diff --git a/core/nss/PKGBUILD b/core/nss/PKGBUILD index 96e48123d..0f540ec93 100644 --- a/core/nss/PKGBUILD +++ b/core/nss/PKGBUILD @@ -6,8 +6,8 @@ pkgbase=nss pkgname=(nss ca-certificates-mozilla) -pkgver=3.29.1 -pkgrel=1 +pkgver=3.29.3 +pkgrel=2 pkgdesc="Network Security Services" url="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS" arch=(i686 x86_64) @@ -18,9 +18,9 @@ makedepends=('perl' 'python2' 'xmlto' 'docbook-xsl') options=('!strip' '!makeflags' 'staticlibs') source=("https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_${pkgver//./_}_RTM/src/${pkgbase}-${pkgver}.tar.gz" certdata2pem.py bundle.sh nss.pc.in nss-config.in nss-config.xml) -sha256sums=('47259bc5c4439d8228d7c577ea652ed140588f27eae8ebb39cc91057aea37366' - '2a2ff9131c21fa3b23ad7c7a2f069eabc783e56c6eb05419ac5f365f48dea0fc' - '045f520403f715a4cc7f3607b4e2c9bcc88fee5bce58d462fddaa2fdb0e4c180' +sha256sums=('35ddcc31251ef829994efeee925011aa1414e32be7e388236970255aa3c8e1eb' + '512b12a2f13129be62c008b4df0153f527dd7d71c2c5183de99dfa2a1c49dd8a' + '3bfadf722da6773bdabdd25bdf78158648043d1b7e57615574f189a88ca865dd' 'f2208c4f70373ff9b60f53d733f8071d4e390c384b776dfc04bf26c306882faf' 'e44ac5095b4d88f24ec7b2e6a9f1581560bd3ad41a3d198596d67ef22f67adb9' '98ace873c63e8e870286bce3ed53249aa2655cc1f53e7049061476e650ab06f1') @@ -118,8 +118,6 @@ package_ca-certificates-mozilla() { pkgdesc="Mozilla's set of trusted CA certificates" depends=(ca-certificates-utils) - local _certdir="$pkgdir/usr/share/ca-certificates/trust-source" - install -Dm644 ca-bundle.trust.crt "$_certdir/mozilla.trust.crt" - install -Dm644 ca-bundle.neutral-trust.crt "$_certdir/mozilla.neutral-trust.crt" - install -Dm644 ca-bundle.supplement.p11-kit "$_certdir/mozilla.supplement.p11-kit" + install -Dm644 ca-bundle.trust.p11-kit \ + "$pkgdir/usr/share/ca-certificates/trust-source/mozilla.trust.p11-kit" } diff --git a/core/nss/bundle.sh b/core/nss/bundle.sh index 253e64a2f..531a49622 100644 --- a/core/nss/bundle.sh +++ b/core/nss/bundle.sh @@ -5,11 +5,8 @@ cat <<EOF # This is a bundle of X.509 certificates of public Certificate # Authorities. It was generated from the Mozilla root CA list. -# These certificates are in the OpenSSL "TRUSTED CERTIFICATE" -# format and have trust bits set accordingly. -# An exception are auxiliary certificates, without positive or negative -# trust, but are used to assist in finding a preferred trust path. -# Those neutral certificates use the plain BEGIN CERTIFICATE format. +# These certificates and trust/distrust attributes use the file format accepted +# by the p11-kit-trust module. # # Source: nss/lib/ckfw/builtins/certdata.txt # Source: nss/lib/ckfw/builtins/nssckbi.h @@ -18,37 +15,8 @@ EOF cat certs/nssckbi.h | grep -w NSS_BUILTINS_LIBRARY_VERSION | awk '{print "# " $2 " " $3}' echo '#' -) > ca-bundle.trust.crt -for f in certs/*.crt; do - echo "processing $f" - tbits=`sed -n '/^# openssl-trust/{s/^.*=//;p;}' $f` - distbits=`sed -n '/^# openssl-distrust/{s/^.*=//;p;}' $f` - alias=`sed -n '/^# alias=/{s/^.*=//;p;q;}' $f | sed "s/'//g" | sed 's/"//g'` - targs="" - if [ -n "$tbits" ]; then - for t in $tbits; do - targs="${targs} -addtrust $t" - done - fi - if [ -n "$distbits" ]; then - for t in $distbits; do - targs="${targs} -addreject $t" - done - fi - if [ -n "$targs" ]; then - echo "trust flags $targs for $f" >> info.trust - openssl x509 -text -in "$f" -trustout $targs -setalias "$alias" >> ca-bundle.trust.crt - else - echo "no trust flags for $f" >> info.notrust - # p11-kit-trust defines empty trust lists as "rejected for all purposes". - # That's why we use the simple file format - # (BEGIN CERTIFICATE, no trust information) - # because p11-kit-trust will treat it as a certificate with neutral trust. - # This means we cannot use the -setalias feature for neutral trust certs. - openssl x509 -text -in "$f" >> ca-bundle.neutral-trust.crt - fi -done +) > ca-bundle.trust.p11-kit -for p in certs/*.p11-kit; do - cat "$p" >> ca-bundle.supplement.p11-kit +for p in certs/*.tmp-p11-kit; do + cat "$p" >> ca-bundle.trust.p11-kit done diff --git a/core/nss/certdata2pem.py b/core/nss/certdata2pem.py index 021772aea..e63ca0f0f 100644 --- a/core/nss/certdata2pem.py +++ b/core/nss/certdata2pem.py @@ -27,6 +27,7 @@ import re import sys import textwrap import urllib +import subprocess objects = [] @@ -113,6 +114,17 @@ def obj_to_filename(obj): serial = printable_serial(obj) return label + ":" + serial +def write_cert_ext_to_file(f, oid, value, public_key): + f.write("[p11-kit-object-v1]\n") + f.write("label: "); + f.write(tobj['CKA_LABEL']) + f.write("\n") + f.write("class: x-certificate-extension\n"); + f.write("object-id: " + oid + "\n") + f.write("value: \"" + value + "\"\n") + f.write("modifiable: false\n"); + f.write(public_key) + trust_types = { "CKA_TRUST_DIGITAL_SIGNATURE": "digital-signature", "CKA_TRUST_NON_REPUDIATION": "non-repudiation", @@ -132,6 +144,18 @@ trust_types = { "CKA_TRUST_STEP_UP_APPROVED": "step-up-approved", } +legacy_trust_types = { + "LEGACY_CKA_TRUST_SERVER_AUTH": "server-auth", + "LEGACY_CKA_TRUST_CODE_SIGNING": "code-signing", + "LEGACY_CKA_TRUST_EMAIL_PROTECTION": "email-protection", +} + +legacy_to_real_trust_types = { + "LEGACY_CKA_TRUST_SERVER_AUTH": "CKA_TRUST_SERVER_AUTH", + "LEGACY_CKA_TRUST_CODE_SIGNING": "CKA_TRUST_CODE_SIGNING", + "LEGACY_CKA_TRUST_EMAIL_PROTECTION": "CKA_TRUST_EMAIL_PROTECTION", +} + openssl_trust = { "CKA_TRUST_SERVER_AUTH": "serverAuth", "CKA_TRUST_CLIENT_AUTH": "clientAuth", @@ -147,6 +171,8 @@ for tobj in objects: distrustbits = [] openssl_trustflags = [] openssl_distrustflags = [] + legacy_trustbits = [] + legacy_openssl_trustflags = [] for t in trust_types.keys(): if tobj.has_key(t) and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': trustbits.append(t) @@ -157,29 +183,180 @@ for tobj in objects: if t in openssl_trust: openssl_distrustflags.append(openssl_trust[t]) + for t in legacy_trust_types.keys(): + if tobj.has_key(t) and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': + real_t = legacy_to_real_trust_types[t] + legacy_trustbits.append(real_t) + if real_t in openssl_trust: + legacy_openssl_trustflags.append(openssl_trust[real_t]) + if tobj.has_key(t) and tobj[t] == 'CKT_NSS_NOT_TRUSTED': + raise NotImplementedError, 'legacy distrust not supported.\n' + line + fname = obj_to_filename(tobj) try: obj = certmap[key] except: obj = None - if obj != None: - fname += ".crt" - else: - fname += ".p11-kit" + # optional debug code, that dumps the parsed input to files + #fulldump = "dump-" + fname + #dumpf = open(fulldump, 'w') + #dumpf.write(str(obj)); + #dumpf.write(str(tobj)); + #dumpf.close(); - f = open(fname, 'w') - if obj != None: + is_legacy = 0 + if tobj.has_key('LEGACY_CKA_TRUST_SERVER_AUTH') or tobj.has_key('LEGACY_CKA_TRUST_EMAIL_PROTECTION') or tobj.has_key('LEGACY_CKA_TRUST_CODE_SIGNING'): + is_legacy = 1 + if obj == None: + raise NotImplementedError, 'found legacy trust without certificate.\n' + line + + legacy_fname = "legacy-default/" + fname + ".crt" + f = open(legacy_fname, 'w') f.write("# alias=%s\n"%tobj['CKA_LABEL']) - f.write("# trust=" + " ".join(trustbits) + "\n") - f.write("# distrust=" + " ".join(distrustbits) + "\n") - if openssl_trustflags: - f.write("# openssl-trust=" + " ".join(openssl_trustflags) + "\n") - if openssl_distrustflags: - f.write("# openssl-distrust=" + " ".join(openssl_distrustflags) + "\n") + f.write("# trust=" + " ".join(legacy_trustbits) + "\n") + if legacy_openssl_trustflags: + f.write("# openssl-trust=" + " ".join(legacy_openssl_trustflags) + "\n") f.write("-----BEGIN CERTIFICATE-----\n") f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64))) f.write("\n-----END CERTIFICATE-----\n") + f.close() + + if tobj.has_key('CKA_TRUST_SERVER_AUTH') or tobj.has_key('CKA_TRUST_EMAIL_PROTECTION') or tobj.has_key('CKA_TRUST_CODE_SIGNING'): + legacy_fname = "legacy-disable/" + fname + ".crt" + f = open(legacy_fname, 'w') + f.write("# alias=%s\n"%tobj['CKA_LABEL']) + f.write("# trust=" + " ".join(trustbits) + "\n") + if openssl_trustflags: + f.write("# openssl-trust=" + " ".join(openssl_trustflags) + "\n") + f.write("-----BEGIN CERTIFICATE-----\n") + f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64))) + f.write("\n-----END CERTIFICATE-----\n") + f.close() + + # don't produce p11-kit output for legacy certificates + continue + + pk = '' + cert_comment = '' + if obj != None: + # must extract the public key from the cert, let's use openssl + cert_fname = "cert-" + fname + fc = open(cert_fname, 'w') + fc.write("-----BEGIN CERTIFICATE-----\n") + fc.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64))) + fc.write("\n-----END CERTIFICATE-----\n") + fc.close(); + pk_fname = "pubkey-" + fname + fpkout = open(pk_fname, "w") + dump_pk_command = ["openssl", "x509", "-in", cert_fname, "-noout", "-pubkey"] + subprocess.call(dump_pk_command, stdout=fpkout) + fpkout.close() + with open (pk_fname, "r") as myfile: + pk=myfile.read() + # obtain certificate information suitable as a comment + comment_fname = "comment-" + fname + fcout = open(comment_fname, "w") + comment_command = ["openssl", "x509", "-in", cert_fname, "-noout", "-text"] + subprocess.call(comment_command, stdout=fcout) + fcout.close() + sed_command = ["sed", "--in-place", "s/^/#/", comment_fname] + subprocess.call(sed_command) + with open (comment_fname, "r") as myfile: + cert_comment=myfile.read() + + fname += ".tmp-p11-kit" + f = open(fname, 'w') + + if obj != None: + is_distrusted = False + has_server_trust = False + has_email_trust = False + has_code_trust = False + + if tobj.has_key('CKA_TRUST_SERVER_AUTH'): + if tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_NOT_TRUSTED': + is_distrusted = True + elif tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_TRUSTED_DELEGATOR': + has_server_trust = True + + if tobj.has_key('CKA_TRUST_EMAIL_PROTECTION'): + if tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_NOT_TRUSTED': + is_distrusted = True + elif tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_TRUSTED_DELEGATOR': + has_email_trust = True + + if tobj.has_key('CKA_TRUST_CODE_SIGNING'): + if tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_NOT_TRUSTED': + is_distrusted = True + elif tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_TRUSTED_DELEGATOR': + has_code_trust = True + + if is_distrusted: + trust_ext_oid = "1.3.6.1.4.1.3319.6.10.1" + trust_ext_value = "0.%06%0a%2b%06%01%04%01%99w%06%0a%01%04 0%1e%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03" + write_cert_ext_to_file(f, trust_ext_oid, trust_ext_value, pk) + + trust_ext_oid = "2.5.29.37" + if has_server_trust: + if has_email_trust: + if has_code_trust: + # server + email + code + trust_ext_value = "0%2a%06%03U%1d%25%01%01%ff%04 0%1e%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03" + else: + # server + email + trust_ext_value = "0 %06%03U%1d%25%01%01%ff%04%160%14%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01" + else: + if has_code_trust: + # server + code + trust_ext_value = "0 %06%03U%1d%25%01%01%ff%04%160%14%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03" + else: + # server + trust_ext_value = "0%16%06%03U%1d%25%01%01%ff%04%0c0%0a%06%08%2b%06%01%05%05%07%03%01" + else: + if has_email_trust: + if has_code_trust: + # email + code + trust_ext_value = "0 %06%03U%1d%25%01%01%ff%04%160%14%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%03" + else: + # email + trust_ext_value = "0%16%06%03U%1d%25%01%01%ff%04%0c0%0a%06%08%2b%06%01%05%05%07%03%04" + else: + if has_code_trust: + # code + trust_ext_value = "0%16%06%03U%1d%25%01%01%ff%04%0c0%0a%06%08%2b%06%01%05%05%07%03%03" + else: + # none + trust_ext_value = "0%18%06%03U%1d%25%01%01%ff%04%0e0%0c%06%0a%2b%06%01%04%01%99w%06%0a%10" + + # no 2.5.29.37 for neutral certificates + if (is_distrusted or has_server_trust or has_email_trust or has_code_trust): + write_cert_ext_to_file(f, trust_ext_oid, trust_ext_value, pk) + + pk = '' + f.write("\n") + + f.write("[p11-kit-object-v1]\n") + f.write("label: "); + f.write(tobj['CKA_LABEL']) + f.write("\n") + if is_distrusted: + f.write("x-distrusted: true\n") + elif has_server_trust or has_email_trust or has_code_trust: + f.write("trusted: true\n") + else: + f.write("trusted: false\n") + + # requires p11-kit >= 0.23.4 + f.write("nss-mozilla-ca-policy: true\n") + f.write("modifiable: false\n"); + + f.write("-----BEGIN CERTIFICATE-----\n") + f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64))) + f.write("\n-----END CERTIFICATE-----\n") + f.write(cert_comment) + f.write("\n") + else: f.write("[p11-kit-object-v1]\n") f.write("label: "); @@ -187,6 +364,7 @@ for tobj in objects: f.write("\n") f.write("class: certificate\n") f.write("certificate-type: x-509\n") + f.write("modifiable: false\n"); f.write("issuer: \""); f.write(urllib.quote(tobj['CKA_ISSUER'])); f.write("\"\n")