Bug 1136817 - there is no API to distinguish certificates with a purpose in the trust module
Summary: there is no API to distinguish certificates with a purpose in the trust module
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: p11-kit
Version: 21
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Stef Walter
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-09-03 11:40 UTC by Nikos Mavrogiannopoulos
Modified: 2014-09-27 09:57 UTC (History)
3 users (show)

Fixed In Version: p11-kit-0.21.3-1.fc21
Clone Of:
Environment:
Last Closed: 2014-09-27 09:57:29 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
patch to compile (1.38 KB, text/plain)
2014-09-09 09:23 UTC, Nikos Mavrogiannopoulos
no flags Details


Links
System ID Private Priority Status Summary Last Updated
FreeDesktop.org 83495 0 None None None Never

Description Nikos Mavrogiannopoulos 2014-09-03 11:40:53 UTC
In #1134602, a verisign CA certificate was removed from the trusted TLS list, but was present in the trusted email list. That however, resulted in gnutls still seeing the certificate when verifying using the p11-kit trust module.

What is needed is the availability of an API that implements the external trust policy (stapled extensions) as in:
http://p11-glue.freedesktop.org/doc/storing-trust-policy/storing-trust-pkcs11.html
(or something equivalent)

Comment 1 Stef Walter 2014-09-04 13:41:33 UTC
Patch upstream. Needs some basic testing.

Comment 2 Nikos Mavrogiannopoulos 2014-09-08 13:39:45 UTC
Thanks Stef. can there be some branch on upstream with that change to try working on an implementation. Patch https://bugs.freedesktop.org/attachment.cgi?id=105744 doesn't apply cleanly in p11-kit master or stable.

Comment 3 Stef Walter 2014-09-08 16:31:40 UTC
Here you go: http://cgit.freedesktop.org/p11-glue/p11-kit/log/?h=wip/pkcs11x

Comment 4 Nikos Mavrogiannopoulos 2014-09-09 09:23:55 UTC
Created attachment 935595 [details]
patch to compile

patch to compile

Comment 5 Nikos Mavrogiannopoulos 2014-09-09 09:27:30 UTC
I realized that there is no predefined set of extensions in [0]. Which extensions may be present in a p11-kit trust module, and is there some way to list them? I mean is it only the "Extended Key Usage" that you set (and if yes, which are the available values in it?).

[0]. http://p11-glue.freedesktop.org/doc/storing-trust-policy/storing-trust-pkcs11.html

Comment 6 Stef Walter 2014-09-09 10:58:58 UTC
(In reply to Nikos Mavrogiannopoulos from comment #4)
> Created attachment 935595 [details]
> patch to compile

Thanks. Fixed up the commit upstream.

(In reply to Nikos Mavrogiannopoulos from comment #5)

Replied in the p11-glue mailing list: http://lists.freedesktop.org/archives/p11-glue/2014-September/000472.html

Comment 7 Stef Walter 2014-09-10 06:11:36 UTC
Patches merged to git master upstream. Continuing discussion about refining the documentation and clarifying teh concepts.

Comment 8 Fedora Update System 2014-09-17 14:27:48 UTC
p11-kit-0.21.3-1.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/p11-kit-0.21.3-1.fc21

Comment 9 Fedora Update System 2014-09-18 16:13:29 UTC
Package p11-kit-0.21.3-1.fc21:
* should fix your issue,
* was pushed to the Fedora 21 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing p11-kit-0.21.3-1.fc21'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-10942/p11-kit-0.21.3-1.fc21
then log in and leave karma (feedback).

Comment 10 Fedora Update System 2014-09-27 09:57:29 UTC
p11-kit-0.21.3-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.