389-commits June 2009

389-commits@lists.fedoraproject.org

1 participants
17 discussions

esc/win32 setup.iss,1.14,1.15
by Jack Magne 24 Jun '09

24 Jun '09

Author: jmagne Update of /cvs/dirsec/esc/win32 In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv22189 Modified Files: setup.iss Log Message: Fixed typos. Index: setup.iss =================================================================== RCS file: /cvs/dirsec/esc/win32/setup.iss,v retrieving revision 1.14 retrieving revision 1.15 diff -u -r1.14 -r1.15 --- setup.iss 24 Jun 2009 23:17:50 -0000 1.14 +++ setup.iss 24 Jun 2009 23:24:18 -0000 1.15 @@ -5,16 +5,16 @@ AppName=Smart Card Manager AppMutex=ESCMutex AppVerName=Smart Card Manager 1.1.0-8 -AppPublisher=Red Hat, Inc. +AppPublisher=Fedora CreateAppDir=true Compression=lzma SolidCompression=true MinVersion=0,5.0.2195 ShowLanguageDialog=yes OutputBaseFilename=SmartCardManagerSetup-1.1.0-8.win32.i386 -DefaultDirName={pf}\Red Hat\ESC +DefaultDirName={pf}\Fedora\ESC DisableProgramGroupPage=false -DefaultGroupName=Red Hat +DefaultGroupName=Fedora SetupIconFile=BUILD\ESC\components\esc.ico UninstallDisplayIcon={app}\components\esc.ico WizardImageFile=BUILD\ESC\chrome\content\esc\esc-image-large.bmp

1 0

esc/win32 setup.iss,1.13,1.14 build.sh,1.10,1.11
by Jack Magne 24 Jun '09

24 Jun '09

Author: jmagne Update of /cvs/dirsec/esc/win32 In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv20188 Modified Files: setup.iss build.sh Log Message: Bump version. Index: setup.iss =================================================================== RCS file: /cvs/dirsec/esc/win32/setup.iss,v retrieving revision 1.13 retrieving revision 1.14 diff -u -r1.13 -r1.14 --- setup.iss 19 Jun 2009 21:00:49 -0000 1.13 +++ setup.iss 24 Jun 2009 23:17:50 -0000 1.14 @@ -4,28 +4,27 @@ [Setup] AppName=Smart Card Manager AppMutex=ESCMutex -AppVerName=Smart Card Manager 1.1.0-7 -AppPublisher=Fedora +AppVerName=Smart Card Manager 1.1.0-8 +AppPublisher=Red Hat, Inc. CreateAppDir=true Compression=lzma SolidCompression=true MinVersion=0,5.0.2195 ShowLanguageDialog=yes -OutputBaseFilename=SmartCardManagerSetup-1.1.0-7.win32.i386 -DefaultDirName={pf}\Fedora\ESC +OutputBaseFilename=SmartCardManagerSetup-1.1.0-8.win32.i386 +DefaultDirName={pf}\Red Hat\ESC DisableProgramGroupPage=false -DefaultGroupName=Fedora +DefaultGroupName=Red Hat SetupIconFile=BUILD\ESC\components\esc.ico UninstallDisplayIcon={app}\components\esc.ico -;WizardImageFile=BUILD\ESC\chrome\content\esc\esc-image-large.bmp -WizardImageFile=esc-image-large.bmp +WizardImageFile=BUILD\ESC\chrome\content\esc\esc-image-large.bmp WizardSmallImageFile=BUILD\ESC\components\esc.bmp AllowNoIcons=yes LicenseFile=esc-license.txt InfoBeforeFile=info-before.txt InfoAfterFile=info-after.txt PrivilegesRequired=admin -VersionInfoVersion=1.1.0.7 +VersionInfoVersion=1.1.0.8 [Files] @@ -438,13 +437,14 @@ Root: HKLM; Subkey: Software\Microsoft\Cryptography\Calais\SmartCards\Gemalto 64K V2; ValueType: binary; ValueName: ATR; ValueData: 3b 95 00 40 00 ae 01 03 00 00 -; Now register the Safenet 330J +; Now register the Safenet 330J Root: HKLM; Subkey: Software\Microsoft\Cryptography\Calais\SmartCards\Safenet 330J; ValueType: binary; ValueName: ATRMask; ValueData: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00; Flags: uninsdeletekey Root: HKLM; Subkey: Software\Microsoft\Cryptography\Calais\SmartCards\Safenet 330J; ValueType: string; ValueName: Crypto Provider; ValueData: CoolKey PKCS #11 CSP Root: HKLM; Subkey: Software\Microsoft\Cryptography\Calais\SmartCards\Safenet 330J; ValueType: binary; ValueName: ATR; ValueData: 3b ec 00 ff 81 31 fe 45 a0 00 00 00 56 33 33 30 4a 33 06 00 00 + Root: HKLM; Subkey: Software\ ; Turn off the "pick a cert" dialog box Root: HKCU; Subkey: Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3; ValueType: dword; ValueName: 1A04; ValueData: 0 Index: build.sh =================================================================== RCS file: /cvs/dirsec/esc/win32/build.sh,v retrieving revision 1.10 retrieving revision 1.11 diff -u -r1.10 -r1.11 --- build.sh 6 Jun 2009 00:30:35 -0000 1.10 +++ build.sh 24 Jun 2009 23:17:50 -0000 1.11 @@ -78,7 +78,7 @@ #ESC values ESC_NAME=esc -ESC_VERSION_NO=1.1.0-6 +ESC_VERSION_NO=1.1.0-8 #Cygwin values

1 0

esc/src/lib/NssHttpClient httpClientNss.cpp,1.3,1.4
by Jack Magne 22 Jun '09

22 Jun '09

Author: jmagne Update of /cvs/dirsec/esc/src/lib/NssHttpClient In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv2297 Modified Files: httpClientNss.cpp Log Message: Bugzilla Index: httpClientNss.cpp =================================================================== RCS file: /cvs/dirsec/esc/src/lib/NssHttpClient/httpClientNss.cpp,v retrieving revision 1.3 retrieving revision 1.4 diff -u -r1.3 -r1.4 --- httpClientNss.cpp 4 Feb 2009 01:43:47 -0000 1.3 +++ httpClientNss.cpp 23 Jun 2009 02:02:02 -0000 1.4 @@ -64,8 +64,53 @@ PSHttpResponse *HttpClientNss::httpSendChunked(char *host_port, char *uri, char *method, char *body,PSChunkedResponseCallback cb,void *uw,PRBool doSSL,int messageTimeout ) { - - PSHttpServer server(host_port, PR_AF_INET); + char *pPort = NULL; + char *pPortActual = NULL; + + char hostName[512]; + + /* + * Isolate the host name, account for IPV6 numeric addresses. + * + */ + + if(host_port) + strncpy(hostName,host_port,512); + + pPort = hostName; + while(1) { + pPort = strchr(pPort, ':'); + if (pPort) { + pPortActual = pPort; + pPort++; + } else + break; + } + + if(pPortActual) + *pPortActual = '\0'; + + /* + * Rifle through the values for the host + */ + + PRAddrInfo *ai; + void *iter; + PRNetAddr addr; + int family = PR_AF_INET; + + ai = PR_GetAddrInfoByName(hostName, PR_AF_UNSPEC, PR_AI_ADDRCONFIG); + if (ai) { + printf("%s\n", PR_GetCanonNameFromAddrInfo(ai)); + iter = NULL; + while ((iter = PR_EnumerateAddrInfo(iter, ai, 0, &addr)) != NULL) { + family = PR_NetAddrFamily(&addr); + break; + } + PR_FreeAddrInfo(ai); + } + + PSHttpServer server(host_port, family); PSHttpRequest request( &server, uri, HTTP11, 0 ); _request = &request;

1 0

esc/src/app/xul/esc/chrome/content/esc certManager.xul, 1.4, 1.5
by Jack Magne 19 Jun '09

19 Jun '09

Author: jmagne Update of /cvs/dirsec/esc/src/app/xul/esc/chrome/content/esc In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv27580/app/xul/esc/chrome/content/esc Modified Files: certManager.xul Log Message: Bugzilla#479722 ESC to TPS SSL communication problem with renewed TPS cert. Index: certManager.xul =================================================================== RCS file: /cvs/dirsec/esc/src/app/xul/esc/chrome/content/esc/certManager.xul,v retrieving revision 1.4 retrieving revision 1.5 diff -u -r1.4 -r1.5 --- certManager.xul 7 Jun 2009 00:09:16 -0000 1.4 +++ certManager.xul 19 Jun 2009 21:03:39 -0000 1.5 @@ -65,7 +65,7 @@ <tabs id="certMgrTabbox" onselect="CertsTabsSelected();"> <tab id="mine_tab" label="&certmgr.tab.mine;" selected="true"/> <tab id="others_tab" hidden="true" label="&certmgr.tab.others2;"/> - <tab id="websites_tab" hidden="true" label="&certmgr.tab.websites3;"/> + <tab id="websites_tab" hidden="false" label="&certmgr.tab.websites3;"/> <tab id="ca_tab" hidden="false" label="&certmgr.tab.ca;"/> <tab id="orphan_tab" hidden="true" label="&certmgr.tab.orphan2;"/>

1 0

esc/src/lib/NssHttpClient engine.cpp, 1.4, 1.5 engine.h, 1.1.1.1, 1.2 manifest.mn, 1.4, 1.5
by Jack Magne 19 Jun '09

19 Jun '09

Author: jmagne Update of /cvs/dirsec/esc/src/lib/NssHttpClient In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv27580/lib/NssHttpClient Modified Files: engine.cpp engine.h manifest.mn Log Message: Bugzilla#479722 ESC to TPS SSL communication problem with renewed TPS cert. Index: engine.cpp =================================================================== RCS file: /cvs/dirsec/esc/src/lib/NssHttpClient/engine.cpp,v retrieving revision 1.4 retrieving revision 1.5 diff -u -r1.4 -r1.5 --- engine.cpp 24 Feb 2007 02:10:45 -0000 1.4 +++ engine.cpp 19 Jun 2009 21:03:40 -0000 1.5 @@ -16,6 +16,8 @@ * All rights reserved. * END COPYRIGHT BLOCK **/ +#define FORCE_PR_LOG 1 + #include <nspr.h> #include "sslproto.h" #include <prerror.h> @@ -27,7 +29,7 @@ #include "certt.h" #include "sslerr.h" #include "secerr.h" - +#include "CoolKey.h" #include "engine.h" #include "http.h" @@ -39,6 +41,9 @@ int cipherCount = 0; int _doVerifyServerCert = 1; +PRLogModuleInfo *httpEngineLog = PR_NewLogModule("coolKeyHttpEngine"); + + PRIntervalTime Engine::globaltimeout = PR_TicksPerSecond()*30; /** @@ -56,13 +61,26 @@ SECStatus secStatus = SECFailure; PRErrorCode err; + char tBuff[56]; + + PR_LOG(httpEngineLog, PR_LOG_DEBUG, + ("%s myBadCertHandler enter. \n",GetTStamp(tBuff,56))); + /* log invalid cert here */ if ( !arg ) { return secStatus; } - *(PRErrorCode *)arg = err = PORT_GetError(); + err = PORT_GetError(); + + BadCertData *data = (BadCertData *) arg; + if(data) { + data->error = err; + } + + PR_LOG(httpEngineLog, PR_LOG_DEBUG, + ("%s myBadCertHandler err: %d . \n",GetTStamp(tBuff,56),err)); /* If any of the cases in the switch are met, then we will proceed */ /* with the processing of the request anyway. Otherwise, the default */ @@ -91,6 +109,10 @@ break; } + PR_LOG(httpEngineLog, PR_LOG_DEBUG, + ("%s myBadCertHandler status: %d . \n",GetTStamp(tBuff,56),secStatus)); + + return secStatus; } @@ -416,7 +438,6 @@ return; } - void Engine::CloseConnection() { connectionClosed = true; @@ -426,7 +447,14 @@ PR_Close(_sock); _sock = NULL; } + + if(_certData) + { + delete _certData; + _certData = NULL; + } } + /** * Returns a file descriptor for I/O if the HTTP connection is successful * @param addr PRnetAddr structure which points to the server to connect to @@ -442,21 +470,19 @@ PRFileDesc *tcpsock = NULL; PRFileDesc *sock = NULL; connectionClosed = false; + _certData = new BadCertData(); tcpsock = PR_OpenTCPSocket(addr->raw.family); - if (!tcpsock) { - return NULL; } nodelay(tcpsock); if (PR_TRUE == SSLOn) { - sock=SSL_ImportFD(NULL, tcpsock); - + sock=SSL_ImportFD(NULL, tcpsock); if (!sock) { //xxx log if( tcpsock != NULL ) { @@ -516,9 +542,23 @@ PRErrorCode errCode = 0; - rv = SSL_BadCertHook( sock, + if(_certData) { + _certData->error = errCode; + _certData->port = PR_ntohs(PR_NetAddrInetPort(addr)); + } + + CoolKeyBadCertHandler overriddenHandler = CoolKeyGetBadCertHandler(); + + if(overriddenHandler) { + rv = SSL_BadCertHook( sock, + (SSLBadCertHandler)overriddenHandler, + (void *)_certData); + } else { + rv = SSL_BadCertHook( sock, (SSLBadCertHandler)myBadCertHandler, - &errCode ); + (void *)_certData); + } + rv = SSL_SetURL( sock, serverName ); if (rv != SECSuccess ) { @@ -536,8 +576,6 @@ sock = tcpsock; } - - if ( PR_Connect(sock, addr, timeout) == PR_FAILURE ) { if( sock != NULL ) { @@ -563,11 +601,17 @@ const PSHttpServer& server, int timeout, PRBool expectChunked ,PRBool processStreamed) { PRNetAddr addr; - PRFileDesc *sock = NULL; PSHttpResponse *resp = NULL; PRBool response_code = 0; + char tBuff[56]; + + PR_LOG(httpEngineLog, PR_LOG_DEBUG, + ("%s HttpEngine::makeRequest enter. \n",GetTStamp(tBuff,56))); + + + server.getAddr(&addr); char *nickName = request.getCertNickName(); @@ -575,8 +619,17 @@ char *serverName = (char *)server.getAddr(); _sock = _doConnect( &addr, request.isSSL(), 0, 0,nickName, 0, serverName ); + PR_LOG(httpEngineLog, PR_LOG_DEBUG, + ("%s HttpEngine::makeRequest past doConnect sock: %p. \n", + GetTStamp(tBuff,56),_sock)); + if ( _sock != NULL) { PRBool status = request.send( _sock ); + + PR_LOG(httpEngineLog, PR_LOG_DEBUG, + ("%s HttpEngine::makeRequest past request.send status: %d. \n", + GetTStamp(tBuff,56),status)); + if ( status ) { resp = new PSHttpResponse( _sock, &request, timeout, expectChunked ,this); response_code = resp->processResponse(processStreamed); Index: engine.h =================================================================== RCS file: /cvs/dirsec/esc/src/lib/NssHttpClient/engine.h,v retrieving revision 1.1.1.1 retrieving revision 1.2 diff -u -r1.1.1.1 -r1.2 --- engine.h 12 Jun 2006 23:39:52 -0000 1.1.1.1 +++ engine.h 19 Jun 2009 21:03:40 -0000 1.2 @@ -22,9 +22,17 @@ #include "response.h" #include "request.h" +struct BadCertData { + PRErrorCode error; + PRInt32 port; +}; + +typedef struct BadCertData BadCertData; + + class __EXPORT Engine { public: - Engine() {}; + Engine() { _certData = NULL; _sock=NULL;}; ~Engine() {}; PRFileDesc *_doConnect(PRNetAddr *addr, PRBool SSLOn = PR_FALSE, @@ -37,7 +45,8 @@ static PRIntervalTime globaltimeout; PRFileDesc *_sock; - + BadCertData *_certData; + BadCertData *getBadCertData() { return _certData;} PRFileDesc *getSocket() { return _sock;} bool connectionClosed ; Index: manifest.mn =================================================================== RCS file: /cvs/dirsec/esc/src/lib/NssHttpClient/manifest.mn,v retrieving revision 1.4 retrieving revision 1.5 diff -u -r1.4 -r1.5 --- manifest.mn 4 Feb 2009 01:43:47 -0000 1.4 +++ manifest.mn 19 Jun 2009 21:03:40 -0000 1.5 @@ -24,7 +24,7 @@ MODULE = httpchunked LIBRARY_NAME = $(MODULE) SHARED_NAME = $(MODULE) -REQUIRES = nss nspr +REQUIRES = nss nspr ckymanager ifndef MOZ_OFFSET MOZ_OFFSET = mozilla-1.7.13 endif

1 0

esc/src/lib/coolkey CoolKey.cpp, 1.10, 1.11 CoolKey.h, 1.8, 1.9 Makefile, 1.2, 1.3 manifest.mn, 1.5, 1.6
by Jack Magne 19 Jun '09

19 Jun '09

Author: jmagne Update of /cvs/dirsec/esc/src/lib/coolkey In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv27580/lib/coolkey Modified Files: CoolKey.cpp CoolKey.h Makefile manifest.mn Log Message: Bugzilla#479722 ESC to TPS SSL communication problem with renewed TPS cert. Index: CoolKey.cpp =================================================================== RCS file: /cvs/dirsec/esc/src/lib/coolkey/CoolKey.cpp,v retrieving revision 1.10 retrieving revision 1.11 diff -u -r1.10 -r1.11 --- CoolKey.cpp 13 Jun 2009 23:44:52 -0000 1.10 +++ CoolKey.cpp 19 Jun 2009 21:03:40 -0000 1.11 @@ -259,12 +259,14 @@ static CoolKeyRelease g_Release = NULL; static CoolKeyGetConfigValue g_GetConfigValue = NULL; static CoolKeySetConfigValue g_SetConfigValue = NULL; +static CoolKeyBadCertHandler g_BadCertHandler = NULL; char* CoolKeyVerifyPassword(PK11SlotInfo *,PRBool,void *); COOLKEY_API HRESULT CoolKeySetCallbacks(CoolKeyDispatch dispatch, CoolKeyReference reference, CoolKeyRelease release, - CoolKeyGetConfigValue getconfigvalue,CoolKeySetConfigValue setconfigvalue) + CoolKeyGetConfigValue getconfigvalue,CoolKeySetConfigValue setconfigvalue, + CoolKeyBadCertHandler badcerthandler) { char tBuff[56]; g_Dispatch = dispatch; @@ -272,6 +274,7 @@ g_Release = release; g_GetConfigValue = getconfigvalue; g_SetConfigValue = setconfigvalue; + g_BadCertHandler = badcerthandler; char * suppressPINPrompt =(char*) CoolKeyGetConfig("esc.security.url"); @@ -1300,6 +1303,13 @@ return aCUID; } +CoolKeyBadCertHandler CoolKeyGetBadCertHandler() +{ + if(g_BadCertHandler) + return g_BadCertHandler; + return NULL; +} + const char *CoolKeyGetConfig(const char *aValue) { if(!g_GetConfigValue || ! aValue) Index: CoolKey.h =================================================================== RCS file: /cvs/dirsec/esc/src/lib/coolkey/CoolKey.h,v retrieving revision 1.8 retrieving revision 1.9 diff -u -r1.8 -r1.9 --- CoolKey.h 13 Jun 2009 23:44:52 -0000 1.8 +++ CoolKey.h 19 Jun 2009 21:03:40 -0000 1.9 @@ -26,6 +26,7 @@ // platforms (coreconf will do the appropriate processing. #define COOLKEY_API +#include "ssl.h" #include <string.h> #include <stdlib.h> #include <vector> @@ -100,7 +101,7 @@ typedef HRESULT (*CoolKeySetConfigValue)(const char *name,const char *value); typedef const char * (*CoolKeyGetConfigValue)(const char *name); - +typedef SECStatus (*CoolKeyBadCertHandler)(void *arg, PRFileDesc *fd); extern "C" { @@ -112,7 +113,8 @@ COOLKEY_API HRESULT CoolKeyUnregisterListener(CoolKeyListener* aListener); COOLKEY_API HRESULT CoolKeySetCallbacks(CoolKeyDispatch dispatch, CoolKeyReference reference, CoolKeyRelease release, - CoolKeyGetConfigValue getconfigvalue,CoolKeySetConfigValue setconfigvalue); + CoolKeyGetConfigValue getconfigvalue,CoolKeySetConfigValue setconfigvalue, + CoolKeyBadCertHandler badcerthandler=NULL); COOLKEY_API bool CoolKeyRequiresAuthentication(const CoolKey *aKey); COOLKEY_API bool CoolKeyHasApplet(const CoolKey *aKey); @@ -259,6 +261,9 @@ const char *CoolKeyGetConfig(const char *aName); HRESULT CoolKeySetConfig(const char *aName,const char *aValue); +CoolKeyBadCertHandler CoolKeyGetBadCertHandler(); + + } Index: Makefile =================================================================== RCS file: /cvs/dirsec/esc/src/lib/coolkey/Makefile,v retrieving revision 1.2 retrieving revision 1.3 diff -u -r1.2 -r1.3 --- Makefile 10 Jan 2007 02:21:25 -0000 1.2 +++ Makefile 19 Jun 2009 21:03:40 -0000 1.3 @@ -35,6 +35,9 @@ echo "Build Linux or Windows." make -f common.mk +export:: + make -f common.mk export + endif ifeq ($(OS_ARCH),Darwin) Index: manifest.mn =================================================================== RCS file: /cvs/dirsec/esc/src/lib/coolkey/manifest.mn,v retrieving revision 1.5 retrieving revision 1.6 diff -u -r1.5 -r1.6 --- manifest.mn 23 Apr 2009 22:04:11 -0000 1.5 +++ manifest.mn 19 Jun 2009 21:03:40 -0000 1.6 @@ -19,7 +19,6 @@ XULRUNNER_BASE=$(CORE_DEPTH)/dist/$(OBJDIR)//xulrunner_build - SYS_INC = /usr/include MODULE = ckymanager LIBRARY_NAME = $(MODULE) @@ -41,7 +40,7 @@ SmartCardMonitoringThread.cpp \ $(NULL) -EXPORTS = \ +EXPORTS = \ CoolKey.h \ $(NULL)

1 0

esc/src/app/xpcom Makefile.sdk, 1.3, 1.4 rhCoolKey.cpp, 1.11, 1.12 rhCoolKey.h, 1.1.1.1, 1.2
by Jack Magne 19 Jun '09

19 Jun '09

Author: jmagne Update of /cvs/dirsec/esc/src/app/xpcom In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv27580/app/xpcom Modified Files: Makefile.sdk rhCoolKey.cpp rhCoolKey.h Log Message: Bugzilla#479722 ESC to TPS SSL communication problem with renewed TPS cert. Index: Makefile.sdk =================================================================== RCS file: /cvs/dirsec/esc/src/app/xpcom/Makefile.sdk,v retrieving revision 1.3 retrieving revision 1.4 diff -u -r1.3 -r1.4 --- Makefile.sdk 17 Apr 2009 00:11:11 -0000 1.3 +++ Makefile.sdk 19 Jun 2009 21:03:39 -0000 1.4 @@ -109,7 +109,7 @@ CPPFLAGS += -fno-rtti \ -fno-exceptions \ -fshort-wchar -fPIC -GECKO_LD_LIBS=-L$(GECKO_SDK_PATH)/lib $(GECKO_SDK_PATH)/lib/libxpcomglue.a -lnss3 -lcrmf -lssl3 -lsmime3 -lplds4 -lplc4 -lnspr4 -lpthread -ldl +GECKO_LD_LIBS=-L$(GECKO_SDK_PATH)/lib $(GECKO_SDK_PATH)/lib/libxpcomglue.a -lnssutil3 -lnss3 -lcrmf -lssl3 -lsmime3 -lplds4 -lplc4 -lnspr4 -lpthread -ldl endif ifeq ($(OS_ARCH),WINNT) @@ -145,7 +145,7 @@ GECKO_INCLUDES += -I $(GECKO_SDK_PATH)/sdk/include OBJECT = rhCoolKey.obj OBJECTCSP = CoolKeyCSP.obj -COOL_LDFLAGS = -IMPLIB:fake-import /LIBPATH:$(CORE_DIST)/lib ckymanager.lib httpchunked.lib $(GECKO_LD_LIBS) nss3.lib ssl3.lib smime3.lib softokn3.lib /LIBPATH:$(CKY_LIB_LDD) libckyapplet.lib crypt32.lib kernel32.lib user32.lib gdi32.lib winmm.lib wsock32.lib advapi32.lib /NODEFAULTLIB:libc.lib +COOL_LDFLAGS = -IMPLIB:fake-import /LIBPATH:$(CORE_DIST)/lib ckymanager.lib httpchunked.lib $(GECKO_LD_LIBS) nssutil3.lib nss3.lib ssl3.lib smime3.lib softokn3.lib /LIBPATH:$(CKY_LIB_LDD) libckyapplet.lib crypt32.lib kernel32.lib user32.lib gdi32.lib winmm.lib wsock32.lib advapi32.lib /NODEFAULTLIB:libc.lib endif ifeq ($(OS_ARCH),Darwin) Index: rhCoolKey.cpp =================================================================== RCS file: /cvs/dirsec/esc/src/app/xpcom/rhCoolKey.cpp,v retrieving revision 1.11 retrieving revision 1.12 diff -u -r1.11 -r1.12 --- rhCoolKey.cpp 13 Jun 2009 23:44:51 -0000 1.11 +++ rhCoolKey.cpp 19 Jun 2009 21:03:39 -0000 1.12 @@ -30,7 +30,7 @@ #else #include "nsServiceManagerUtils.h" #endif - +#include "pipnss/nsICertOverrideService.h" #include "nsIPrefBranch.h" #include "nsIPrefService.h" #include "nsCOMPtr.h" @@ -69,6 +69,7 @@ #endif #define PSM_COMPONENT_CONTRACTID "@mozilla.org/psm;1" +#define NS_CERTOVERRIDE_CONTRACTID "@mozilla.org/security/certoverride;1" static const nsIID kIModuleIID = NS_IMODULE_IID; static const nsIID kIFactoryIID = NS_IFACTORY_IID; @@ -89,6 +90,7 @@ std::list< nsCOMPtr <rhIKeyNotify> > rhCoolKey::gNotifyListeners; +PRLock* rhCoolKey::certCBLock=NULL; PRBool rhCoolKey::gAutoEnrollBlankTokens = PR_FALSE; @@ -190,6 +192,13 @@ mCSPListener = nsnull; #endif + certCBLock = PR_NewLock(); + + if(!certCBLock) { + PR_LOG( coolKeyLog, PR_LOG_ERROR, ("%s Failed to create lock exiting! \n",GetTStamp(tBuff,56))); + exit(1); + } + PRBool res = InitInstance(); if(res == PR_FALSE) @@ -207,6 +216,10 @@ char tBuff[56]; PR_LOG( coolKeyLog, PR_LOG_DEBUG, ("%s rhCoolKey::~rhCoolKey: %p \n",GetTStamp(tBuff,56),this)); + + if(certCBLock) { + PR_DestroyLock(certCBLock); + } } void rhCoolKey::ShutDownInstance() @@ -255,6 +268,212 @@ return S_OK; } +struct BadCertData { + PRErrorCode error; + PRInt32 port; +}; + +typedef struct BadCertData BadCertData; + +SECStatus rhCoolKey::badCertHandler(void *arg, PRFileDesc *fd) +{ + SECStatus secStatus = SECFailure; + PRErrorCode err; + char *host = NULL; + PRInt32 port = 0; + CERTCertificate *serverCert = NULL; + PRUint32 errorBits = 0; + char tBuff[56]; + + PR_Lock(certCBLock); + + if (!arg || !fd) { + PR_Unlock(certCBLock); + return secStatus; + } + + // Retrieve callback data from NssHttpClient + // Caller cleans up this data + BadCertData *data = (BadCertData *) arg; + data->error = err = PORT_GetError(); + + + /* If any of the cases in the switch are met, then we will proceed */ + + switch (err) { + case SEC_ERROR_INVALID_AVA: + case SEC_ERROR_INVALID_TIME: + case SEC_ERROR_BAD_SIGNATURE: + case SEC_ERROR_EXPIRED_CERTIFICATE: + case SEC_ERROR_UNKNOWN_ISSUER: + case SEC_ERROR_UNTRUSTED_CERT: + case SEC_ERROR_CERT_VALID: + case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE: + case SEC_ERROR_CRL_EXPIRED: + case SEC_ERROR_CRL_BAD_SIGNATURE: + case SEC_ERROR_EXTENSION_VALUE_INVALID: + case SEC_ERROR_CA_CERT_INVALID: + case SEC_ERROR_CERT_USAGES_INVALID: + case SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION: + case SEC_ERROR_EXTENSION_NOT_FOUND: // Added by Rob 5/21/2002 + secStatus = SECSuccess; + break; + default: + secStatus = SECFailure; + break; + } + + if(secStatus == SECSuccess) { + PR_Unlock(certCBLock); + return secStatus; + } + + // Collect errors to compare with override service output + switch(err) { + case SEC_ERROR_UNTRUSTED_ISSUER: + errorBits |= nsICertOverrideService::ERROR_UNTRUSTED; + break; + case SSL_ERROR_BAD_CERT_DOMAIN: + errorBits |= nsICertOverrideService::ERROR_MISMATCH; + break; + case SEC_ERROR_EXPIRED_CERTIFICATE: + errorBits |= nsICertOverrideService::ERROR_TIME; + default: + break; + }; + + // Now proceed to see if we have an exception. + // Get the server certificate that was rejected. + serverCert = SSL_PeerCertificate(fd); + + if(!serverCert) { + PR_Unlock(certCBLock); + return secStatus; + } + + port = data->port; + host = SSL_RevealURL(fd); + + if(!host || port <= 0) { + PR_Unlock(certCBLock); + return secStatus; + } + + PR_LOG(coolKeyLog, PR_LOG_DEBUG, + ("%s rhCoolKey::badCertHandler enter: error: %d url: %s port: %d \n", + GetTStamp(tBuff,56),err,host,port) + ); + + PRBool isTemporaryOverride = PR_FALSE; + PRUint32 overrideBits = 0; + PRBool overrideResult = PR_FALSE; + + // Use the nsICertOverrideService to see if we have + // previously trusted this certificate. + nsCOMPtr<nsICertOverrideService> overrideService = + do_GetService(NS_CERTOVERRIDE_CONTRACTID); + + const nsEmbedCString nsHost(host); + nsEmbedCString hashAlg,fingerPrint; + + nsresult nsrv; + unsigned char* fingerprint=NULL; + if(overrideService) { + nsrv = overrideService->GetValidityOverride((const nsACString &)nsHost, + port,(nsACString &)hashAlg, + (nsACString&)fingerPrint,&overrideBits, + &isTemporaryOverride,&overrideResult + ); + if(nsrv == NS_OK) { + PR_LOG(coolKeyLog, PR_LOG_DEBUG, + ("%s rhCoolKey::badCertHandler res %d print %s len %d bits %u temp %d alg: %s \n", + GetTStamp(tBuff,56),overrideResult,fingerPrint.get(), + fingerPrint.Length(),overrideBits, isTemporaryOverride,hashAlg.get()) + ); + } + + PRBool certMatches = PR_FALSE; + + if( (nsrv == NS_OK) && overrideResult) { + SECItem oid; + oid.data = nsnull; + oid.len = 0; + SECStatus srv = SEC_StringToOID(nsnull, &oid, + hashAlg.get(), hashAlg.Length()); + + if (srv != SECSuccess) { + PR_Free(host); + host=NULL; + CERT_DestroyCertificate(serverCert); + serverCert=NULL; + PR_Unlock(certCBLock); + return secStatus; + } + + SECOidTag oid_tag = SECOID_FindOIDTag(&oid); + + unsigned int hash_len = HASH_ResultLenByOidTag(oid_tag); + fingerprint = new unsigned char[hash_len]; + + if(!fingerprint) { + CERT_DestroyCertificate(serverCert); + serverCert=NULL; + PR_Unlock(certCBLock); + return secStatus; + } + + SECItem computedPrint; + memset(fingerprint, 0, sizeof fingerprint); + PK11_HashBuf(oid_tag, fingerprint, + serverCert->derCert.data, serverCert->derCert.len); + CERT_DestroyCertificate(serverCert); + serverCert=NULL; + + computedPrint.data=fingerprint; + computedPrint.len=hash_len; + + char *formattedPrint = CERT_Hexify(&computedPrint,1); + char *inputPrint = (char *)fingerPrint.get(); + + //Compare fingerprints. + + if(formattedPrint && inputPrint) { + if(!PL_strcmp(formattedPrint, inputPrint)) + certMatches = PR_TRUE; + } + PR_LOG( coolKeyLog, PR_LOG_DEBUG, ("%s certMatches: %d \n", + GetTStamp(tBuff,56),certMatches) + ); + + if(formattedPrint) { + PORT_Free(formattedPrint); + formattedPrint = NULL; + } + } else { + PR_LOG( coolKeyLog, PR_LOG_DEBUG, ("%s override test failed. \n", + GetTStamp(tBuff,56)) + ); + } + + if( certMatches ) { + if(overrideBits | errorBits) + secStatus = SECSuccess; + } + } + + PR_Free(host); + host = NULL; + if(fingerprint) { + delete [] fingerprint; + fingerprint = NULL; + } + + PR_Unlock(certCBLock); + + return secStatus; +} + + HRESULT rhCoolKey::doSetCoolKeyConfigValue(const char *aName, const char *aValue) { @@ -340,7 +559,7 @@ nssComponent = do_GetService(PSM_COMPONENT_CONTRACTID); - CoolKeySetCallbacks(Dispatch,Reference, Release,doGetCoolKeyConfigValue ,doSetCoolKeyConfigValue); + CoolKeySetCallbacks(Dispatch,Reference, Release,doGetCoolKeyConfigValue ,doSetCoolKeyConfigValue,badCertHandler); mProxy = CreateProxyObject(); Index: rhCoolKey.h =================================================================== RCS file: /cvs/dirsec/esc/src/app/xpcom/rhCoolKey.h,v retrieving revision 1.1.1.1 retrieving revision 1.2 diff -u -r1.1.1.1 -r1.2 --- rhCoolKey.h 12 Jun 2006 23:39:50 -0000 1.1.1.1 +++ rhCoolKey.h 19 Jun 2009 21:03:39 -0000 1.2 @@ -22,6 +22,15 @@ #include "nsIGenericFactory.h" #include "nsEmbedString.h" #include <list> +#include "nspr.h" +#include "prio.h" +#include "ssl.h" +#include "pk11func.h" +#include "cert.h" +#include "sslerr.h" +#include "secerr.h" +#include "sechash.h" + #include "CoolKey.h" #include "nsCOMPtr.h" #include "nsIObserver.h" @@ -92,6 +101,7 @@ static HRESULT doSetCoolKeyConfigValue(const char *aName, const char *aValue); static const char *doGetCoolKeyConfigValue(const char *aName ); + static SECStatus badCertHandler(void *arg, PRFileDesc *fd); protected: /* additional members */ @@ -107,6 +117,8 @@ static std::list< nsCOMPtr <rhIKeyNotify> > gNotifyListeners; + static PRLock* certCBLock; + rhICoolKey* mProxy; static PRBool gAutoEnrollBlankTokens;

1 0

esc/win32 setup.iss,1.12,1.13
by Jack Magne 19 Jun '09

19 Jun '09

Author: jmagne Update of /cvs/dirsec/esc/win32 In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv26797 Modified Files: setup.iss Log Message: Bugzilla#479722 ESC to TPS SSL communication problem with renewed TPS cert. Index: setup.iss =================================================================== RCS file: /cvs/dirsec/esc/win32/setup.iss,v retrieving revision 1.12 retrieving revision 1.13 diff -u -r1.12 -r1.13 --- setup.iss 7 Jun 2009 00:09:15 -0000 1.12 +++ setup.iss 19 Jun 2009 21:00:49 -0000 1.13 @@ -4,14 +4,14 @@ [Setup] AppName=Smart Card Manager AppMutex=ESCMutex -AppVerName=Smart Card Manager 1.1.0-6 +AppVerName=Smart Card Manager 1.1.0-7 AppPublisher=Fedora CreateAppDir=true Compression=lzma SolidCompression=true MinVersion=0,5.0.2195 ShowLanguageDialog=yes -OutputBaseFilename=SmartCardManagerSetup-1.1.0-6.win32.i386 +OutputBaseFilename=SmartCardManagerSetup-1.1.0-7.win32.i386 DefaultDirName={pf}\Fedora\ESC DisableProgramGroupPage=false DefaultGroupName=Fedora @@ -25,7 +25,7 @@ InfoBeforeFile=info-before.txt InfoAfterFile=info-after.txt PrivilegesRequired=admin -VersionInfoVersion=1.1.0.6 +VersionInfoVersion=1.1.0.7 [Files]

1 0

esc/src/lib/coolkey CoolKey.cpp, 1.9, 1.10 CoolKey.h, 1.7, 1.8 NSSManager.cpp, 1.5, 1.6 NSSManager.h, 1.4, 1.5
by Jack Magne 13 Jun '09

13 Jun '09

Author: jmagne Update of /cvs/dirsec/esc/src/lib/coolkey In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv18349/lib/coolkey Modified Files: CoolKey.cpp CoolKey.h NSSManager.cpp NSSManager.h Log Message: Bugzilla #491019 Security Officer: Format Card operation to format a user card also formats a security officer card. Index: CoolKey.cpp =================================================================== RCS file: /cvs/dirsec/esc/src/lib/coolkey/CoolKey.cpp,v retrieving revision 1.9 retrieving revision 1.10 diff -u -r1.9 -r1.10 --- CoolKey.cpp 29 Mar 2009 00:23:54 -0000 1.9 +++ CoolKey.cpp 13 Jun 2009 23:44:52 -0000 1.10 @@ -997,6 +997,16 @@ return NSSManager::GetKeyPolicy(aKey, aBuf, aBufLen); } + +HRESULT +CoolKeyGetUID(const CoolKey *aKey, char *aBuf, int aBufLength) +{ + if (!aKey || !aKey->mKeyID || !aBuf || aBufLength < 1) + return E_FAIL; + + return NSSManager::GetKeyUID(aKey,aBuf,aBufLength); +} + HRESULT CoolKeyGetIssuedTo(const CoolKey *aKey, char *aBuf, int aBufLength) { Index: CoolKey.h =================================================================== RCS file: /cvs/dirsec/esc/src/lib/coolkey/CoolKey.h,v retrieving revision 1.7 retrieving revision 1.8 diff -u -r1.7 -r1.8 --- CoolKey.h 25 Jul 2007 20:43:22 -0000 1.7 +++ CoolKey.h 13 Jun 2009 23:44:52 -0000 1.8 @@ -133,6 +133,8 @@ COOLKEY_API HRESULT CoolKeyGetCertInfo(const CoolKey *aKey, char *aCertNickname, std::string & aCertInfo); +COOLKEY_API HRESULT CoolKeyGetUID(const CoolKey *aKey, char *aBuf, int aBufLength); + COOLKEY_API HRESULT CoolKeyGetIssuedTo(const CoolKey *aKey, char *aBuf, int aBufLength); COOLKEY_API HRESULT CoolKeyGetIssuer(const CoolKey *aKey, char *aBuf, int aBufLength); Index: NSSManager.cpp =================================================================== RCS file: /cvs/dirsec/esc/src/lib/coolkey/NSSManager.cpp,v retrieving revision 1.5 retrieving revision 1.6 diff -u -r1.5 -r1.6 --- NSSManager.cpp 25 Jul 2007 20:43:22 -0000 1.5 +++ NSSManager.cpp 13 Jun 2009 23:44:52 -0000 1.6 @@ -369,7 +369,7 @@ aBuf[0]=0; - PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%s NSSManager::GetKeyIssuedTo \n",GetTStamp(tBuff,56))); + PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%s NSSManager::GetKeyIssuer \n",GetTStamp(tBuff,56))); if(!aKey ) return E_FAIL; @@ -409,7 +409,7 @@ continue; } orgID = CERT_GetOrgName(&cert->subject); - PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%s NSSManager::GetKeyIssuedTo ourSlot %p curSlot %p org %s \n",GetTStamp(tBuff,56),slot,cert->slot,orgID)); + PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%s NSSManager::GetKeyIssuer ourSlot %p curSlot %p org %s \n",GetTStamp(tBuff,56),slot,cert->slot,orgID)); } @@ -437,6 +437,85 @@ return S_OK; } +HRESULT NSSManager::GetKeyUID(const CoolKey *aKey, char *aBuf, int aBufLength) +{ + char tBuff[56]; + if(!aBuf) + return E_FAIL; + + aBuf[0]=0; + + PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%s NSSManager::GetKeyUID \n",GetTStamp(tBuff,56))); + + if(!aKey ) + return E_FAIL; + + PK11SlotInfo *slot = GetSlotForKeyID(aKey); + + if (!slot) + return E_FAIL; + + CERTCertList *certs = PK11_ListCerts(PK11CertListAll,NULL); + + if (!certs) + { + PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%sNSSManager::GetKeyUID no certs found! \n",GetTStamp(tBuff,56))); + PK11_FreeSlot(slot); + return E_FAIL; + } + + CERTCertListNode *node= NULL; + + char *certID = NULL; + + for( node = CERT_LIST_HEAD(certs); + ! CERT_LIST_END(node, certs); + node = CERT_LIST_NEXT(node)) + { + if(node->cert) + { + CERTCertificate *cert = node->cert; + + if(cert) + { + if(cert->slot == slot) + { + if(IsCACert(cert)) + { + continue; + } + + certID = CERT_GetCertUid(&cert->subject); + + PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%s NSSManager::GetKeyUID ourSlot %p curSlot %p certID %s \n",GetTStamp(tBuff,56),slot,cert->slot,certID)); + + } + + if(certID) + break; + } + } + + } + + if(certID && ((int)strlen(certID) < aBufLength)) + { + strcpy(aBuf,certID); + } + + if(certs) + CERT_DestroyCertList(certs); + + if(slot) + PK11_FreeSlot(slot); + + if(certID) + PORT_Free(certID); + + return S_OK; +} + + HRESULT NSSManager::GetKeyIssuedTo(const CoolKey *aKey, char *aBuf, int aBufLength) { char tBuff[56]; @@ -487,6 +566,10 @@ certID = CERT_GetCommonName(&cert->subject); + if(!certID) { + certID = CERT_GetCertUid(&cert->subject); + } + PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%s NSSManager::GetKeyIssuedTo ourSlot %p curSlot %p certID %s \n",GetTStamp(tBuff,56),slot,cert->slot,certID)); } Index: NSSManager.h =================================================================== RCS file: /cvs/dirsec/esc/src/lib/coolkey/NSSManager.h,v retrieving revision 1.4 retrieving revision 1.5 diff -u -r1.4 -r1.5 --- NSSManager.h 25 Jul 2007 20:43:22 -0000 1.4 +++ NSSManager.h 13 Jun 2009 23:44:52 -0000 1.5 @@ -70,6 +70,8 @@ static HRESULT GetKeyCertNicknames( const CoolKey *aKey, vector<string> & aStrings ); + static HRESULT GetKeyUID(const CoolKey *aKey, char *aBuf, int aBufLength); + static HRESULT GetKeyIssuedTo(const CoolKey *aKey, char *aBuf, int aBufLength); static HRESULT GetKeyIssuer(const CoolKey *aKey, char *aBuf, int aBufLength);

1 0

esc/src/app/xpcom rhCoolKey.cpp, 1.10, 1.11 rhICoolKey.idl, 1.7, 1.8
by Jack Magne 13 Jun '09

13 Jun '09

Author: jmagne Update of /cvs/dirsec/esc/src/app/xpcom In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv18349/app/xpcom Modified Files: rhCoolKey.cpp rhICoolKey.idl Log Message: Bugzilla #491019 Security Officer: Format Card operation to format a user card also formats a security officer card. Index: rhCoolKey.cpp =================================================================== RCS file: /cvs/dirsec/esc/src/app/xpcom/rhCoolKey.cpp,v retrieving revision 1.10 retrieving revision 1.11 diff -u -r1.10 -r1.11 --- rhCoolKey.cpp 4 Feb 2009 01:43:46 -0000 1.10 +++ rhCoolKey.cpp 13 Jun 2009 23:44:51 -0000 1.11 @@ -1262,6 +1262,38 @@ } /* string GetCoolKeyIssuedTo (in unsigned long aKeyType, in string aKeyID); */ +NS_IMETHODIMP rhCoolKey::GetCoolKeyUID(PRUint32 aKeyType, const char *aKeyID, char **uid) +{ + char tBuff[56]; + if (!aKeyID) { + return NS_ERROR_FAILURE; + } + + AutoCoolKey key(aKeyType, ( char *)aKeyID); + + char buff[512]; + int bufLength = 512; + buff[0] = 0; + + CoolKeyGetUID(&key, (char *) buff, bufLength); + + if(!buff[0]) + { + return NS_OK; + } + + PR_LOG(coolKeyLog,PR_LOG_DEBUG,("%s rhCoolKey::RhGetCoolKeyGetUID %s \n",GetTStamp(tBuff,56),(char *) buff)); + + char *temp = (char *) nsMemory::Clone(buff,sizeof(char) * strlen(buff) + 1); + + *uid = temp; + + return NS_OK; + +} + + +/* string GetCoolKeyIssuedTo (in unsigned long aKeyType, in string aKeyID); */ NS_IMETHODIMP rhCoolKey::GetCoolKeyIssuedTo(PRUint32 aKeyType, const char *aKeyID, char **issuedTo) { char tBuff[56]; Index: rhICoolKey.idl =================================================================== RCS file: /cvs/dirsec/esc/src/app/xpcom/rhICoolKey.idl,v retrieving revision 1.7 retrieving revision 1.8 diff -u -r1.7 -r1.8 --- rhICoolKey.idl 7 Jun 2007 21:16:28 -0000 1.7 +++ rhICoolKey.idl 13 Jun 2009 23:44:51 -0000 1.8 @@ -66,6 +66,8 @@ string GetCoolKeyCertInfo(in unsigned long aKeyType, in string aKeyID, in string aCertNickname); + string GetCoolKeyUID(in unsigned long aKeyType, in string aKeyID); + string GetCoolKeyIssuedTo(in unsigned long aKeyType, in string aKeyID); string GetCoolKeyIssuer(in unsigned long aKeyType, in string aKeyID);

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-commits June 2009