diff options
author | Dave Cobbley <david.j.cobbley@linux.intel.com> | 2018-08-14 20:05:37 +0300 |
---|---|---|
committer | Brad Bishop <bradleyb@fuzziesquirrel.com> | 2018-08-23 04:26:31 +0300 |
commit | eb8dc40360f0cfef56fb6947cc817a547d6d9bc6 (patch) | |
tree | de291a73dc37168da6370e2cf16c347d1eba9df8 /poky/meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch | |
parent | 9c3cf826d853102535ead04cebc2d6023eff3032 (diff) | |
download | openbmc-eb8dc40360f0cfef56fb6947cc817a547d6d9bc6.tar.xz |
[Subtree] Removing import-layers directory
As part of the move to subtrees, need to bring all the import layers
content to the top level.
Change-Id: I4a163d10898cbc6e11c27f776f60e1a470049d8f
Signed-off-by: Dave Cobbley <david.j.cobbley@linux.intel.com>
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
Diffstat (limited to 'poky/meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch')
-rw-r--r-- | poky/meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch | 215 |
1 files changed, 215 insertions, 0 deletions
diff --git a/poky/meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch b/poky/meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch new file mode 100644 index 000000000..3d8ebd1bd --- /dev/null +++ b/poky/meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch @@ -0,0 +1,215 @@ +From 825a9969dea052b02ba868bdf39e676349f10dce Mon Sep 17 00:00:00 2001 +From: Jussi Kukkonen <jussi.kukkonen@intel.com> +Date: Thu, 9 Feb 2017 14:51:28 +0200 +Subject: [PATCH] curl: allow overriding default CA certificate file + +Similar to curl, --cacert can now be used in cve-check-tool and +cve-check-update to override the default CA certificate file. Useful +in cases where the system default is unsuitable (for example, +out-dated) or broken (as in OE's current native libcurl, which embeds +a path string from one build host and then uses it on another although +the right path may have become something different). + +Upstream-Status: Submitted [https://github.com/ikeydoherty/cve-check-tool/pull/45] + +Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> + + +Took Patrick Ohlys original patch from meta-security-isafw, rebased +on top of other patches. + +Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> +--- + src/library/cve-check-tool.h | 1 + + src/library/fetch.c | 10 +++++++++- + src/library/fetch.h | 3 ++- + src/main.c | 5 ++++- + src/update-main.c | 4 +++- + src/update.c | 12 +++++++----- + src/update.h | 2 +- + 7 files changed, 27 insertions(+), 10 deletions(-) + +diff --git a/src/library/cve-check-tool.h b/src/library/cve-check-tool.h +index e4bb5b1..f89eade 100644 +--- a/src/library/cve-check-tool.h ++++ b/src/library/cve-check-tool.h +@@ -43,6 +43,7 @@ typedef struct CveCheckTool { + bool bugs; /**<Whether bug tracking is enabled */ + GHashTable *mapping; /**<CVE Mapping */ + const char *output_file; /**<Output file, if any */ ++ const char *cacert_file; /**<Non-default SSL certificate file, if any */ + } CveCheckTool; + + /** +diff --git a/src/library/fetch.c b/src/library/fetch.c +index 0fe6d76..8f998c3 100644 +--- a/src/library/fetch.c ++++ b/src/library/fetch.c +@@ -60,7 +60,8 @@ static int progress_callback_new(void *ptr, curl_off_t dltotal, curl_off_t dlnow + } + + FetchStatus fetch_uri(const char *uri, const char *target, bool verbose, +- unsigned int start_percent, unsigned int end_percent) ++ unsigned int start_percent, unsigned int end_percent, ++ const char *cacert_file) + { + FetchStatus ret = FETCH_STATUS_FAIL; + CURLcode res; +@@ -74,6 +75,13 @@ FetchStatus fetch_uri(const char *uri, const char *target, bool verbose, + return ret; + } + ++ if (cacert_file) { ++ res = curl_easy_setopt(curl, CURLOPT_CAINFO, cacert_file); ++ if (res != CURLE_OK) { ++ goto bail; ++ } ++ } ++ + if (stat(target, &st) == 0) { + res = curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE); + if (res != CURLE_OK) { +diff --git a/src/library/fetch.h b/src/library/fetch.h +index 4cce5d1..836c7d7 100644 +--- a/src/library/fetch.h ++++ b/src/library/fetch.h +@@ -29,7 +29,8 @@ typedef enum { + * @return A FetchStatus, indicating the operation taken + */ + FetchStatus fetch_uri(const char *uri, const char *target, bool verbose, +- unsigned int this_percent, unsigned int next_percent); ++ unsigned int this_percent, unsigned int next_percent, ++ const char *cacert_file); + + /** + * Attempt to extract the given gzipped file +diff --git a/src/main.c b/src/main.c +index 8e6f158..ae69d47 100644 +--- a/src/main.c ++++ b/src/main.c +@@ -280,6 +280,7 @@ static bool csv_mode = false; + static char *modified_stamp = NULL; + static gchar *mapping_file = NULL; + static gchar *output_file = NULL; ++static gchar *cacert_file = NULL; + + static GOptionEntry _entries[] = { + { "not-patched", 'n', 0, G_OPTION_ARG_NONE, &hide_patched, "Hide patched/addressed CVEs", NULL }, +@@ -294,6 +295,7 @@ static GOptionEntry _entries[] = { + { "csv", 'c', 0, G_OPTION_ARG_NONE, &csv_mode, "Output CSV formatted data only", NULL }, + { "mapping", 'M', 0, G_OPTION_ARG_STRING, &mapping_file, "Path to a mapping file", NULL}, + { "output-file", 'o', 0, G_OPTION_ARG_STRING, &output_file, "Path to the output file (output plugin specific)", NULL}, ++ { "cacert", 'C', 0, G_OPTION_ARG_STRING, &cacert_file, "Path to the combined SSL certificates file (system default is used if not set)", NULL}, + { .short_name = 0 } + }; + +@@ -492,6 +494,7 @@ int main(int argc, char **argv) + + quiet = csv_mode || !no_html; + self->output_file = output_file; ++ self->cacert_file = cacert_file; + + if (!csv_mode && self->output_file) { + quiet = false; +@@ -530,7 +533,7 @@ int main(int argc, char **argv) + if (status) { + fprintf(stderr, "Update of db forced\n"); + cve_db_unlock(); +- if (!update_db(quiet, db_path->str)) { ++ if (!update_db(quiet, db_path->str, self->cacert_file)) { + fprintf(stderr, "DB update failure\n"); + goto cleanup; + } +diff --git a/src/update-main.c b/src/update-main.c +index 2379cfa..c52d9d0 100644 +--- a/src/update-main.c ++++ b/src/update-main.c +@@ -43,11 +43,13 @@ the Free Software Foundation; either version 2 of the License, or\n\ + static gchar *nvds = NULL; + static bool _show_version = false; + static bool _quiet = false; ++static const char *_cacert_file = NULL; + + static GOptionEntry _entries[] = { + { "nvd-dir", 'd', 0, G_OPTION_ARG_STRING, &nvds, "NVD directory in filesystem", NULL }, + { "version", 'v', 0, G_OPTION_ARG_NONE, &_show_version, "Show version", NULL }, + { "quiet", 'q', 0, G_OPTION_ARG_NONE, &_quiet, "Run silently", NULL }, ++ { "cacert", 'C', 0, G_OPTION_ARG_STRING, &_cacert_file, "Path to the combined SSL certificates file (system default is used if not set)", NULL}, + { .short_name = 0 } + }; + +@@ -88,7 +90,7 @@ int main(int argc, char **argv) + goto end; + } + +- if (update_db(_quiet, db_path->str)) { ++ if (update_db(_quiet, db_path->str, _cacert_file)) { + ret = EXIT_SUCCESS; + } else { + fprintf(stderr, "Failed to update database\n"); +diff --git a/src/update.c b/src/update.c +index 070560a..8cb4a39 100644 +--- a/src/update.c ++++ b/src/update.c +@@ -267,7 +267,8 @@ static inline void update_end(int fd, const char *update_fname, bool ok) + + static int do_fetch_update(int year, const char *db_dir, CveDB *cve_db, + bool db_exist, bool verbose, +- unsigned int this_percent, unsigned int next_percent) ++ unsigned int this_percent, unsigned int next_percent, ++ const char *cacert_file) + { + const char nvd_uri[] = URI_PREFIX; + autofree(cve_string) *uri_meta = NULL; +@@ -331,14 +332,14 @@ refetch: + } + + /* Fetch NVD META file */ +- st = fetch_uri(uri_meta->str, nvdcve_meta->str, verbose, this_percent, this_percent); ++ st = fetch_uri(uri_meta->str, nvdcve_meta->str, verbose, this_percent, this_percent, cacert_file); + if (st == FETCH_STATUS_FAIL) { + fprintf(stderr, "Failed to fetch %s\n", uri_meta->str); + return -1; + } + + /* Fetch NVD XML file */ +- st = fetch_uri(uri_data_gz->str, nvdcve_data_gz->str, verbose, this_percent, next_percent); ++ st = fetch_uri(uri_data_gz->str, nvdcve_data_gz->str, verbose, this_percent, next_percent, cacert_file); + switch (st) { + case FETCH_STATUS_FAIL: + fprintf(stderr, "Failed to fetch %s\n", uri_data_gz->str); +@@ -391,7 +392,7 @@ refetch: + return 0; + } + +-bool update_db(bool quiet, const char *db_file) ++bool update_db(bool quiet, const char *db_file, const char *cacert_file) + { + autofree(char) *db_dir = NULL; + autofree(CveDB) *cve_db = NULL; +@@ -466,7 +467,8 @@ bool update_db(bool quiet, const char *db_file) + if (!quiet) + fprintf(stderr, "completed: %u%%\r", start_percent); + rc = do_fetch_update(y, db_dir, cve_db, db_exist, !quiet, +- start_percent, end_percent); ++ start_percent, end_percent, ++ cacert_file); + switch (rc) { + case 0: + if (!quiet) +diff --git a/src/update.h b/src/update.h +index b8e9911..ceea0c3 100644 +--- a/src/update.h ++++ b/src/update.h +@@ -15,7 +15,7 @@ cve_string *get_db_path(const char *path); + + int update_required(const char *db_file); + +-bool update_db(bool quiet, const char *db_file); ++bool update_db(bool quiet, const char *db_file, const char *cacert_file); + + + /* +-- +2.1.4 + |