diff options
author | Andreas Rammhold <andreas@rammhold.de> | 2020-12-01 20:11:55 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2020-12-01 20:11:55 +0100 |
commit | f17006459c5dfd8d03faa7d380a44437b5e68f32 (patch) | |
tree | f6fe0c6a89b0b12c50117fea3163d169e1343ae0 /pkgs/data/misc | |
parent | 97506537f46ae06a9c097340942b54018c53e69f (diff) | |
parent | 87f46764926fd727d80de278d358fb67a294ed5d (diff) |
Merge pull request #105568 from lukegb/nixpkgs-cacert-blacklist
cacert: fix certificate denylist
Diffstat (limited to 'pkgs/data/misc')
-rw-r--r-- | pkgs/data/misc/cacert/default.nix | 60 | ||||
-rw-r--r-- | pkgs/data/misc/cacert/fix-unicode-ca-names.patch | 20 |
2 files changed, 53 insertions, 27 deletions
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix index 34e0ec132a9f..0545c0e5efae 100644 --- a/pkgs/data/misc/cacert/default.nix +++ b/pkgs/data/misc/cacert/default.nix @@ -1,6 +1,10 @@ { stdenv, fetchurl, nss, python3 , blacklist ? [] -, includeEmail ? false + +# Used for tests only +, runCommand +, cacert +, openssl }: with stdenv.lib; @@ -37,11 +41,6 @@ stdenv.mkDerivation { EOF cat ${certdata2pem} > certdata2pem.py - patch -p1 < ${./fix-unicode-ca-names.patch} - ${optionalString includeEmail '' - # Disable CAs used for mail signing - substituteInPlace certdata2pem.py --replace \[\'CKA_TRUST_EMAIL_PROTECTION\'\] ''' - ''} ''; buildPhase = '' @@ -66,12 +65,59 @@ stdenv.mkDerivation { setupHook = ./setup-hook.sh; passthru.updateScript = ./update.sh; + passthru.tests = { + # Test that building this derivation with a blacklist works, and that UTF-8 is supported. + blacklist-utf8 = let + blacklistCAToFingerprint = { + # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint. + "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD"; + "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98"; + }; + mapBlacklist = f: concatStringsSep "\n" (mapAttrsToList f blacklistCAToFingerprint); + in runCommand "verify-the-cacert-filter-output" { + cacert = cacert.unbundled; + cacertWithExcludes = (cacert.override { + blacklist = builtins.attrNames blacklistCAToFingerprint; + }).unbundled; + + nativeBuildInputs = [ openssl ]; + } '' + isPresent() { + # isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint> + for f in $1/etc/ssl/certs/*.crt; do + fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)" + if [[ "x$fingerprint" == "x$3" ]]; then + return 0 + fi + done + return 1 + } + + # Ensure that each certificate is in the main "cacert". + ${mapBlacklist (caName: caFingerprint: '' + isPresent "$cacert" "${caName}" "${caFingerprint}" || ({ + echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2 + exit 1 + }) + '')} + + # Ensure that each certificate is NOT in the "cacertWithExcludes". + ${mapBlacklist (caName: caFingerprint: '' + isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({ + echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2 + exit 1 + }) + '')} + + touch $out + ''; + }; meta = { homepage = "https://curl.haxx.se/docs/caextract.html"; description = "A bundle of X.509 certificates of public Certificate Authorities (CA)"; platforms = platforms.all; - maintainers = with maintainers; [ fpletz ]; + maintainers = with maintainers; [ andir fpletz lukegb ]; license = licenses.mpl20; }; } diff --git a/pkgs/data/misc/cacert/fix-unicode-ca-names.patch b/pkgs/data/misc/cacert/fix-unicode-ca-names.patch deleted file mode 100644 index 07d3629196a7..000000000000 --- a/pkgs/data/misc/cacert/fix-unicode-ca-names.patch +++ /dev/null @@ -1,20 +0,0 @@ ---- a/certdata2pem.py 2017-08-01 23:10:00.000000000 +0300 -+++ b/certdata2pem.py 2017-08-01 23:08:21.131297636 +0300 -@@ -88,7 +88,7 @@ - \# Read blacklist. - blacklist = [] - if os.path.exists('blacklist.txt'): -- for line in open('blacklist.txt', 'r'): -+ for line in io.open('blacklist.txt', 'r', encoding='utf-8'): - line = line.strip() - if line.startswith('#') or len(line) == 0: - continue -@@ -101,7 +101,7 @@ - if obj['CKA_CLASS'] != 'CKO_NSS_TRUST': - continue - if obj['CKA_LABEL'] in blacklist: -- print("Certificate %s blacklisted, ignoring." % obj['CKA_LABEL']) -+ print("Certificate %s blacklisted, ignoring." % unicode(obj['CKA_LABEL']).encode('utf-8')) - elif obj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_TRUSTED_DELEGATOR': - trust[obj['CKA_LABEL']] = True - elif obj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_TRUSTED_DELEGATOR': |