- rediff patch, rebuild with openssl 3.0.0, rel 4

[packages/sbsigntool.git] / openssl.patch

From 3186e24f5a46172cd771d61cdeec5e590f73743e Mon Sep 17 00:00:00 2001
From: Steve Langasek <steve.langasek@canonical.com>
Date: Wed, 15 Jul 2015 08:48:25 -0700
Subject: [PATCH] Support openssl 1.0.2b and above

Newer versions of openssl return a different error with alternate
certificate chains; update for compatibility.

Signed-off-by: Marc Deslauriers <marc.deslauriers@canonical.com>
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1474541
---
 src/sbverify.c | 1 +
 1 file changed, 1 insertion(+)

diff -urNp -x '*.orig' sbsigntool-0.6.org/src/sbkeysync.c sbsigntool-0.6/src/sbkeysync.c
--- sbsigntool-0.6.org/src/sbkeysync.c	2012-10-11 14:32:32.000000000 +0200
+++ sbsigntool-0.6/src/sbkeysync.c	2021-10-03 23:16:05.621000201 +0200
@@ -203,16 +203,15 @@ static int x509_key_parse(struct key *ke
 		return -1;
 
 	/* we use the X509 serial number as the key ID */
-	if (!x509->cert_info || !x509->cert_info->serialNumber)
+	serial = X509_get_serialNumber(x509);
+	if (!serial)
 		goto out;
 
-	serial = x509->cert_info->serialNumber;
-
 	key->id_len = ASN1_STRING_length(serial);
 	key->id = talloc_memdup(key, ASN1_STRING_data(serial), key->id_len);
 
 	key->description = talloc_array(key, char, description_len);
-	X509_NAME_oneline(x509->cert_info->subject,
+	X509_NAME_oneline(X509_get_subject_name(x509),
 			key->description, description_len);
 
 	rc = 0;
diff -urNp -x '*.orig' sbsigntool-0.6.org/src/sbverify.c sbsigntool-0.6/src/sbverify.c
--- sbsigntool-0.6.org/src/sbverify.c	2012-10-11 14:32:32.000000000 +0200
+++ sbsigntool-0.6/src/sbverify.c	2021-10-03 23:16:05.621000201 +0200
@@ -55,6 +55,14 @@
 #include <openssl/pem.h>
 #include <openssl/x509v3.h>
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#define X509_OBJECT_get0_X509(obj) ((obj)->data.x509)
+#define X509_OBJECT_get_type(obj) ((obj)->type)
+#define X509_STORE_CTX_get0_cert(ctx) ((ctx)->cert)
+#define X509_STORE_get0_objects(certs) ((certs)->objs)
+#define X509_get_extended_key_usage(cert) ((cert)->ex_xkusage)
+#endif
+
 static const char *toolname = "sbverify";
 static const int cert_name_len = 160;
 
@@ -123,9 +131,9 @@ static void print_signature_info(PKCS7 *
 
 	for (i = 0; i < sk_X509_num(p7->d.sign->cert); i++) {
 		cert = sk_X509_value(p7->d.sign->cert, i);
-		X509_NAME_oneline(cert->cert_info->subject,
+		X509_NAME_oneline(X509_get_subject_name(cert),
 				subject_name, cert_name_len);
-		X509_NAME_oneline(cert->cert_info->issuer,
+		X509_NAME_oneline(X509_get_issuer_name(cert),
 				issuer_name, cert_name_len);
 
 		printf(" - subject: %s\n", subject_name);
@@ -136,20 +144,26 @@ static void print_signature_info(PKCS7 *
 static void print_certificate_store_certs(X509_STORE *certs)
 {
 	char subject_name[cert_name_len + 1], issuer_name[cert_name_len + 1];
+	STACK_OF(X509_OBJECT) *objs;
 	X509_OBJECT *obj;
+	X509 *cert;
 	int i;
 
 	printf("certificate store:\n");
 
-	for (i = 0; i < sk_X509_OBJECT_num(certs->objs); i++) {
-		obj = sk_X509_OBJECT_value(certs->objs, i);
+	objs = X509_STORE_get0_objects(certs);
+
+	for (i = 0; i < sk_X509_OBJECT_num(objs); i++) {
+		obj = sk_X509_OBJECT_value(objs, i);
 
-		if (obj->type != X509_LU_X509)
+		if (X509_OBJECT_get_type(obj) != X509_LU_X509)
 			continue;
 
-		X509_NAME_oneline(obj->data.x509->cert_info->subject,
+		cert = X509_OBJECT_get0_X509(obj);
+
+		X509_NAME_oneline(X509_get_subject_name(cert),
 				subject_name, cert_name_len);
-		X509_NAME_oneline(obj->data.x509->cert_info->issuer,
+		X509_NAME_oneline(X509_get_issuer_name(cert),
 				issuer_name, cert_name_len);
 
 		printf(" - subject: %s\n", subject_name);
@@ -182,12 +196,21 @@ static int load_detached_signature_data(
 
 static int cert_in_store(X509 *cert, X509_STORE_CTX *ctx)
 {
-	X509_OBJECT obj;
+	STACK_OF(X509_OBJECT) *objs;
+	X509_OBJECT *obj;
+	int i;
+
+	objs = X509_STORE_get0_objects(X509_STORE_CTX_get0_store(ctx));
 
-	obj.type = X509_LU_X509;
-	obj.data.x509 = cert;
+	for (i = 0; i < sk_X509_OBJECT_num(objs); i++) {
+		obj = sk_X509_OBJECT_value(objs, i);
 
-	return X509_OBJECT_retrieve_match(ctx->ctx->objs, &obj) != NULL;
+		if (X509_OBJECT_get_type(obj) == X509_LU_X509 &&
+		    !X509_cmp(X509_OBJECT_get0_X509(obj), cert))
+			return 1;
+	}
+
+	return 0;
 }
 
 static int x509_verify_cb(int status, X509_STORE_CTX *ctx)
@@ -195,15 +218,17 @@ static int x509_verify_cb(int status, X5
 	int err = X509_STORE_CTX_get_error(ctx);
 
 	/* also accept code-signing keys */
-	if (err == X509_V_ERR_INVALID_PURPOSE
-			&& ctx->cert->ex_xkusage == XKU_CODE_SIGN)
+	if (err == X509_V_ERR_INVALID_PURPOSE &&
+			X509_get_extended_key_usage(X509_STORE_CTX_get0_cert(ctx))
+			== XKU_CODE_SIGN)
 		status = 1;
 
 	/* all certs given with the --cert argument are trusted */
 	else if (err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY ||
+			err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT ||
 			err == X509_V_ERR_CERT_UNTRUSTED) {
 
-		if (cert_in_store(ctx->current_cert, ctx))
+		if (cert_in_store(X509_STORE_CTX_get_current_cert(ctx), ctx))
 			status = 1;
 	}