40e1c46892
2006/12/01 18:07:25 hr 1.9.12.4: #i70840#: the -Wl,-z,noexecstack switch is available on all systems with GNU ld 2006/11/28 16:45:26 hr 1.9.12.3: #i70840#: fix typo 2006/11/28 13:32:19 hjs 1.9.12.2: #i72063# add to CFLAGS instead of overwriting 2006/11/28 13:07:32 hr 1.9.12.1: #i70840#: disable executable stack (linux compiled with GCC) |
||
---|---|---|
.. | ||
prj | ||
makefile.mk | ||
readme.txt | ||
xmlsec1-1.2.6.patch |
The XML Security library has been modified, so that there is NO verification of the certificate during sign or verification operation. On Windows this was done in the function xmlSecMSCryptoX509StoreVerify (file src/mscrypto/x509vfy.c) and on UNIX in xmlSecNssX509StoreVerify (file src/nss/x509vfy.c). This change requires that the XML Signature contains in Signature/KeyInfo/X509Data only entries which represent the same certificate. The implementation creates certificates from all of the X509Data children (X509IssuerSerial, X509Certificate) and used to iterate over all certificates, verify them and return the first "good" certificate. Now the first one is used. The X509IssuerSerial information is used by XML Security Library to find the certificate in the certificate store on the machine. The X509Certificate entry is used to create a certificate no matter if this is already contained in the certificate store. Do not forget: Suggest to XML Security Library to provide a way to carry out signature operations without verification of certificates. There is flag XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS that can be set in a xmlSecKeyInfoCtx (see function xmlSecNssKeyDataX509XmlRead, in file src/nss/x509.c), which indicates such a possibility but it does not work.