Re: FAILED: patch "[PATCH] X.509: Remove certificate date checks" failed to apply to 3.12-stable tree

[Alexander Holler <holler@xxxxxxxxxxxxx>]

Am 01.12.2013 21:09, schrieb gregkh@xxxxxxxxxxxxxxxxxxx:
> The patch below does not apply to the 3.12-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@xxxxxxxxxxxxxxx>.

Try this one:

http://permalink.gmane.org/gmane.linux.kernel/1484116

Thanks,

Alexander Holler

> thanks,
>
> greg k-h
>
> ------------------ original commit in Linus's tree ------------------
>
>  From 124df926090b32a998483f6e43ebeccdbe5b5302 Mon Sep 17 00:00:00 2001
> From: David Howells <dhowells@xxxxxxxxxx>
> Date: Tue, 18 Jun 2013 17:40:44 +0100
> Subject: [PATCH] X.509: Remove certificate date checks
>
> Remove the certificate date checks that are performed when a certificate is
> parsed.  There are two checks: a valid from and a valid to.  The first check is
> causing a lot of problems with system clocks that don't keep good time and the
> second places an implicit expiry date upon the kernel when used for module
> signing, so do we really need them?
>
> Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
> cc: David Woodhouse <dwmw2@xxxxxxxxxxxxx>
> cc: Rusty Russell <rusty@xxxxxxxxxxxxxxx>
> cc: Josh Boyer <jwboyer@xxxxxxxxxx>
> cc: Alexander Holler <holler@xxxxxxxxxxxxx>
> cc: stable@xxxxxxxxxxxxxxx
>
> diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
> index 0f55e3b027a0..c1540e8f454a 100644
> --- a/crypto/asymmetric_keys/x509_public_key.c
> +++ b/crypto/asymmetric_keys/x509_public_key.c
> @@ -108,7 +108,6 @@ EXPORT_SYMBOL_GPL(x509_check_signature);
>   static int x509_key_preparse(struct key_preparsed_payload *prep)
>   {
>   	struct x509_certificate *cert;
> -	struct tm now;
>   	size_t srlen, sulen;
>   	char *desc = NULL;
>   	int ret;
> @@ -150,43 +149,6 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
>   		goto error_free_cert;
>   	}
>
> -	time_to_tm(CURRENT_TIME.tv_sec, 0, &now);
> -	pr_devel("Now: %04ld-%02d-%02d %02d:%02d:%02d\n",
> -		 now.tm_year + 1900, now.tm_mon + 1, now.tm_mday,
> -		 now.tm_hour, now.tm_min,  now.tm_sec);
> -	if (now.tm_year < cert->valid_from.tm_year ||
> -	    (now.tm_year == cert->valid_from.tm_year &&
> -	     (now.tm_mon < cert->valid_from.tm_mon ||
> -	      (now.tm_mon == cert->valid_from.tm_mon &&
> -	       (now.tm_mday < cert->valid_from.tm_mday ||
> -		(now.tm_mday == cert->valid_from.tm_mday &&
> -		 (now.tm_hour < cert->valid_from.tm_hour ||
> -		  (now.tm_hour == cert->valid_from.tm_hour &&
> -		   (now.tm_min < cert->valid_from.tm_min ||
> -		    (now.tm_min == cert->valid_from.tm_min &&
> -		     (now.tm_sec < cert->valid_from.tm_sec
> -		      ))))))))))) {
> -		pr_warn("Cert %s is not yet valid\n", cert->fingerprint);
> -		ret = -EKEYREJECTED;
> -		goto error_free_cert;
> -	}
> -	if (now.tm_year > cert->valid_to.tm_year ||
> -	    (now.tm_year == cert->valid_to.tm_year &&
> -	     (now.tm_mon > cert->valid_to.tm_mon ||
> -	      (now.tm_mon == cert->valid_to.tm_mon &&
> -	       (now.tm_mday > cert->valid_to.tm_mday ||
> -		(now.tm_mday == cert->valid_to.tm_mday &&
> -		 (now.tm_hour > cert->valid_to.tm_hour ||
> -		  (now.tm_hour == cert->valid_to.tm_hour &&
> -		   (now.tm_min > cert->valid_to.tm_min ||
> -		    (now.tm_min == cert->valid_to.tm_min &&
> -		     (now.tm_sec > cert->valid_to.tm_sec
> -		      ))))))))))) {
> -		pr_warn("Cert %s has expired\n", cert->fingerprint);
> -		ret = -EKEYEXPIRED;
> -		goto error_free_cert;
> -	}
> -
>   	cert->pub->algo = pkey_algo[cert->pub->pkey_algo];
>   	cert->pub->id_type = PKEY_ID_X509;

--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html