Attachment 707190 Details for Bug 919511 – Temporarily hard code distrust v2

[patch] Temporarily hard code distrust v2

temporarily-hard-code-distrust-v2.patch (text/plain), 10.45 KB, created by Stef Walter on 2013-03-08 19:40:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stef Walter

Created: 2013-03-08 19:40:30 UTC

Size: 10.45 KB

patch

obsolete

>diff --git a/trust/token.c b/trust/token.c
>index 4e6f6e9..46eea20 100644
>--- a/trust/token.c
>+++ b/trust/token.c
>@@ -53,6 +53,8 @@
> #include <stdlib.h>
> #include <string.h>
> 
>+#define ELEMS(x) (sizeof (x) / sizeof (x[0]))
>+
> struct _p11_token {
> 	p11_parser *parser;
> 	p11_dict *objects;
>@@ -70,6 +72,8 @@ on_parser_object (CK_ATTRIBUTE *attrs,
> 	CK_OBJECT_HANDLE *key;
> 	p11_token *token = user_data;
> 
>+	return_if_fail (attrs != NULL);
>+
> 	object = p11_module_next_id ();
> 
> 	key = memdup (&object, sizeof (object));
>@@ -211,21 +215,167 @@ static int
> load_builtin_objects (p11_token *token)
> {
> 	CK_OBJECT_CLASS builtin = CKO_NETSCAPE_BUILTIN_ROOT_LIST;
>-	const char *vlabel = "Trust Anchor Roots";
>+	CK_OBJECT_CLASS nss_trust = CKO_NETSCAPE_TRUST;
>+	CK_TRUST nss_not_trusted = CKT_NETSCAPE_UNTRUSTED;
> 	CK_BBOOL vtrue = CK_TRUE;
> 	CK_BBOOL vfalse = CK_FALSE;
>-	CK_ATTRIBUTE *attrs;
>-
>-	CK_ATTRIBUTE klass = { CKA_CLASS, &builtin, sizeof (builtin) };
>-	CK_ATTRIBUTE tok = { CKA_TOKEN, &vtrue, sizeof (vtrue) };
>-	CK_ATTRIBUTE priv = { CKA_PRIVATE, &vfalse, sizeof (vfalse) };
>-	CK_ATTRIBUTE modifiable = { CKA_MODIFIABLE, &vfalse, sizeof (vfalse) };
>-	CK_ATTRIBUTE label = { CKA_LABEL, (void *)vlabel, strlen (vlabel) };
>-
>-	attrs = p11_attrs_build (NULL, &klass, &tok, &priv, &modifiable, &label, NULL);
>-	return_val_if_fail (attrs != NULL, 0);
> 
>-	on_parser_object (attrs, token);
>+	const char *trust_anchor_roots = "Trust Anchor Roots";
>+	CK_ATTRIBUTE builtin_root_list[] = {
>+		{ CKA_CLASS, &builtin, sizeof (builtin) },
>+		{ CKA_TOKEN, &vtrue, sizeof (vtrue) },
>+		{ CKA_PRIVATE, &vfalse, sizeof (vfalse) },
>+		{ CKA_MODIFIABLE, &vfalse, sizeof (vfalse) },
>+		{ CKA_LABEL, (void *)trust_anchor_roots, strlen (trust_anchor_roots) },
>+	};
>+
>+	/* Explicitly Distrust "MITM subCA 1 issued by Trustwave", Bug 724929 */
>+	char label_trustwave1[] = "MITM subCA 1 issued by Trustwave";
>+	char issuer_trustwave1[] =
>+		"\060\201\253\061\013\060\011\006\003\125\004\006\023\002\125\123"
>+		"\061\021\060\017\006\003\125\004\010\023\010\111\154\154\151\156"
>+		"\157\151\163\061\020\060\016\006\003\125\004\007\023\007\103\150"
>+		"\151\143\141\147\157\061\041\060\037\006\003\125\004\012\023\030"
>+		"\124\162\165\163\164\167\141\166\145\040\110\157\154\144\151\156"
>+		"\147\163\054\040\111\156\143\056\061\063\060\061\006\003\125\004"
>+		"\003\023\052\124\162\165\163\164\167\141\166\145\040\117\162\147"
>+		"\141\156\151\172\141\164\151\157\156\040\111\163\163\165\151\156"
>+		"\147\040\103\101\054\040\114\145\166\145\154\040\062\061\037\060"
>+		"\035\006\011\052\206\110\206\367\015\001\011\001\026\020\143\141"
>+		"\100\164\162\165\163\164\167\141\166\145\056\143\157\155";
>+	char serial_trustwave1[] = "\002\004\153\111\322\005";
>+	CK_ATTRIBUTE distrust_trustwave1[] = {
>+		{ CKA_CLASS, &nss_trust, sizeof (nss_trust) },
>+		{ CKA_TOKEN, &vtrue, sizeof (vtrue) },
>+		{ CKA_PRIVATE, &vfalse, sizeof (vfalse) },
>+		{ CKA_MODIFIABLE, &vfalse, sizeof (vfalse) },
>+		{ CKA_LABEL, label_trustwave1, sizeof (label_trustwave1) - 1 },
>+		{ CKA_ISSUER, issuer_trustwave1, sizeof (issuer_trustwave1) -1 },
>+		{ CKA_SERIAL_NUMBER, serial_trustwave1, sizeof (serial_trustwave1) - 1 },
>+		{ CKA_TRUST_SERVER_AUTH, &nss_not_trusted, sizeof (nss_not_trusted) },
>+		{ CKA_TRUST_EMAIL_PROTECTION, &nss_not_trusted, sizeof (nss_not_trusted) },
>+		{ CKA_TRUST_CODE_SIGNING, &nss_not_trusted, sizeof (nss_not_trusted) },
>+		{ CKA_TRUST_STEP_UP_APPROVED, &vfalse, sizeof (vfalse) },
>+	};
>+
>+	/* Explicitly Distrust "MITM subCA 2 issued by Trustwave", Bug 724929 */
>+	char label_trustwave2[] = "MITM subCA 2 issued by Trustwave";
>+	char issuer_trustwave2[] =
>+		"\060\201\253\061\013\060\011\006\003\125\004\006\023\002\125\123"
>+		"\061\021\060\017\006\003\125\004\010\023\010\111\154\154\151\156"
>+		"\157\151\163\061\020\060\016\006\003\125\004\007\023\007\103\150"
>+		"\151\143\141\147\157\061\041\060\037\006\003\125\004\012\023\030"
>+		"\124\162\165\163\164\167\141\166\145\040\110\157\154\144\151\156"
>+		"\147\163\054\040\111\156\143\056\061\063\060\061\006\003\125\004"
>+		"\003\023\052\124\162\165\163\164\167\141\166\145\040\117\162\147"
>+		"\141\156\151\172\141\164\151\157\156\040\111\163\163\165\151\156"
>+		"\147\040\103\101\054\040\114\145\166\145\154\040\062\061\037\060"
>+		"\035\006\011\052\206\110\206\367\015\001\011\001\026\020\143\141"
>+		"\100\164\162\165\163\164\167\141\166\145\056\143\157\155";
>+	char serial_trustwave2[] = "\002\004\153\111\322\006";
>+	CK_ATTRIBUTE distrust_trustwave2[] = {
>+		{ CKA_CLASS, &nss_trust, sizeof (nss_trust) },
>+		{ CKA_TOKEN, &vtrue, sizeof (vtrue) },
>+		{ CKA_PRIVATE, &vfalse, sizeof (vfalse) },
>+		{ CKA_MODIFIABLE, &vfalse, sizeof (vfalse) },
>+		{ CKA_LABEL, label_trustwave2, sizeof (label_trustwave2) - 1 },
>+		{ CKA_ISSUER, issuer_trustwave2, sizeof (issuer_trustwave2) -1 },
>+		{ CKA_SERIAL_NUMBER, serial_trustwave2, sizeof (serial_trustwave2) - 1 },
>+		{ CKA_TRUST_SERVER_AUTH, &nss_not_trusted, sizeof (nss_not_trusted) },
>+		{ CKA_TRUST_EMAIL_PROTECTION, &nss_not_trusted, sizeof (nss_not_trusted) },
>+		{ CKA_TRUST_CODE_SIGNING, &nss_not_trusted, sizeof (nss_not_trusted) },
>+		{ CKA_TRUST_STEP_UP_APPROVED, &vfalse, sizeof (vfalse) },
>+	};
>+
>+	/* Explicitly Distrust "TURKTRUST Mis-issued Intermediate CA 1", Bug 825022 */
>+	char label_turktrust1[] = "TURKTRUST Mis-issued Intermediate CA 1";
>+	char issuer_turktrust1[] =
>+		"\060\201\254\061\075\060\073\006\003\125\004\003\014\064\124\303"
>+		"\234\122\113\124\122\125\123\124\040\105\154\145\153\164\162\157"
>+		"\156\151\153\040\123\165\156\165\143\165\040\123\145\162\164\151"
>+		"\146\151\153\141\163\304\261\040\110\151\172\155\145\164\154\145"
>+		"\162\151\061\013\060\011\006\003\125\004\006\023\002\124\122\061"
>+		"\136\060\134\006\003\125\004\012\014\125\124\303\234\122\113\124"
>+		"\122\125\123\124\040\102\151\154\147\151\040\304\260\154\145\164"
>+		"\151\305\237\151\155\040\166\145\040\102\151\154\151\305\237\151"
>+		"\155\040\107\303\274\166\145\156\154\151\304\237\151\040\110\151"
>+		"\172\155\145\164\154\145\162\151\040\101\056\305\236\056\040\050"
>+		"\143\051\040\113\141\163\304\261\155\040\040\062\060\060\065";
>+	char serial_turktrust1[] = "\002\002\010\047";
>+	CK_ATTRIBUTE distrust_turktrust1[] = {
>+		{ CKA_CLASS, &nss_trust, sizeof (nss_trust) },
>+		{ CKA_TOKEN, &vtrue, sizeof (vtrue) },
>+		{ CKA_PRIVATE, &vfalse, sizeof (vfalse) },
>+		{ CKA_MODIFIABLE, &vfalse, sizeof (vfalse) },
>+		{ CKA_LABEL, label_turktrust1, sizeof (label_turktrust1) - 1 },
>+		{ CKA_ISSUER, issuer_turktrust1, sizeof (issuer_turktrust1) -1 },
>+		{ CKA_SERIAL_NUMBER, serial_turktrust1, sizeof (serial_turktrust1) - 1 },
>+		{ CKA_TRUST_SERVER_AUTH, &nss_not_trusted, sizeof (nss_not_trusted) },
>+		{ CKA_TRUST_EMAIL_PROTECTION, &nss_not_trusted, sizeof (nss_not_trusted) },
>+		{ CKA_TRUST_CODE_SIGNING, &nss_not_trusted, sizeof (nss_not_trusted) },
>+		{ CKA_TRUST_STEP_UP_APPROVED, &vfalse, sizeof (vfalse) },
>+	};
>+
>+	/* Explicitly Distrust "TURKTRUST Mis-issued Intermediate CA 2", Bug 825022 */
>+	char label_turktrust2[] = "TURKTRUST Mis-issued Intermediate CA 2";
>+	char issuer_turktrust2[] =
>+		"\060\201\254\061\075\060\073\006\003\125\004\003\014\064\124\303"
>+		"\234\122\113\124\122\125\123\124\040\105\154\145\153\164\162\157"
>+		"\156\151\153\040\123\165\156\165\143\165\040\123\145\162\164\151"
>+		"\146\151\153\141\163\304\261\040\110\151\172\155\145\164\154\145"
>+		"\162\151\061\013\060\011\006\003\125\004\006\023\002\124\122\061"
>+		"\136\060\134\006\003\125\004\012\014\125\124\303\234\122\113\124"
>+		"\122\125\123\124\040\102\151\154\147\151\040\304\260\154\145\164"
>+		"\151\305\237\151\155\040\166\145\040\102\151\154\151\305\237\151"
>+		"\155\040\107\303\274\166\145\156\154\151\304\237\151\040\110\151"
>+		"\172\155\145\164\154\145\162\151\040\101\056\305\236\056\040\050"
>+		"\143\051\040\113\141\163\304\261\155\040\040\062\060\060\065";
>+	char serial_turktrust2[] = "\002\002\010\144";
>+	CK_ATTRIBUTE distrust_turktrust2[] = {
>+		{ CKA_CLASS, &nss_trust, sizeof (nss_trust) },
>+		{ CKA_TOKEN, &vtrue, sizeof (vtrue) },
>+		{ CKA_PRIVATE, &vfalse, sizeof (vfalse) },
>+		{ CKA_MODIFIABLE, &vfalse, sizeof (vfalse) },
>+		{ CKA_LABEL, label_turktrust2, sizeof (label_turktrust2) - 1 },
>+		{ CKA_ISSUER, issuer_turktrust2, sizeof (issuer_turktrust2) -1 },
>+		{ CKA_SERIAL_NUMBER, serial_turktrust2, sizeof (serial_turktrust2) - 1 },
>+		{ CKA_TRUST_SERVER_AUTH, &nss_not_trusted, sizeof (nss_not_trusted) },
>+		{ CKA_TRUST_EMAIL_PROTECTION, &nss_not_trusted, sizeof (nss_not_trusted) },
>+		{ CKA_TRUST_CODE_SIGNING, &nss_not_trusted, sizeof (nss_not_trusted) },
>+		{ CKA_TRUST_STEP_UP_APPROVED, &vfalse, sizeof (vfalse) },
>+	};
>+
>+	/* Explicitly Distrust "Explicitly distrust p11-kit Test SUB CA" */
>+	char label_p11subca[] = "Explicitly distrust p11-kit Test SUB CA";
>+	char issuer_p11subca[] =
>+		"\060\152\061\013\060\011\006\003\125\004\006\023\002\104\105\061"
>+		"\023\060\021\006\003\125\004\010\023\012\124\145\163\164\040\123"
>+		"\164\141\164\145\061\021\060\017\006\003\125\004\007\023\010\124"
>+		"\145\163\164\040\114\157\143\061\031\060\027\006\003\125\004\012"
>+		"\023\020\160\061\061\055\153\151\164\040\124\145\163\164\040\117"
>+		"\162\147\061\030\060\026\006\003\125\004\003\023\017\160\061\061"
>+		"\055\153\151\164\040\124\145\163\164\040\103\101";
>+	char serial_p11subca[] = "\002\002\047\020";
>+	CK_ATTRIBUTE distrust_p11subca[] = {
>+		{ CKA_CLASS, &nss_trust, sizeof (nss_trust) },
>+		{ CKA_TOKEN, &vtrue, sizeof (vtrue) },
>+		{ CKA_PRIVATE, &vfalse, sizeof (vfalse) },
>+		{ CKA_MODIFIABLE, &vfalse, sizeof (vfalse) },
>+		{ CKA_LABEL, label_p11subca, sizeof (label_p11subca) - 1 },
>+		{ CKA_ISSUER, issuer_p11subca, sizeof (issuer_p11subca) -1 },
>+		{ CKA_SERIAL_NUMBER, serial_p11subca, sizeof (serial_p11subca) - 1 },
>+		{ CKA_TRUST_SERVER_AUTH, &nss_not_trusted, sizeof (nss_not_trusted) },
>+		{ CKA_TRUST_EMAIL_PROTECTION, &nss_not_trusted, sizeof (nss_not_trusted) },
>+		{ CKA_TRUST_CODE_SIGNING, &nss_not_trusted, sizeof (nss_not_trusted) },
>+		{ CKA_TRUST_STEP_UP_APPROVED, &vfalse, sizeof (vfalse) },
>+	};
>+
>+	on_parser_object (p11_attrs_buildn (NULL, builtin_root_list, ELEMS (builtin_root_list)), token);
>+	on_parser_object (p11_attrs_buildn (NULL, distrust_trustwave1, ELEMS (distrust_trustwave1)), token);
>+	on_parser_object (p11_attrs_buildn (NULL, distrust_trustwave2, ELEMS (distrust_trustwave2)), token);
>+	on_parser_object (p11_attrs_buildn (NULL, distrust_turktrust1, ELEMS (distrust_turktrust1)), token);
>+	on_parser_object (p11_attrs_buildn (NULL, distrust_turktrust2, ELEMS (distrust_turktrust2)), token);
>+	on_parser_object (p11_attrs_buildn (NULL, distrust_p11subca, ELEMS (distrust_p11subca)), token);
> 	return 1;
> }
>

Actions: View | Diff

Attachments on bug 919511: 707185 | 707190