You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@subversion.apache.org by sv...@apache.org on 2015/05/13 06:00:24 UTC
svn commit: r1679133 - in /subversion/branches/1.9.x: ./ STATUS
subversion/libsvn_subr/cmdline.c
Author: svn-role
Date: Wed May 13 04:00:24 2015
New Revision: 1679133
URL: http://svn.apache.org/r1679133
Log:
Merge r1678571 from trunk:
* r1678571
Fix false-positive acceptance via cmdline api of certificates with
multiple failures of which some but not all were designated acceptable.
Justification:
Security issue.
Notes:
The issue does not exist in 1.8.x or earlier.
Votes:
+1: rhuijben, philip, stsp
+0: danielsh (not tested)
Modified:
subversion/branches/1.9.x/ (props changed)
subversion/branches/1.9.x/STATUS
subversion/branches/1.9.x/subversion/libsvn_subr/cmdline.c
Propchange: subversion/branches/1.9.x/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Wed May 13 04:00:24 2015
@@ -91,4 +91,4 @@
/subversion/branches/verify-at-commit:1462039-1462408
/subversion/branches/verify-keep-going:1439280-1546110
/subversion/branches/wc-collate-path:1402685-1480384
-/subversion/trunk:1660545-1660547,1660549-1662901,1663003,1663183-1663184,1663338,1663347,1663355,1663374,1663450,1663530,1663671,1663697,1663706,1663738,1663749,1663791,1663991,1664035,1664078,1664080,1664084-1664085,1664187,1664191,1664193,1664200,1664344,1664476,1664480-1664481,1664483,1664489-1664490,1664507,1664520-1664521,1664523,1664526-1664527,1664531-1664532,1664588,1664593-1664594,1664596,1664653,1664664,1664672,1664674,1664684,1664927,1664938-1664940,1664978,1664984,1664997,1665164,1665195,1665213,1665259,1665318,1665437-1665438,1665609,1665611-1665612,1665845,1665850,1665852,1665886,1665894,1665896,1666096,1666258,1666270,1666272,1666379,1666449,1666690,1666832,1666851,1666965,1667101,1667106-1667107,1667120,1667228,1667233-1667235,1667249-1667250,1667258,1667290,1667301,1667471,1667691-1667693,1667699-1667700,1667715,1667941,1667976,1668320,1668598-1668600,1668602-1668603,1668607-1668608,1668618,1669743,1669746,1669749,1669945,1670139,1670149,1670152,1670329,1670337,167
0347,1670353,1671164,1671388,1672295,1672311,1672372,1672404,1672511-1672512,1672578,1672728,1673044,1673062-1673063,1673065,1673153,1673170,1673172,1673197,1673202,1673204,1673228,1673282,1673445,1673691-1673692,1673746,1673785,1673803,1674015,1674032,1674170,1674406,1674415,1674487,1674522,1674580,1674627,1674891,1675771,1676526,1676535,1676538,1676555,1676564,1676570,1676665,1676667,1676769,1677003,1677191,1677267,1677440,1678147,1678149,1678494
+/subversion/trunk:1660545-1660547,1660549-1662901,1663003,1663183-1663184,1663338,1663347,1663355,1663374,1663450,1663530,1663671,1663697,1663706,1663738,1663749,1663791,1663991,1664035,1664078,1664080,1664084-1664085,1664187,1664191,1664193,1664200,1664344,1664476,1664480-1664481,1664483,1664489-1664490,1664507,1664520-1664521,1664523,1664526-1664527,1664531-1664532,1664588,1664593-1664594,1664596,1664653,1664664,1664672,1664674,1664684,1664927,1664938-1664940,1664978,1664984,1664997,1665164,1665195,1665213,1665259,1665318,1665437-1665438,1665609,1665611-1665612,1665845,1665850,1665852,1665886,1665894,1665896,1666096,1666258,1666270,1666272,1666379,1666449,1666690,1666832,1666851,1666965,1667101,1667106-1667107,1667120,1667228,1667233-1667235,1667249-1667250,1667258,1667290,1667301,1667471,1667691-1667693,1667699-1667700,1667715,1667941,1667976,1668320,1668598-1668600,1668602-1668603,1668607-1668608,1668618,1669743,1669746,1669749,1669945,1670139,1670149,1670152,1670329,1670337,167
0347,1670353,1671164,1671388,1672295,1672311,1672372,1672404,1672511-1672512,1672578,1672728,1673044,1673062-1673063,1673065,1673153,1673170,1673172,1673197,1673202,1673204,1673228,1673282,1673445,1673691-1673692,1673746,1673785,1673803,1674015,1674032,1674170,1674406,1674415,1674487,1674522,1674580,1674627,1674891,1675771,1676526,1676535,1676538,1676555,1676564,1676570,1676665,1676667,1676769,1677003,1677191,1677267,1677440,1678147,1678149,1678494,1678571
Modified: subversion/branches/1.9.x/STATUS
URL: http://svn.apache.org/viewvc/subversion/branches/1.9.x/STATUS?rev=1679133&r1=1679132&r2=1679133&view=diff
==============================================================================
--- subversion/branches/1.9.x/STATUS (original)
+++ subversion/branches/1.9.x/STATUS Wed May 13 04:00:24 2015
@@ -82,17 +82,6 @@ Veto-blocked changes:
Approved changes:
=================
- * r1678571
- Fix false-positive acceptance via cmdline api of certificates with
- multiple failures of which some but not all were designated acceptable.
- Justification:
- Security issue.
- Notes:
- The issue does not exist in 1.8.x or earlier.
- Votes:
- +1: rhuijben, philip, stsp
- +0: danielsh (not tested)
-
* r1678846
Change an assertion to an error.
Justification:
Modified: subversion/branches/1.9.x/subversion/libsvn_subr/cmdline.c
URL: http://svn.apache.org/viewvc/subversion/branches/1.9.x/subversion/libsvn_subr/cmdline.c?rev=1679133&r1=1679132&r2=1679133&view=diff
==============================================================================
--- subversion/branches/1.9.x/subversion/libsvn_subr/cmdline.c (original)
+++ subversion/branches/1.9.x/subversion/libsvn_subr/cmdline.c Wed May 13 04:00:24 2015
@@ -538,19 +538,20 @@ trust_server_cert_non_interactive(svn_au
apr_pool_t *pool)
{
struct trust_server_cert_non_interactive_baton *b = baton;
+ apr_uint32_t non_ignored_failures;
*cred_p = NULL;
- if (failures == 0 ||
- (b->trust_server_cert_unknown_ca &&
- (failures & SVN_AUTH_SSL_UNKNOWNCA)) ||
- (b->trust_server_cert_cn_mismatch &&
- (failures & SVN_AUTH_SSL_CNMISMATCH)) ||
- (b->trust_server_cert_expired &&
- (failures & SVN_AUTH_SSL_EXPIRED)) ||
- (b->trust_server_cert_not_yet_valid &&
- (failures & SVN_AUTH_SSL_NOTYETVALID)) ||
- (b->trust_server_cert_other_failure &&
- (failures & SVN_AUTH_SSL_OTHER)))
+ /* Mask away bits we are instructed to ignore. */
+ non_ignored_failures = failures & ~(
+ (b->trust_server_cert_unknown_ca ? SVN_AUTH_SSL_UNKNOWNCA : 0)
+ | (b->trust_server_cert_cn_mismatch ? SVN_AUTH_SSL_CNMISMATCH : 0)
+ | (b->trust_server_cert_expired ? SVN_AUTH_SSL_EXPIRED : 0)
+ | (b->trust_server_cert_not_yet_valid ? SVN_AUTH_SSL_NOTYETVALID : 0)
+ | (b->trust_server_cert_other_failure ? SVN_AUTH_SSL_OTHER : 0)
+ );
+
+ /* If no failures remain, accept the certificate. */
+ if (non_ignored_failures == 0)
{
*cred_p = apr_pcalloc(pool, sizeof(**cred_p));
(*cred_p)->may_save = FALSE;