diff options
author | BrLi | 2020-02-06 15:24:30 +0800 |
---|---|---|
committer | BrLi | 2020-02-06 15:24:30 +0800 |
commit | a6a77888a3bab81c1dd5ceb1d5d06df507c45511 (patch) | |
tree | 2d13606a2a6d31d54a871964856bf1bd036f6df5 | |
parent | ffa91bed11fc10847ccae83fe6f8601f14d824f7 (diff) | |
download | aur-a6a77888a3bab81c1dd5ceb1d5d06df507c45511.tar.gz |
updpkg
-rw-r--r-- | .SRCINFO | 11 | ||||
-rw-r--r-- | PKGBUILD | 11 | ||||
-rw-r--r-- | certdata2pem.py | 277 |
3 files changed, 257 insertions, 42 deletions
@@ -1,17 +1,18 @@ pkgbase = ca-certificates-blacklist-anti-china pkgdesc = A set of Chinese CAs' certificates which should be avoided - pkgver = 3.47 + pkgver = 3.49.2 pkgrel = 1 url = https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS arch = any license = MPL license = GPL - makedepends = python2 + makedepends = python depends = ca-certificates-utils - source = https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_47_RTM/src/nss-3.47.tar.gz + depends = ca-certificates-mozilla=3.49.2 + source = https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_49_2_RTM/src/nss-3.49.2.tar.gz source = certdata2pem.py - sha256sums = 6cd0c4438b616bdacc0b5f25ff1506b0d07ee97ea6c95d514c5487200a155fa7 - sha256sums = 2a2ff9131c21fa3b23ad7c7a2f069eabc783e56c6eb05419ac5f365f48dea0fc + sha256sums = faa7502c3ce9240d4be2aa88f63d88cf7d1cc512060e63ef21a7813c236160b2 + sha256sums = d2a1579dae05fd16175fac27ef08b54731ecefdf414085c610179afcf62b096c pkgname = ca-certificates-blacklist-anti-china @@ -2,18 +2,19 @@ # Contributor: hexchain <i at hexchain dot org> pkgname=ca-certificates-blacklist-anti-china -pkgver=3.47 +pkgver=3.49.2 pkgrel=1 pkgdesc="A set of Chinese CAs' certificates which should be avoided" url="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS" arch=(any) license=('MPL' 'GPL') -depends=('ca-certificates-utils') -makedepends=('python2') +depends=('ca-certificates-utils' + "ca-certificates-mozilla=$pkgver") +makedepends=('python') source=("https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_${pkgver//./_}_RTM/src/nss-${pkgver}.tar.gz" "certdata2pem.py") -sha256sums=('6cd0c4438b616bdacc0b5f25ff1506b0d07ee97ea6c95d514c5487200a155fa7' - '2a2ff9131c21fa3b23ad7c7a2f069eabc783e56c6eb05419ac5f365f48dea0fc') +sha256sums=('faa7502c3ce9240d4be2aa88f63d88cf7d1cc512060e63ef21a7813c236160b2' + 'd2a1579dae05fd16175fac27ef08b54731ecefdf414085c610179afcf62b096c') prepare() { mkdir -p certs diff --git a/certdata2pem.py b/certdata2pem.py index 021772aea1ab..a52ce9c740fd 100644 --- a/certdata2pem.py +++ b/certdata2pem.py @@ -26,16 +26,17 @@ import os.path import re import sys import textwrap -import urllib +import urllib.request, urllib.parse, urllib.error +import subprocess objects = [] def printable_serial(obj): - return ".".join(map(lambda x:str(ord(x)), obj['CKA_SERIAL_NUMBER'])) + return ".".join([str(x) for x in obj['CKA_SERIAL_NUMBER']]) # Dirty file parser. in_data, in_multiline, in_obj = False, False, False -field, type, value, obj = None, None, None, dict() +field, ftype, value, binval, obj = None, None, None, bytearray(), dict() for line in open('certdata.txt', 'r'): # Ignore the file header. if not in_data: @@ -55,33 +56,36 @@ for line in open('certdata.txt', 'r'): continue if in_multiline: if not line.startswith('END'): - if type == 'MULTILINE_OCTAL': + if ftype == 'MULTILINE_OCTAL': line = line.strip() for i in re.finditer(r'\\([0-3][0-7][0-7])', line): - value += chr(int(i.group(1), 8)) + integ = int(i.group(1), 8) + binval.extend((integ).to_bytes(1, sys.byteorder)) + obj[field] = binval else: value += line + obj[field] = value continue - obj[field] = value in_multiline = False continue if line.startswith('CKA_CLASS'): in_obj = True line_parts = line.strip().split(' ', 2) if len(line_parts) > 2: - field, type = line_parts[0:2] + field, ftype = line_parts[0:2] value = ' '.join(line_parts[2:]) elif len(line_parts) == 2: - field, type = line_parts + field, ftype = line_parts value = None else: - raise NotImplementedError, 'line_parts < 2 not supported.\n' + line - if type == 'MULTILINE_OCTAL': + raise NotImplementedError('line_parts < 2 not supported.\n' + line) + if ftype == 'MULTILINE_OCTAL': in_multiline = True value = "" + binval = bytearray() continue obj[field] = value -if len(obj.items()) > 0: +if len(list(obj.items())) > 0: objects.append(obj) # Build up trust database. @@ -91,7 +95,7 @@ for obj in objects: continue key = obj['CKA_LABEL'] + printable_serial(obj) trustmap[key] = obj - print " added trust", key + print(" added trust", key) # Build up cert database. certmap = dict() @@ -100,7 +104,7 @@ for obj in objects: continue key = obj['CKA_LABEL'] + printable_serial(obj) certmap[key] = obj - print " added cert", key + print(" added cert", key) def obj_to_filename(obj): label = obj['CKA_LABEL'][1:-1] @@ -109,10 +113,32 @@ def obj_to_filename(obj): .replace('(', '=')\ .replace(')', '=')\ .replace(',', '_') - label = re.sub(r'\\x[0-9a-fA-F]{2}', lambda m:chr(int(m.group(0)[2:], 16)), label) + labelbytes = bytearray() + i = 0 + imax = len(label) + while i < imax: + if i < imax-3 and label[i] == '\\' and label[i+1] == 'x': + labelbytes.extend(bytes.fromhex(label[i+2:i+4])) + i += 4 + continue + labelbytes.extend(str.encode(label[i])) + i = i+1 + continue + label = labelbytes.decode('utf-8') serial = printable_serial(obj) return label + ":" + serial +def write_cert_ext_to_file(f, oid, value, public_key): + f.write("[p11-kit-object-v1]\n") + f.write("label: "); + f.write(tobj['CKA_LABEL']) + f.write("\n") + f.write("class: x-certificate-extension\n"); + f.write("object-id: " + oid + "\n") + f.write("value: \"" + value + "\"\n") + f.write("modifiable: false\n"); + f.write(public_key) + trust_types = { "CKA_TRUST_DIGITAL_SIGNATURE": "digital-signature", "CKA_TRUST_NON_REPUDIATION": "non-repudiation", @@ -132,6 +158,18 @@ trust_types = { "CKA_TRUST_STEP_UP_APPROVED": "step-up-approved", } +legacy_trust_types = { + "LEGACY_CKA_TRUST_SERVER_AUTH": "server-auth", + "LEGACY_CKA_TRUST_CODE_SIGNING": "code-signing", + "LEGACY_CKA_TRUST_EMAIL_PROTECTION": "email-protection", +} + +legacy_to_real_trust_types = { + "LEGACY_CKA_TRUST_SERVER_AUTH": "CKA_TRUST_SERVER_AUTH", + "LEGACY_CKA_TRUST_CODE_SIGNING": "CKA_TRUST_CODE_SIGNING", + "LEGACY_CKA_TRUST_EMAIL_PROTECTION": "CKA_TRUST_EMAIL_PROTECTION", +} + openssl_trust = { "CKA_TRUST_SERVER_AUTH": "serverAuth", "CKA_TRUST_CLIENT_AUTH": "clientAuth", @@ -139,47 +177,221 @@ openssl_trust = { "CKA_TRUST_EMAIL_PROTECTION": "emailProtection", } +cert_distrust_types = { + "CKA_NSS_SERVER_DISTRUST_AFTER": "nss-server-distrust-after", + "CKA_NSS_EMAIL_DISTRUST_AFTER": "nss-email-distrust-after", +} + for tobj in objects: if tobj['CKA_CLASS'] == 'CKO_NSS_TRUST': key = tobj['CKA_LABEL'] + printable_serial(tobj) - print "producing trust for " + key + print("producing trust for " + key) trustbits = [] distrustbits = [] openssl_trustflags = [] openssl_distrustflags = [] - for t in trust_types.keys(): - if tobj.has_key(t) and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': + legacy_trustbits = [] + legacy_openssl_trustflags = [] + for t in list(trust_types.keys()): + if t in tobj and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': trustbits.append(t) if t in openssl_trust: openssl_trustflags.append(openssl_trust[t]) - if tobj.has_key(t) and tobj[t] == 'CKT_NSS_NOT_TRUSTED': + if t in tobj and tobj[t] == 'CKT_NSS_NOT_TRUSTED': distrustbits.append(t) if t in openssl_trust: openssl_distrustflags.append(openssl_trust[t]) + for t in list(legacy_trust_types.keys()): + if t in tobj and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': + real_t = legacy_to_real_trust_types[t] + legacy_trustbits.append(real_t) + if real_t in openssl_trust: + legacy_openssl_trustflags.append(openssl_trust[real_t]) + if t in tobj and tobj[t] == 'CKT_NSS_NOT_TRUSTED': + raise NotImplementedError('legacy distrust not supported.\n' + line) + fname = obj_to_filename(tobj) try: obj = certmap[key] except: obj = None + # optional debug code, that dumps the parsed input to files + #fulldump = "dump-" + fname + #dumpf = open(fulldump, 'w') + #dumpf.write(str(obj)); + #dumpf.write(str(tobj)); + #dumpf.close(); + + is_legacy = 0 + if 'LEGACY_CKA_TRUST_SERVER_AUTH' in tobj or 'LEGACY_CKA_TRUST_EMAIL_PROTECTION' in tobj or 'LEGACY_CKA_TRUST_CODE_SIGNING' in tobj: + is_legacy = 1 + if obj == None: + raise NotImplementedError('found legacy trust without certificate.\n' + line) + + legacy_fname = "legacy-default/" + fname + ".crt" + f = open(legacy_fname, 'w') + f.write("# alias=%s\n"%tobj['CKA_LABEL']) + f.write("# trust=" + " ".join(legacy_trustbits) + "\n") + if legacy_openssl_trustflags: + f.write("# openssl-trust=" + " ".join(legacy_openssl_trustflags) + "\n") + f.write("-----BEGIN CERTIFICATE-----\n") + temp_encoded_b64 = base64.b64encode(obj['CKA_VALUE']) + temp_wrapped = textwrap.wrap(temp_encoded_b64.decode(), 64) + f.write("\n".join(temp_wrapped)) + f.write("\n-----END CERTIFICATE-----\n") + f.close() + + if 'CKA_TRUST_SERVER_AUTH' in tobj or 'CKA_TRUST_EMAIL_PROTECTION' in tobj or 'CKA_TRUST_CODE_SIGNING' in tobj: + legacy_fname = "legacy-disable/" + fname + ".crt" + f = open(legacy_fname, 'w') + f.write("# alias=%s\n"%tobj['CKA_LABEL']) + f.write("# trust=" + " ".join(trustbits) + "\n") + if openssl_trustflags: + f.write("# openssl-trust=" + " ".join(openssl_trustflags) + "\n") + f.write("-----BEGIN CERTIFICATE-----\n") + f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64))) + f.write("\n-----END CERTIFICATE-----\n") + f.close() + + # don't produce p11-kit output for legacy certificates + continue + + pk = '' + cert_comment = '' if obj != None: - fname += ".crt" - else: - fname += ".p11-kit" + # must extract the public key from the cert, let's use openssl + cert_fname = "cert-" + fname + fc = open(cert_fname, 'w') + fc.write("-----BEGIN CERTIFICATE-----\n") + temp_encoded_b64 = base64.b64encode(obj['CKA_VALUE']) + temp_wrapped = textwrap.wrap(temp_encoded_b64.decode(), 64) + fc.write("\n".join(temp_wrapped)) + fc.write("\n-----END CERTIFICATE-----\n") + fc.close(); + pk_fname = "pubkey-" + fname + fpkout = open(pk_fname, "w") + dump_pk_command = ["openssl", "x509", "-in", cert_fname, "-noout", "-pubkey"] + subprocess.call(dump_pk_command, stdout=fpkout) + fpkout.close() + with open (pk_fname, "r") as myfile: + pk=myfile.read() + # obtain certificate information suitable as a comment + comment_fname = "comment-" + fname + fcout = open(comment_fname, "w") + comment_command = ["openssl", "x509", "-in", cert_fname, "-noout", "-text"] + subprocess.call(comment_command, stdout=fcout) + fcout.close() + sed_command = ["sed", "--in-place", "s/^/#/", comment_fname] + subprocess.call(sed_command) + with open (comment_fname, "r", errors = 'replace') as myfile: + cert_comment=myfile.read() + fname += ".tmp-p11-kit" f = open(fname, 'w') + if obj != None: - f.write("# alias=%s\n"%tobj['CKA_LABEL']) - f.write("# trust=" + " ".join(trustbits) + "\n") - f.write("# distrust=" + " ".join(distrustbits) + "\n") - if openssl_trustflags: - f.write("# openssl-trust=" + " ".join(openssl_trustflags) + "\n") - if openssl_distrustflags: - f.write("# openssl-distrust=" + " ".join(openssl_distrustflags) + "\n") + is_distrusted = False + has_server_trust = False + has_email_trust = False + has_code_trust = False + + if 'CKA_TRUST_SERVER_AUTH' in tobj: + if tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_NOT_TRUSTED': + is_distrusted = True + elif tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_TRUSTED_DELEGATOR': + has_server_trust = True + + if 'CKA_TRUST_EMAIL_PROTECTION' in tobj: + if tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_NOT_TRUSTED': + is_distrusted = True + elif tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_TRUSTED_DELEGATOR': + has_email_trust = True + + if 'CKA_TRUST_CODE_SIGNING' in tobj: + if tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_NOT_TRUSTED': + is_distrusted = True + elif tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_TRUSTED_DELEGATOR': + has_code_trust = True + + if is_distrusted: + trust_ext_oid = "1.3.6.1.4.1.3319.6.10.1" + trust_ext_value = "0.%06%0a%2b%06%01%04%01%99w%06%0a%01%04 0%1e%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03" + write_cert_ext_to_file(f, trust_ext_oid, trust_ext_value, pk) + + trust_ext_oid = "2.5.29.37" + if has_server_trust: + if has_email_trust: + if has_code_trust: + # server + email + code + trust_ext_value = "0%2a%06%03U%1d%25%01%01%ff%04 0%1e%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03" + else: + # server + email + trust_ext_value = "0 %06%03U%1d%25%01%01%ff%04%160%14%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01" + else: + if has_code_trust: + # server + code + trust_ext_value = "0 %06%03U%1d%25%01%01%ff%04%160%14%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03" + else: + # server + trust_ext_value = "0%16%06%03U%1d%25%01%01%ff%04%0c0%0a%06%08%2b%06%01%05%05%07%03%01" + else: + if has_email_trust: + if has_code_trust: + # email + code + trust_ext_value = "0 %06%03U%1d%25%01%01%ff%04%160%14%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%03" + else: + # email + trust_ext_value = "0%16%06%03U%1d%25%01%01%ff%04%0c0%0a%06%08%2b%06%01%05%05%07%03%04" + else: + if has_code_trust: + # code + trust_ext_value = "0%16%06%03U%1d%25%01%01%ff%04%0c0%0a%06%08%2b%06%01%05%05%07%03%03" + else: + # none + trust_ext_value = "0%18%06%03U%1d%25%01%01%ff%04%0e0%0c%06%0a%2b%06%01%04%01%99w%06%0a%10" + + # no 2.5.29.37 for neutral certificates + if (is_distrusted or has_server_trust or has_email_trust or has_code_trust): + write_cert_ext_to_file(f, trust_ext_oid, trust_ext_value, pk) + + pk = '' + f.write("\n") + + f.write("[p11-kit-object-v1]\n") + f.write("label: "); + f.write(tobj['CKA_LABEL']) + f.write("\n") + if is_distrusted: + f.write("x-distrusted: true\n") + elif has_server_trust or has_email_trust or has_code_trust: + f.write("trusted: true\n") + else: + f.write("trusted: false\n") + + # requires p11-kit >= 0.23.4 + f.write("nss-mozilla-ca-policy: true\n") + f.write("modifiable: false\n"); + + # requires p11-kit >= 0.23.19 + for t in list(cert_distrust_types.keys()): + if t in obj: + value = obj[t] + if value == 'CK_FALSE': + value = bytearray(1) + f.write(cert_distrust_types[t] + ": \"") + f.write(urllib.parse.quote(value)); + f.write("\"\n") + f.write("-----BEGIN CERTIFICATE-----\n") - f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64))) + temp_encoded_b64 = base64.b64encode(obj['CKA_VALUE']) + temp_wrapped = textwrap.wrap(temp_encoded_b64.decode(), 64) + f.write("\n".join(temp_wrapped)) f.write("\n-----END CERTIFICATE-----\n") + f.write(cert_comment) + f.write("\n") + else: f.write("[p11-kit-object-v1]\n") f.write("label: "); @@ -187,14 +399,15 @@ for tobj in objects: f.write("\n") f.write("class: certificate\n") f.write("certificate-type: x-509\n") + f.write("modifiable: false\n"); f.write("issuer: \""); - f.write(urllib.quote(tobj['CKA_ISSUER'])); + f.write(urllib.parse.quote(tobj['CKA_ISSUER'])); f.write("\"\n") f.write("serial-number: \""); - f.write(urllib.quote(tobj['CKA_SERIAL_NUMBER'])); + f.write(urllib.parse.quote(tobj['CKA_SERIAL_NUMBER'])); f.write("\"\n") if (tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_NOT_TRUSTED') or (tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_NOT_TRUSTED') or (tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_NOT_TRUSTED'): f.write("x-distrusted: true\n") f.write("\n\n") f.close() - print " -> written as '%s', trust = %s, openssl-trust = %s, distrust = %s, openssl-distrust = %s" % (fname, trustbits, openssl_trustflags, distrustbits, openssl_distrustflags) + print(" -> written as '%s', trust = %s, openssl-trust = %s, distrust = %s, openssl-distrust = %s" % (fname, trustbits, openssl_trustflags, distrustbits, openssl_distrustflags)) |