| 1 |
============================================================================== |
| 2 |
CHANGES to fetch-crl - the Certificate Revocation List retrieval tool |
| 3 |
============================================================================== |
| 4 |
The fetch-crl utility will retrieve certificate revocation lists (CRLs) for |
| 5 |
a set of installed trust anchors, based on crl_url files or IGTF-style info |
| 6 |
files. It will install these for use with OpenSSL, NSS or third-party tools. |
| 7 |
|
| 8 |
Changes in 3.0.4-1 |
| 9 |
---------------------- |
| 10 |
* Add support for directory based drop-in configuration in /etc/fetch-crl.d/ |
| 11 |
* Only use cached CRL contents if the nextUpdate time of the cached CRL is |
| 12 |
still in the future. This will ensure that a new download is attempted |
| 13 |
each and everytime for CRLs that have already expired. |
| 14 |
|
| 15 |
Changes in 3.0.3-1 |
| 16 |
---------------------- |
| 17 |
* Clean up of man page format macro PU (reported by Mattias Ellert) |
| 18 |
|
| 19 |
Changes in 3.0.2-1 |
| 20 |
---------------------- |
| 21 |
* Clean up of man page format macro PU (reported by Mattias Ellert) |
| 22 |
|
| 23 |
Changes in 3.0.1-1 |
| 24 |
---------------------- |
| 25 |
* hunts through more places to find the latest successful CRL download to |
| 26 |
set the latest local modification time for a CRL |
| 27 |
(resolves a comparison error in case output and infodir are unset) |
| 28 |
|
| 29 |
Changes in 3.0.0-0.RC4 |
| 30 |
---------------------- |
| 31 |
* the config file name has changed to fetch-crl.conf, although a |
| 32 |
fetch-crl.cnf file will also be used when present |
| 33 |
* symlinked meta-data files can be ignored with the --nosymlinks option |
| 34 |
(or nosymlinks in the configuration file). This allows fetch-crl to be |
| 35 |
used effectively with new-format IGTF distribution before 1.37 |
| 36 |
* infinite loop for non-indexed CA file names fixed |
| 37 |
|
| 38 |
Changes in fetch-crl 3.0 |
| 39 |
------------------------ |
| 40 |
* fetch-crl 3.0 is a complete re-write, and shares no code with the 1.x and |
| 41 |
2.x series utility of the same name, although the function and some of |
| 42 |
the syntax is obviously the same |
| 43 |
|
| 44 |
* support for multiple output formats: OpenSSL 1 in dual-hash mode, specific |
| 45 |
DER and PEM outputs, and NSS databases |
| 46 |
* support for multiple CRLs for a single CA, allowing more than one CA with |
| 47 |
the same subject name but different CLRs. Review your client software to see |
| 48 |
if and how these CRLs are used. |
| 49 |
* stateful retrieval helps reduce bandwidth usage by caching the CRLs locally |
| 50 |
and respecting the Cache Control headers sent by the web server hosting the |
| 51 |
CRL. This can reduce the number of downloads |
| 52 |
* support for HEAD-only requests when state preservation is used (initially |
| 53 |
only retrieve HTTP headers, and only if the CRL actually changed to a full |
| 54 |
download) |
| 55 |
* support for more CRL retrieval protocols (file:// and ftp://) |
| 56 |
* ability to try site-local URLs first, before relying on the URLs shipped with |
| 57 |
the trust anchor. This allows building an explicit local caching (web) server. |
| 58 |
* ability to specify additional URLs to try in case the URLs shipped with the |
| 59 |
trust anchor were not responsive. This allows for automatic fall-back to |
| 60 |
(local or global) mirror services for CRL downloads |
| 61 |
* warnings and errors can be suppressed on a per-trust anchor basis, to allow |
| 62 |
silencing for particularly unstable trust anchors |
| 63 |
* aging tolerance (the delay time before errors are generated in case downloads |
| 64 |
consistently fail) can be configured on a per-trust anchor basis |
| 65 |
* parallel downloading for multiple trust anchors |
| 66 |
* minimized use of temporary files in the file system (now limited to the |
| 67 |
invocation of OpenSSL only, and only for brief periods of time) |
| 68 |
* dependencies on wget, lynx and other unix utilities have been removed |
| 69 |
* explicit web proxy support (using LWP http proxies) |
| 70 |
* completely re-written in perl, with some (hopefully minimal) dependencies: |
| 71 |
LWP, Sys::Syslog, POSIX. And Data::Dumper (when debugging is enabled), |
| 72 |
and IO::Select (if parallel downloads are enabled). |
| 73 |
|
| 74 |
Differences with respect to the previous versions |
| 75 |
|
| 76 |
* when downloading CRLs via https, the server certificate is not checked, |
| 77 |
neither for the correct DNS name nor for being issued by a valid CA. Since |
| 78 |
the CRL in itself is signed, this is not a security vulnerability. If |
| 79 |
stricter checking is anyway desired, and the Crypt::SSLeay perl module has |
| 80 |
been installed, set the HTTPS_CA_FILE environment variable before invoking |
| 81 |
fetch-crl -- but keep in mind that the DNS name verification is limited |
| 82 |
and will (incorrectly) reject DNS names if these are listed only in the |
| 83 |
subjectAlternativeName of the server certificate |
| 84 |
* Existing files with a name that matches a CRL target name are overwritten, |
| 85 |
even if they did not originally contain CRL data. In v2 this was configurable |
| 86 |
via the FORCE_OVERWRITE configuration setting. In version 3, files are |
| 87 |
overwritten by default, and this can no longer be configured. |
| 88 |
* fetch-crl3 will no longer check CA certificates for consistency or validity |
| 89 |
by themselves, only retrieved CRLs are verified |
| 90 |
|
| 91 |
Downsides of the new version |
| 92 |
|
| 93 |
* it requires perl5 to be installed (tested with perl 5.8.0 and higher) with |
| 94 |
libwww-perl, whereas version 2 only required a traditional Bourne shell |
| 95 |
* requires a version of OpenSSL (0.9.5a or better) to be installed. Needs |
| 96 |
OpenSSL 1.0.0 (at least beta5) for dual-hash support. |
| 97 |
* when using parallel downloads, it can only run on pure-POSIX systems |
| 98 |
* parallelism in combination with the NSS database output format is not tested |
| 99 |
* Even when only the NSS database output format has been selected, OpenSSL is |
| 100 |
still needed for verification and processing |
| 101 |
|
| 102 |
|
| 103 |
============================================================================== |
| 104 |
|
| 105 |
The change log below applies to the 1.x and 2.x series fetch-crl and is |
| 106 |
included for historical purposes only. Fetch-crl3, with which this |
| 107 |
changes file is being shipped, is a complete re-write of the utility. |
| 108 |
Although a lot of backwards compatibility has been preserves, there have |
| 109 |
been significant changes and the information below should NOT be used |
| 110 |
to infer any behaviour of fetch-crl3. |
| 111 |
|
| 112 |
Fetch-crl 1.x and 2.x were released under the EU DataGrid License. |
| 113 |
|
| 114 |
Changes in version EGP 2.8.5 |
| 115 |
---------------------------- |
| 116 |
(2010.06.03) |
| 117 |
|
| 118 |
* fetch-crl was occasionally leaving behind {hash}.r0.XXXXXX.r0 files |
| 119 |
This has been fixed in this release (patch thanks to Jason Smith, BNL) |
| 120 |
* man page was not compliant to Debian guidelines, this has been fixed |
| 121 |
(patch thanks to Mattias Ellert, Uppsala University) |
| 122 |
|
| 123 |
Changes in version EGP 2.8.4 |
| 124 |
---------------------------- |
| 125 |
(2010.04.04) |
| 126 |
|
| 127 |
* Fixes error when randomWait is not set [RH Bug 579488] |
| 128 |
|
| 129 |
Changes in version EGP 2.8.3 |
| 130 |
---------------------------- |
| 131 |
(2010.03.28) |
| 132 |
|
| 133 |
* Preserve SELinux context for CRL files if SElinux status program exists |
| 134 |
and selinux is enabled (RH bug 577403) |
| 135 |
* Fix argument parsing on syslog facility specification (RH bug 577387) |
| 136 |
* Increase granularity of the RandomWait and allow for 0 in -r option |
| 137 |
|
| 138 |
Changes in version EGP 2.8.2 |
| 139 |
---------------------------- |
| 140 |
(2010.03.03) |
| 141 |
|
| 142 |
* Improved support for multiple CRL URLs by downloading until a success |
| 143 |
is achieved, instead of downloading all of them |
| 144 |
* Imported randomwait patch from Steve Traylen |
| 145 |
|
| 146 |
Changes in version EGP 2.8.1 |
| 147 |
---------------------------- |
| 148 |
(2010.01.26) |
| 149 |
|
| 150 |
* The installed CRL file is re-checked for validity to catch file system |
| 151 |
errors and local disk corruption. When possible, it will try to restore |
| 152 |
a backup copy. Failures are not subject to aging tolerance. |
| 153 |
|
| 154 |
Changes in version EGP 2.8.0 |
| 155 |
---------------------------- |
| 156 |
(2009.09.22) |
| 157 |
|
| 158 |
* The RPM packaging has been overhauled and is now sufficiently conformant |
| 159 |
to EPEL and FedoraProject guidelines. |
| 160 |
* New init scripts and a cron job entry have been added to allow management |
| 161 |
of fetch-crl via the chkconfig mechanism |
| 162 |
|
| 163 |
These changes were contributed by Steve Traylen (CERN, Geneva, CH). |
| 164 |
|
| 165 |
Changes in version EGP 2.7.0 |
| 166 |
---------------------------- |
| 167 |
(2009.01.25) |
| 168 |
|
| 169 |
* Warnings and errors are now counted. If there are errors in the download |
| 170 |
or verification process for one or more CRLs, the exit status will be 1; |
| 171 |
if there are errors in the local setup or in the script invocation, the |
| 172 |
exit status will be 2. |
| 173 |
* The installed CRLs no longer have the textual representation of the CRL, |
| 174 |
but only the PEM data blob, thus reducing IO and memory requirements. |
| 175 |
* the CRL aging threshold is now set by default to 24 hours. The previous |
| 176 |
default was 0. The CRL aging threshold is set in the config file using |
| 177 |
CRL_AGING_THRESHOLD=<xx>, or with the "-a" command-line argument. |
| 178 |
* Default network timeouts reduced to 10 seconds (was 30) and retries to 2 |
| 179 |
* Added caching and conditional downloading. When CACHEDIR is set, the |
| 180 |
original downloads are preserved and wget timestamping mode enabled. |
| 181 |
When the content did not change, only the timestamp on the installed |
| 182 |
CRL is updated. If SLOPPYCRLHASHES is set, the has is calculated based |
| 183 |
on the name of the crl_url file, otherwise it is taken from the CRL itself. |
| 184 |
- The CACHEDIR must be exclusively writable by the user running fetch-crl |
| 185 |
- Setting CACHEDIR significantly reduced the bandwidth used by fetch-crl |
| 186 |
* Added RESETPATHMODE setting in sysconfig. It defines whether or not to |
| 187 |
set re-set $PATH to "/bin:/usr/bin" before start. The search for OpenSSL |
| 188 |
may be done based on the old path. |
| 189 |
yes=always replace; searchopenssl=search for openssl first and then reset; |
| 190 |
no=keep original path, whatever that me be (may be empty if called from cron) |
| 191 |
Default="yes". This replaces the hard-coded path in the tool! |
| 192 |
* Hidden "FORCE_OVERWRITE" option now has a regular name. This is backwards- |
| 193 |
compatible. Set FORCE_OVERWRITE=yes if you want files overwritten that |
| 194 |
have a CRL-like name and ought to have CRL content, but currently do not. |
| 195 |
* Addresses gLite Savannah bugs 28418 and 29559. Bug 27023 is partially |
| 196 |
addressed. Bug 20062 can be remedied with WGET_OPTS arguments. |
| 197 |
Addresses OSG ticket 4673. |
| 198 |
|
| 199 |
Changes in version EGP 2.6.6 |
| 200 |
---------------------------- |
| 201 |
(2007.09.16) |
| 202 |
(version 2.5.5 is invalid and was not publicly released) |
| 203 |
|
| 204 |
* Added obscure configuration parameter to allow overwriting of |
| 205 |
arbitrary data files with a downloaded CRL (on request of |
| 206 |
CERN, see https://savannah.cern.ch/bugs/index.php?29559) |
| 207 |
|
| 208 |
Changes in version EGP 2.6.4 |
| 209 |
---------------------------- |
| 210 |
(2007.08.15) |
| 211 |
|
| 212 |
* Expired CA issuer certificate now gives a warning instead of an error |
| 213 |
with the full verification result message |
| 214 |
* additional logfile output target can be selected via the configuration file |
| 215 |
* CRL aging threshold documented in manual page. Errors will now also be |
| 216 |
generated in the CRL download failed consistently and the current CRL |
| 217 |
has already expired |
| 218 |
|
| 219 |
Changes in version EGP 2.6.3 |
| 220 |
---------------------------- |
| 221 |
(2006.11.13) |
| 222 |
|
| 223 |
* cron job example: fetch-crl invocation syntax error corrected |
| 224 |
|
| 225 |
Changes in version EGP 2.6.2 |
| 226 |
---------------------------- |
| 227 |
(2006.10.27) |
| 228 |
|
| 229 |
* fixed bug: older wget versions do not recognise --no-check-certificate |
| 230 |
|
| 231 |
Changes in version EGP 2.6.1 |
| 232 |
---------------------------- |
| 233 |
(2006.10.25) |
| 234 |
|
| 235 |
* fixed local timezone vs UTC error in LastUpdate CRL validation comparison |
| 236 |
* fixed time comparison is the one-hour LastUpdate/download tolerance |
| 237 |
(both fixes thanks to Alain Roy) |
| 238 |
* added support for directory names containing whitespace |
| 239 |
* added support for syslog reporting (via -f option or SYSLOGFACILITY directive) |
| 240 |
* SERVERCERTCHECK=no is now the default. It can be reset via the configuration |
| 241 |
file, or using the "--check-server-certificate" commandline option |
| 242 |
* the main configuration file location (formerly fixed to be |
| 243 |
/etc/sysconfig/fetch-crl) can now be set via the variable $FETCH_CRL_SYSCONFIG |
| 244 |
* logfile format timestamp and tag have been normalised |
| 245 |
|
| 246 |
Changes in version EGP 2.6 |
| 247 |
-------------------------- |
| 248 |
(2006.05.20) |
| 249 |
|
| 250 |
* if the current local CRL has a lastUpdate time in the future, and the |
| 251 |
newly downloaded CRL is older that the current one, allow the installation |
| 252 |
of the newly downloaded CRL and issue a warning. |
| 253 |
* added non-suppressable warning in case the newly downloaded CRL has a |
| 254 |
lastUpdate time in the future, but install that CRL anyway (as the local |
| 255 |
clock might have been wrong). |
| 256 |
|
| 257 |
Changes in version EGP 2.5 |
| 258 |
-------------------------- |
| 259 |
(2006.01.16) |
| 260 |
|
| 261 |
* added additional configuration arguments and configuration variables |
| 262 |
to skip the server certificate check in wget |
| 263 |
(to support https:// URLs where the server is authenticated with |
| 264 |
a certificate that is not part of it's own trusted domain, such as |
| 265 |
the KISTI URL) |
| 266 |
|
| 267 |
Changes in version EGP 2.4 |
| 268 |
-------------------------- |
| 269 |
(2005.11.15) |
| 270 |
|
| 271 |
* for those platforms that support the stat(1) command, and in case the |
| 272 |
.crl_url file is named after the hash of the crl subject name to download, |
| 273 |
error eporting for individual download errors can be suppressed for |
| 274 |
a configurable amount of time as set via the "-a" option (unit: hours). |
| 275 |
|
| 276 |
Changes in version EGP 2.3 |
| 277 |
-------------------------- |
| 278 |
(2005.11.05) |
| 279 |
|
| 280 |
* do not replace recent CRLs with ones that have an older lastUpdate |
| 281 |
timestamp (prevents ARP/DNS DoS attacks) |
| 282 |
|
| 283 |
Changes in version EGP 2.2 |
| 284 |
-------------------------- |
| 285 |
(2005.10.27) |
| 286 |
|
| 287 |
* secure http download by wget recognise the CAs in the trusted directory. |
| 288 |
solves the issue described in the LCG bug tracking system |
| 289 |
https://savannah.cern.ch/bugs/index.php?func=detailitem&item_id=12182 |
| 290 |
|
| 291 |
Changes in version EGP 2.1 |
| 292 |
-------------------------- |
| 293 |
(2005.08.12) |
| 294 |
* specifically look for the most recent version of OpenSSL. The |
| 295 |
one in GLOBUS_LOCATION (which used to take precedence in the |
| 296 |
previous releases) is outdated in many cases and caused |
| 297 |
troubles on the LCG production systems in validating v2 CRLs |
| 298 |
* added manual page fetch-crl(8) |
| 299 |
|
| 300 |
Changes in version EGP 2.0 |
| 301 |
-------------------------- |
| 302 |
(2005.02.28) |
| 303 |
* name of the installed script changed to "fetch-crl" |
| 304 |
* the cronjob script is no longer installed by default, but supplied |
| 305 |
as an example in the %doc directory |
| 306 |
* RPM is now relocatable (default install in /usr) |
| 307 |
* READMA and CHANGES file now inclued in %doc tree |
| 308 |
* make install now installs |
| 309 |
* version increased to 2.0 |
| 310 |
|
| 311 |
Changes in version EGP 1.9 |
| 312 |
-------------------------- |
| 313 |
(2005.02.24) |
| 314 |
* the content of the final target CRL file is now checked for |
| 315 |
containing a valid CRL if it already exists. If it does not |
| 316 |
contain a CRL, an error is displayed and the file left untouched |
| 317 |
So making the final ".r0" file in ${outdir} a link to something else |
| 318 |
will not work, preventing an escalation in the final stage. |
| 319 |
|
| 320 |
Changes in version EGP 1.8 |
| 321 |
-------------------------- |
| 322 |
(changes from Fabio's version 1.7, 2005.02.24) |
| 323 |
|
| 324 |
* All temporary files (the initial CRL download using wget |
| 325 |
and the PEM-converted version of that file) are now created using |
| 326 |
mktemp |
| 327 |
* the RetrieveFileByURL function will not overwrite files that |
| 328 |
have any data in them |
| 329 |
* Note that the script can be run by a non-priviledged user, but |
| 330 |
that the output directory must be made writable by that user |
| 331 |
in an out-of-band way. |
| 332 |
|
| 333 |
EDG version 1.7 |
| 334 |
--------------- |
| 335 |
Imported with consent of Fabio Hernandez and Steve Traylen from |
| 336 |
the original EDG repository. |
| 337 |
The EU DataGrid License applies, see http://www.eu-datagrid.org/ |
Parent Directory
| 
Revision Log