From jmagne at fedoraproject.org Sat Jun 6 00:23:16 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Sat, 6 Jun 2009 00:23:16 +0000 (UTC)
Subject: [389-commits]
esc/src/lib/coolkey SmartCardMonitoringThread.cpp, 1.4, 1.5
Message-ID: <20090606002316.9DE1E70131@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/src/lib/coolkey
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv11985
Modified Files:
SmartCardMonitoringThread.cpp
Log Message:
Fix for Bug #496759.
Index: SmartCardMonitoringThread.cpp
===================================================================
RCS file: /cvs/dirsec/esc/src/lib/coolkey/SmartCardMonitoringThread.cpp,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- SmartCardMonitoringThread.cpp 18 Apr 2009 23:25:15 -0000 1.4
+++ SmartCardMonitoringThread.cpp 6 Jun 2009 00:23:13 -0000 1.5
@@ -159,7 +159,7 @@
/* if we think we have a token, but it's not the right one, or it's
* not there, then send a removal event */
- if (info && (!isPresent || (info->mSeries != PK11_GetSlotSeries(slot))) ) {
+ if (info && !isPresent) {
PR_LOG( coolKeyLogSC, PR_LOG_DEBUG,
("%s SmartCardMonitoringThread::Execute Token Removed : \n",GetTStamp(tBuff,56)));
From jmagne at fedoraproject.org Sat Jun 6 00:30:37 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Sat, 6 Jun 2009 00:30:37 +0000 (UTC)
Subject: [389-commits] esc/win32 build.sh,1.9,1.10
Message-ID: <20090606003037.E6BF870131@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/win32
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv13546
Modified Files:
build.sh
Log Message:
Fix for Bug #500696.
Index: build.sh
===================================================================
RCS file: /cvs/dirsec/esc/win32/build.sh,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- build.sh 29 Apr 2009 20:37:59 -0000 1.9
+++ build.sh 6 Jun 2009 00:30:35 -0000 1.10
@@ -78,7 +78,7 @@
#ESC values
ESC_NAME=esc
-ESC_VERSION_NO=1.1.0-3
+ESC_VERSION_NO=1.1.0-6
#Cygwin values
From jmagne at fedoraproject.org Sat Jun 6 19:36:23 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Sat, 6 Jun 2009 19:36:23 +0000 (UTC)
Subject: [389-commits] esc/win32 setup.iss,1.10,1.11
Message-ID: <20090606193623.2668E70100@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/win32
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv29616
Modified Files:
setup.iss
Log Message:
Fix for Bug #499291, eginstall problem.
Index: setup.iss
===================================================================
RCS file: /cvs/dirsec/esc/win32/setup.iss,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- setup.iss 29 Apr 2009 20:36:09 -0000 1.10
+++ setup.iss 6 Jun 2009 19:36:20 -0000 1.11
@@ -4,14 +4,14 @@
[Setup]
AppName=Smart Card Manager
AppMutex=ESCMutex
-AppVerName=Smart Card Manager 1.1.0-4
+AppVerName=Smart Card Manager 1.1.0-6
AppPublisher=Fedora
CreateAppDir=true
Compression=lzma
SolidCompression=true
MinVersion=0,5.0.2195
ShowLanguageDialog=yes
-OutputBaseFilename=SmartCardManagerSetup-1.1.0-4.win32.i386
+OutputBaseFilename=SmartCardManagerSetup-1.1.0-6.win32.i386
DefaultDirName={pf}\Fedora\ESC
DisableProgramGroupPage=false
DefaultGroupName=Fedora
@@ -25,23 +25,10 @@
InfoBeforeFile=info-before.txt
InfoAfterFile=info-after.txt
PrivilegesRequired=admin
-VersionInfoVersion=1.1.0.4
+VersionInfoVersion=1.1.0.6
[Files]
-Source: BUILD\egate\slbmgpg.dll; DestDir: {win}\egate2.4; Flags: uninsneveruninstall
-Source: BUILD\egate\egate.cat; DestDir: {win}\egate2.4; Flags: uninsneveruninstall
-Source: BUILD\egate\egate.inf; DestDir: {win}\egate2.4; Flags: uninsneveruninstall
-Source: BUILD\egate\egate.sys; DestDir: {win}\egate2.4; Flags: uninsneveruninstall
-Source: BUILD\egate\egate_License.txt; DestDir: {win}\egate2.4; Flags: uninsneveruninstall
-Source: BUILD\egate\egatebus.cat; DestDir: {win}\egate2.4; Flags: uninsneveruninstall
-Source: BUILD\egate\egatebus.inf; DestDir: {win}\egate2.4; Flags: uninsneveruninstall
-Source: BUILD\egate\egatebus.sys; DestDir: {win}\egate2.4; Flags: uninsneveruninstall
-Source: BUILD\egate\egaterdr.cat; DestDir: {win}\egate2.4; Flags: uninsneveruninstall
-Source: BUILD\egate\egaterdr.inf; DestDir: {win}\egate2.4; Flags: uninsneveruninstall
-Source: BUILD\egate\egaterdr.sys; DestDir: {win}\egate2.4; Flags: uninsneveruninstall
-Source: BUILD\egate\egdrvins1.dll; DestDir: {win}\egate2.4; Flags: uninsneveruninstall
-Source: BUILD\egate\eginstall.exe; DestDir: {win}\egate2.4; Flags: ignoreversion
Source: BUILD\clkcsp.dll; DestDir: {sys}; Flags: regserver restartreplace
Source: BUILD\cspres.dll; DestDir: {sys}; Flags: restartreplace
Source: BUILD\pk11install.exe; DestDir: {app}\PKCS11
@@ -426,7 +413,6 @@
[Run]
-Filename: {win}\egate2.4\eginstall.exe; Parameters: -f -l eginstall.txt; WorkingDir: {win}\egate2.4; Flags: waituntilterminated; StatusMsg: Installing smart card drivers....
Filename: {app}\PKCS11\pk11install.exe; Parameters: "-v ""name='CoolKey Module' library=coolkeypk11.dll NSS=""slotParams={{0x1=[slotFlags=PublicCerts]}"""""; WorkingDir: {sys}; StatusMsg: Configuring System for smart cards...
Filename: {app}\xulrunner\xulrunner.exe; Parameters: """--register-global"""
Filename: {app}\esc.exe; WorkingDir: {app}; StatusMsg: {code:GetEscStatusMsg}; Flags: nowait
From jmagne at fedoraproject.org Sun Jun 7 00:09:18 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Sun, 7 Jun 2009 00:09:18 +0000 (UTC)
Subject: [389-commits] esc/win32 setup.iss,1.11,1.12
Message-ID: <20090607000918.56B9B70134@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/win32
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv20779
Modified Files:
setup.iss
Log Message:
Fix for #501336, esc hangs on error.
Index: setup.iss
===================================================================
RCS file: /cvs/dirsec/esc/win32/setup.iss,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -r1.11 -r1.12
--- setup.iss 6 Jun 2009 19:36:20 -0000 1.11
+++ setup.iss 7 Jun 2009 00:09:15 -0000 1.12
@@ -61,7 +61,6 @@
Source: BUILD\ESC\application.ini; DestDir: {app}
Source: BUILD\ESC\chrome\chrome.manifest; DestDir: {app}\chrome
Source: BUILD\ESC\chrome\content\esc\TRAY.js; DestDir: {app}\chrome\content\esc
-Source: BUILD\ESC\chrome\content\esc\CertInfo.js; DestDir: {app}\chrome\content\esc
;Source: BUILD\ESC\chrome\content\esc\certinfo.xul; DestDir: {app}\chrome\content\esc
Source: BUILD\ESC\chrome\content\esc\config.xul; DestDir: {app}\chrome\content\esc
Source: BUILD\ESC\chrome\content\esc\contents.rdf; DestDir: {app}\chrome\content\esc
From jmagne at fedoraproject.org Sun Jun 7 00:09:18 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Sun, 7 Jun 2009 00:09:18 +0000 (UTC)
Subject: [389-commits] esc/src/app/xul/esc/chrome/locale/en-US
esc.properties, 1.8, 1.9
Message-ID: <20090607000918.6A8ED7011A@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/src/app/xul/esc/chrome/locale/en-US
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv20779/esc/src/app/xul/esc/chrome/locale/en-US
Modified Files:
esc.properties
Log Message:
Fix for #501336, esc hangs on error.
Index: esc.properties
===================================================================
RCS file: /cvs/dirsec/esc/src/app/xul/esc/chrome/locale/en-US/esc.properties,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- esc.properties 22 Apr 2009 23:38:20 -0000 1.8
+++ esc.properties 7 Jun 2009 00:09:16 -0000 1.9
@@ -104,8 +104,7 @@
errorInvalidTokenTypeParams=The Smart Card Server cannot process the requested type of enrollment due to a misconfiguration.
errorCannotPublish=The Smart Card Server cannot publish your card's certificates to the certificate directory.
errorCommTokenDB=The Smart Card Server cannot connect to its internal database.
-errorTokenSuspended=You are not allowed to perform this operation with this sm
-art card.
+errorTokenSuspended=You are not allowed to perform this operation with this smart card.
errorPinResetable=You are not allowed to reset the password of this smart card.
errorConnLost=The Smart Card Manager has lost the connection to the Smart Card Server.
errorEntryTokenDB=The Smart Card Server cannot add your smart card to its internal database.
From jmagne at fedoraproject.org Sun Jun 7 00:09:18 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Sun, 7 Jun 2009 00:09:18 +0000 (UTC)
Subject: [389-commits] esc/src/app/xul/esc/chrome/content/esc ESC.js, 1.23,
1.24 certManager.xul, 1.3, 1.4 password.xul, 1.4, 1.5
Message-ID: <20090607000918.62D9570100@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/src/app/xul/esc/chrome/content/esc
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv20779/esc/src/app/xul/esc/chrome/content/esc
Modified Files:
ESC.js certManager.xul password.xul
Log Message:
Fix for #501336, esc hangs on error.
Index: ESC.js
===================================================================
RCS file: /cvs/dirsec/esc/src/app/xul/esc/chrome/content/esc/ESC.js,v
retrieving revision 1.23
retrieving revision 1.24
diff -u -r1.23 -r1.24
--- ESC.js 31 Mar 2009 18:35:59 -0000 1.23
+++ ESC.js 7 Jun 2009 00:09:15 -0000 1.24
@@ -522,7 +522,10 @@
if(!string_id || !gStringBundle)
return null;
- str = gStringBundle.getString(string_id);
+ try {
+ str = gStringBundle.getString(string_id);
+ } catch(e) {
+ }
return str;
}
Index: certManager.xul
===================================================================
RCS file: /cvs/dirsec/esc/src/app/xul/esc/chrome/content/esc/certManager.xul,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- certManager.xul 26 Feb 2009 22:34:43 -0000 1.3
+++ certManager.xul 7 Jun 2009 00:09:16 -0000 1.4
@@ -59,7 +59,6 @@
-
Index: password.xul
===================================================================
RCS file: /cvs/dirsec/esc/src/app/xul/esc/chrome/content/esc/password.xul,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- password.xul 4 Feb 2009 01:43:47 -0000 1.4
+++ password.xul 7 Jun 2009 00:09:16 -0000 1.5
@@ -23,7 +23,6 @@
id="esc-window"
title="&getESCPassword;"
onload="PasswordLoad();"
- onunload="cleanup();"
xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
From jmagne at fedoraproject.org Sat Jun 13 23:44:54 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Sat, 13 Jun 2009 23:44:54 +0000 (UTC)
Subject: [389-commits] esc/src/app/xul/esc application.ini,1.8,1.9
Message-ID: <20090613234454.3FF4F7012E@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/src/app/xul/esc
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv18349/app/xul/esc
Modified Files:
application.ini
Log Message:
Bugzilla #491019 Security Officer: Format Card operation to format a user card also formats a security officer card.
Index: application.ini
===================================================================
RCS file: /cvs/dirsec/esc/src/app/xul/esc/application.ini,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- application.ini 18 Apr 2009 23:25:15 -0000 1.8
+++ application.ini 13 Jun 2009 23:44:51 -0000 1.9
@@ -25,7 +25,7 @@
Name=ESC
;
; This field specifies your application's version. This field is optional.
-Version=1.1.0-3
+Version=1.1.0-7
;
; This field specifies your application's build ID (timestamp). This field is
; required.
From jmagne at fedoraproject.org Sat Jun 13 23:44:54 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Sat, 13 Jun 2009 23:44:54 +0000 (UTC)
Subject: [389-commits] esc/src/app/xpcom rhCoolKey.cpp, 1.10,
1.11 rhICoolKey.idl, 1.7, 1.8
Message-ID: <20090613234454.4E77770122@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/src/app/xpcom
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv18349/app/xpcom
Modified Files:
rhCoolKey.cpp rhICoolKey.idl
Log Message:
Bugzilla #491019 Security Officer: Format Card operation to format a user card also formats a security officer card.
Index: rhCoolKey.cpp
===================================================================
RCS file: /cvs/dirsec/esc/src/app/xpcom/rhCoolKey.cpp,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- rhCoolKey.cpp 4 Feb 2009 01:43:46 -0000 1.10
+++ rhCoolKey.cpp 13 Jun 2009 23:44:51 -0000 1.11
@@ -1262,6 +1262,38 @@
}
/* string GetCoolKeyIssuedTo (in unsigned long aKeyType, in string aKeyID); */
+NS_IMETHODIMP rhCoolKey::GetCoolKeyUID(PRUint32 aKeyType, const char *aKeyID, char **uid)
+{
+ char tBuff[56];
+ if (!aKeyID) {
+ return NS_ERROR_FAILURE;
+ }
+
+ AutoCoolKey key(aKeyType, ( char *)aKeyID);
+
+ char buff[512];
+ int bufLength = 512;
+ buff[0] = 0;
+
+ CoolKeyGetUID(&key, (char *) buff, bufLength);
+
+ if(!buff[0])
+ {
+ return NS_OK;
+ }
+
+ PR_LOG(coolKeyLog,PR_LOG_DEBUG,("%s rhCoolKey::RhGetCoolKeyGetUID %s \n",GetTStamp(tBuff,56),(char *) buff));
+
+ char *temp = (char *) nsMemory::Clone(buff,sizeof(char) * strlen(buff) + 1);
+
+ *uid = temp;
+
+ return NS_OK;
+
+}
+
+
+/* string GetCoolKeyIssuedTo (in unsigned long aKeyType, in string aKeyID); */
NS_IMETHODIMP rhCoolKey::GetCoolKeyIssuedTo(PRUint32 aKeyType, const char *aKeyID, char **issuedTo)
{
char tBuff[56];
Index: rhICoolKey.idl
===================================================================
RCS file: /cvs/dirsec/esc/src/app/xpcom/rhICoolKey.idl,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- rhICoolKey.idl 7 Jun 2007 21:16:28 -0000 1.7
+++ rhICoolKey.idl 13 Jun 2009 23:44:51 -0000 1.8
@@ -66,6 +66,8 @@
string GetCoolKeyCertInfo(in unsigned long aKeyType, in string aKeyID, in string aCertNickname);
+ string GetCoolKeyUID(in unsigned long aKeyType, in string aKeyID);
+
string GetCoolKeyIssuedTo(in unsigned long aKeyType, in string aKeyID);
string GetCoolKeyIssuer(in unsigned long aKeyType, in string aKeyID);
From jmagne at fedoraproject.org Sat Jun 13 23:44:54 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Sat, 13 Jun 2009 23:44:54 +0000 (UTC)
Subject: [389-commits] esc/src/lib/coolkey CoolKey.cpp, 1.9, 1.10 CoolKey.h,
1.7, 1.8 NSSManager.cpp, 1.5, 1.6 NSSManager.h, 1.4, 1.5
Message-ID: <20090613234454.54B8270126@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/src/lib/coolkey
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv18349/lib/coolkey
Modified Files:
CoolKey.cpp CoolKey.h NSSManager.cpp NSSManager.h
Log Message:
Bugzilla #491019 Security Officer: Format Card operation to format a user card also formats a security officer card.
Index: CoolKey.cpp
===================================================================
RCS file: /cvs/dirsec/esc/src/lib/coolkey/CoolKey.cpp,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- CoolKey.cpp 29 Mar 2009 00:23:54 -0000 1.9
+++ CoolKey.cpp 13 Jun 2009 23:44:52 -0000 1.10
@@ -997,6 +997,16 @@
return NSSManager::GetKeyPolicy(aKey, aBuf, aBufLen);
}
+
+HRESULT
+CoolKeyGetUID(const CoolKey *aKey, char *aBuf, int aBufLength)
+{
+ if (!aKey || !aKey->mKeyID || !aBuf || aBufLength < 1)
+ return E_FAIL;
+
+ return NSSManager::GetKeyUID(aKey,aBuf,aBufLength);
+}
+
HRESULT
CoolKeyGetIssuedTo(const CoolKey *aKey, char *aBuf, int aBufLength)
{
Index: CoolKey.h
===================================================================
RCS file: /cvs/dirsec/esc/src/lib/coolkey/CoolKey.h,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- CoolKey.h 25 Jul 2007 20:43:22 -0000 1.7
+++ CoolKey.h 13 Jun 2009 23:44:52 -0000 1.8
@@ -133,6 +133,8 @@
COOLKEY_API HRESULT CoolKeyGetCertInfo(const CoolKey *aKey, char *aCertNickname, std::string & aCertInfo);
+COOLKEY_API HRESULT CoolKeyGetUID(const CoolKey *aKey, char *aBuf, int aBufLength);
+
COOLKEY_API HRESULT CoolKeyGetIssuedTo(const CoolKey *aKey, char *aBuf, int aBufLength);
COOLKEY_API HRESULT CoolKeyGetIssuer(const CoolKey *aKey, char *aBuf, int aBufLength);
Index: NSSManager.cpp
===================================================================
RCS file: /cvs/dirsec/esc/src/lib/coolkey/NSSManager.cpp,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- NSSManager.cpp 25 Jul 2007 20:43:22 -0000 1.5
+++ NSSManager.cpp 13 Jun 2009 23:44:52 -0000 1.6
@@ -369,7 +369,7 @@
aBuf[0]=0;
- PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%s NSSManager::GetKeyIssuedTo \n",GetTStamp(tBuff,56)));
+ PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%s NSSManager::GetKeyIssuer \n",GetTStamp(tBuff,56)));
if(!aKey )
return E_FAIL;
@@ -409,7 +409,7 @@
continue;
}
orgID = CERT_GetOrgName(&cert->subject);
- PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%s NSSManager::GetKeyIssuedTo ourSlot %p curSlot %p org %s \n",GetTStamp(tBuff,56),slot,cert->slot,orgID));
+ PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%s NSSManager::GetKeyIssuer ourSlot %p curSlot %p org %s \n",GetTStamp(tBuff,56),slot,cert->slot,orgID));
}
@@ -437,6 +437,85 @@
return S_OK;
}
+HRESULT NSSManager::GetKeyUID(const CoolKey *aKey, char *aBuf, int aBufLength)
+{
+ char tBuff[56];
+ if(!aBuf)
+ return E_FAIL;
+
+ aBuf[0]=0;
+
+ PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%s NSSManager::GetKeyUID \n",GetTStamp(tBuff,56)));
+
+ if(!aKey )
+ return E_FAIL;
+
+ PK11SlotInfo *slot = GetSlotForKeyID(aKey);
+
+ if (!slot)
+ return E_FAIL;
+
+ CERTCertList *certs = PK11_ListCerts(PK11CertListAll,NULL);
+
+ if (!certs)
+ {
+ PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%sNSSManager::GetKeyUID no certs found! \n",GetTStamp(tBuff,56)));
+ PK11_FreeSlot(slot);
+ return E_FAIL;
+ }
+
+ CERTCertListNode *node= NULL;
+
+ char *certID = NULL;
+
+ for( node = CERT_LIST_HEAD(certs);
+ ! CERT_LIST_END(node, certs);
+ node = CERT_LIST_NEXT(node))
+ {
+ if(node->cert)
+ {
+ CERTCertificate *cert = node->cert;
+
+ if(cert)
+ {
+ if(cert->slot == slot)
+ {
+ if(IsCACert(cert))
+ {
+ continue;
+ }
+
+ certID = CERT_GetCertUid(&cert->subject);
+
+ PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%s NSSManager::GetKeyUID ourSlot %p curSlot %p certID %s \n",GetTStamp(tBuff,56),slot,cert->slot,certID));
+
+ }
+
+ if(certID)
+ break;
+ }
+ }
+
+ }
+
+ if(certID && ((int)strlen(certID) < aBufLength))
+ {
+ strcpy(aBuf,certID);
+ }
+
+ if(certs)
+ CERT_DestroyCertList(certs);
+
+ if(slot)
+ PK11_FreeSlot(slot);
+
+ if(certID)
+ PORT_Free(certID);
+
+ return S_OK;
+}
+
+
HRESULT NSSManager::GetKeyIssuedTo(const CoolKey *aKey, char *aBuf, int aBufLength)
{
char tBuff[56];
@@ -487,6 +566,10 @@
certID = CERT_GetCommonName(&cert->subject);
+ if(!certID) {
+ certID = CERT_GetCertUid(&cert->subject);
+ }
+
PR_LOG( coolKeyLogNSS, PR_LOG_DEBUG, ("%s NSSManager::GetKeyIssuedTo ourSlot %p curSlot %p certID %s \n",GetTStamp(tBuff,56),slot,cert->slot,certID));
}
Index: NSSManager.h
===================================================================
RCS file: /cvs/dirsec/esc/src/lib/coolkey/NSSManager.h,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- NSSManager.h 25 Jul 2007 20:43:22 -0000 1.4
+++ NSSManager.h 13 Jun 2009 23:44:52 -0000 1.5
@@ -70,6 +70,8 @@
static HRESULT GetKeyCertNicknames( const CoolKey *aKey, vector & aStrings );
+ static HRESULT GetKeyUID(const CoolKey *aKey, char *aBuf, int aBufLength);
+
static HRESULT GetKeyIssuedTo(const CoolKey *aKey, char *aBuf, int aBufLength);
static HRESULT GetKeyIssuer(const CoolKey *aKey, char *aBuf, int aBufLength);
From jmagne at fedoraproject.org Fri Jun 19 21:00:52 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Fri, 19 Jun 2009 21:00:52 +0000 (UTC)
Subject: [389-commits] esc/win32 setup.iss,1.12,1.13
Message-ID: <20090619210052.98ADE70132@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/win32
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv26797
Modified Files:
setup.iss
Log Message:
Bugzilla#479722 ESC to TPS SSL communication problem with renewed TPS cert.
Index: setup.iss
===================================================================
RCS file: /cvs/dirsec/esc/win32/setup.iss,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -r1.12 -r1.13
--- setup.iss 7 Jun 2009 00:09:15 -0000 1.12
+++ setup.iss 19 Jun 2009 21:00:49 -0000 1.13
@@ -4,14 +4,14 @@
[Setup]
AppName=Smart Card Manager
AppMutex=ESCMutex
-AppVerName=Smart Card Manager 1.1.0-6
+AppVerName=Smart Card Manager 1.1.0-7
AppPublisher=Fedora
CreateAppDir=true
Compression=lzma
SolidCompression=true
MinVersion=0,5.0.2195
ShowLanguageDialog=yes
-OutputBaseFilename=SmartCardManagerSetup-1.1.0-6.win32.i386
+OutputBaseFilename=SmartCardManagerSetup-1.1.0-7.win32.i386
DefaultDirName={pf}\Fedora\ESC
DisableProgramGroupPage=false
DefaultGroupName=Fedora
@@ -25,7 +25,7 @@
InfoBeforeFile=info-before.txt
InfoAfterFile=info-after.txt
PrivilegesRequired=admin
-VersionInfoVersion=1.1.0.6
+VersionInfoVersion=1.1.0.7
[Files]
From jmagne at fedoraproject.org Fri Jun 19 21:03:41 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Fri, 19 Jun 2009 21:03:41 +0000 (UTC)
Subject: [389-commits]
esc/src/app/xpcom Makefile.sdk, 1.3, 1.4 rhCoolKey.cpp,
1.11, 1.12 rhCoolKey.h, 1.1.1.1, 1.2
Message-ID: <20090619210341.E76F570132@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/src/app/xpcom
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv27580/app/xpcom
Modified Files:
Makefile.sdk rhCoolKey.cpp rhCoolKey.h
Log Message:
Bugzilla#479722 ESC to TPS SSL communication problem with renewed TPS cert.
Index: Makefile.sdk
===================================================================
RCS file: /cvs/dirsec/esc/src/app/xpcom/Makefile.sdk,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- Makefile.sdk 17 Apr 2009 00:11:11 -0000 1.3
+++ Makefile.sdk 19 Jun 2009 21:03:39 -0000 1.4
@@ -109,7 +109,7 @@
CPPFLAGS += -fno-rtti \
-fno-exceptions \
-fshort-wchar -fPIC
-GECKO_LD_LIBS=-L$(GECKO_SDK_PATH)/lib $(GECKO_SDK_PATH)/lib/libxpcomglue.a -lnss3 -lcrmf -lssl3 -lsmime3 -lplds4 -lplc4 -lnspr4 -lpthread -ldl
+GECKO_LD_LIBS=-L$(GECKO_SDK_PATH)/lib $(GECKO_SDK_PATH)/lib/libxpcomglue.a -lnssutil3 -lnss3 -lcrmf -lssl3 -lsmime3 -lplds4 -lplc4 -lnspr4 -lpthread -ldl
endif
ifeq ($(OS_ARCH),WINNT)
@@ -145,7 +145,7 @@
GECKO_INCLUDES += -I $(GECKO_SDK_PATH)/sdk/include
OBJECT = rhCoolKey.obj
OBJECTCSP = CoolKeyCSP.obj
-COOL_LDFLAGS = -IMPLIB:fake-import /LIBPATH:$(CORE_DIST)/lib ckymanager.lib httpchunked.lib $(GECKO_LD_LIBS) nss3.lib ssl3.lib smime3.lib softokn3.lib /LIBPATH:$(CKY_LIB_LDD) libckyapplet.lib crypt32.lib kernel32.lib user32.lib gdi32.lib winmm.lib wsock32.lib advapi32.lib /NODEFAULTLIB:libc.lib
+COOL_LDFLAGS = -IMPLIB:fake-import /LIBPATH:$(CORE_DIST)/lib ckymanager.lib httpchunked.lib $(GECKO_LD_LIBS) nssutil3.lib nss3.lib ssl3.lib smime3.lib softokn3.lib /LIBPATH:$(CKY_LIB_LDD) libckyapplet.lib crypt32.lib kernel32.lib user32.lib gdi32.lib winmm.lib wsock32.lib advapi32.lib /NODEFAULTLIB:libc.lib
endif
ifeq ($(OS_ARCH),Darwin)
Index: rhCoolKey.cpp
===================================================================
RCS file: /cvs/dirsec/esc/src/app/xpcom/rhCoolKey.cpp,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -r1.11 -r1.12
--- rhCoolKey.cpp 13 Jun 2009 23:44:51 -0000 1.11
+++ rhCoolKey.cpp 19 Jun 2009 21:03:39 -0000 1.12
@@ -30,7 +30,7 @@
#else
#include "nsServiceManagerUtils.h"
#endif
-
+#include "pipnss/nsICertOverrideService.h"
#include "nsIPrefBranch.h"
#include "nsIPrefService.h"
#include "nsCOMPtr.h"
@@ -69,6 +69,7 @@
#endif
#define PSM_COMPONENT_CONTRACTID "@mozilla.org/psm;1"
+#define NS_CERTOVERRIDE_CONTRACTID "@mozilla.org/security/certoverride;1"
static const nsIID kIModuleIID = NS_IMODULE_IID;
static const nsIID kIFactoryIID = NS_IFACTORY_IID;
@@ -89,6 +90,7 @@
std::list< nsCOMPtr > rhCoolKey::gNotifyListeners;
+PRLock* rhCoolKey::certCBLock=NULL;
PRBool rhCoolKey::gAutoEnrollBlankTokens = PR_FALSE;
@@ -190,6 +192,13 @@
mCSPListener = nsnull;
#endif
+ certCBLock = PR_NewLock();
+
+ if(!certCBLock) {
+ PR_LOG( coolKeyLog, PR_LOG_ERROR, ("%s Failed to create lock exiting! \n",GetTStamp(tBuff,56)));
+ exit(1);
+ }
+
PRBool res = InitInstance();
if(res == PR_FALSE)
@@ -207,6 +216,10 @@
char tBuff[56];
PR_LOG( coolKeyLog, PR_LOG_DEBUG, ("%s rhCoolKey::~rhCoolKey: %p \n",GetTStamp(tBuff,56),this));
+
+ if(certCBLock) {
+ PR_DestroyLock(certCBLock);
+ }
}
void rhCoolKey::ShutDownInstance()
@@ -255,6 +268,212 @@
return S_OK;
}
+struct BadCertData {
+ PRErrorCode error;
+ PRInt32 port;
+};
+
+typedef struct BadCertData BadCertData;
+
+SECStatus rhCoolKey::badCertHandler(void *arg, PRFileDesc *fd)
+{
+ SECStatus secStatus = SECFailure;
+ PRErrorCode err;
+ char *host = NULL;
+ PRInt32 port = 0;
+ CERTCertificate *serverCert = NULL;
+ PRUint32 errorBits = 0;
+ char tBuff[56];
+
+ PR_Lock(certCBLock);
+
+ if (!arg || !fd) {
+ PR_Unlock(certCBLock);
+ return secStatus;
+ }
+
+ // Retrieve callback data from NssHttpClient
+ // Caller cleans up this data
+ BadCertData *data = (BadCertData *) arg;
+ data->error = err = PORT_GetError();
+
+
+ /* If any of the cases in the switch are met, then we will proceed */
+
+ switch (err) {
+ case SEC_ERROR_INVALID_AVA:
+ case SEC_ERROR_INVALID_TIME:
+ case SEC_ERROR_BAD_SIGNATURE:
+ case SEC_ERROR_EXPIRED_CERTIFICATE:
+ case SEC_ERROR_UNKNOWN_ISSUER:
+ case SEC_ERROR_UNTRUSTED_CERT:
+ case SEC_ERROR_CERT_VALID:
+ case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE:
+ case SEC_ERROR_CRL_EXPIRED:
+ case SEC_ERROR_CRL_BAD_SIGNATURE:
+ case SEC_ERROR_EXTENSION_VALUE_INVALID:
+ case SEC_ERROR_CA_CERT_INVALID:
+ case SEC_ERROR_CERT_USAGES_INVALID:
+ case SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION:
+ case SEC_ERROR_EXTENSION_NOT_FOUND: // Added by Rob 5/21/2002
+ secStatus = SECSuccess;
+ break;
+ default:
+ secStatus = SECFailure;
+ break;
+ }
+
+ if(secStatus == SECSuccess) {
+ PR_Unlock(certCBLock);
+ return secStatus;
+ }
+
+ // Collect errors to compare with override service output
+ switch(err) {
+ case SEC_ERROR_UNTRUSTED_ISSUER:
+ errorBits |= nsICertOverrideService::ERROR_UNTRUSTED;
+ break;
+ case SSL_ERROR_BAD_CERT_DOMAIN:
+ errorBits |= nsICertOverrideService::ERROR_MISMATCH;
+ break;
+ case SEC_ERROR_EXPIRED_CERTIFICATE:
+ errorBits |= nsICertOverrideService::ERROR_TIME;
+ default:
+ break;
+ };
+
+ // Now proceed to see if we have an exception.
+ // Get the server certificate that was rejected.
+ serverCert = SSL_PeerCertificate(fd);
+
+ if(!serverCert) {
+ PR_Unlock(certCBLock);
+ return secStatus;
+ }
+
+ port = data->port;
+ host = SSL_RevealURL(fd);
+
+ if(!host || port <= 0) {
+ PR_Unlock(certCBLock);
+ return secStatus;
+ }
+
+ PR_LOG(coolKeyLog, PR_LOG_DEBUG,
+ ("%s rhCoolKey::badCertHandler enter: error: %d url: %s port: %d \n",
+ GetTStamp(tBuff,56),err,host,port)
+ );
+
+ PRBool isTemporaryOverride = PR_FALSE;
+ PRUint32 overrideBits = 0;
+ PRBool overrideResult = PR_FALSE;
+
+ // Use the nsICertOverrideService to see if we have
+ // previously trusted this certificate.
+ nsCOMPtr overrideService =
+ do_GetService(NS_CERTOVERRIDE_CONTRACTID);
+
+ const nsEmbedCString nsHost(host);
+ nsEmbedCString hashAlg,fingerPrint;
+
+ nsresult nsrv;
+ unsigned char* fingerprint=NULL;
+ if(overrideService) {
+ nsrv = overrideService->GetValidityOverride((const nsACString &)nsHost,
+ port,(nsACString &)hashAlg,
+ (nsACString&)fingerPrint,&overrideBits,
+ &isTemporaryOverride,&overrideResult
+ );
+ if(nsrv == NS_OK) {
+ PR_LOG(coolKeyLog, PR_LOG_DEBUG,
+ ("%s rhCoolKey::badCertHandler res %d print %s len %d bits %u temp %d alg: %s \n",
+ GetTStamp(tBuff,56),overrideResult,fingerPrint.get(),
+ fingerPrint.Length(),overrideBits, isTemporaryOverride,hashAlg.get())
+ );
+ }
+
+ PRBool certMatches = PR_FALSE;
+
+ if( (nsrv == NS_OK) && overrideResult) {
+ SECItem oid;
+ oid.data = nsnull;
+ oid.len = 0;
+ SECStatus srv = SEC_StringToOID(nsnull, &oid,
+ hashAlg.get(), hashAlg.Length());
+
+ if (srv != SECSuccess) {
+ PR_Free(host);
+ host=NULL;
+ CERT_DestroyCertificate(serverCert);
+ serverCert=NULL;
+ PR_Unlock(certCBLock);
+ return secStatus;
+ }
+
+ SECOidTag oid_tag = SECOID_FindOIDTag(&oid);
+
+ unsigned int hash_len = HASH_ResultLenByOidTag(oid_tag);
+ fingerprint = new unsigned char[hash_len];
+
+ if(!fingerprint) {
+ CERT_DestroyCertificate(serverCert);
+ serverCert=NULL;
+ PR_Unlock(certCBLock);
+ return secStatus;
+ }
+
+ SECItem computedPrint;
+ memset(fingerprint, 0, sizeof fingerprint);
+ PK11_HashBuf(oid_tag, fingerprint,
+ serverCert->derCert.data, serverCert->derCert.len);
+ CERT_DestroyCertificate(serverCert);
+ serverCert=NULL;
+
+ computedPrint.data=fingerprint;
+ computedPrint.len=hash_len;
+
+ char *formattedPrint = CERT_Hexify(&computedPrint,1);
+ char *inputPrint = (char *)fingerPrint.get();
+
+ //Compare fingerprints.
+
+ if(formattedPrint && inputPrint) {
+ if(!PL_strcmp(formattedPrint, inputPrint))
+ certMatches = PR_TRUE;
+ }
+ PR_LOG( coolKeyLog, PR_LOG_DEBUG, ("%s certMatches: %d \n",
+ GetTStamp(tBuff,56),certMatches)
+ );
+
+ if(formattedPrint) {
+ PORT_Free(formattedPrint);
+ formattedPrint = NULL;
+ }
+ } else {
+ PR_LOG( coolKeyLog, PR_LOG_DEBUG, ("%s override test failed. \n",
+ GetTStamp(tBuff,56))
+ );
+ }
+
+ if( certMatches ) {
+ if(overrideBits | errorBits)
+ secStatus = SECSuccess;
+ }
+ }
+
+ PR_Free(host);
+ host = NULL;
+ if(fingerprint) {
+ delete [] fingerprint;
+ fingerprint = NULL;
+ }
+
+ PR_Unlock(certCBLock);
+
+ return secStatus;
+}
+
+
HRESULT rhCoolKey::doSetCoolKeyConfigValue(const char *aName, const char *aValue)
{
@@ -340,7 +559,7 @@
nssComponent
= do_GetService(PSM_COMPONENT_CONTRACTID);
- CoolKeySetCallbacks(Dispatch,Reference, Release,doGetCoolKeyConfigValue ,doSetCoolKeyConfigValue);
+ CoolKeySetCallbacks(Dispatch,Reference, Release,doGetCoolKeyConfigValue ,doSetCoolKeyConfigValue,badCertHandler);
mProxy = CreateProxyObject();
Index: rhCoolKey.h
===================================================================
RCS file: /cvs/dirsec/esc/src/app/xpcom/rhCoolKey.h,v
retrieving revision 1.1.1.1
retrieving revision 1.2
diff -u -r1.1.1.1 -r1.2
--- rhCoolKey.h 12 Jun 2006 23:39:50 -0000 1.1.1.1
+++ rhCoolKey.h 19 Jun 2009 21:03:39 -0000 1.2
@@ -22,6 +22,15 @@
#include "nsIGenericFactory.h"
#include "nsEmbedString.h"
#include
+#include "nspr.h"
+#include "prio.h"
+#include "ssl.h"
+#include "pk11func.h"
+#include "cert.h"
+#include "sslerr.h"
+#include "secerr.h"
+#include "sechash.h"
+
#include "CoolKey.h"
#include "nsCOMPtr.h"
#include "nsIObserver.h"
@@ -92,6 +101,7 @@
static HRESULT doSetCoolKeyConfigValue(const char *aName, const char *aValue);
static const char *doGetCoolKeyConfigValue(const char *aName );
+ static SECStatus badCertHandler(void *arg, PRFileDesc *fd);
protected:
/* additional members */
@@ -107,6 +117,8 @@
static std::list< nsCOMPtr > gNotifyListeners;
+ static PRLock* certCBLock;
+
rhICoolKey* mProxy;
static PRBool gAutoEnrollBlankTokens;
From jmagne at fedoraproject.org Fri Jun 19 21:03:42 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Fri, 19 Jun 2009 21:03:42 +0000 (UTC)
Subject: [389-commits]
esc/src/lib/coolkey CoolKey.cpp, 1.10, 1.11 CoolKey.h,
1.8, 1.9 Makefile, 1.2, 1.3 manifest.mn, 1.5, 1.6
Message-ID: <20090619210342.9035E70132@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/src/lib/coolkey
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv27580/lib/coolkey
Modified Files:
CoolKey.cpp CoolKey.h Makefile manifest.mn
Log Message:
Bugzilla#479722 ESC to TPS SSL communication problem with renewed TPS cert.
Index: CoolKey.cpp
===================================================================
RCS file: /cvs/dirsec/esc/src/lib/coolkey/CoolKey.cpp,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- CoolKey.cpp 13 Jun 2009 23:44:52 -0000 1.10
+++ CoolKey.cpp 19 Jun 2009 21:03:40 -0000 1.11
@@ -259,12 +259,14 @@
static CoolKeyRelease g_Release = NULL;
static CoolKeyGetConfigValue g_GetConfigValue = NULL;
static CoolKeySetConfigValue g_SetConfigValue = NULL;
+static CoolKeyBadCertHandler g_BadCertHandler = NULL;
char* CoolKeyVerifyPassword(PK11SlotInfo *,PRBool,void *);
COOLKEY_API HRESULT CoolKeySetCallbacks(CoolKeyDispatch dispatch,
CoolKeyReference reference, CoolKeyRelease release,
- CoolKeyGetConfigValue getconfigvalue,CoolKeySetConfigValue setconfigvalue)
+ CoolKeyGetConfigValue getconfigvalue,CoolKeySetConfigValue setconfigvalue,
+ CoolKeyBadCertHandler badcerthandler)
{
char tBuff[56];
g_Dispatch = dispatch;
@@ -272,6 +274,7 @@
g_Release = release;
g_GetConfigValue = getconfigvalue;
g_SetConfigValue = setconfigvalue;
+ g_BadCertHandler = badcerthandler;
char * suppressPINPrompt =(char*) CoolKeyGetConfig("esc.security.url");
@@ -1300,6 +1303,13 @@
return aCUID;
}
+CoolKeyBadCertHandler CoolKeyGetBadCertHandler()
+{
+ if(g_BadCertHandler)
+ return g_BadCertHandler;
+ return NULL;
+}
+
const char *CoolKeyGetConfig(const char *aValue)
{
if(!g_GetConfigValue || ! aValue)
Index: CoolKey.h
===================================================================
RCS file: /cvs/dirsec/esc/src/lib/coolkey/CoolKey.h,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- CoolKey.h 13 Jun 2009 23:44:52 -0000 1.8
+++ CoolKey.h 19 Jun 2009 21:03:40 -0000 1.9
@@ -26,6 +26,7 @@
// platforms (coreconf will do the appropriate processing.
#define COOLKEY_API
+#include "ssl.h"
#include
#include
#include
@@ -100,7 +101,7 @@
typedef HRESULT (*CoolKeySetConfigValue)(const char *name,const char *value);
typedef const char * (*CoolKeyGetConfigValue)(const char *name);
-
+typedef SECStatus (*CoolKeyBadCertHandler)(void *arg, PRFileDesc *fd);
extern "C" {
@@ -112,7 +113,8 @@
COOLKEY_API HRESULT CoolKeyUnregisterListener(CoolKeyListener* aListener);
COOLKEY_API HRESULT CoolKeySetCallbacks(CoolKeyDispatch dispatch,
CoolKeyReference reference, CoolKeyRelease release,
- CoolKeyGetConfigValue getconfigvalue,CoolKeySetConfigValue setconfigvalue);
+ CoolKeyGetConfigValue getconfigvalue,CoolKeySetConfigValue setconfigvalue,
+ CoolKeyBadCertHandler badcerthandler=NULL);
COOLKEY_API bool CoolKeyRequiresAuthentication(const CoolKey *aKey);
COOLKEY_API bool CoolKeyHasApplet(const CoolKey *aKey);
@@ -259,6 +261,9 @@
const char *CoolKeyGetConfig(const char *aName);
HRESULT CoolKeySetConfig(const char *aName,const char *aValue);
+CoolKeyBadCertHandler CoolKeyGetBadCertHandler();
+
+
}
Index: Makefile
===================================================================
RCS file: /cvs/dirsec/esc/src/lib/coolkey/Makefile,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- Makefile 10 Jan 2007 02:21:25 -0000 1.2
+++ Makefile 19 Jun 2009 21:03:40 -0000 1.3
@@ -35,6 +35,9 @@
echo "Build Linux or Windows."
make -f common.mk
+export::
+ make -f common.mk export
+
endif
ifeq ($(OS_ARCH),Darwin)
Index: manifest.mn
===================================================================
RCS file: /cvs/dirsec/esc/src/lib/coolkey/manifest.mn,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- manifest.mn 23 Apr 2009 22:04:11 -0000 1.5
+++ manifest.mn 19 Jun 2009 21:03:40 -0000 1.6
@@ -19,7 +19,6 @@
XULRUNNER_BASE=$(CORE_DEPTH)/dist/$(OBJDIR)//xulrunner_build
-
SYS_INC = /usr/include
MODULE = ckymanager
LIBRARY_NAME = $(MODULE)
@@ -41,7 +40,7 @@
SmartCardMonitoringThread.cpp \
$(NULL)
-EXPORTS = \
+EXPORTS = \
CoolKey.h \
$(NULL)
From jmagne at fedoraproject.org Fri Jun 19 21:03:42 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Fri, 19 Jun 2009 21:03:42 +0000 (UTC)
Subject: [389-commits] esc/src/lib/NssHttpClient engine.cpp, 1.4,
1.5 engine.h, 1.1.1.1, 1.2 manifest.mn, 1.4, 1.5
Message-ID: <20090619210342.4033D70132@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/src/lib/NssHttpClient
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv27580/lib/NssHttpClient
Modified Files:
engine.cpp engine.h manifest.mn
Log Message:
Bugzilla#479722 ESC to TPS SSL communication problem with renewed TPS cert.
Index: engine.cpp
===================================================================
RCS file: /cvs/dirsec/esc/src/lib/NssHttpClient/engine.cpp,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- engine.cpp 24 Feb 2007 02:10:45 -0000 1.4
+++ engine.cpp 19 Jun 2009 21:03:40 -0000 1.5
@@ -16,6 +16,8 @@
* All rights reserved.
* END COPYRIGHT BLOCK **/
+#define FORCE_PR_LOG 1
+
#include
#include "sslproto.h"
#include
@@ -27,7 +29,7 @@
#include "certt.h"
#include "sslerr.h"
#include "secerr.h"
-
+#include "CoolKey.h"
#include "engine.h"
#include "http.h"
@@ -39,6 +41,9 @@
int cipherCount = 0;
int _doVerifyServerCert = 1;
+PRLogModuleInfo *httpEngineLog = PR_NewLogModule("coolKeyHttpEngine");
+
+
PRIntervalTime Engine::globaltimeout = PR_TicksPerSecond()*30;
/**
@@ -56,13 +61,26 @@
SECStatus secStatus = SECFailure;
PRErrorCode err;
+ char tBuff[56];
+
+ PR_LOG(httpEngineLog, PR_LOG_DEBUG,
+ ("%s myBadCertHandler enter. \n",GetTStamp(tBuff,56)));
+
/* log invalid cert here */
if ( !arg ) {
return secStatus;
}
- *(PRErrorCode *)arg = err = PORT_GetError();
+ err = PORT_GetError();
+
+ BadCertData *data = (BadCertData *) arg;
+ if(data) {
+ data->error = err;
+ }
+
+ PR_LOG(httpEngineLog, PR_LOG_DEBUG,
+ ("%s myBadCertHandler err: %d . \n",GetTStamp(tBuff,56),err));
/* If any of the cases in the switch are met, then we will proceed */
/* with the processing of the request anyway. Otherwise, the default */
@@ -91,6 +109,10 @@
break;
}
+ PR_LOG(httpEngineLog, PR_LOG_DEBUG,
+ ("%s myBadCertHandler status: %d . \n",GetTStamp(tBuff,56),secStatus));
+
+
return secStatus;
}
@@ -416,7 +438,6 @@
return;
}
-
void Engine::CloseConnection()
{
connectionClosed = true;
@@ -426,7 +447,14 @@
PR_Close(_sock);
_sock = NULL;
}
+
+ if(_certData)
+ {
+ delete _certData;
+ _certData = NULL;
+ }
}
+
/**
* Returns a file descriptor for I/O if the HTTP connection is successful
* @param addr PRnetAddr structure which points to the server to connect to
@@ -442,21 +470,19 @@
PRFileDesc *tcpsock = NULL;
PRFileDesc *sock = NULL;
connectionClosed = false;
+ _certData = new BadCertData();
tcpsock = PR_OpenTCPSocket(addr->raw.family);
-
if (!tcpsock) {
-
return NULL;
}
nodelay(tcpsock);
if (PR_TRUE == SSLOn) {
- sock=SSL_ImportFD(NULL, tcpsock);
-
+ sock=SSL_ImportFD(NULL, tcpsock);
if (!sock) {
//xxx log
if( tcpsock != NULL ) {
@@ -516,9 +542,23 @@
PRErrorCode errCode = 0;
- rv = SSL_BadCertHook( sock,
+ if(_certData) {
+ _certData->error = errCode;
+ _certData->port = PR_ntohs(PR_NetAddrInetPort(addr));
+ }
+
+ CoolKeyBadCertHandler overriddenHandler = CoolKeyGetBadCertHandler();
+
+ if(overriddenHandler) {
+ rv = SSL_BadCertHook( sock,
+ (SSLBadCertHandler)overriddenHandler,
+ (void *)_certData);
+ } else {
+ rv = SSL_BadCertHook( sock,
(SSLBadCertHandler)myBadCertHandler,
- &errCode );
+ (void *)_certData);
+ }
+
rv = SSL_SetURL( sock, serverName );
if (rv != SECSuccess ) {
@@ -536,8 +576,6 @@
sock = tcpsock;
}
-
-
if ( PR_Connect(sock, addr, timeout) == PR_FAILURE ) {
if( sock != NULL ) {
@@ -563,11 +601,17 @@
const PSHttpServer& server,
int timeout, PRBool expectChunked ,PRBool processStreamed) {
PRNetAddr addr;
- PRFileDesc *sock = NULL;
PSHttpResponse *resp = NULL;
PRBool response_code = 0;
+ char tBuff[56];
+
+ PR_LOG(httpEngineLog, PR_LOG_DEBUG,
+ ("%s HttpEngine::makeRequest enter. \n",GetTStamp(tBuff,56)));
+
+
+
server.getAddr(&addr);
char *nickName = request.getCertNickName();
@@ -575,8 +619,17 @@
char *serverName = (char *)server.getAddr();
_sock = _doConnect( &addr, request.isSSL(), 0, 0,nickName, 0, serverName );
+ PR_LOG(httpEngineLog, PR_LOG_DEBUG,
+ ("%s HttpEngine::makeRequest past doConnect sock: %p. \n",
+ GetTStamp(tBuff,56),_sock));
+
if ( _sock != NULL) {
PRBool status = request.send( _sock );
+
+ PR_LOG(httpEngineLog, PR_LOG_DEBUG,
+ ("%s HttpEngine::makeRequest past request.send status: %d. \n",
+ GetTStamp(tBuff,56),status));
+
if ( status ) {
resp = new PSHttpResponse( _sock, &request, timeout, expectChunked ,this);
response_code = resp->processResponse(processStreamed);
Index: engine.h
===================================================================
RCS file: /cvs/dirsec/esc/src/lib/NssHttpClient/engine.h,v
retrieving revision 1.1.1.1
retrieving revision 1.2
diff -u -r1.1.1.1 -r1.2
--- engine.h 12 Jun 2006 23:39:52 -0000 1.1.1.1
+++ engine.h 19 Jun 2009 21:03:40 -0000 1.2
@@ -22,9 +22,17 @@
#include "response.h"
#include "request.h"
+struct BadCertData {
+ PRErrorCode error;
+ PRInt32 port;
+};
+
+typedef struct BadCertData BadCertData;
+
+
class __EXPORT Engine {
public:
- Engine() {};
+ Engine() { _certData = NULL; _sock=NULL;};
~Engine() {};
PRFileDesc *_doConnect(PRNetAddr *addr, PRBool SSLOn = PR_FALSE,
@@ -37,7 +45,8 @@
static PRIntervalTime globaltimeout;
PRFileDesc *_sock;
-
+ BadCertData *_certData;
+ BadCertData *getBadCertData() { return _certData;}
PRFileDesc *getSocket() { return _sock;}
bool connectionClosed ;
Index: manifest.mn
===================================================================
RCS file: /cvs/dirsec/esc/src/lib/NssHttpClient/manifest.mn,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- manifest.mn 4 Feb 2009 01:43:47 -0000 1.4
+++ manifest.mn 19 Jun 2009 21:03:40 -0000 1.5
@@ -24,7 +24,7 @@
MODULE = httpchunked
LIBRARY_NAME = $(MODULE)
SHARED_NAME = $(MODULE)
-REQUIRES = nss nspr
+REQUIRES = nss nspr ckymanager
ifndef MOZ_OFFSET
MOZ_OFFSET = mozilla-1.7.13
endif
From jmagne at fedoraproject.org Fri Jun 19 21:03:42 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Fri, 19 Jun 2009 21:03:42 +0000 (UTC)
Subject: [389-commits] esc/src/app/xul/esc/chrome/content/esc
certManager.xul, 1.4, 1.5
Message-ID: <20090619210342.0A29D700F9@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/src/app/xul/esc/chrome/content/esc
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv27580/app/xul/esc/chrome/content/esc
Modified Files:
certManager.xul
Log Message:
Bugzilla#479722 ESC to TPS SSL communication problem with renewed TPS cert.
Index: certManager.xul
===================================================================
RCS file: /cvs/dirsec/esc/src/app/xul/esc/chrome/content/esc/certManager.xul,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- certManager.xul 7 Jun 2009 00:09:16 -0000 1.4
+++ certManager.xul 19 Jun 2009 21:03:39 -0000 1.5
@@ -65,7 +65,7 @@
-
+
From jmagne at fedoraproject.org Tue Jun 23 02:02:05 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Tue, 23 Jun 2009 02:02:05 +0000 (UTC)
Subject: [389-commits] esc/src/lib/NssHttpClient httpClientNss.cpp,1.3,1.4
Message-ID: <20090623020205.3373270138@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/src/lib/NssHttpClient
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv2297
Modified Files:
httpClientNss.cpp
Log Message:
Bugzilla
Index: httpClientNss.cpp
===================================================================
RCS file: /cvs/dirsec/esc/src/lib/NssHttpClient/httpClientNss.cpp,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- httpClientNss.cpp 4 Feb 2009 01:43:47 -0000 1.3
+++ httpClientNss.cpp 23 Jun 2009 02:02:02 -0000 1.4
@@ -64,8 +64,53 @@
PSHttpResponse *HttpClientNss::httpSendChunked(char *host_port, char *uri, char *method, char *body,PSChunkedResponseCallback cb,void *uw,PRBool doSSL,int messageTimeout )
{
-
- PSHttpServer server(host_port, PR_AF_INET);
+ char *pPort = NULL;
+ char *pPortActual = NULL;
+
+ char hostName[512];
+
+ /*
+ * Isolate the host name, account for IPV6 numeric addresses.
+ *
+ */
+
+ if(host_port)
+ strncpy(hostName,host_port,512);
+
+ pPort = hostName;
+ while(1) {
+ pPort = strchr(pPort, ':');
+ if (pPort) {
+ pPortActual = pPort;
+ pPort++;
+ } else
+ break;
+ }
+
+ if(pPortActual)
+ *pPortActual = '\0';
+
+ /*
+ * Rifle through the values for the host
+ */
+
+ PRAddrInfo *ai;
+ void *iter;
+ PRNetAddr addr;
+ int family = PR_AF_INET;
+
+ ai = PR_GetAddrInfoByName(hostName, PR_AF_UNSPEC, PR_AI_ADDRCONFIG);
+ if (ai) {
+ printf("%s\n", PR_GetCanonNameFromAddrInfo(ai));
+ iter = NULL;
+ while ((iter = PR_EnumerateAddrInfo(iter, ai, 0, &addr)) != NULL) {
+ family = PR_NetAddrFamily(&addr);
+ break;
+ }
+ PR_FreeAddrInfo(ai);
+ }
+
+ PSHttpServer server(host_port, family);
PSHttpRequest request( &server, uri, HTTP11, 0 );
_request = &request;
From jmagne at fedoraproject.org Wed Jun 24 23:17:52 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Wed, 24 Jun 2009 23:17:52 +0000 (UTC)
Subject: [389-commits] esc/win32 setup.iss,1.13,1.14 build.sh,1.10,1.11
Message-ID: <20090624231752.A3AAF70107@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/win32
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv20188
Modified Files:
setup.iss build.sh
Log Message:
Bump version.
Index: setup.iss
===================================================================
RCS file: /cvs/dirsec/esc/win32/setup.iss,v
retrieving revision 1.13
retrieving revision 1.14
diff -u -r1.13 -r1.14
--- setup.iss 19 Jun 2009 21:00:49 -0000 1.13
+++ setup.iss 24 Jun 2009 23:17:50 -0000 1.14
@@ -4,28 +4,27 @@
[Setup]
AppName=Smart Card Manager
AppMutex=ESCMutex
-AppVerName=Smart Card Manager 1.1.0-7
-AppPublisher=Fedora
+AppVerName=Smart Card Manager 1.1.0-8
+AppPublisher=Red Hat, Inc.
CreateAppDir=true
Compression=lzma
SolidCompression=true
MinVersion=0,5.0.2195
ShowLanguageDialog=yes
-OutputBaseFilename=SmartCardManagerSetup-1.1.0-7.win32.i386
-DefaultDirName={pf}\Fedora\ESC
+OutputBaseFilename=SmartCardManagerSetup-1.1.0-8.win32.i386
+DefaultDirName={pf}\Red Hat\ESC
DisableProgramGroupPage=false
-DefaultGroupName=Fedora
+DefaultGroupName=Red Hat
SetupIconFile=BUILD\ESC\components\esc.ico
UninstallDisplayIcon={app}\components\esc.ico
-;WizardImageFile=BUILD\ESC\chrome\content\esc\esc-image-large.bmp
-WizardImageFile=esc-image-large.bmp
+WizardImageFile=BUILD\ESC\chrome\content\esc\esc-image-large.bmp
WizardSmallImageFile=BUILD\ESC\components\esc.bmp
AllowNoIcons=yes
LicenseFile=esc-license.txt
InfoBeforeFile=info-before.txt
InfoAfterFile=info-after.txt
PrivilegesRequired=admin
-VersionInfoVersion=1.1.0.7
+VersionInfoVersion=1.1.0.8
[Files]
@@ -438,13 +437,14 @@
Root: HKLM; Subkey: Software\Microsoft\Cryptography\Calais\SmartCards\Gemalto 64K V2; ValueType: binary; ValueName: ATR; ValueData: 3b 95 00 40 00 ae 01 03 00 00
-; Now register the Safenet 330J
+; Now register the Safenet 330J
Root: HKLM; Subkey: Software\Microsoft\Cryptography\Calais\SmartCards\Safenet 330J; ValueType: binary; ValueName: ATRMask; ValueData: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00; Flags: uninsdeletekey
Root: HKLM; Subkey: Software\Microsoft\Cryptography\Calais\SmartCards\Safenet 330J; ValueType: string; ValueName: Crypto Provider; ValueData: CoolKey PKCS #11 CSP
Root: HKLM; Subkey: Software\Microsoft\Cryptography\Calais\SmartCards\Safenet 330J; ValueType: binary; ValueName: ATR; ValueData: 3b ec 00 ff 81 31 fe 45 a0 00 00 00 56 33 33 30 4a 33 06 00 00
+
Root: HKLM; Subkey: Software\
; Turn off the "pick a cert" dialog box
Root: HKCU; Subkey: Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3; ValueType: dword; ValueName: 1A04; ValueData: 0
Index: build.sh
===================================================================
RCS file: /cvs/dirsec/esc/win32/build.sh,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- build.sh 6 Jun 2009 00:30:35 -0000 1.10
+++ build.sh 24 Jun 2009 23:17:50 -0000 1.11
@@ -78,7 +78,7 @@
#ESC values
ESC_NAME=esc
-ESC_VERSION_NO=1.1.0-6
+ESC_VERSION_NO=1.1.0-8
#Cygwin values
From jmagne at fedoraproject.org Wed Jun 24 23:24:20 2009
From: jmagne at fedoraproject.org (Jack Magne)
Date: Wed, 24 Jun 2009 23:24:20 +0000 (UTC)
Subject: [389-commits] esc/win32 setup.iss,1.14,1.15
Message-ID: <20090624232420.BE8AE70139@cvs1.fedora.phx.redhat.com>
Author: jmagne
Update of /cvs/dirsec/esc/win32
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv22189
Modified Files:
setup.iss
Log Message:
Fixed typos.
Index: setup.iss
===================================================================
RCS file: /cvs/dirsec/esc/win32/setup.iss,v
retrieving revision 1.14
retrieving revision 1.15
diff -u -r1.14 -r1.15
--- setup.iss 24 Jun 2009 23:17:50 -0000 1.14
+++ setup.iss 24 Jun 2009 23:24:18 -0000 1.15
@@ -5,16 +5,16 @@
AppName=Smart Card Manager
AppMutex=ESCMutex
AppVerName=Smart Card Manager 1.1.0-8
-AppPublisher=Red Hat, Inc.
+AppPublisher=Fedora
CreateAppDir=true
Compression=lzma
SolidCompression=true
MinVersion=0,5.0.2195
ShowLanguageDialog=yes
OutputBaseFilename=SmartCardManagerSetup-1.1.0-8.win32.i386
-DefaultDirName={pf}\Red Hat\ESC
+DefaultDirName={pf}\Fedora\ESC
DisableProgramGroupPage=false
-DefaultGroupName=Red Hat
+DefaultGroupName=Fedora
SetupIconFile=BUILD\ESC\components\esc.ico
UninstallDisplayIcon={app}\components\esc.ico
WizardImageFile=BUILD\ESC\chrome\content\esc\esc-image-large.bmp