[Pkg-openssl-changes] r430 - in openssl/trunk/debian: . patches

[Kurt Roeckx]

Author: kroeckx
Date: 2009-09-11 14:51:07 +0000 (Fri, 11 Sep 2009)
New Revision: 430

Added:
   openssl/trunk/debian/patches/no_check_self_signed.patch
Modified:
   openssl/trunk/debian/changelog
   openssl/trunk/debian/patches/series
Log:
Don't check self signed certificate signatures in X509_verify_cert()
(Closes: #541735)


Modified: openssl/trunk/debian/changelog
===================================================================
--- openssl/trunk/debian/changelog	2009-08-11 21:05:47 UTC (rev 429)
+++ openssl/trunk/debian/changelog	2009-09-11 14:51:07 UTC (rev 430)
@@ -1,3 +1,10 @@
+openssl (0.9.8k-5) unstable; urgency=low
+
+  * Don't check self signed certificate signatures in X509_verify_cert()
+    (Closes: #541735)
+
+ -- Kurt Roeckx <kurt at roeckx.be>  Fri, 11 Sep 2009 15:42:32 +0200
+
 openssl (0.9.8k-4) unstable; urgency=low
 
   * Split all the patches into a separate files

Added: openssl/trunk/debian/patches/no_check_self_signed.patch
===================================================================
--- openssl/trunk/debian/patches/no_check_self_signed.patch	                        (rev 0)
+++ openssl/trunk/debian/patches/no_check_self_signed.patch	2009-09-11 14:51:07 UTC (rev 430)
@@ -0,0 +1,39 @@
+Description: Don't check self signed certificate signatures in
+ X509_verify_cert(): it just wastes time without adding any security. As a
+ useful side effect self signed root CAs with non-FIPS digests are now usable
+ in FIPS mode. [Steve Henson]
+Origin: upstream, http://cvs.openssl.org/chngview?cn=18260
+Bug-Debian: http://bugs.debian.org/541735
+
+Index: openssl/crypto/x509/x509_vfy.c
+RCS File: /v/openssl/cvs/openssl/crypto/x509/x509_vfy.c,v
+rcsdiff -q -kk '-r1.77.2.8' '-r1.77.2.9' -u '/v/openssl/cvs/openssl/crypto/x509/x509_vfy.c,v' 2>/dev/null
+--- x509_vfy.c	2008/07/13 14:33:15	1.77.2.8
++++ x509_vfy.c	2009/06/15 14:52:38	1.77.2.9
+@@ -986,7 +986,11 @@
+ 	while (n >= 0)
+ 		{
+ 		ctx->error_depth=n;
+-		if (!xs->valid)
++
++		/* Skip signature check for self signed certificates. It
++		 * doesn't add any security and just wastes time.
++		 */
++		if (!xs->valid && xs != xi)
+ 			{
+ 			if ((pkey=X509_get_pubkey(xi)) == NULL)
+ 				{
+@@ -996,13 +1000,6 @@
+ 				if (!ok) goto end;
+ 				}
+ 			else if (X509_verify(xs,pkey) <= 0)
+-				/* XXX  For the final trusted self-signed cert,
+-				 * this is a waste of time.  That check should
+-				 * optional so that e.g. 'openssl x509' can be
+-				 * used to detect invalid self-signatures, but
+-				 * we don't verify again and again in SSL
+-				 * handshakes and the like once the cert has
+-				 * been declared trusted. */
+ 				{
+ 				ctx->error=X509_V_ERR_CERT_SIGNATURE_FAILURE;
+ 				ctx->current_cert=xs;

Modified: openssl/trunk/debian/patches/series
===================================================================
--- openssl/trunk/debian/patches/series	2009-08-11 21:05:47 UTC (rev 429)
+++ openssl/trunk/debian/patches/series	2009-09-11 14:51:07 UTC (rev 430)
@@ -24,4 +24,4 @@
 CVE-2009-1379.patch
 CVE-2009-1387.patch
 CVE-2009-2409.patch
-
+no_check_self_signed.patch