Bug 1136817

Summary:

there is no API to distinguish certificates with a purpose in the trust module

Product:

[Fedora] Fedora

Reporter:

Nikos Mavrogiannopoulos <nmavrogi>

Component:

p11-kit

Assignee:

Stef Walter <stefw>

Status:

CLOSED ERRATA

QA Contact:

Fedora Extras Quality Assurance <extras-qa>

Severity:

unspecified

Docs Contact:

Priority:

unspecified

Version:

CC:

kengert, stefw, tmraz

Target Milestone:

---

Target Release:

---

Hardware:

Unspecified

OS:

Unspecified

Whiteboard:

Fixed In Version:

p11-kit-0.21.3-1.fc21

Doc Type:

Bug Fix

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2014-09-27 09:57:29 UTC

Type:

Bug

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Attachments:

Description	Flags
patch to compile	none

Description Nikos Mavrogiannopoulos 2014-09-03 11:40:53 UTC

In #1134602, a verisign CA certificate was removed from the trusted TLS list, but was present in the trusted email list. That however, resulted in gnutls still seeing the certificate when verifying using the p11-kit trust module.

What is needed is the availability of an API that implements the external trust policy (stapled extensions) as in:
http://p11-glue.freedesktop.org/doc/storing-trust-policy/storing-trust-pkcs11.html
(or something equivalent)

Comment 1 Stef Walter 2014-09-04 13:41:33 UTC

Patch upstream. Needs some basic testing.

Comment 2 Nikos Mavrogiannopoulos 2014-09-08 13:39:45 UTC

Thanks Stef. can there be some branch on upstream with that change to try working on an implementation. Patch https://bugs.freedesktop.org/attachment.cgi?id=105744 doesn't apply cleanly in p11-kit master or stable.

Comment 3 Stef Walter 2014-09-08 16:31:40 UTC

Here you go: http://cgit.freedesktop.org/p11-glue/p11-kit/log/?h=wip/pkcs11x

Comment 4 Nikos Mavrogiannopoulos 2014-09-09 09:23:55 UTC

Created attachment 935595 [details]
patch to compile

patch to compile

Comment 5 Nikos Mavrogiannopoulos 2014-09-09 09:27:30 UTC

I realized that there is no predefined set of extensions in [0]. Which extensions may be present in a p11-kit trust module, and is there some way to list them? I mean is it only the "Extended Key Usage" that you set (and if yes, which are the available values in it?).

[0]. http://p11-glue.freedesktop.org/doc/storing-trust-policy/storing-trust-pkcs11.html

Comment 6 Stef Walter 2014-09-09 10:58:58 UTC

(In reply to Nikos Mavrogiannopoulos from comment #4)
> Created attachment 935595 [details]
> patch to compile

Thanks. Fixed up the commit upstream.

(In reply to Nikos Mavrogiannopoulos from comment #5)

Replied in the p11-glue mailing list: http://lists.freedesktop.org/archives/p11-glue/2014-September/000472.html

Comment 7 Stef Walter 2014-09-10 06:11:36 UTC

Patches merged to git master upstream. Continuing discussion about refining the documentation and clarifying teh concepts.

Comment 8 Fedora Update System 2014-09-17 14:27:48 UTC

p11-kit-0.21.3-1.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/p11-kit-0.21.3-1.fc21

Comment 9 Fedora Update System 2014-09-18 16:13:29 UTC

Package p11-kit-0.21.3-1.fc21:
* should fix your issue,
* was pushed to the Fedora 21 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing p11-kit-0.21.3-1.fc21'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-10942/p11-kit-0.21.3-1.fc21
then log in and leave karma (feedback).

Comment 10 Fedora Update System 2014-09-27 09:57:29 UTC

p11-kit-0.21.3-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.