linux-kernel - Re: [PATCH] tools/certs: Make print-cert-tbs-hash.sh compatible with recent OpenSSL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250709.ZooYu6oasaiN@digikod.net>
Date: Wed, 9 Jul 2025 15:19:47 +0200
From: Mickaël Salaün <mic@...ikod.net>
To: David Howells <dhowells@...hat.com>, 
	David Woodhouse <dwmw2@...radead.org>
Cc: keyrings@...r.kernel.org, Eric Snowberg <eric.snowberg@...cle.com>, 
	Jarkko Sakkinen <jarkko@...nel.org>, Daniel Urbonas <t-durbonas@...rosoft.com>, 
	linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] tools/certs: Make print-cert-tbs-hash.sh compatible with
 recent OpenSSL

I can take it but I'd like an Acked-by please.

On Mon, Oct 07, 2024 at 08:42:16PM +0200, Mickaël Salaün wrote:
> Could someone please take this patch?
> 
> On Mon, Jul 29, 2024 at 08:02:32PM +0200, Mickaël Salaün wrote:
> > Recent OpenSSL versions (2 or 3) broke the "x509" argument parsing by
> > not handling "-in -" (unlike OpenSSL 1.1):
> >   Could not open file or uri for loading certificate from -: No such
> >   file or directory
> > 
> > Avoid this issue and still make this script work with older versions of
> > OpenSSL by using implicit arguments instead.
> > 
> > To hopefully make it more future-proof, apply the same simplifications
> > for other OpenSSL commands.
> > 
> > Cc: David Howells <dhowells@...hat.com>
> > Cc: David Woodhouse <dwmw2@...radead.org>
> > Cc: Eric Snowberg <eric.snowberg@...cle.com>
> > Cc: Jarkko Sakkinen <jarkko@...nel.org>
> > Reported-by: Daniel Urbonas <t-durbonas@...rosoft.com>
> > Fixes: 58d416351e6d ("tools/certs: Add print-cert-tbs-hash.sh")
> > Signed-off-by: Mickaël Salaün <mic@...ikod.net>
> > ---
> >  tools/certs/print-cert-tbs-hash.sh | 6 +++---
> >  1 file changed, 3 insertions(+), 3 deletions(-)
> > 
> > diff --git a/tools/certs/print-cert-tbs-hash.sh b/tools/certs/print-cert-tbs-hash.sh
> > index c93df5387ec9..22bdeec4d286 100755
> > --- a/tools/certs/print-cert-tbs-hash.sh
> > +++ b/tools/certs/print-cert-tbs-hash.sh
> > @@ -54,7 +54,7 @@ RANGE_AND_DIGEST_RE='
> >  '
> >  
> >  RANGE_AND_DIGEST=($(echo "${PEM}" | \
> > -	openssl asn1parse -in - | \
> > +	openssl asn1parse | \
> >  	sed -n -e "${RANGE_AND_DIGEST_RE}"))
> >  
> >  if [ "${#RANGE_AND_DIGEST[@]}" != 3 ]; then
> > @@ -85,7 +85,7 @@ if [ -z "${DIGEST_MATCH}" ]; then
> >  fi
> >  
> >  echo "${PEM}" | \
> > -	openssl x509 -in - -outform DER | \
> > +	openssl x509 -outform DER | \
> >  	dd "bs=1" "skip=${OFFSET}" "count=${END}" "status=none" | \
> > -	openssl dgst "-${DIGEST_MATCH}" - | \
> > +	openssl dgst "-${DIGEST_MATCH}" | \
> >  	awk '{printf "tbs:" $2}'
> > -- 
> > 2.45.2
> >