrà il %4. E&apos; mantenuta nel database XCA &apos;%5&apos;</translation>
</message>
</context>
<context>
<name>pki_evp</name>
<message>
<source>Failed to decrypt the key (bad password) </source>
- <translation type="vanished">Impossibile decrittare la chiave (password errata) </translation>
+ <translation>Impossibile decrittare la chiave (password errata) </translation>
</message>
<message>
<source>Failed to decrypt the key (bad password) %1</source>
- <translation type="vanished">Impossibile decrittare la chiave (password errata) %1</translation>
+ <translation>Impossibile decrittare la chiave (password errata) %1</translation>
</message>
<message>
<source>Please enter the password to decrypt the private key.</source>
- <translation type="vanished">Prego inserire la password per decrittare la chiave privata.</translation>
+ <translation>Prego inserire la password per decrittare la chiave privata.</translation>
</message>
<message>
<location filename="../lib/pki_evp.cpp" line="+260"/>

View file

@ -1,17 +0,0 @@
diff -Naurp xca-2.4.0.orig/misc/xca.xml xca-2.4.0.new/misc/xca.xml
--- xca-2.4.0.orig/misc/xca.xml 2021-05-07 22:40:29.000000000 +0200
+++ xca-2.4.0.new/misc/xca.xml 2021-11-13 17:09:16.478893271 +0100
@@ -3,11 +3,11 @@
<mime-type type="application/x-xca-database">
<comment>XCA database</comment>
<glob pattern="*.xdb"/>
- <icon name="x-xca-database"/>
+ <generic-icon name="x-xca-database"/>
</mime-type>
<mime-type type="application/x-xca-template">
<comment>XCA template</comment>
<glob pattern="*.xca"/>
- <icon name="x-xca-template"/>
+ <generic-icon name="x-xca-template"/>
</mime-type>
</mime-info>

View file

@ -1,14 +0,0 @@
diff -Naurp xca-2.4.0.orig/Makefile xca-2.4.0.new/Makefile
--- xca-2.4.0.orig/Makefile 2021-05-07 22:40:29.000000000 +0200
+++ xca-2.4.0.new/Makefile 2021-11-13 16:59:53.656274074 +0100
@@ -69,7 +69,9 @@ PRINT=:
endif
export PRINT
-ifneq ($(TOPDIR), $(BUILD))
+REALBUILD=$(shell realpath $(BUILD))
+REALTOPDIR=$(shell realpath $(TOPDIR))
+ifneq ($(REALTOPDIR), $(REALBUILD))
do.ui: clean_topdir
clean_topdir:
$(MAKE) -C $(TOPDIR) clean

View file

@ -1,233 +0,0 @@
diff -Naurp xca-2.4.0.orig/lib/pkcs11.cpp xca-2.4.0.new/lib/pkcs11.cpp
--- xca-2.4.0.orig/lib/pkcs11.cpp 2021-05-07 22:40:29.000000000 +0200
+++ xca-2.4.0.new/lib/pkcs11.cpp 2021-11-13 02:58:27.866824246 +0100
@@ -840,8 +840,7 @@ EVP_PKEY *pkcs11::getPrivateKey(EVP_PKEY
switch (EVP_PKEY_type(keytype)) {
case EVP_PKEY_RSA:
- rsa = EVP_PKEY_get0_RSA(pub);
- rsa = RSAPublicKey_dup(rsa);
+ rsa = RSAPublicKey_dup(EVP_PKEY_get0_RSA(pub));
openssl_error();
if (!rsa_meth) {
#if OPENSSL_VERSION_NUMBER >= 0x1010000L
@@ -865,8 +864,7 @@ EVP_PKEY *pkcs11::getPrivateKey(EVP_PKEY
EVP_PKEY_assign_RSA(evp, rsa);
break;
case EVP_PKEY_DSA:
- dsa = EVP_PKEY_get0_DSA(pub);
- dsa = DSAparams_dup(dsa);
+ dsa = DSAparams_dup(EVP_PKEY_get0_DSA(pub));
openssl_error();
if (!dsa_meth) {
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
@@ -889,8 +887,7 @@ EVP_PKEY *pkcs11::getPrivateKey(EVP_PKEY
break;
#if !defined(OPENSSL_NO_EC) && OPENSSL_VERSION_NUMBER >= 0x10100000L
case EVP_PKEY_EC:
- ec = EVP_PKEY_get0_EC_KEY(pub);
- ec = EC_KEY_dup(ec);
+ ec = EC_KEY_dup(EVP_PKEY_get0_EC_KEY(pub));
openssl_error();
if (!ec_key_meth) {
ec_key_meth = setup_ec_key_meth();
diff -Naurp xca-2.4.0.orig/lib/pki_evp.cpp xca-2.4.0.new/lib/pki_evp.cpp
--- xca-2.4.0.orig/lib/pki_evp.cpp 2021-05-07 22:40:29.000000000 +0200
+++ xca-2.4.0.new/lib/pki_evp.cpp 2021-11-13 03:00:39.279152488 +0100
@@ -282,8 +282,8 @@ void pki_evp::fromPEMbyteArray(const QBy
static void search_ec_oid(EVP_PKEY *pkey)
{
#ifndef OPENSSL_NO_EC
- EC_KEY *ec;
EC_GROUP *builtin;
+ const EC_KEY *ec;
const EC_GROUP *ec_group;
int keytype = EVP_PKEY_id(pkey);
@@ -498,7 +498,7 @@ void pki_evp::fload(const QString &fname
void pki_evp::fromData(const unsigned char *p, db_header_t *head)
{
int version, type, size;
- void *ptr = NULL;
+ const void *ptr = NULL;
if (key)
EVP_PKEY_free(key);
@@ -518,8 +518,23 @@ void pki_evp::fromData(const unsigned ch
}
pki_openssl_error();
- if (key)
- ptr = EVP_PKEY_get0(key);
+ if (key) {
+ switch (EVP_PKEY_type(EVP_PKEY_id(key))) {
+ case EVP_PKEY_RSA:
+ ptr = EVP_PKEY_get0_RSA(key);
+ break;
+ case EVP_PKEY_DSA:
+ ptr = EVP_PKEY_get0_DSA(key);
+ break;
+#ifndef OPENSSL_NO_EX
+ case EVP_PKEY_EC:
+ ptr = EVP_PKEY_get0_EC_KEY(key);
+ break;
+#endif
+ default:
+ ptr = EVP_PKEY_get0(key);
+ }
+ }
if (!ptr)
throw errorEx(tr("Ignoring unsupported private key"));
@@ -621,8 +636,8 @@ EVP_PKEY *pki_evp::legacyDecryptKey(QByt
pki_openssl_error();
if (EVP_PKEY_type(getKeyType()) == EVP_PKEY_RSA) {
- RSA *rsa = EVP_PKEY_get0_RSA(tmpkey);
- RSA_blinding_on(rsa, NULL);
+ const RSA *rsa = EVP_PKEY_get0_RSA(tmpkey);
+ RSA_blinding_on((RSA *) rsa, NULL);
}
myencKey.fill(0);
return tmpkey;
@@ -930,7 +945,7 @@ bool pki_evp::verify_priv(EVP_PKEY *pkey
EVP_MD_CTX_free(ctx);
#endif
if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA && EVP_PKEY_isPrivKey(pkey)) {
- RSA *rsa = EVP_PKEY_get0_RSA(pkey);
+ const RSA *rsa = EVP_PKEY_get0_RSA(pkey);
if (RSA_check_key(rsa) != 1)
verify = false;
}
diff -Naurp xca-2.4.0.orig/lib/pki_key.cpp xca-2.4.0.new/lib/pki_key.cpp
--- xca-2.4.0.orig/lib/pki_key.cpp 2021-05-07 22:40:29.000000000 +0200
+++ xca-2.4.0.new/lib/pki_key.cpp 2021-11-13 02:58:27.866824246 +0100
@@ -197,7 +197,7 @@ QString pki_key::length() const
if (EVP_PKEY_id(key) == EVP_PKEY_DSA) {
const BIGNUM *p = NULL;
- DSA *dsa = EVP_PKEY_get0_DSA(key);
+ const DSA *dsa = EVP_PKEY_get0_DSA(key);
if (dsa)
DSA_get0_pqg(dsa, &p, NULL, NULL);
dsa_unset = p == NULL;
@@ -299,7 +299,7 @@ QString pki_key::modulus() const
if (getKeyType() == EVP_PKEY_RSA) {
const BIGNUM *n = NULL;
- RSA *rsa = EVP_PKEY_get0_RSA(key);
+ const RSA *rsa = EVP_PKEY_get0_RSA(key);
RSA_get0_key(rsa, &n, NULL, NULL);
return BN2QString(n);
}
@@ -310,7 +310,7 @@ QString pki_key::pubEx() const
{
if (getKeyType() == EVP_PKEY_RSA) {
const BIGNUM *e = NULL;
- RSA *rsa = EVP_PKEY_get0_RSA(key);
+ const RSA *rsa = EVP_PKEY_get0_RSA(key);
RSA_get0_key(rsa, NULL, &e, NULL);
return BN2QString(e);
}
@@ -321,7 +321,7 @@ QString pki_key::subprime() const
{
if (getKeyType() == EVP_PKEY_DSA) {
const BIGNUM *q = NULL;
- DSA *dsa = EVP_PKEY_get0_DSA(key);
+ const DSA *dsa = EVP_PKEY_get0_DSA(key);
if (dsa)
DSA_get0_pqg(dsa, NULL, &q, NULL);
return BN2QString(q);
@@ -333,7 +333,7 @@ QString pki_key::pubkey() const
{
if (getKeyType() == EVP_PKEY_DSA) {
const BIGNUM *pubkey = NULL;
- DSA *dsa = EVP_PKEY_get0_DSA(key);
+ const DSA *dsa = EVP_PKEY_get0_DSA(key);
if (dsa)
DSA_get0_key(dsa, &pubkey, NULL);
return BN2QString(pubkey);
@@ -766,7 +766,7 @@ QByteArray pki_key::SSH2publicQByteArray
txt = "ssh-rsa";
ssh_key_QBA2data(txt, &data);
{
- RSA *rsa = EVP_PKEY_get0_RSA(key);
+ const RSA *rsa = EVP_PKEY_get0_RSA(key);
const BIGNUM *n, *e;
RSA_get0_key(rsa, &n, &e, NULL);
ssh_key_bn2data(e, &data);
@@ -777,7 +777,7 @@ QByteArray pki_key::SSH2publicQByteArray
txt = "ssh-dss";
ssh_key_QBA2data(txt, &data);
{
- DSA *dsa = EVP_PKEY_get0_DSA(key);
+ const DSA *dsa = EVP_PKEY_get0_DSA(key);
const BIGNUM *p, *q, *g, *pubkey;
DSA_get0_pqg(dsa, &p, &q, &g);
DSA_get0_key(dsa, &pubkey, NULL);
diff -Naurp xca-2.4.0.orig/lib/pki_scard.cpp xca-2.4.0.new/lib/pki_scard.cpp
--- xca-2.4.0.orig/lib/pki_scard.cpp 2021-05-07 22:40:29.000000000 +0200
+++ xca-2.4.0.new/lib/pki_scard.cpp 2021-11-13 03:02:20.379174056 +0100
@@ -293,10 +293,10 @@ void pki_scard::deleteFromToken()
pk11_attlist pki_scard::objectAttributesNoId(EVP_PKEY *pk, bool priv) const
{
QByteArray ba;
- RSA *rsa;
- DSA *dsa;
+ const RSA *rsa;
+ const DSA *dsa;
#ifndef OPENSSL_NO_EC
- EC_KEY *ec;
+ const EC_KEY *ec;
#endif
const BIGNUM *n = NULL;
const BIGNUM *e = NULL;
@@ -401,10 +401,10 @@ int pki_scard::renameOnToken(const sloti
void pki_scard::store_token(const slotid &slot, EVP_PKEY *pkey)
{
QByteArray ba;
- RSA *rsa;
- DSA *dsa;
+ const RSA *rsa;
+ const DSA *dsa;
#ifndef OPENSSL_NO_EC
- EC_KEY *ec;
+ const EC_KEY *ec;
#endif
pk11_attlist pub_atts;
pk11_attlist priv_atts;
@@ -691,7 +691,7 @@ pki_scard::~pki_scard()
void pki_scard::fromData(const unsigned char *p, db_header_t *head )
{
int version, size;
- void *ptr = NULL;
+ const void *ptr = NULL;
size = head->len - sizeof(db_header_t);
version = head->version;
@@ -713,8 +713,23 @@ void pki_scard::fromData(const unsigned
d2i(ba);
- if (key)
- ptr = EVP_PKEY_get0(key);
+ if (key) {
+ switch (EVP_PKEY_type(EVP_PKEY_id(key))) {
+ case EVP_PKEY_RSA:
+ ptr = EVP_PKEY_get0_RSA(key);
+ break;
+ case EVP_PKEY_DSA:
+ ptr = EVP_PKEY_get0_DSA(key);
+ break;
+#ifndef OPENSSL_NO_EX
+ case EVP_PKEY_EC:
+ ptr = EVP_PKEY_get0_EC_KEY(key);
+ break;
+#endif
+ default:
+ ptr = EVP_PKEY_get0(key);
+ }
+ }
if (!ptr)
throw errorEx(tr("Ignoring unsupported token key"));

View file

@ -0,0 +1,23 @@
diff -Naurp xca-2.5.0.orig/lib/db_x509.cpp xca-2.5.0.new/lib/db_x509.cpp
--- xca-2.5.0.orig/lib/db_x509.cpp 2023-09-24 20:22:03.000000000 +0200
+++ xca-2.5.0.new/lib/db_x509.cpp 2024-01-22 08:22:11.704982550 +0100
@@ -768,13 +768,15 @@ void db_x509::certRenewal(QModelIndexLis
newcert->sign(signkey, oldcert->getDigest());
newcert = dynamic_cast<pki_x509 *>(insert(newcert));
createSuccess(newcert);
-
- // delete old certificate if requested
- if (doReplace)
- deletePKI(idx);
}
if (doRevoke)
do_revoke(indexes, r);
+
+ // delete old certificates if requested
+ if (doReplace)
+ foreach(idx, indexes)
+ if (fromIndex<pki_x509>(idx))
+ deletePKI(idx);
}
catch (errorEx &err) {
XCA_ERROR(err);

90
xca-2.5-pastekey.patch Normal file
View file

@ -0,0 +1,90 @@
From d29d55ab20509d3e7d279f1fcd85374b5fecdcd8 Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Thu, 2 Nov 2023 14:06:12 +0100
Subject: [PATCH] Close #477: paste an encrypted private key results in a crash
Improve error- and password handling:
- Also identify: (ERR_LIB_PROV:PROV_R_BAD_DECRYPT) as password error.
- Do not use the OpenSSL internal bitfield definition (0xff000fff)
but the official API: ERR_GET_LIB(), ERR_GET_REASON()
Especially ERR_LIB_OFFSET changed from 24 to 23 in Openssl 3.0.0
- First check for "Cancel", then for invalid password to avoid
an "Invalid Password" message after aborting the password input dialog.
---
lib/pki_evp.cpp | 16 +++++++++++-----
lib/pki_multi.cpp | 3 +++
2 files changed, 14 insertions(+), 5 deletions(-)
diff --git a/lib/pki_evp.cpp b/lib/pki_evp.cpp
index d2097ed2..54846d5c 100644
--- a/lib/pki_evp.cpp
+++ b/lib/pki_evp.cpp
@@ -22,6 +22,7 @@
#include <openssl/pem.h>
#include <openssl/pkcs12.h>
#include <openssl/err.h>
+#include <openssl/proverr.h>
Passwd pki_evp::passwd;
@@ -213,10 +214,14 @@ pki_evp::pki_evp(EVP_PKEY *pkey)
bool pki_evp::openssl_pw_error() const
{
- switch (ERR_peek_error() & 0xff000fff) {
+ unsigned long e = ERR_peek_error();
+
+ switch (ERR_PACK(ERR_GET_LIB(e), 0, ERR_GET_REASON(e))) {
case ERR_PACK(ERR_LIB_PEM, 0, PEM_R_BAD_DECRYPT):
case ERR_PACK(ERR_LIB_PEM, 0, PEM_R_BAD_PASSWORD_READ):
case ERR_PACK(ERR_LIB_EVP, 0, EVP_R_BAD_DECRYPT):
+ case ERR_PACK(ERR_LIB_PROV, 0, PROV_R_BAD_DECRYPT):
+ case ERR_PACK(ERR_LIB_PKCS12, 0, PKCS12_R_PKCS12_CIPHERFINAL_ERROR):
pki_ign_openssl_error();
return true;
}
@@ -230,14 +235,15 @@ void pki_evp::fromPEMbyteArray(const QByteArray &ba, const QString &name)
tr("Please enter the password to decrypt the private key %1.")
.arg(name));
pkey = load_ssh_ed25519_privatekey(ba, p);
+ pki_ign_openssl_error();
while (!pkey) {
pkey = PEM_read_bio_PrivateKey(BioByteArray(ba).ro(), NULL,
PwDialogCore::pwCallback, &p);
- if (openssl_pw_error())
- XCA_PASSWD_ERROR();
if (p.getResult() != pw_ok)
throw p.getResult();
+ if (openssl_pw_error())
+ XCA_PASSWD_ERROR();
if (pki_ign_openssl_error())
break;
}
@@ -396,10 +402,10 @@ void pki_evp::fload(const QString &fname)
do {
pkey = PEM_read_bio_PrivateKey(BioByteArray(ba).ro(),
NULL, cb, &p);
- if (openssl_pw_error())
- XCA_PASSWD_ERROR();
if (p.getResult() != pw_ok)
throw p.getResult();
+ if (openssl_pw_error())
+ XCA_PASSWD_ERROR();
if (pki_ign_openssl_error())
break;
} while (!pkey);
diff --git a/lib/pki_multi.cpp b/lib/pki_multi.cpp
index 1ed81035..f3c6332e 100644
--- a/lib/pki_multi.cpp
+++ b/lib/pki_multi.cpp
@@ -127,6 +127,9 @@ void pki_multi::fromPEMbyteArray(const QByteArray &_ba, const QString &name)
XCA_ERROR(err);
delete item;
item = NULL;
+ } catch (...) {
+ delete item;
+ item = NULL;
}
ba.remove(0, sizeof BEGIN -1);
}

46
xca-2.5-revokedel.patch Normal file
View file

@ -0,0 +1,46 @@
From 43e1b336d23e7512b246da142c78307baad4cbff Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Mon, 30 Oct 2023 01:11:30 +0100
Subject: [PATCH] Fix crash when deleting CA certificates
If a CA certificate is deleted, all issued certificates must be moved to
an other issuer or the top-level list.
The CA cert will be taken from the model together with the issued certs
first. Then the issued certs are re-inserted.
To make this work correctly, the issuer must be erased from the issued certs
to be interpreted as insertion and not as move.
---
lib/db_base.cpp | 2 +-
lib/pki_base.cpp | 5 ++++-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/lib/db_base.cpp b/lib/db_base.cpp
index 4d7cc87d..a2e4250f 100644
--- a/lib/db_base.cpp
+++ b/lib/db_base.cpp
@@ -302,7 +302,7 @@ void db_base::insertChild(pki_base *child, pki_base *parent)
if (parent != treeItem && treeview)
idx = index(parent);
- if (curr_parent) { // && curr_parent != parent)
+ if (curr_parent) {
int row = curr_parent->indexOf(child);
beginMoveRows(index(curr_parent), row, row, idx, 0);
curr_parent->takeChild(child);
diff --git a/lib/pki_base.cpp b/lib/pki_base.cpp
index 62ca3ac5..77722cb2 100644
--- a/lib/pki_base.cpp
+++ b/lib/pki_base.cpp
@@ -269,7 +269,10 @@ QList<pki_base*> pki_base::getChildItems() const
pki_base *pki_base::takeFirst()
{
- return childItems.takeFirst();
+ pki_base *pki = childItems.takeFirst();
+ if (pki)
+ pki->setParent(nullptr);
+ return pki;
}
QString pki_base::pki_source_name() const

View file

@ -0,0 +1,27 @@
When trying to use a private key when working on a database protected by
a password set by xca version < 2.0.0, version 2.5.0 might issue an error like:
---
The following error occurred:
(8pki_x509[]:foo)
error:0300009C:digital envelope routines::unsupported algorithm
error:068C0100:asn1 encoding routines::malloc failure
error:068C0100:asn1 encoding routines::malloc failure
(pki_x509.cpp:574)
---
The database is therefore unusable as it is in xca 2.5.0 for any operation
involving some private key.
The solution is to reset the database password with xca version 2.4.0
(Extra --> Change Database password). The new password may be the same as
the old one.
If some private keys have their own password, reset the latter the same
way (right click --> Change password).
Once these operations have been performed, the database is ready for use with
xca version 2.5.
See https://github.com/chris2511/xca/discussions/468.

View file

@ -3,17 +3,18 @@
Summary: Graphical X.509 certificate management tool
Name: xca
Version: 2.4.0
Release: 5%{?dist}
Version: 2.5.0
Release: 3%{?dist}
License: BSD
URL: https://hohnstaedt.de/xca/
Source0: https://github.com/%{gitowner0}/%{gitproject0}/releases/download/RELEASE.%{version}/%{name}-%{version}.tar.gz
Patch1: xca-2.4.0-openssl3.patch
Patch2: xca-2.4.0-noclean.patch
Patch3: xca-2.4.0-mimeicons.patch
Patch4: xca-2.4.0-lang-it.patch
Patch5: xca-2.4.0-lang-fr.patch
Source1: xca-2.5.0-README.IMPORTANT
Patch1: xca-2.5-pastekey.patch
Patch2: xca-2.5-revokedel.patch
Patch3: xca-2.5-delete_after_revoke.patch
BuildRequires: cmake
BuildRequires: make
BuildRequires: gcc-c++
BuildRequires: qt5-qtbase-devel
@ -23,6 +24,7 @@ BuildRequires: openssl-devel
BuildRequires: xdg-utils
BuildRequires: libtool-ltdl-devel
BuildRequires: python3-sphinx
BuildRequires: python3-sphinxcontrib-qthelp
Requires: hicolor-icon-theme
@ -50,24 +52,23 @@ format, portable across operating systems.
#-------------------------------------------------------------------------------
%autosetup -p 1
cp '%{SOURCE1}' README.IMPORTANT
#-------------------------------------------------------------------------------
%build
#-------------------------------------------------------------------------------
%configure CXXFLAGS='%{optflags}' \
STRIP=: \
LIBS='-Wl,-as-needed'
make %{?_smp_mflags}
export CXXFLAGS='%{optflags} -DDOCDIR=\"%{_docdir}/xca\"'
%cmake -DCMAKE_SHARED_LINKER_FLAGS="-Wl,--as-needed"
%cmake_build
#-------------------------------------------------------------------------------
%install
#-------------------------------------------------------------------------------
make DESTDIR='%{buildroot}' \
ICON_SIZES='16x16 32x32 48x48 64x64 128x128 256x256' install
%cmake_install
# Do not include db statistics program and man.
find '%{buildroot}' -name 'xca_db_stat*' -delete
@ -75,6 +76,10 @@ find '%{buildroot}' -name 'xca_db_stat*' -delete
# Do not use pixmaps directory.
rm -rf '%{buildroot}%{_datadir}/pixmaps'
# Reinstall documentation.
rm -rf '%{buildroot}%{_docdir}/xca'/*
mv '%{buildroot}%{_datadir}/xca/html' '%{buildroot}%{_docdir}/xca/'
# Install mime file types.
install -d -m 755 '%{buildroot}%{_datadir}/mime/packages'
install -p -m 644 misc/xca.xml '%{buildroot}%{_datadir}/mime/packages/'
@ -96,7 +101,7 @@ desktop-file-install --mode 0644 \
%files -f %{name}.lang
#-------------------------------------------------------------------------------
%doc AUTHORS COPYRIGHT
%doc AUTHORS COPYRIGHT README.IMPORTANT
%doc %{_docdir}/xca/*
%{_bindir}/*
%dir %{_datadir}/xca
@ -111,6 +116,25 @@ desktop-file-install --mode 0644 \
#-------------------------------------------------------------------------------
%changelog
#-------------------------------------------------------------------------------
* Mon Jan 22 2024 Patrick Monnerat <patrick@monnerat.net> 2.5.0-3
- Patch "pastekey" fixes a crash pasting an encrypted private key.
https://github.com/chris2511/xca/commit/d29d55a
- Patch "revokedel" fixes a freeze when deleting a certificate.
https://github.com/chris2511/xca/commit/43e1b33
- Patch "delete_after_revoke" fixes a crash deleting+revoking a certificate.
https://bugzilla.redhat.com/show_bug.cgi?id=2259477
* Tue Nov 07 2023 Miro Hrončok <mhroncok@redhat.com> - 2.5.0-2
- Explicitly BuildRequire python3-sphinxcontrib-qthelp
* Fri Oct 6 2023 Patrick Monnerat <patrick@monnerat.net> 2.5.0-1
- New upstream release.
- Build using cmake.
- Doc file "README.IMPORTANT" for needed passord reset.
https://github.com/chris2511/xca/issues/458#issuecomment-1740106691
* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.0-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
@ -123,8 +147,6 @@ desktop-file-install --mode 0644 \
* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
#-------------------------------------------------------------------------------
* Sat Nov 13 2021 Patrick Monnerat <patrick@monnerat.net> 2.4.0-1
- New upstream release.
- Patch "openssl3" for openssl version 3 compatibility.