diff options
author | Hexchain Tong | 2016-09-02 22:00:04 +0800 |
---|---|---|
committer | Hexchain Tong | 2016-09-02 22:01:03 +0800 |
commit | 6ce919f722d8381fece03eb03c45b99cdfe751e3 (patch) | |
tree | e81cfa6105d90ef1d138db28aa2066c28fb7589d | |
download | aur-6ce919f722d8381fece03eb03c45b99cdfe751e3.tar.gz |
initial
-rw-r--r-- | .SRCINFO | 25 | ||||
-rw-r--r-- | PKGBUILD | 45 | ||||
-rw-r--r-- | certdata2pem.py | 200 |
3 files changed, 270 insertions, 0 deletions
diff --git a/.SRCINFO b/.SRCINFO new file mode 100644 index 000000000000..ba868eec70c3 --- /dev/null +++ b/.SRCINFO @@ -0,0 +1,25 @@ +# Generated by mksrcinfo v8 +# Fri Sep 2 13:59:55 UTC 2016 +pkgbase = ca-certificates-blacklist + pkgdesc = A set of broken CA certificates which should not be trusted + pkgver = 3.26 + pkgrel = 1 + url = https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS + arch = any + license = MPL + license = GPL + makedepends = perl + makedepends = python2 + makedepends = xmlto + makedepends = docbook-xsl + depends = ca-certificates-utils + options = !strip + options = !makeflags + options = staticlibs + source = https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_26_RTM/src/nss-3.26.tar.gz + source = certdata2pem.py + sha256sums = 91783a570ab953693eb977ce47c501f04c104cec287fa011c91bcc8970d1c564 + sha256sums = 2a2ff9131c21fa3b23ad7c7a2f069eabc783e56c6eb05419ac5f365f48dea0fc + +pkgname = ca-certificates-blacklist + diff --git a/PKGBUILD b/PKGBUILD new file mode 100644 index 000000000000..6256e350d76d --- /dev/null +++ b/PKGBUILD @@ -0,0 +1,45 @@ +# Contributor: hexchain <i at hexchain dot org> + +pkgname=ca-certificates-blacklist +pkgver=3.26 +pkgrel=1 +pkgdesc="A set of broken CA certificates which should not be trusted" +url="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS" +arch=(any) +license=('MPL' 'GPL') +_nsprver=4.12 +depends=('ca-certificates-utils') +makedepends=('perl' 'python2' 'xmlto' 'docbook-xsl') +options=('!strip' '!makeflags' 'staticlibs') +source=("https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_${pkgver//./_}_RTM/src/nss-${pkgver}.tar.gz" +"certdata2pem.py") + +prepare() { + mkdir -p certs + + cd "nss-$pkgver" + ln -sfr nss/lib/ckfw/builtins/certdata.txt ../certs/ +} + + +build() { + cd certs + python2 ../certdata2pem.py +} + +package() { + cd "$srcdir/certs" + install -Dm644 -t "$pkgdir/usr/share/ca-certificates/trust-source/blacklist/" \ + CA_WoSign_ECC_Root:2.16.104.74.88.112.128.107.240.143.2.250.246.222.232.176.144.144.crt \ + CNNIC_ROOT\:2.4.73.51.0.1.crt \ + Certification_Authority_of_WoSign_G2:2.16.107.37.218.138.136.157.124.188.15.5.179.177.122.97.69.68.crt \ + China_Internet_Network_Information_Center_EV_Certificates_Root\:2.4.72.159.0.1.crt \ + StartCom_Certification_Authority:2.1.1.crt \ + StartCom_Certification_Authority:2.1.45.crt \ + StartCom_Certification_Authority_G2:2.1.59.crt \ + WoSign:2.16.94.104.214.17.113.148.99.80.86.0.104.243.62.201.197.145.crt \ + WoSign_China:2.16.80.112.107.205.216.19.252.27.78.59.51.114.210.17.72.141.crt +} + +sha256sums=('91783a570ab953693eb977ce47c501f04c104cec287fa011c91bcc8970d1c564' +'2a2ff9131c21fa3b23ad7c7a2f069eabc783e56c6eb05419ac5f365f48dea0fc') diff --git a/certdata2pem.py b/certdata2pem.py new file mode 100644 index 000000000000..021772aea1ab --- /dev/null +++ b/certdata2pem.py @@ -0,0 +1,200 @@ +#!/usr/bin/python +# vim:set et sw=4: +# +# certdata2pem.py - splits certdata.txt into multiple files +# +# Copyright (C) 2009 Philipp Kern <pkern@debian.org> +# Copyright (C) 2013 Kai Engert <kaie@redhat.com> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, +# USA. + +import base64 +import os.path +import re +import sys +import textwrap +import urllib + +objects = [] + +def printable_serial(obj): + return ".".join(map(lambda x:str(ord(x)), obj['CKA_SERIAL_NUMBER'])) + +# Dirty file parser. +in_data, in_multiline, in_obj = False, False, False +field, type, value, obj = None, None, None, dict() +for line in open('certdata.txt', 'r'): + # Ignore the file header. + if not in_data: + if line.startswith('BEGINDATA'): + in_data = True + continue + # Ignore comment lines. + if line.startswith('#'): + continue + # Empty lines are significant if we are inside an object. + if in_obj and len(line.strip()) == 0: + objects.append(obj) + obj = dict() + in_obj = False + continue + if len(line.strip()) == 0: + continue + if in_multiline: + if not line.startswith('END'): + if type == 'MULTILINE_OCTAL': + line = line.strip() + for i in re.finditer(r'\\([0-3][0-7][0-7])', line): + value += chr(int(i.group(1), 8)) + else: + value += line + continue + obj[field] = value + in_multiline = False + continue + if line.startswith('CKA_CLASS'): + in_obj = True + line_parts = line.strip().split(' ', 2) + if len(line_parts) > 2: + field, type = line_parts[0:2] + value = ' '.join(line_parts[2:]) + elif len(line_parts) == 2: + field, type = line_parts + value = None + else: + raise NotImplementedError, 'line_parts < 2 not supported.\n' + line + if type == 'MULTILINE_OCTAL': + in_multiline = True + value = "" + continue + obj[field] = value +if len(obj.items()) > 0: + objects.append(obj) + +# Build up trust database. +trustmap = dict() +for obj in objects: + if obj['CKA_CLASS'] != 'CKO_NSS_TRUST': + continue + key = obj['CKA_LABEL'] + printable_serial(obj) + trustmap[key] = obj + print " added trust", key + +# Build up cert database. +certmap = dict() +for obj in objects: + if obj['CKA_CLASS'] != 'CKO_CERTIFICATE': + continue + key = obj['CKA_LABEL'] + printable_serial(obj) + certmap[key] = obj + print " added cert", key + +def obj_to_filename(obj): + label = obj['CKA_LABEL'][1:-1] + label = label.replace('/', '_')\ + .replace(' ', '_')\ + .replace('(', '=')\ + .replace(')', '=')\ + .replace(',', '_') + label = re.sub(r'\\x[0-9a-fA-F]{2}', lambda m:chr(int(m.group(0)[2:], 16)), label) + serial = printable_serial(obj) + return label + ":" + serial + +trust_types = { + "CKA_TRUST_DIGITAL_SIGNATURE": "digital-signature", + "CKA_TRUST_NON_REPUDIATION": "non-repudiation", + "CKA_TRUST_KEY_ENCIPHERMENT": "key-encipherment", + "CKA_TRUST_DATA_ENCIPHERMENT": "data-encipherment", + "CKA_TRUST_KEY_AGREEMENT": "key-agreement", + "CKA_TRUST_KEY_CERT_SIGN": "cert-sign", + "CKA_TRUST_CRL_SIGN": "crl-sign", + "CKA_TRUST_SERVER_AUTH": "server-auth", + "CKA_TRUST_CLIENT_AUTH": "client-auth", + "CKA_TRUST_CODE_SIGNING": "code-signing", + "CKA_TRUST_EMAIL_PROTECTION": "email-protection", + "CKA_TRUST_IPSEC_END_SYSTEM": "ipsec-end-system", + "CKA_TRUST_IPSEC_TUNNEL": "ipsec-tunnel", + "CKA_TRUST_IPSEC_USER": "ipsec-user", + "CKA_TRUST_TIME_STAMPING": "time-stamping", + "CKA_TRUST_STEP_UP_APPROVED": "step-up-approved", +} + +openssl_trust = { + "CKA_TRUST_SERVER_AUTH": "serverAuth", + "CKA_TRUST_CLIENT_AUTH": "clientAuth", + "CKA_TRUST_CODE_SIGNING": "codeSigning", + "CKA_TRUST_EMAIL_PROTECTION": "emailProtection", +} + +for tobj in objects: + if tobj['CKA_CLASS'] == 'CKO_NSS_TRUST': + key = tobj['CKA_LABEL'] + printable_serial(tobj) + print "producing trust for " + key + trustbits = [] + distrustbits = [] + openssl_trustflags = [] + openssl_distrustflags = [] + for t in trust_types.keys(): + if tobj.has_key(t) and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': + trustbits.append(t) + if t in openssl_trust: + openssl_trustflags.append(openssl_trust[t]) + if tobj.has_key(t) and tobj[t] == 'CKT_NSS_NOT_TRUSTED': + distrustbits.append(t) + if t in openssl_trust: + openssl_distrustflags.append(openssl_trust[t]) + + fname = obj_to_filename(tobj) + try: + obj = certmap[key] + except: + obj = None + + if obj != None: + fname += ".crt" + else: + fname += ".p11-kit" + + f = open(fname, 'w') + if obj != None: + f.write("# alias=%s\n"%tobj['CKA_LABEL']) + f.write("# trust=" + " ".join(trustbits) + "\n") + f.write("# distrust=" + " ".join(distrustbits) + "\n") + if openssl_trustflags: + f.write("# openssl-trust=" + " ".join(openssl_trustflags) + "\n") + if openssl_distrustflags: + f.write("# openssl-distrust=" + " ".join(openssl_distrustflags) + "\n") + f.write("-----BEGIN CERTIFICATE-----\n") + f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64))) + f.write("\n-----END CERTIFICATE-----\n") + else: + f.write("[p11-kit-object-v1]\n") + f.write("label: "); + f.write(tobj['CKA_LABEL']); + f.write("\n") + f.write("class: certificate\n") + f.write("certificate-type: x-509\n") + f.write("issuer: \""); + f.write(urllib.quote(tobj['CKA_ISSUER'])); + f.write("\"\n") + f.write("serial-number: \""); + f.write(urllib.quote(tobj['CKA_SERIAL_NUMBER'])); + f.write("\"\n") + if (tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_NOT_TRUSTED') or (tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_NOT_TRUSTED') or (tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_NOT_TRUSTED'): + f.write("x-distrusted: true\n") + f.write("\n\n") + f.close() + print " -> written as '%s', trust = %s, openssl-trust = %s, distrust = %s, openssl-distrust = %s" % (fname, trustbits, openssl_trustflags, distrustbits, openssl_distrustflags) |