Attachment 18220 Details for Bug 15551 – patch for 4.19

[patch] patch for 4.19

v4-19-samba-fix-gpupdate-ca-utf8-decode.patch (text/plain), 2.12 KB, created by Andreas Schneider on 2024-01-08 12:50:48 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andreas Schneider

Created: 2024-01-08 12:50:48 UTC

Size: 2.12 KB

patch

obsolete

>From d7fc2e0848bda1c26c8d3e095166ac558250202e Mon Sep 17 00:00:00 2001
>From: Gabriel Nagy <gabriel.nagy@canonical.com>
>Date: Wed, 16 Aug 2023 12:20:11 +0300
>Subject: [PATCH] gp: Convert CA certificates to base64
>
>I don't know whether this applies universally, but in our case the
>contents of `es['cACertificate'][0]` are binary, so cleanly converting
>to a string fails with the following:
>
>'utf-8' codec can't decode byte 0x82 in position 1: invalid start byte
>
>We found a fix to be encoding the certificate to base64 when
>constructing the CA list.
>
>Section 4.4.5.2 of MS-CAESO also suggests that the content of
>`cACertificate` is binary (OCTET string).
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=15551
>
>Signed-off-by: Gabriel Nagy <gabriel.nagy@canonical.com>
>Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
>Reviewed-by: David Mulder <dmulder@samba.org>
>(cherry picked from commit 157335ee93eb866f9b6a47486a5668d6e76aced5)
>---
> python/samba/gp/gp_cert_auto_enroll_ext.py | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
>diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py
>index 312c8ddf467..cb5022c665e 100644
>--- a/python/samba/gp/gp_cert_auto_enroll_ext.py
>+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py
>@@ -156,7 +156,7 @@ def fetch_certification_authorities(ldb):
>     for es in res:
>         data = { 'name': get_string(es['cn'][0]),
>                  'hostname': get_string(es['dNSHostName'][0]),
>-                 'cACertificate': get_string(es['cACertificate'][0])
>+                 'cACertificate': get_string(base64.b64encode(es['cACertificate'][0]))
>                }
>         result.append(data)
>     return result
>@@ -174,8 +174,7 @@ def fetch_template_attrs(ldb, name, attrs=None):
>         return {'msPKI-Minimal-Key-Size': ['2048']}
> 
> def format_root_cert(cert):
>-    cert = base64.b64encode(cert.encode())
>-    return cert_wrap % re.sub(b"(.{64})", b"\\1\n", cert, 0, re.DOTALL)
>+    return cert_wrap % re.sub(b"(.{64})", b"\\1\n", cert.encode(), 0, re.DOTALL)
> 
> def find_cepces_submit():
>     certmonger_dirs = [os.environ.get("PATH"), '/usr/lib/certmonger',
>-- 
>2.43.0
>

Actions: View

Attachments on bug 15551: 18220 | 18221