Ubuntu
pam-pkcs11 package

[FFe] Please sync new upstream release 0.6.6-2 from Debian Unstable

Bug #739392 reported by Nicolas DERIVE on 2011-03-21

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	pam-pkcs11 (Ubuntu)	Won't Fix	Undecided	Unassigned

Bug Description

Please sync new upstream release 0.6.6-2 from Debian Unstable. We have a old june 2010 version, and this one brings some enhancement and bug fixing (see upstream changelog diff in the following comment). No bug or problem reported in Debian PTS.

Debian Changelog:

pam-pkcs11 (0.6.6-2) unstable; urgency=low

* upload to unstable

-- Ludovic Rousseau <email address hidden> Wed, 09 Feb 2011 23:22:44 +0100

pam-pkcs11 (0.6.6-1) experimental; urgency=low

* New upstream release

-- Ludovic Rousseau <email address hidden> Sun, 21 Nov 2010 14:49:42 +0100
pam-pkcs11 (0.6.5-1) experimental; urgency=low

   * New upstream release
   * debian/control: Standards-Version: 3.8.4 -> 3.9.1. No change needed.
   * use a minimal debian/rules file

-- Ludovic Rousseau <email address hidden> Sat, 23 Oct 2010 22:48:12 +0200

Revision history for this message

Nicolas DERIVE (kalon33) wrote on 2011-03-21:

Download full text (9.5 KiB)

Upstream ChangeLog:

2010-11-20 ludovic.rousseau

* [r475] configure.in: release 0.6.6

2010-11-18 ludovic.rousseau

* [r474] src/tools/Makefile.am, src/tools/card_eventmgr.c,
   src/tools/pkcs11_eventmgr.c: Use daemon implementation from
   daemon.c when needed (for example on
   Solaris 10)

See
http://www.opensc-project.org/pipermail/opensc-user/2010-November/004331.html
* [r473] src/tools/daemon.c: Use config.h instead of includes.h

   Define _PATH_DEVNULL if needed. It was defined in includes.h in
   OpenSSH
* [r472] src/tools/daemon.c: new file from OpenSSH version 5.6p1
   openssh-5.6p1/openbsd-compat/daemon.c

   The licence is BSD 3-clause so compatible with the LGPL v2+ used
   by
   pam_pkcs11

2010-10-25 ludovic.rousseau

* [r471] configure.in: Fix the change in revision 470

   Thanks (again) to Arfrever Frehtes Taifersar Arahesis
   http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015175.html
* [r470] configure.in: Default is to use pcsc-lite. The argument is
   --without-pcsclite to
   disable pcsc-lite use/support

Thanks to Arfrever Frehtes Taifersar Arahesis for the bug report
http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015172.html

2010-10-23 ludovic.rousseau

* [r469] doc/pam_pkcs11.xml: rename make_hash_link.sh in
   pkcs11_make_hash_link
* [r468] configure.in: Display ${libdir} value
* [r467] tools/Makefile.am, tools/make_hash_link.sh,
   tools/pkcs11_make_hash_link: rename make_hash_link.sh to
   pkcs11_make_hash_link to match the manpage
   name

2010-10-19 ludovic.rousseau

* [r465] src/pam_pkcs11/pam_pkcs11.c: Unload the mapper also on
success

   Thanks to Andre Zepezauer for the patch
   http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015150.html
* [r464] doc/doxygen.conf.in: Update from doxygen version 1.5.6 to
   1.7.1
* [r463] configure.in: release 0.6.5
* [r462] po/de.po, po/fr.po, po/nl.po, po/pam_pkcs11.pot, po/pl.po,
   po/pt_br.po, po/ru.po: regenerate
* [r461] src/common/Makefile.am: Add the missing strndup.h file
* [r460] src/common/uri.c: get_http(): check if complete message
   was transmitted

   Thanks to Andre Zepezauer for the patch
   http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015137.html
* [r459] src/common/uri.c: get_http(): allocate enough memory to
   fit http-request

Thanks to Andre Zepezauer for the patch
http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015137.html
* [r458] src/common/uri.c: get_http(): add missing return statement

   Thanks to Andre Zepezauer for the patch
   http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015137.html
* [r457] configure.in: If dlopen() is not found in libdl we try to
   find it without specifying a
   library before exiting in error.

   I don't remember why I used this code. Maybe dlopen() is not in
   libdl on
   some systems.

2010-10-16 ludovic.rousseau

Upstream ChangeLog:

2010-11-20  ludovic.rousseau

* [r475] configure.in: release 0.6.6

2010-11-18  ludovic.rousseau

* [r474] src/tools/Makefile.am, src/tools/card_eventmgr.c,
	  src/tools/pkcs11_eventmgr.c: Use daemon implementation from
	  daemon.c when needed (for example on
	  Solaris 10)
	  
	  See
	  http://www.opensc-project.org/pipermail/opensc-user/2010-November/004331.html
	* [r473] src/tools/daemon.c: Use config.h instead of includes.h
	  
	  Define _PATH_DEVNULL if needed. It was defined in includes.h in
	  OpenSSH
	* [r472] src/tools/daemon.c: new file from OpenSSH version 5.6p1
	  openssh-5.6p1/openbsd-compat/daemon.c
	  
	  The licence is BSD 3-clause so compatible with the LGPL v2+ used
	  by
	  pam_pkcs11

2010-10-25  ludovic.rousseau

* [r471] configure.in: Fix the change in revision 470
	  
	  Thanks (again) to Arfrever Frehtes Taifersar Arahesis
	  http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015175.html
	* [r470] configure.in: Default is to use pcsc-lite. The argument is
	  --without-pcsclite to
	  disable pcsc-lite use/support
	  
	  Thanks to Arfrever Frehtes Taifersar Arahesis for the bug report
	  http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015172.html

2010-10-23  ludovic.rousseau

* [r469] doc/pam_pkcs11.xml: rename make_hash_link.sh in
	  pkcs11_make_hash_link
	* [r468] configure.in: Display ${libdir} value
	* [r467] tools/Makefile.am, tools/make_hash_link.sh,
	  tools/pkcs11_make_hash_link: rename make_hash_link.sh to
	  pkcs11_make_hash_link to match the manpage
	  name

2010-10-19  ludovic.rousseau

* [r465] src/pam_pkcs11/pam_pkcs11.c: Unload the mapper also on
	  success
	  
	  Thanks to Andre Zepezauer for the patch
	  http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015150.html
	* [r464] doc/doxygen.conf.in: Update from doxygen version 1.5.6 to
	  1.7.1
	* [r463] configure.in: release 0.6.5
	* [r462] po/de.po, po/fr.po, po/nl.po, po/pam_pkcs11.pot, po/pl.po,
	  po/pt_br.po, po/ru.po: regenerate
	* [r461] src/common/Makefile.am: Add the missing strndup.h file
	* [r460] src/common/uri.c: get_http(): check if complete message
	  was transmitted
	  
	  Thanks to Andre Zepezauer for the patch
	  http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015137.html
	* [r459] src/common/uri.c: get_http(): allocate enough memory to
	  fit http-request
	  
	  Thanks to Andre Zepezauer for the patch
	  http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015137.html
	* [r458] src/common/uri.c: get_http(): add missing return statement
	  
	  Thanks to Andre Zepezauer for the patch
	  http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015137.html
	* [r457] configure.in: If dlopen() is not found in libdl we try to
	  find it without specifying a
	  library before exiting in error.
	  
	  I don't remember why I used this code. Maybe dlopen() is not in
	  libdl on
	  some systems.

2010-10-16  ludovic.rousseau

* [r456] po/fr.po: Translate a string
	* [r455] po/de.po, po/fr.po, po/nl.po, po/pam_pkcs11.pot, po/pl.po,
	  po/pt_br.po, po/ru.po: Regenerate
	* [r454] src/pam_pkcs11/pam_pkcs11.c: Replace "Found the %s." by
	  "%s found."
	  
	  Thanks to Mr Dash Four for the bug report
	  http://www.opensc-project.org/pipermail/opensc-devel/2010-October/015135.html

2010-10-15  ludovic.rousseau

* [r453] src/common/pkcs11_lib.c: crypto_init(): fix a typo in log
	  message

2010-09-22  ludovic.rousseau

* [r452] src/common/pkcs11_lib.c: pkcs11_pass_login(): check if the
	  PIN returned by getpass is NULL
	  
	  Thanks to Andre Zepezauer for the patch
	  http://www.opensc-project.org/pipermail/opensc-devel/2010-September/014976.html
	* [r451] src/common/pkcs11_lib.c: pkcs11_pass_login(): log an error
	  if pkcs11_login() fails
	  
	  Thanks to Andre Zepezauer for the patch
	  http://www.opensc-project.org/pipermail/opensc-devel/2010-September/014964.html
	* [r450] src/common/pkcs11_lib.c: pkcs11_pass_login(): do not clean
	  a zero length PIN
	  
	  Thanks to Andre Zepezauer for the patch
	  http://www.opensc-project.org/pipermail/opensc-devel/2010-September/014964.html
	* [r449] src/common/pkcs11_lib.c, src/pam_pkcs11/pam_pkcs11.c: Show
	  PIN code in debug output only if DEBUG_SHOW_PASSWORD is defined
	  (not defined by default)
	  
	  Thanks to Andre Zepezauer for the bug report
	  http://www.opensc-project.org/pipermail/opensc-devel/2010-September/014964.html

2010-09-21  ludovic.rousseau

* [r448] src/pam_pkcs11/pam_config.c: parse_config_file(): get the
	  debug value from the configuration file
	  
	  Thanks to Andre Zepezauer for the patch
	  http://www.opensc-project.org/pipermail/opensc-devel/2010-September/014949.html

2010-08-25  ludovic.rousseau

* [r447] src/tools/card_eventmgr.c: Do not call
	  SCardEstablishContext() before daemonize since pcsc-lite
	  handles are invalid after a fork.
	  
	  Thanks to Patrik Martinsson for the patch
	  http://www.opensc-project.org/pipermail/opensc-devel/2010-August/014632.html

2010-08-19  ludovic.rousseau

* [r446] src/tools/card_eventmgr.c: Use SCARD_READERSTATE instead
	  of SCARD_READERSTATE_A since it was
	  removed in pcsc-lite >= 1.6.2

2010-08-14  ludovic.rousseau

* [r445] src/mappers/cn_mapper.c, src/mappers/digest_mapper.c,
	  src/mappers/generic_mapper.c, src/mappers/krb_mapper.c,
	  src/mappers/ldap_mapper.c, src/mappers/mail_mapper.c,
	  src/mappers/mapper.c, src/mappers/mapper.h,
	  src/mappers/ms_mapper.c, src/mappers/null_mapper.c,
	  src/mappers/opensc_mapper.c, src/mappers/openssh_mapper.c,
	  src/mappers/pwent_mapper.c, src/mappers/subject_mapper.c,
	  src/mappers/uid_mapper.c, src/pam_pkcs11/mapper_mgr.c,
	  src/tools/pklogin_finder.c: Patch for #239 and #240 (handle more
	  than one cert/pattern matching)
	  
	  Thanks to Wolf Geldmacher for the patch.
	  http://www.opensc-project.org/pipermail/opensc-devel/2010-June/014405.html
	  
	  " Here's a patch to solve the issues I've encountered using
	  pam_pkcs11.
	  
	  In regards to #239 (pam_pkcs11 only looks at first certificate on
	  token):
	  
	  The fix for this turns out to be somewhat problematic, and I'm
	  not at
	  all sure, whether my implementation of the fix is a valid one.
	  
	  The basic problem (as I understood it from analyzing the code) is
	  that
	  finder functions of the mappers return a char*, allowing for a
	  single
	  value (NULL) to signalize failure and return the key if no
	  mapping (i.e.
	  no value associated with the key) was found (cf. comment for
	  mapfile_find in src/mappers/mapper.c). Thus a caller (i.e.
	  find_user in
	  src/pam_pkcs11/mapper_mgr.c) cannot distinguish between a mapping
	  or a
	  key being returned and thus will prematurely terminate on the
	  first
	  certificate that passes the other validity tests.
	  
	  The fix provided changes the finder function interface by
	  requiring an
	  additional out parameter that is set to 1, if a real mapping
	  value was
	  returned and remains unchanged otherwise. This fix breaks
	  existing
	  loadable mappers.
	  
	  I considered overloading of the value returned (e.g. having a
	  byte/substring as first character of the value returned to be
	  able to
	  distinguish between a value and a key being returned) which would
	  preserve the interface to the mappers, but refrained from
	  implementing
	  it that way as I believe this to be unclean and prone to
	  difficult to
	  track errors.
	  
	  Another solution I considered was the addition of another entry
	  to the
	  structure encapsulating the mappers (e.g. a finder2 method), but
	  as this
	  is no better in breaking the interface for loadable mappers and
	  duplicates code I forfeited this solution, too.
	  
	  If somebody could look into the problem and come up with a
	  solution that
	  preserves the interface to external mappers while allowing the
	  distinction between keys and values, I'd be more than happy to
	  implement
	  it.
	  
	  It might also may make sense to add a new configuration parameter
	  for
	  the new behaviour of find_user, allowing existing applications to
	  continue to work with keys being returned instead of values
	  (Feedback
	  anyone? The comment for find_user actually states that a mapping
	  value
	  is returned).
	  
	  In regards to #240 (Allow pattern matching in pam_pkcs11):
	  
	  I restricted this to only work for mapfiles and the
	  implementation
	  turned out to be quite simple - it's essentially an 11 line
	  change in
	  src/mappers/mapper.c - and is triggered by the specification of a
	  fully
	  anchored (i.e. *must* have initial "^" and *must* end in "$")
	  pattern as
	  key in a mapfile.
	  
	  This now allows syntax like
	  ^.*/serialNumber=xxx-xxx-xxx-xxx$ -> username
	  in all mapfiles.
	  
	  The patch attached contains the changes for both issues.
	  
	  Cheers,
	  Wolf "

2010-08-13  ludovic.rousseau

* [r444] src/pam_pkcs11/pam_pkcs11.c: Do not use a variadic
	  parameter for pam_prompt. It is not supported on
	  FreeBSD.

2010-08-12  ludovic.rousseau

* [r443] src/common/strndup.h, src/tools/pkcs11_setup.c: Add a new
	  header file to define strndup if needed.
	  
	  pkcs11_setup.c: In function â€˜scconf_replace_str_listâ€™:
	  pkcs11_setup.c:73: warning: implicit declaration of function
	  â€˜strndupâ€™
	  pkcs11_setup.c:73: warning: incompatible implicit declaration of
	  built-in function â€˜strndupâ€™
	* [r441] src/pam_pkcs11/pam_config.c, src/tools/pkcs11_inspect.c,
	  src/tools/pkcs11_listcerts.c, src/tools/pklogin_finder.c: Revert
	  changeset 301 parsing arguments in pam_config.c but skip the
	  first argument in command line tools.
	  
	  Thanks to halfline for the patch. Closes ticket #29

Revision history for this message

Nicolas DERIVE (kalon33) wrote on 2011-03-29:

Hello,

Is this syncable with Unstable now or too late (even if mainly bugfixes)?

Thanks a lot for taking time to review this (I know you're all pretty busy now...).

Revision history for this message

Scott Kitterman (kitterman) wrote on 2011-04-26:

This is too late. It will automatically get sync'ed into oneiric, so the bug does not need to stay open.

Changed in pam-pkcs11 (Ubuntu):
status:	New → Won't Fix

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntupam-pkcs11 package

[FFe] Please sync new upstream release 0.6.6-2 from Debian Unstable

Bug Description

Other bug subscribers

Remote bug watches

Ubuntu
pam-pkcs11 package