| 1 |
============================================================================== |
| 2 |
CHANGES to fetch-crl - the Certificate Revocation List retrieval tool |
| 3 |
============================================================================== |
| 4 |
The fetch-crl utility will retrieve certificate revocation lists (CRLs) for |
| 5 |
a set of installed trust anchors, based on crl_url files or IGTF-style info |
| 6 |
files. It will install these for use with OpenSSL, NSS or third-party tools. |
| 7 |
|
| 8 |
Changes in 3.0.11-1 |
| 9 |
---------------------- |
| 10 |
* Added reference to /etc/fetch-crl.d/ to the man page, used shortened URL |
| 11 |
to full documentation in man page |
| 12 |
|
| 13 |
Changes in 3.0.10-1 |
| 14 |
---------------------- |
| 15 |
* Added a "noquiet" option in the configuration file that will override |
| 16 |
the default single "-q" option in the cro-job that is shipped with |
| 17 |
the fetch-crl3 init scripts (feature request by Ryan Taylor) |
| 18 |
* Added option "--inet6glue" and "inet6glue" config setting to load |
| 19 |
the Net::INET6Glue perl module (if it is available) to use IPv6 |
| 20 |
connections in LWP to download CRLs |
| 21 |
|
| 22 |
Changes in 3.0.8-1 |
| 23 |
---------------------- |
| 24 |
* Trust anchor name inferrence based on retrieved-CRL added as option (at cost |
| 25 |
of retrieving CRL even if there is no accompanying trust anchor found later) |
| 26 |
Option is disabled by default, but can be enabled by using @HASH@ in the |
| 27 |
ca-template name list. (feature request by Rob van der Wal, SARA, NL) |
| 28 |
|
| 29 |
Changes in 3.0.7-1 |
| 30 |
---------------------- |
| 31 |
* CRL modofication time heuristic inadvertently modified file name templates |
| 32 |
(solves issue kindly reported by Elan Ruusamae) |
| 33 |
* Expanded representation of tokenisation characters in strings to work |
| 34 |
around bug in file(1) (rhbz#699546, works around RedHat Bugzilla 699548) |
| 35 |
|
| 36 |
Changes in 3.0.6-1 |
| 37 |
---------------------- |
| 38 |
* Response parsing disabled to suppress superfluous warning on unexpected |
| 39 |
UTF-8 respons when retrieving a CRL (solves RedHat Bugzilla 688902) |
| 40 |
|
| 41 |
Changes in 3.0.5-1 |
| 42 |
---------------------- |
| 43 |
* CRLs for multiple similarly-named trust anchors might not all be downloaded. |
| 44 |
This is fixed in this release. |
| 45 |
* Spurious "restoreLogMode" internal errors are no longer raised |
| 46 |
|
| 47 |
Changes in 3.0.4-1 |
| 48 |
---------------------- |
| 49 |
* Add support for directory based drop-in configuration in /etc/fetch-crl.d/ |
| 50 |
* Only use cached CRL contents if the nextUpdate time of the cached CRL is |
| 51 |
still in the future. This will ensure that a new download is attempted |
| 52 |
each and everytime for CRLs that have already expired. |
| 53 |
|
| 54 |
Changes in 3.0.3-1 |
| 55 |
---------------------- |
| 56 |
* Clean up of man page format macro PU (reported by Mattias Ellert) |
| 57 |
|
| 58 |
Changes in 3.0.2-1 |
| 59 |
---------------------- |
| 60 |
* Clean up of man page format macro PU (reported by Mattias Ellert) |
| 61 |
|
| 62 |
Changes in 3.0.1-1 |
| 63 |
---------------------- |
| 64 |
* hunts through more places to find the latest successful CRL download to |
| 65 |
set the latest local modification time for a CRL |
| 66 |
(resolves a comparison error in case output and infodir are unset) |
| 67 |
|
| 68 |
Changes in 3.0.0-0.RC4 |
| 69 |
---------------------- |
| 70 |
* the config file name has changed to fetch-crl.conf, although a |
| 71 |
fetch-crl.cnf file will also be used when present |
| 72 |
* symlinked meta-data files can be ignored with the --nosymlinks option |
| 73 |
(or nosymlinks in the configuration file). This allows fetch-crl to be |
| 74 |
used effectively with new-format IGTF distribution before 1.37 |
| 75 |
* infinite loop for non-indexed CA file names fixed |
| 76 |
|
| 77 |
Changes in fetch-crl 3.0 |
| 78 |
------------------------ |
| 79 |
* fetch-crl 3.0 is a complete re-write, and shares no code with the 1.x and |
| 80 |
2.x series utility of the same name, although the function and some of |
| 81 |
the syntax is obviously the same |
| 82 |
|
| 83 |
* support for multiple output formats: OpenSSL 1 in dual-hash mode, specific |
| 84 |
DER and PEM outputs, and NSS databases |
| 85 |
* support for multiple CRLs for a single CA, allowing more than one CA with |
| 86 |
the same subject name but different CLRs. Review your client software to see |
| 87 |
if and how these CRLs are used. |
| 88 |
* stateful retrieval helps reduce bandwidth usage by caching the CRLs locally |
| 89 |
and respecting the Cache Control headers sent by the web server hosting the |
| 90 |
CRL. This can reduce the number of downloads |
| 91 |
* support for HEAD-only requests when state preservation is used (initially |
| 92 |
only retrieve HTTP headers, and only if the CRL actually changed to a full |
| 93 |
download) |
| 94 |
* support for more CRL retrieval protocols (file:// and ftp://) |
| 95 |
* ability to try site-local URLs first, before relying on the URLs shipped with |
| 96 |
the trust anchor. This allows building an explicit local caching (web) server. |
| 97 |
* ability to specify additional URLs to try in case the URLs shipped with the |
| 98 |
trust anchor were not responsive. This allows for automatic fall-back to |
| 99 |
(local or global) mirror services for CRL downloads |
| 100 |
* warnings and errors can be suppressed on a per-trust anchor basis, to allow |
| 101 |
silencing for particularly unstable trust anchors |
| 102 |
* aging tolerance (the delay time before errors are generated in case downloads |
| 103 |
consistently fail) can be configured on a per-trust anchor basis |
| 104 |
* parallel downloading for multiple trust anchors |
| 105 |
* minimized use of temporary files in the file system (now limited to the |
| 106 |
invocation of OpenSSL only, and only for brief periods of time) |
| 107 |
* dependencies on wget, lynx and other unix utilities have been removed |
| 108 |
* explicit web proxy support (using LWP http proxies) |
| 109 |
* completely re-written in perl, with some (hopefully minimal) dependencies: |
| 110 |
LWP, Sys::Syslog, POSIX. And Data::Dumper (when debugging is enabled), |
| 111 |
and IO::Select (if parallel downloads are enabled). |
| 112 |
|
| 113 |
Differences with respect to the previous versions |
| 114 |
|
| 115 |
* when downloading CRLs via https, the server certificate is not checked, |
| 116 |
neither for the correct DNS name nor for being issued by a valid CA. Since |
| 117 |
the CRL in itself is signed, this is not a security vulnerability. If |
| 118 |
stricter checking is anyway desired, and the Crypt::SSLeay perl module has |
| 119 |
been installed, set the HTTPS_CA_FILE environment variable before invoking |
| 120 |
fetch-crl -- but keep in mind that the DNS name verification is limited |
| 121 |
and will (incorrectly) reject DNS names if these are listed only in the |
| 122 |
subjectAlternativeName of the server certificate |
| 123 |
* Existing files with a name that matches a CRL target name are overwritten, |
| 124 |
even if they did not originally contain CRL data. In v2 this was configurable |
| 125 |
via the FORCE_OVERWRITE configuration setting. In version 3, files are |
| 126 |
overwritten by default, and this can no longer be configured. |
| 127 |
* fetch-crl3 will no longer check CA certificates for consistency or validity |
| 128 |
by themselves, only retrieved CRLs are verified |
| 129 |
|
| 130 |
Downsides of the new version |
| 131 |
|
| 132 |
* it requires perl5 to be installed (tested with perl 5.8.0 and higher) with |
| 133 |
libwww-perl, whereas version 2 only required a traditional Bourne shell |
| 134 |
* requires a version of OpenSSL (0.9.5a or better) to be installed. Needs |
| 135 |
OpenSSL 1.0.0 (at least beta5) for dual-hash support. |
| 136 |
* when using parallel downloads, it can only run on pure-POSIX systems |
| 137 |
* parallelism in combination with the NSS database output format is not tested |
| 138 |
* Even when only the NSS database output format has been selected, OpenSSL is |
| 139 |
still needed for verification and processing |
| 140 |
|
| 141 |
|
| 142 |
============================================================================== |
| 143 |
|
| 144 |
The change log below applies to the 1.x and 2.x series fetch-crl and is |
| 145 |
included for historical purposes only. Fetch-crl3, with which this |
| 146 |
changes file is being shipped, is a complete re-write of the utility. |
| 147 |
Although a lot of backwards compatibility has been preserves, there have |
| 148 |
been significant changes and the information below should NOT be used |
| 149 |
to infer any behaviour of fetch-crl3. |
| 150 |
|
| 151 |
Fetch-crl 1.x and 2.x were released under the EU DataGrid License. |
| 152 |
|
| 153 |
Changes in version EGP 2.8.5 |
| 154 |
---------------------------- |
| 155 |
(2010.06.03) |
| 156 |
|
| 157 |
* fetch-crl was occasionally leaving behind {hash}.r0.XXXXXX.r0 files |
| 158 |
This has been fixed in this release (patch thanks to Jason Smith, BNL) |
| 159 |
* man page was not compliant to Debian guidelines, this has been fixed |
| 160 |
(patch thanks to Mattias Ellert, Uppsala University) |
| 161 |
|
| 162 |
Changes in version EGP 2.8.4 |
| 163 |
---------------------------- |
| 164 |
(2010.04.04) |
| 165 |
|
| 166 |
* Fixes error when randomWait is not set [RH Bug 579488] |
| 167 |
|
| 168 |
Changes in version EGP 2.8.3 |
| 169 |
---------------------------- |
| 170 |
(2010.03.28) |
| 171 |
|
| 172 |
* Preserve SELinux context for CRL files if SElinux status program exists |
| 173 |
and selinux is enabled (RH bug 577403) |
| 174 |
* Fix argument parsing on syslog facility specification (RH bug 577387) |
| 175 |
* Increase granularity of the RandomWait and allow for 0 in -r option |
| 176 |
|
| 177 |
Changes in version EGP 2.8.2 |
| 178 |
---------------------------- |
| 179 |
(2010.03.03) |
| 180 |
|
| 181 |
* Improved support for multiple CRL URLs by downloading until a success |
| 182 |
is achieved, instead of downloading all of them |
| 183 |
* Imported randomwait patch from Steve Traylen |
| 184 |
|
| 185 |
Changes in version EGP 2.8.1 |
| 186 |
---------------------------- |
| 187 |
(2010.01.26) |
| 188 |
|
| 189 |
* The installed CRL file is re-checked for validity to catch file system |
| 190 |
errors and local disk corruption. When possible, it will try to restore |
| 191 |
a backup copy. Failures are not subject to aging tolerance. |
| 192 |
|
| 193 |
Changes in version EGP 2.8.0 |
| 194 |
---------------------------- |
| 195 |
(2009.09.22) |
| 196 |
|
| 197 |
* The RPM packaging has been overhauled and is now sufficiently conformant |
| 198 |
to EPEL and FedoraProject guidelines. |
| 199 |
* New init scripts and a cron job entry have been added to allow management |
| 200 |
of fetch-crl via the chkconfig mechanism |
| 201 |
|
| 202 |
These changes were contributed by Steve Traylen (CERN, Geneva, CH). |
| 203 |
|
| 204 |
Changes in version EGP 2.7.0 |
| 205 |
---------------------------- |
| 206 |
(2009.01.25) |
| 207 |
|
| 208 |
* Warnings and errors are now counted. If there are errors in the download |
| 209 |
or verification process for one or more CRLs, the exit status will be 1; |
| 210 |
if there are errors in the local setup or in the script invocation, the |
| 211 |
exit status will be 2. |
| 212 |
* The installed CRLs no longer have the textual representation of the CRL, |
| 213 |
but only the PEM data blob, thus reducing IO and memory requirements. |
| 214 |
* the CRL aging threshold is now set by default to 24 hours. The previous |
| 215 |
default was 0. The CRL aging threshold is set in the config file using |
| 216 |
CRL_AGING_THRESHOLD=<xx>, or with the "-a" command-line argument. |
| 217 |
* Default network timeouts reduced to 10 seconds (was 30) and retries to 2 |
| 218 |
* Added caching and conditional downloading. When CACHEDIR is set, the |
| 219 |
original downloads are preserved and wget timestamping mode enabled. |
| 220 |
When the content did not change, only the timestamp on the installed |
| 221 |
CRL is updated. If SLOPPYCRLHASHES is set, the has is calculated based |
| 222 |
on the name of the crl_url file, otherwise it is taken from the CRL itself. |
| 223 |
- The CACHEDIR must be exclusively writable by the user running fetch-crl |
| 224 |
- Setting CACHEDIR significantly reduced the bandwidth used by fetch-crl |
| 225 |
* Added RESETPATHMODE setting in sysconfig. It defines whether or not to |
| 226 |
set re-set $PATH to "/bin:/usr/bin" before start. The search for OpenSSL |
| 227 |
may be done based on the old path. |
| 228 |
yes=always replace; searchopenssl=search for openssl first and then reset; |
| 229 |
no=keep original path, whatever that me be (may be empty if called from cron) |
| 230 |
Default="yes". This replaces the hard-coded path in the tool! |
| 231 |
* Hidden "FORCE_OVERWRITE" option now has a regular name. This is backwards- |
| 232 |
compatible. Set FORCE_OVERWRITE=yes if you want files overwritten that |
| 233 |
have a CRL-like name and ought to have CRL content, but currently do not. |
| 234 |
* Addresses gLite Savannah bugs 28418 and 29559. Bug 27023 is partially |
| 235 |
addressed. Bug 20062 can be remedied with WGET_OPTS arguments. |
| 236 |
Addresses OSG ticket 4673. |
| 237 |
|
| 238 |
Changes in version EGP 2.6.6 |
| 239 |
---------------------------- |
| 240 |
(2007.09.16) |
| 241 |
(version 2.5.5 is invalid and was not publicly released) |
| 242 |
|
| 243 |
* Added obscure configuration parameter to allow overwriting of |
| 244 |
arbitrary data files with a downloaded CRL (on request of |
| 245 |
CERN, see https://savannah.cern.ch/bugs/index.php?29559) |
| 246 |
|
| 247 |
Changes in version EGP 2.6.4 |
| 248 |
---------------------------- |
| 249 |
(2007.08.15) |
| 250 |
|
| 251 |
* Expired CA issuer certificate now gives a warning instead of an error |
| 252 |
with the full verification result message |
| 253 |
* additional logfile output target can be selected via the configuration file |
| 254 |
* CRL aging threshold documented in manual page. Errors will now also be |
| 255 |
generated in the CRL download failed consistently and the current CRL |
| 256 |
has already expired |
| 257 |
|
| 258 |
Changes in version EGP 2.6.3 |
| 259 |
---------------------------- |
| 260 |
(2006.11.13) |
| 261 |
|
| 262 |
* cron job example: fetch-crl invocation syntax error corrected |
| 263 |
|
| 264 |
Changes in version EGP 2.6.2 |
| 265 |
---------------------------- |
| 266 |
(2006.10.27) |
| 267 |
|
| 268 |
* fixed bug: older wget versions do not recognise --no-check-certificate |
| 269 |
|
| 270 |
Changes in version EGP 2.6.1 |
| 271 |
---------------------------- |
| 272 |
(2006.10.25) |
| 273 |
|
| 274 |
* fixed local timezone vs UTC error in LastUpdate CRL validation comparison |
| 275 |
* fixed time comparison is the one-hour LastUpdate/download tolerance |
| 276 |
(both fixes thanks to Alain Roy) |
| 277 |
* added support for directory names containing whitespace |
| 278 |
* added support for syslog reporting (via -f option or SYSLOGFACILITY directive) |
| 279 |
* SERVERCERTCHECK=no is now the default. It can be reset via the configuration |
| 280 |
file, or using the "--check-server-certificate" commandline option |
| 281 |
* the main configuration file location (formerly fixed to be |
| 282 |
/etc/sysconfig/fetch-crl) can now be set via the variable $FETCH_CRL_SYSCONFIG |
| 283 |
* logfile format timestamp and tag have been normalised |
| 284 |
|
| 285 |
Changes in version EGP 2.6 |
| 286 |
-------------------------- |
| 287 |
(2006.05.20) |
| 288 |
|
| 289 |
* if the current local CRL has a lastUpdate time in the future, and the |
| 290 |
newly downloaded CRL is older that the current one, allow the installation |
| 291 |
of the newly downloaded CRL and issue a warning. |
| 292 |
* added non-suppressable warning in case the newly downloaded CRL has a |
| 293 |
lastUpdate time in the future, but install that CRL anyway (as the local |
| 294 |
clock might have been wrong). |
| 295 |
|
| 296 |
Changes in version EGP 2.5 |
| 297 |
-------------------------- |
| 298 |
(2006.01.16) |
| 299 |
|
| 300 |
* added additional configuration arguments and configuration variables |
| 301 |
to skip the server certificate check in wget |
| 302 |
(to support https:// URLs where the server is authenticated with |
| 303 |
a certificate that is not part of it's own trusted domain, such as |
| 304 |
the KISTI URL) |
| 305 |
|
| 306 |
Changes in version EGP 2.4 |
| 307 |
-------------------------- |
| 308 |
(2005.11.15) |
| 309 |
|
| 310 |
* for those platforms that support the stat(1) command, and in case the |
| 311 |
.crl_url file is named after the hash of the crl subject name to download, |
| 312 |
error eporting for individual download errors can be suppressed for |
| 313 |
a configurable amount of time as set via the "-a" option (unit: hours). |
| 314 |
|
| 315 |
Changes in version EGP 2.3 |
| 316 |
-------------------------- |
| 317 |
(2005.11.05) |
| 318 |
|
| 319 |
* do not replace recent CRLs with ones that have an older lastUpdate |
| 320 |
timestamp (prevents ARP/DNS DoS attacks) |
| 321 |
|
| 322 |
Changes in version EGP 2.2 |
| 323 |
-------------------------- |
| 324 |
(2005.10.27) |
| 325 |
|
| 326 |
* secure http download by wget recognise the CAs in the trusted directory. |
| 327 |
solves the issue described in the LCG bug tracking system |
| 328 |
https://savannah.cern.ch/bugs/index.php?func=detailitem&item_id=12182 |
| 329 |
|
| 330 |
Changes in version EGP 2.1 |
| 331 |
-------------------------- |
| 332 |
(2005.08.12) |
| 333 |
* specifically look for the most recent version of OpenSSL. The |
| 334 |
one in GLOBUS_LOCATION (which used to take precedence in the |
| 335 |
previous releases) is outdated in many cases and caused |
| 336 |
troubles on the LCG production systems in validating v2 CRLs |
| 337 |
* added manual page fetch-crl(8) |
| 338 |
|
| 339 |
Changes in version EGP 2.0 |
| 340 |
-------------------------- |
| 341 |
(2005.02.28) |
| 342 |
* name of the installed script changed to "fetch-crl" |
| 343 |
* the cronjob script is no longer installed by default, but supplied |
| 344 |
as an example in the %doc directory |
| 345 |
* RPM is now relocatable (default install in /usr) |
| 346 |
* READMA and CHANGES file now inclued in %doc tree |
| 347 |
* make install now installs |
| 348 |
* version increased to 2.0 |
| 349 |
|
| 350 |
Changes in version EGP 1.9 |
| 351 |
-------------------------- |
| 352 |
(2005.02.24) |
| 353 |
* the content of the final target CRL file is now checked for |
| 354 |
containing a valid CRL if it already exists. If it does not |
| 355 |
contain a CRL, an error is displayed and the file left untouched |
| 356 |
So making the final ".r0" file in ${outdir} a link to something else |
| 357 |
will not work, preventing an escalation in the final stage. |
| 358 |
|
| 359 |
Changes in version EGP 1.8 |
| 360 |
-------------------------- |
| 361 |
(changes from Fabio's version 1.7, 2005.02.24) |
| 362 |
|
| 363 |
* All temporary files (the initial CRL download using wget |
| 364 |
and the PEM-converted version of that file) are now created using |
| 365 |
mktemp |
| 366 |
* the RetrieveFileByURL function will not overwrite files that |
| 367 |
have any data in them |
| 368 |
* Note that the script can be run by a non-priviledged user, but |
| 369 |
that the output directory must be made writable by that user |
| 370 |
in an out-of-band way. |
| 371 |
|
| 372 |
EDG version 1.7 |
| 373 |
--------------- |
| 374 |
Imported with consent of Fabio Hernandez and Steve Traylen from |
| 375 |
the original EDG repository. |
| 376 |
The EU DataGrid License applies, see http://www.eu-datagrid.org/ |
Parent Directory
| 
Revision Log