Merge "upd: improve format script"

diff --git a/Makefile b/Makefile
index 74caedfec89165288246c0286c7cbac77f0c20e2..7e9ba6598ce586ced6c429dcbe63e30cc8b0c7d1 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -24,7 +24,7 @@ CXX_DEP=g++
 LD=libtool --mode=link g++
 
 ifneq (,$(filter debug,$(DEB_BUILD_OPTIONS)))
-CFLAGS+=-DNO_DAEMON -g
+CFLAGS+=-DNO_DAEMON -g -Og
 endif
 ifneq (,$(filter noopt,$(DEB_BUILD_OPTIONS)))
     CFLAGS += -O0
@@ -93,7 +93,7 @@ endif
 install: build
        ${INSTALL_PROGRAM} bin/cassiopeia ${DESTDIR}/usr/bin/cassiopeia
        ${INSTALL_PROGRAM} bin/cassiopeia-signer ${DESTDIR}/usr/bin/cassiopeia-signer
-       ${INSTALL_DIR} ${DESTDIR}/etc/cacert/cassiopeia
+       ${INSTALL_DIR} ${DESTDIR}/etc/wpia/cassiopeia
 
 .PHONY: libs
 libs: ${LIBS}

diff --git a/README.md b/README.md
index 54a8404638ba614b7164feacc4b446a3146feb20..502c008e47d768d9546b78ac2496b3fb97a447d3 100644 (file)
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
 Cassiopeia
 =================
 
-Signing Module for CAcert
+Signing Module for WPIA

diff --git a/debian/.gitignore b/debian/.gitignore
index 611a639777740607397f3c2ba74246b1957c227d..b68134384c6ca511a4e8b4ce62c9a7c422f948aa 100644 (file)
--- a/debian/.gitignore
+++ b/debian/.gitignore
@@ -1,6 +1,6 @@
 /files
-/cacert-cassiopeia
-/cacert-cassiopeia-doc
-/cacert-cassiopeia-signer
+/wpia-cassiopeia
+/wpia-cassiopeia-doc
+/wpia-cassiopeia-signer
 /*.substvars
 /*.debhelper

diff --git a/debian/README b/debian/README
index 37f9c0e2e8174380d11d02cfeb7474027fde3819..5dc88058dd309c8228a98ad368d8ad144757ffb2 100644 (file)
--- a/debian/README
+++ b/debian/README
@@ -3,4 +3,4 @@ The Debian Package cassiopeia
 
 Comments regarding the Package
 
- -- CAcert Software Team <cacert-devel@cacert.org>  Tue, 04 Feb 2014 23:42:00 +0100
+ -- WPIA Software Team <software@wpia.club>  Tue, 04 Feb 2014 23:42:00 +0100

diff --git a/debian/cacert-cassiopeia.install b/debian/cacert-cassiopeia.install
deleted file mode 100644 (file)
index 63e3122..0000000
--- a/debian/cacert-cassiopeia.install
+++ /dev/null
@@ -1,2 +0,0 @@
-/usr/bin/cassiopeia
-/etc/cacert/cassiopeia

diff --git a/debian/cassiopeia.1 b/debian/cassiopeia.1
index 2d7465eaa15805e9988f9649615a2d55514ad5fa..eef8aa4060dc57769e74aa9961fe8948c5c51d81 100644 (file)
--- a/debian/cassiopeia.1
+++ b/debian/cassiopeia.1
@@ -1,15 +1,15 @@
 .\"                                      Hey, EMACS: -*- nroff -*-
-.\" (C) Copyright 2014 CAcert Software Team <software@cacert.org>,
+.\" (C) Copyright 2014-2017 WPIA Software Team <software@wpia.club>,
 .\"
 .TH cassiopeia 1 "November 2, 2014"
 .SH NAME
-cassiopeia \- the CAcert.org signing software
+cassiopeia \- the WPIA signing software
 .SH SYNOPSIS
 .B cassiopeia
 .RI [options]
 .SH DESCRIPTION
 .B cassiopeia
-is the signing software that will be used to operate the CAcert.org system.
+is the signing software that will be used to operate the WPIA system.
 .SH OPTIONS
 .TP
 .B --once

diff --git a/debian/changelog b/debian/changelog
index 7f636b68d243691dd7488af63b406b5f08311888..e2ccd65c8c94b207e3ff392dd8df427fdd90116d 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,5 @@
-cacert-cassiopeia (0.1) unstable; urgency=low
+wpia-cassiopeia (0.1) unstable; urgency=low
 
   * Initial Release.
 
- -- CAcert Software Team <cacert-devel@cacert.org>  Tue, 04 Feb 2014 23:42:00 +0100
+ -- WPIA Software Team <software@wpia.club>  Tue, 04 Feb 2014 23:42:00 +0100

diff --git a/debian/control b/debian/control
index f8fb9727f34d4b5d38524388b0fddd477799674f..7a7aaf06143bdacc95313376e3a8975efaafc190 100644 (file)
--- a/debian/control
+++ b/debian/control
@@ -1,29 +1,29 @@
-Source: cacert-cassiopeia
+Source: wpia-cassiopeia
 Section: utils
 Priority: extra
-Maintainer: CAcert Software Team <cacert-devel@cacert.org>
+Maintainer: WPIA Software Team <software@wpia.club>
 Build-Depends: debhelper (>= 8.0.0), libtool, libpqxx-dev, libboost-test-dev
 Standards-Version: 3.9.4
-Homepage: https://cacert.org/
+Homepage: https://wpia.club
 #Vcs-Git: git://git.debian.org/collab-maint/cassiopeia.git
 #Vcs-Browser: http://git.debian.org/?p=collab-maint/cassiopeia.git;a=summary
 
-Package: cacert-cassiopeia
+Package: wpia-cassiopeia
 Architecture: any
 Depends: ${shlibs:Depends}, ${misc:Depends}
-Description: CAcert Certificate Signing Software
+Description: WPIA Certificate Signing Software
  This package provides the necessary tools to run a
- certificate signing instance on https://cacert.org
+ certificate signing instance
 
-Package: cacert-cassiopeia-signer
+Package: wpia-cassiopeia-signer
 Architecture: any
 Depends: ${shlibs:Depends}, ${misc:Depends}
-Description: CAcert Certificate Signing Software
+Description: WPIA Certificate Signing Software
  This package provides the signer-side part of the
- CAcert signing software.
+ WPIA signing software.
 
-Package: cacert-cassiopeia-doc
+Package: wpia-cassiopeia-doc
 Architecture: all
-Description: Documentation for the CAcert Certificate Signing Software
+Description: Documentation for the WPIA Certificate Signing Software
  This package provides the necessary tools to run a
- certificate signing instance on https://cacert.org
+ certificate signing instance

diff --git a/debian/copyright b/debian/copyright
index 31b5a0f0ba67fb25783ffa5c5c736e8598b3ade3..c3c64f4c908f32f3063f5719838b44fa901d8b9b 100644 (file)
--- a/debian/copyright
+++ b/debian/copyright
@@ -1,13 +1,13 @@
 Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Upstream-Name: cassiopeia
-Source: <https://github.com/CAcertOrg/cacert-cassiopeia>
+Source: <https://code.wpia.club/?p=cassiopeia.git;a=summary>
 
 Files: *
-Copyright: 2014 CAcert Software Team <cacert-devel@cacert.org>
+Copyright: 2014-2017 WPIA Software Team <software@wpia.club>
 License: GPL-2.0+
 
 Files: debian/*
-Copyright: 2014 CAcert Software Team <cacert-devel@cacert.org>
+Copyright: 2014-2017 WPIA Software Team <software@wpia.club>
 License: GPL-2.0+
 
 License: GPL-2.0+

diff --git a/debian/cacert-cassiopeia-doc.docs b/debian/wpia-cassiopeia-doc.docs
similarity index 100%
rename from debian/cacert-cassiopeia-doc.docs
rename to debian/wpia-cassiopeia-doc.docs

diff --git a/debian/cacert-cassiopeia-doc.install b/debian/wpia-cassiopeia-doc.install
similarity index 100%
rename from debian/cacert-cassiopeia-doc.install
rename to debian/wpia-cassiopeia-doc.install

diff --git a/debian/cacert-cassiopeia-signer.install b/debian/wpia-cassiopeia-signer.install
similarity index 54%
rename from debian/cacert-cassiopeia-signer.install
rename to debian/wpia-cassiopeia-signer.install
index 655c6e614aa59d56c52b1694038e795bb4aa5a7a..ea5f6d09dea9b934b25ccf13fff965ff8f9e47ed 100644 (file)
--- a/debian/cacert-cassiopeia-signer.install
+++ b/debian/wpia-cassiopeia-signer.install
@@ -1,3 +1,3 @@
 /usr/bin/cassiopeia-signer
-/etc/cacert/cassiopeia
+/etc/wpia/cassiopeia
 

diff --git a/debian/cacert-cassiopeia.default b/debian/wpia-cassiopeia.default
similarity index 100%
rename from debian/cacert-cassiopeia.default
rename to debian/wpia-cassiopeia.default

diff --git a/debian/cacert-cassiopeia.init b/debian/wpia-cassiopeia.init
similarity index 95%
rename from debian/cacert-cassiopeia.init
rename to debian/wpia-cassiopeia.init
index b9b7ebaf160cbd999f5c9a89a661701d67d1e7db..8edc24550f2be317933940a46f97e7a9359cd0d1 100644 (file)
--- a/debian/cacert-cassiopeia.init
+++ b/debian/wpia-cassiopeia.init
@@ -11,19 +11,19 @@
 #                    <...>
 ### END INIT INFO
 
-# Author: CAcert Software Team <cacert-devel@cacert.org>
+# Author: WPIA Software Team <software@wpia.club>
 
 # Do NOT "set -e"
 
 # PATH should only include /usr/* if it runs after the mountnfs.sh script
 PATH=/sbin:/usr/sbin:/bin:/usr/bin
-DESC="cacert's signer software"
-NAME=cacert-cassiopeia
+DESC="wpia's signer software"
+NAME=wpia-cassiopeia
 DAEMON=/usr/bin/cassiopeia
 DAEMON_ARGS=
 PIDFILE=/var/run/$NAME.pid
 SCRIPTNAME=/etc/init.d/$NAME
-DIR=/var/lib/cacert-gigi
+DIR=/var/lib/wpia-gigi
 
 # Exit if the package is not installed
 [ -x "$DAEMON" ] || exit 0
@@ -48,7 +48,7 @@ fi
 #
 do_start()
 {
-       if [ ! -f /etc/cacert/cassiopeia/cassiopeia.conf ]; then
+       if [ ! -f /etc/wpia/cassiopeia/cassiopeia.conf ]; then
                echo Missing cassiopeia-configfile
                 exit 2
         fi
@@ -59,7 +59,7 @@ do_start()
         start-stop-daemon -b --start --quiet --pidfile $PIDFILE -d $DIR --exec $DAEMON --test > /dev/null \
                || return 1
        start-stop-daemon -b --start --quiet --pidfile $PIDFILE --make-pidfile -d $DIR -c nobody --exec $DAEMON --no-close -- \
-               >> /var/log/cacert-cassiopeia.log 2>&1 \
+               >> /var/log/wpia-cassiopeia.log 2>&1 \
                || return 2
        # The above code will not work for interpreted scripts, use the next
        # six lines below instead (Ref: #643337, start-stop-daemon(8) )

diff --git a/debian/wpia-cassiopeia.install b/debian/wpia-cassiopeia.install
new file mode 100644 (file)
index 0000000..c26fe8f
--- /dev/null
+++ b/debian/wpia-cassiopeia.install
@@ -0,0 +1,2 @@
+/usr/bin/cassiopeia
+/etc/wpia/cassiopeia

diff --git a/debian/cacert-cassiopeia.manpages b/debian/wpia-cassiopeia.manpages
similarity index 100%
rename from debian/cacert-cassiopeia.manpages
rename to debian/wpia-cassiopeia.manpages

diff --git a/docs/BuildInstructions.md b/docs/BuildInstructions.md
new file mode 100644 (file)
index 0000000..191d517
--- /dev/null
+++ b/docs/BuildInstructions.md
@@ -0,0 +1,20 @@
+Requirements for building of cassiopeia
+=================
+
+Operation System Debian 9.0 (Stretch)
+
+Install the following packages:
+
+    apt-get install wget curl debhelper fakeroot build-essential libboost-test-dev libtool-bin libpqxx-dev libasan3
+
+Clone the repository:
+
+    git clone https://code.wpia.club/cassiopeia.git
+
+Generate the changelog file for the Debian packages:
+    
+    cassiopeia/scripts/genchangelog.sh
+
+Compile the source code and build the Debian packages:
+
+    cd cassiopeia && dpkg-buildpackage -b -us -uc

diff --git a/lib/Makefile b/lib/Makefile
index 880f2bba308faac18ab00fd9488b39d41d466636..5db2f54e34db064e7a4aa550ce533a78cd09825b 100644 (file)
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -12,7 +12,7 @@ collisiondetect/libdetectcoll.la: ${LIB_COLL_FILES}
 #      echo $^
 
 openssl/libcrypto.a: ${LIB_SSL_FILES}
-       cd ${LIB_SSL} && ( [ -f Makefile ] || ./config -DPURIFY )
+       cd ${LIB_SSL} && ( [ -f Makefile ] || ./config -DPURIFY no-md2 no-md4 no-rc4 no-ssl3 no-weak-ssl-ciphers no-unit-test )
        ${MAKE} -C ${LIB_SSL} depend
        ${MAKE} -C ${LIB_SSL}
 ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))

diff --git a/scripts/genchangelog.sh b/scripts/genchangelog.sh
index 01ab16582f5722cf12fde44f625e207a2cce196e..df7c8f4525bb85fbe859ff398393931d68a242ed 100755 (executable)
--- a/scripts/genchangelog.sh
+++ b/scripts/genchangelog.sh
@@ -1,8 +1,8 @@
 cd "$(dirname $0)"
 cat > ../debian/changelog <<EOF
-cacert-cassiopeia (0.1.b${BUILD_NUMBER}-$(git rev-parse HEAD)) unstable; urgency=low
+wpia-cassiopeia (0.1.b${BUILD_NUMBER}-$(git rev-parse HEAD)) unstable; urgency=low
 
   * Initial Release.
 
- -- CAcert Software Team <cacert-devel@cacert.org>  $(LANG=C date "+%a, %d %b %Y %H:%M:%S %z")
+ -- WPIA Software Team <software@wpia.club>  $(LANG=C date "+%a, %d %b %Y %H:%M:%S %z")
 EOF

diff --git a/src/apps/client.cpp b/src/apps/client.cpp
index 2a7dc72ccba19fa8fdf9091983b55e62ef193ba3..87447431665c9c31340aedc737d734f3e5d36648 100644 (file)
--- a/src/apps/client.cpp
+++ b/src/apps/client.cpp
@@ -66,7 +66,7 @@ int main( int argc, const char* argv[] ) {
     std::string path;
 
 #ifdef NDEBUG
-    path = "/etc/cacert/cassiopeia/cassiopeia.conf";
+    path = "/etc/wpia/cassiopeia/cassiopeia.conf";
 #else
     path = "config.txt";
 #endif

diff --git a/src/apps/signer.cpp b/src/apps/signer.cpp
index 26909bd51d78ea550e612ee771f340e1329b874f..1db3e14ecaa0a039e6808b385fcf669b1daa3824 100644 (file)
--- a/src/apps/signer.cpp
+++ b/src/apps/signer.cpp
@@ -30,7 +30,7 @@ int main( int argc, const char* argv[] ) try {
     std::string path;
 
 #ifdef NDEBUG
-    path = "/etc/cacert/cassiopeia/cassiopeia.conf";
+    path = "/etc/wpia/cassiopeia/cassiopeia.conf";
 #else
     path = "config.txt";
 #endif

diff --git a/src/crypto/CRL.cpp b/src/crypto/CRL.cpp
index d48bc89315f8445fd1c3d865fdc9b85adc5b3b77..01f8af5320b73def166310920010e24362458b1a 100644 (file)
--- a/src/crypto/CRL.cpp
+++ b/src/crypto/CRL.cpp
@@ -58,6 +58,10 @@ std::string CRL::revoke( std::string serial, std::string time ) {
 }
 
 void CRL::sign( std::shared_ptr<CAConfig> ca ) {
+    if(!ca->caKey){
+        throw new std::invalid_argument("Cannot sign CRL with CA " + ca->name + " because it has no private key.");
+    }
+
     // Updating necessary CRL props
     std::shared_ptr<ASN1_TIME> tmptm( ASN1_TIME_new(), ASN1_TIME_free );
 

diff --git a/src/crypto/X509.cpp b/src/crypto/X509.cpp
index 37bb900ff6f281f293dc0489105fbb285eabe94b..f9dbc7a7ff65aef55e4fefd0edd4d01ba1ae8d4a 100644 (file)
--- a/src/crypto/X509.cpp
+++ b/src/crypto/X509.cpp
@@ -237,9 +237,11 @@ std::shared_ptr<SignedCertificate> X509Cert::sign( std::shared_ptr<EVP_PKEY> caK
     } else if( signAlg == "sha256" ) {
         md = EVP_sha256();
     } else if( signAlg == "sha1" ) {
-        md = EVP_sha1();
+        throw std::runtime_error("Refusing to sign with weak signature algorithm (SHA-1).");
+    } else if( signAlg == "md5" ) {
+        throw std::runtime_error("Refusing to sign with weak signature algorithm (MD5).");
     } else {
-        throw std::runtime_error("Unknown md-type");
+        throw std::runtime_error("Unknown signature algorithm");
     }
 
     if( !X509_sign( target.get(), caKey.get(), md ) ) {

diff --git a/src/crypto/simpleOpensslSigner.cpp b/src/crypto/simpleOpensslSigner.cpp
index cad772c4e102b9007c33e80cc921ee0af77c86d2..6987d2c4e84085c25c3349f5c334e42e82475dbe 100644 (file)
--- a/src/crypto/simpleOpensslSigner.cpp
+++ b/src/crypto/simpleOpensslSigner.cpp
@@ -86,6 +86,9 @@ std::shared_ptr<SignedCertificate> SimpleOpensslSigner::sign( std::shared_ptr<TB
         logger::error( "ERROR: Signing CA specified in profile could not be loaded." );
         throw std::runtime_error("CA-key not found");
     }
+    if(!ca->caKey){
+        throw std::runtime_error("Cannot sign certificate with CA " + ca->name + " because it has no private key.");
+    }
 
     logger::note( "FINE: Key for Signing CA is correctly loaded." );
 

diff --git a/src/crypto/sslUtil.cpp b/src/crypto/sslUtil.cpp
index 7a0c6392ea6f6625f69e37be0befa08bdb8c794c..d7fddfe40fd4a54557e907cfe16bacdd212acfeb 100644 (file)
--- a/src/crypto/sslUtil.cpp
+++ b/src/crypto/sslUtil.cpp
@@ -192,10 +192,15 @@ extern std::string crtPrefix;
 
 CAConfig::CAConfig( const std::string& name ) : path( "ca/" + name ), name( name ) {
     ca = loadX509FromFile( path + "/ca.crt" );
+    if (!ca) {
+        throw new std::invalid_argument("ca name: " + name + " contains unreadable certificate.");
+    }
+
     caKey = loadPkeyFromFile( path + "/ca.key" );
-    ASN1_TIME* tm = X509_get_notBefore( ca.get() );
-    auto ca0 = ca;
-    notBefore = std::shared_ptr<ASN1_TIME>( tm, [ca0](auto p){(void)p;} );
+
+    ASN1_TIME* tm = X509_get_notBefore( ca.get() ); // tm MUST NOT be free'd; duplicate for owning copy.
+    notBefore = std::shared_ptr<ASN1_TIME>( ASN1_STRING_dup(tm), ASN1_TIME_free );
+
     std::size_t pos = name.find("_");
     if (pos == std::string::npos) {
         throw new std::invalid_argument("ca name: " + name + " is malformed.");
@@ -204,6 +209,7 @@ CAConfig::CAConfig( const std::string& name ) : path( "ca/" + name ), name( name
     if (pos2 == std::string::npos) {
         throw new std::invalid_argument("ca name: " + name + " is malformed.");
     }
+
     crlURL = crlPrefix + "/g2/" + name.substr(pos+1, pos2-pos - 1) + "/" + name.substr(0,pos) + "-" + name.substr(pos2+1) + ".crl";
     crtURL = crtPrefix + "/g2/" + name.substr(pos+1, pos2-pos - 1) + "/" + name.substr(0,pos) + "-" + name.substr(pos2+1) + ".crt";
 }

diff --git a/test/Makefile b/test/Makefile
index 3e55b135ef43408ca7c762eb21d6cd4df1553672..756e9a24305e7e8cbc0b6576c49d10e71bb74b6c 100644 (file)
--- a/test/Makefile
+++ b/test/Makefile
@@ -16,7 +16,7 @@ CXX_DEP=g++
 LD=libtool --mode=link g++
 
 ifneq (,$(filter debug,$(DEB_BUILD_OPTIONS)))
-CFLAGS+=-DNO_DAEMON -g
+CFLAGS+=-DNO_DAEMON -g -Og
 endif
 
 CFLAGS+=${ADDFLAGS} -Wall -Werror -Wextra -pedantic -std=c++11 -I../src -I../lib/openssl/include