From owner-svn-src-stable@freebsd.org Sun Sep 13 01:09:23 2020 Return-Path: Delivered-To: svn-src-stable@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 10A543E70D1; Sun, 13 Sep 2020 01:09:23 +0000 (UTC) (envelope-from kevans@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4BprxG6fvXz4kMy; Sun, 13 Sep 2020 01:09:22 +0000 (UTC) (envelope-from kevans@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id C96A11DBD8; Sun, 13 Sep 2020 01:09:22 +0000 (UTC) (envelope-from kevans@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 08D19M3r093772; Sun, 13 Sep 2020 01:09:22 GMT (envelope-from kevans@FreeBSD.org) Received: (from kevans@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 08D19MDh093771; Sun, 13 Sep 2020 01:09:22 GMT (envelope-from kevans@FreeBSD.org) Message-Id: <202009130109.08D19MDh093771@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: kevans set sender to kevans@FreeBSD.org using -f From: Kyle Evans Date: Sun, 13 Sep 2020 01:09:22 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r365681 - in stable: 11/usr.sbin/certctl 12/usr.sbin/certctl X-SVN-Group: stable-11 X-SVN-Commit-Author: kevans X-SVN-Commit-Paths: in stable: 11/usr.sbin/certctl 12/usr.sbin/certctl X-SVN-Commit-Revision: 365681 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: SVN commit messages for all the -stable branches of the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Sep 2020 01:09:23 -0000 Author: kevans Date: Sun Sep 13 01:09:22 2020 New Revision: 365681 URL: https://svnweb.freebsd.org/changeset/base/365681 Log: MFC r365500: certctl: fix hashed link generation with duplicate subjects Currently, certctl rehash will just keep clobbering .0 rather than incrementing the suffix upon encountering a duplicate. Do this, and do it for blacklisted certs as well. This also improves the situation with the blacklist to be a little less flakey, comparing cert fingerprints for all certs with a matching subject hash in the blacklist to determine if the cert we're looking at can be installed. Future work needs to completely revamp the blacklist to align more with how it's described in PR 246614. In particular, /etc/ssl/blacklisted should go away to avoid potential confusion -- OpenSSL will not read it, it's basically certctl internal. PR: 246614 Modified: stable/11/usr.sbin/certctl/certctl.sh Directory Properties: stable/11/ (props changed) Changes in other areas also in this revision: Modified: stable/12/usr.sbin/certctl/certctl.sh Directory Properties: stable/12/ (props changed) Modified: stable/11/usr.sbin/certctl/certctl.sh ============================================================================== --- stable/11/usr.sbin/certctl/certctl.sh Sun Sep 13 01:08:18 2020 (r365680) +++ stable/11/usr.sbin/certctl/certctl.sh Sun Sep 13 01:09:22 2020 (r365681) @@ -30,7 +30,7 @@ ############################################################ CONFIGURATION : ${DESTDIR:=} -: ${FILEPAT:="\.pem$|\.crt$|\.cer$|\.crl$|\.0$"} +: ${FILEPAT:="\.pem$|\.crt$|\.cer$|\.crl$"} : ${VERBOSE:=0} ############################################################ GLOBALS @@ -56,31 +56,58 @@ do_hash() fi } +get_decimal() +{ + local checkdir hash decimal + + checkdir=$1 + hash=$2 + decimal=0 + + while [ -e "$checkdir/$hash.$decimal" ]; do + decimal=$((decimal + 1)) + done + + echo ${decimal} + return 0 +} + create_trusted_link() { - local hash + local blisthash certhash hash + local suffix hash=$( do_hash "$1" ) || return - if [ -e "$BLACKLISTDESTDIR/$hash.0" ]; then - echo "Skipping blacklisted certificate $1 ($BLACKLISTDESTDIR/$hash.0)" - return 1 - fi - [ $VERBOSE -gt 0 ] && echo "Adding $hash.0 to trust store" - [ $NOOP -eq 0 ] && install ${INSTALLFLAGS} -lrs $(realpath "$1") "$CERTDESTDIR/$hash.0" + certhash=$( openssl x509 -sha1 -in "$1" -noout -fingerprint ) + for blistfile in $(find $BLACKLISTDESTDIR -name "$hash.*"); do + blisthash=$( openssl x509 -sha1 -in "$blistfile" -noout -fingerprint ) + if [ "$certhash" = "$blisthash" ]; then + echo "Skipping blacklisted certificate $1 ($blistfile)" + return 1 + fi + done + suffix=$(get_decimal "$CERTDESTDIR" "$hash") + [ $VERBOSE -gt 0 ] && echo "Adding $hash.$suffix to trust store" + [ $NOOP -eq 0 ] && \ + install ${INSTALLFLAGS} -lrs $(realpath "$1") "$CERTDESTDIR/$hash.$suffix" } create_blacklisted() { local hash srcfile filename + local suffix # If it exists as a file, we'll try that; otherwise, we'll scan if [ -e "$1" ]; then hash=$( do_hash "$1" ) || return srcfile=$(realpath "$1") - filename="$hash.0" + suffix=$(get_decimal "$BLACKLISTDESTDIR" "$hash") + filename="$hash.$suffix" elif [ -e "${CERTDESTDIR}/$1" ]; then srcfile=$(realpath "${CERTDESTDIR}/$1") - filename="$1" + hash=$(echo "$1" | sed -Ee 's/\.([0-9])+$//') + suffix=$(get_decimal "$BLACKLISTDESTDIR" "$hash") + filename="$hash.$suffix" else return fi @@ -115,7 +142,7 @@ do_list() if [ -e "$1" ]; then cd "$1" - for CFILE in *.0; do + for CFILE in *.[0-9]; do if [ ! -s "$CFILE" ]; then echo "Unable to read $CFILE" >&2 ERRORS=$(( $ERRORS + 1 )) @@ -174,14 +201,20 @@ cmd_blacklist() cmd_unblacklist() { - local BFILE hash + local BFILE blisthash certhash hash shift # verb for BFILE in "$@"; do if [ -s "$BFILE" ]; then hash=$( do_hash "$BFILE" ) - echo "Removing $hash.0 from blacklist" - [ $NOOP -eq 0 ] && rm -f "$BLACKLISTDESTDIR/$hash.0" + certhash=$( openssl x509 -sha1 -in "$BFILE" -noout -fingerprint ) + for BLISTEDFILE in $(find $BLACKLISTDESTDIR -name "$hash.*"); do + blisthash=$( openssl x509 -sha1 -in "$BLISTEDFILE" -noout -fingerprint ) + if [ "$certhash" = "$blisthash" ]; then + echo "Removing $(basename "$BLISTEDFILE") from blacklist" + [ $NOOP -eq 0 ] && rm -f $BLISTEDFILE + fi + done elif [ -e "$BLACKLISTDESTDIR/$BFILE" ]; then echo "Removing $BFILE from blacklist" [ $NOOP -eq 0 ] && rm -f "$BLACKLISTDESTDIR/$BFILE"