| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192 |
- MozNSS: better file name matching for hashed CA certificate directory
- CA certificate files in OpenSSL compatible CACERTDIR were loaded if the file extension was '.0'. However the file name
- should be 8 letters long certificate hash of the certificate subject name, followed by a numeric suffix which is used
- to differentiate between two certificates with the same subject name.
- Wit this patch, certificate file names are matched correctly (using regular expressions).
- Author: Jan Vcelak <jvcelak@redhat.com>
- Upstream ITS: #7374
- Resolves: #852786
- diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
- index 5e49fc5..61d71d4 100644
- --- a/libraries/libldap/tls_m.c
- +++ b/libraries/libldap/tls_m.c
- @@ -38,6 +38,7 @@
- #include <ac/unistd.h>
- #include <ac/param.h>
- #include <ac/dirent.h>
- +#include <ac/regex.h>
-
- #include "ldap-int.h"
- #include "ldap-tls.h"
- @@ -118,9 +119,7 @@ static const PRIOMethods tlsm_PR_methods;
-
- #define PEM_LIBRARY "nsspem"
- #define PEM_MODULE "PEM"
- -/* hash files for use with cacertdir have this file name suffix */
- -#define PEM_CA_HASH_FILE_SUFFIX ".0"
- -#define PEM_CA_HASH_FILE_SUFFIX_LEN 2
- +#define PEM_CA_HASH_FILE_REGEX "^[0-9a-f]{8}\\.[0-9]+$"
-
- static SECMODModule *pem_module;
-
- @@ -1541,6 +1540,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
- PRDir *dir;
- PRDirEntry *entry;
- PRStatus fistatus = PR_FAILURE;
- + regex_t hashfile_re;
-
- memset( &fi, 0, sizeof(fi) );
- fistatus = PR_GetFileInfo( cacertdir, &fi );
- @@ -1570,20 +1570,30 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
- goto done;
- }
-
- + if ( regcomp( &hashfile_re, PEM_CA_HASH_FILE_REGEX, REG_NOSUB|REG_EXTENDED ) != 0 ) {
- + Debug( LDAP_DEBUG_ANY, "TLS: cannot compile regex for CA hash files matching\n", 0, 0, 0 );
- + goto done;
- + }
- +
- do {
- entry = PR_ReadDir( dir, PR_SKIP_BOTH | PR_SKIP_HIDDEN );
- if ( ( NULL != entry ) && ( NULL != entry->name ) ) {
- char *fullpath = NULL;
- - char *ptr;
- + int match;
-
- - ptr = PL_strrstr( entry->name, PEM_CA_HASH_FILE_SUFFIX );
- - if ( ( ptr == NULL ) || ( *(ptr + PEM_CA_HASH_FILE_SUFFIX_LEN) != '\0' ) ) {
- + match = regexec( &hashfile_re, entry->name, 0, NULL, 0 );
- + if ( match == REG_NOMATCH ) {
- Debug( LDAP_DEBUG_TRACE,
- - "TLS: file %s does not end in [%s] - does not appear to be a CA certificate "
- - "directory file with a properly hashed file name - skipping.\n",
- - entry->name, PEM_CA_HASH_FILE_SUFFIX, 0 );
- + "TLS: skipping '%s' - filename does not have expected format "
- + "(certificate hash with numeric suffix)\n", entry->name, 0, 0 );
- + continue;
- + } else if ( match != 0 ) {
- + Debug( LDAP_DEBUG_ANY,
- + "TLS: cannot execute regex for CA hash file matching (%d).\n",
- + match, 0, 0 );
- continue;
- }
- +
- fullpath = PR_smprintf( "%s/%s", cacertdir, entry->name );
- if ( !tlsm_add_cert_from_file( ctx, fullpath, isca ) ) {
- Debug( LDAP_DEBUG_TRACE,
- @@ -1599,6 +1609,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
- PR_smprintf_free( fullpath );
- }
- } while ( NULL != entry );
- + regfree ( &hashfile_re );
- PR_CloseDir( dir );
- }
- done:
- --
- 1.7.11.4
|
