|
 |
d4b2f2 |
From 15d406ee3afbb52832d5c61a1afb735724d109a2 Mon Sep 17 00:00:00 2001
|
|
|
d4b2f2 |
From: Rob Crittenden <rcritten@redhat.com>
|
|
|
d4b2f2 |
Date: Tue, 18 Sep 2018 10:21:28 -0400
|
|
|
d4b2f2 |
Subject: [PATCH 7/7] Use only PK11_ImportCert to import certs, not
|
|
|
d4b2f2 |
CERT_ImportCerts
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
CERT_ImportCerts always imports a given certificate into the
|
|
|
d4b2f2 |
certificate database, whether a token is requested or not.
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
Using PK11_ImportCert will import the cert, associate the key
|
|
|
d4b2f2 |
properly and will only add the certificate to the appropriate
|
|
|
d4b2f2 |
token.
|
|
|
d4b2f2 |
---
|
|
|
d4b2f2 |
src/certsave-n.c | 37 +++++++++++--------------------------
|
|
|
d4b2f2 |
1 file changed, 11 insertions(+), 26 deletions(-)
|
|
|
d4b2f2 |
|
|
|
d4b2f2 |
diff --git a/src/certsave-n.c b/src/certsave-n.c
|
|
|
d4b2f2 |
index d0152cad..fcb43148 100644
|
|
|
d4b2f2 |
--- a/src/certsave-n.c
|
|
|
d4b2f2 |
+++ b/src/certsave-n.c
|
|
|
d4b2f2 |
@@ -100,7 +100,7 @@ cm_certsave_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
|
|
d4b2f2 |
NSSInitContext *ctx;
|
|
|
d4b2f2 |
CERTCertDBHandle *certdb;
|
|
|
d4b2f2 |
CERTCertList *certlist;
|
|
|
d4b2f2 |
- CERTCertificate **returned, *oldcert, cert;
|
|
|
d4b2f2 |
+ CERTCertificate *oldcert, *newcert, cert;
|
|
|
d4b2f2 |
CERTCertTrust trust;
|
|
|
d4b2f2 |
CERTSignedData csdata;
|
|
|
d4b2f2 |
CERTCertListNode *node;
|
|
|
d4b2f2 |
@@ -497,33 +497,18 @@ cm_certsave_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
|
|
d4b2f2 |
}
|
|
|
d4b2f2 |
}
|
|
|
d4b2f2 |
/* Import the certificate. */
|
|
|
d4b2f2 |
- returned = NULL;
|
|
|
d4b2f2 |
- error = CERT_ImportCerts(certdb,
|
|
|
d4b2f2 |
- certUsageUserCertImport,
|
|
|
d4b2f2 |
- 1, &item, &returned,
|
|
|
d4b2f2 |
- PR_TRUE,
|
|
|
d4b2f2 |
- PR_FALSE,
|
|
|
d4b2f2 |
- entry->cm_cert_nickname);
|
|
|
d4b2f2 |
- ec = PORT_GetError();
|
|
|
d4b2f2 |
- if (error == SECSuccess) {
|
|
|
d4b2f2 |
- /* If NSS uses SQL DB storage, CERT_ImportCerts creates
|
|
|
d4b2f2 |
- * an incomplete internal state (the cert isn't
|
|
|
d4b2f2 |
- * associated with the private key, and calling
|
|
|
d4b2f2 |
- * PK11_FindKeyByAnyCert returns no result).
|
|
|
d4b2f2 |
- * As a workaround, we import the cert again using
|
|
|
d4b2f2 |
- * PK11_ImportCert, which magically fixes the issue.
|
|
|
d4b2f2 |
- * See rhbz#1532188 */
|
|
|
d4b2f2 |
+ newcert = CERT_DecodeCertFromPackage((char *)item->data, item->len);
|
|
|
d4b2f2 |
+ if (newcert != NULL) {
|
|
|
d4b2f2 |
error = PK11_ImportCert(sle->slot,
|
|
|
d4b2f2 |
- returned[0],
|
|
|
d4b2f2 |
+ newcert,
|
|
|
d4b2f2 |
CK_INVALID_HANDLE,
|
|
|
d4b2f2 |
- returned[0]->nickname,
|
|
|
d4b2f2 |
+ entry->cm_cert_nickname,
|
|
|
d4b2f2 |
PR_FALSE);
|
|
|
d4b2f2 |
}
|
|
|
d4b2f2 |
if (error == SECSuccess) {
|
|
|
d4b2f2 |
- cm_log(1, "Imported certificate \"%s\", got "
|
|
|
d4b2f2 |
+ cm_log(1, "Imported certificate with "
|
|
|
d4b2f2 |
"nickname \"%s\".\n",
|
|
|
d4b2f2 |
- entry->cm_cert_nickname,
|
|
|
d4b2f2 |
- returned[0]->nickname);
|
|
|
d4b2f2 |
+ entry->cm_cert_nickname);
|
|
|
d4b2f2 |
status = 0;
|
|
|
d4b2f2 |
/* Set the trust on the new certificate,
|
|
|
d4b2f2 |
* perhaps matching the trust on an
|
|
|
d4b2f2 |
@@ -536,7 +521,7 @@ cm_certsave_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
|
|
d4b2f2 |
trust.objectSigningFlags = CERTDB_USER;
|
|
|
d4b2f2 |
}
|
|
|
d4b2f2 |
error = CERT_ChangeCertTrust(certdb,
|
|
|
d4b2f2 |
- returned[0],
|
|
|
d4b2f2 |
+ newcert,
|
|
|
d4b2f2 |
&trust);
|
|
|
d4b2f2 |
ec = PORT_GetError();
|
|
|
d4b2f2 |
if (error != SECSuccess) {
|
|
|
d4b2f2 |
@@ -621,10 +606,10 @@ cm_certsave_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
|
|
d4b2f2 |
}
|
|
|
d4b2f2 |
/* If we managed to import the certificate, mark its
|
|
|
d4b2f2 |
* key for having its nickname removed. */
|
|
|
d4b2f2 |
- if ((returned != NULL) && (returned[0] != NULL)) {
|
|
|
d4b2f2 |
- privkey = PK11_FindKeyByAnyCert(returned[0], NULL);
|
|
|
d4b2f2 |
+ if (newcert != NULL) {
|
|
|
d4b2f2 |
+ privkey = PK11_FindKeyByAnyCert(newcert, NULL);
|
|
|
d4b2f2 |
privkeys = add_privkey_to_list(privkeys, privkey);
|
|
|
d4b2f2 |
- CERT_DestroyCertArray(returned, 1);
|
|
|
d4b2f2 |
+ CERT_DestroyCertificate(newcert);
|
|
|
d4b2f2 |
}
|
|
|
d4b2f2 |
/* In case we're rekeying, but failed, mark the
|
|
|
d4b2f2 |
* candidate key for name-clearing or removal, too. */
|
|
|
d4b2f2 |
--
|
|
|
d4b2f2 |
2.14.4
|
|
|
d4b2f2 |
|