Added get_trust_values(), get_p11_trust(), and write_anchor() functions to eliminate duplicate code
This commit is contained in:
DJ Lucas
parent
5316943b46
commit
6832ac11b8
@ -1,5 +1,7 @@
|
|||||||
1.2 - Use md5sum values for anchors.txt to detect p11-kit changes
|
1.2 - Use md5sum values for anchors.txt to detect p11-kit changes
|
||||||
- Added get_p11_label function to get reliable label values
|
- Added get_p11_label function to get reliable label values
|
||||||
|
- Added get_trust_values(), get_p11_trust(), and write_anchor()
|
||||||
|
functions to eliminate duplicate code
|
||||||
1.1 - Add anchorlist for use by p11-kit to utilize LOCALDIR
|
1.1 - Add anchorlist for use by p11-kit to utilize LOCALDIR
|
||||||
1.0 - Move bundle defaults to /etc/pki/tls/{certs,java}/
|
1.0 - Move bundle defaults to /etc/pki/tls/{certs,java}/
|
||||||
- Fix invalid test cases on command line processing
|
- Fix invalid test cases on command line processing
|
||||||
|
|||||||
165
make-ca
165
make-ca
@ -426,6 +426,70 @@ function get_p11_label() {
|
|||||||
fi
|
fi
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function get_trust_values() {
|
||||||
|
# Determine certificate trust values for SSL/TLS, S/MIME, and Code Signing
|
||||||
|
satrust="$(convert_trust `grep '^CKA_TRUST_SERVER_AUTH' ${1} | \
|
||||||
|
cut -d " " -f 3`)"
|
||||||
|
smtrust="$(convert_trust `grep '^CKA_TRUST_EMAIL_PROTECTION' ${1} | \
|
||||||
|
cut -d " " -f 3`)"
|
||||||
|
cstrust="$(convert_trust `grep '^CKA_TRUST_CODE_SIGNING' ${1} | \
|
||||||
|
cut -d " " -f 3`)"
|
||||||
|
# Not currently included in NSS certdata.txt
|
||||||
|
#catrust="$(convert_trust `grep '^CKA_TRUST_CLIENT_AUTH' ${1} | \
|
||||||
|
# cut -d " " -f 3`)"
|
||||||
|
|
||||||
|
# Get args for OpenSSL trust settings
|
||||||
|
saarg="$(convert_trust_arg "${satrust}" sa)"
|
||||||
|
smarg="$(convert_trust_arg "${smtrust}" sm)"
|
||||||
|
csarg="$(convert_trust_arg "${cstrust}" cs)"
|
||||||
|
# Not currently included in NSS certdata.txt
|
||||||
|
#caarg="$(convert_trust_arg "${catrust}" ca)"
|
||||||
|
}
|
||||||
|
|
||||||
|
function get_p11_trust() {
|
||||||
|
# if distrusted at all, x-distrusted
|
||||||
|
if test "${satrust}" == "p" -o "${smtrust}" == "p" -o "${cstrust}" == "p"
|
||||||
|
then
|
||||||
|
# if any distrusted, x-distrusted
|
||||||
|
p11trust="x-distrusted: true"
|
||||||
|
p11oid="1.3.6.1.4.1.3319.6.10.1"
|
||||||
|
p11value="0.%06%0a%2b%06%01%04%01%99w%06%0a%01%04 0%1e%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03"
|
||||||
|
else
|
||||||
|
p11trust="trusted: true"
|
||||||
|
p11oid="2.5.29.37"
|
||||||
|
trustp11="p11"
|
||||||
|
if test "${satrust}" == "C"; then
|
||||||
|
trustp11="${trustp11}sa"
|
||||||
|
fi
|
||||||
|
if test "${smtrust}" == "C"; then
|
||||||
|
trustp11="${trustp11}sm"
|
||||||
|
fi
|
||||||
|
if test "${cstrust}" == "C"; then
|
||||||
|
trustp11="${trustp11}cs"
|
||||||
|
fi
|
||||||
|
get-p11-val "${trustp11}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
function write_anchor() {
|
||||||
|
echo "[p11-kit-object-v1]" >> "${anchorfile}"
|
||||||
|
echo "label: \"${p11label}\"" >> "${anchorfile}"
|
||||||
|
echo "class: x-certificate-extension" >> "${anchorfile}"
|
||||||
|
echo "object-id: ${p11oid}" >> "${anchorfile}"
|
||||||
|
echo "value: \"${p11value}\"" >> "${anchorfile}"
|
||||||
|
echo "modifiable: false" >> "${anchorfile}"
|
||||||
|
echo "${certkey}" >> "${anchorfile}"
|
||||||
|
echo "" >> "${anchorfile}"
|
||||||
|
echo "[p11-kit-object-v1]" >> "${anchorfile}"
|
||||||
|
echo "label: \"${p11label}\"" >> "${anchorfile}"
|
||||||
|
echo "${p11trust}" >> "${anchorfile}"
|
||||||
|
echo "nss-mozilla-ca-policy: ${moz_trust}" >> "${anchorfile}"
|
||||||
|
echo "modifiable: false" >> "${anchorfile}"
|
||||||
|
echo "${certcer}" >> "${anchorfile}"
|
||||||
|
echo "${certtxt}" | sed 's@^@#@' >> "${anchorfile}"
|
||||||
|
}
|
||||||
|
|
||||||
# Process command line arguments
|
# Process command line arguments
|
||||||
get_args $@
|
get_args $@
|
||||||
|
|
||||||
@ -538,23 +602,7 @@ for tempfile in ${TEMPDIR}/certs/*.tmp; do
|
|||||||
# Get a name for the cert
|
# Get a name for the cert
|
||||||
certname="$(grep "^# Certificate" "${tempfile}" | cut -d '"' -f 2)"
|
certname="$(grep "^# Certificate" "${tempfile}" | cut -d '"' -f 2)"
|
||||||
|
|
||||||
# Determine certificate trust values for SSL/TLS, S/MIME, and Code Signing
|
get_trust_values "${tempfile}"
|
||||||
satrust="$(convert_trust `grep '^CKA_TRUST_SERVER_AUTH' ${tempfile} | \
|
|
||||||
cut -d " " -f 3`)"
|
|
||||||
smtrust="$(convert_trust `grep '^CKA_TRUST_EMAIL_PROTECTION' ${tempfile} | \
|
|
||||||
cut -d " " -f 3`)"
|
|
||||||
cstrust="$(convert_trust `grep '^CKA_TRUST_CODE_SIGNING' ${tempfile} | \
|
|
||||||
cut -d " " -f 3`)"
|
|
||||||
# Not currently included in NSS certdata.txt
|
|
||||||
#catrust="$(convert_trust `grep '^CKA_TRUST_CLIENT_AUTH' ${tempfile} | \
|
|
||||||
# cut -d " " -f 3`)"
|
|
||||||
|
|
||||||
# Get args for OpenSSL trust settings
|
|
||||||
saarg="$(convert_trust_arg "${satrust}" sa)"
|
|
||||||
smarg="$(convert_trust_arg "${smtrust}" sm)"
|
|
||||||
csarg="$(convert_trust_arg "${cstrust}" cs)"
|
|
||||||
# Not currently included in NSS certdata.txt
|
|
||||||
#caarg="$(convert_trust_arg "${catrust}" ca)"
|
|
||||||
|
|
||||||
# Convert to a PEM formated certificate
|
# Convert to a PEM formated certificate
|
||||||
printf $(awk '/^CKA_VALUE/{flag=1;next}/^END/{flag=0}flag{printf $0}' \
|
printf $(awk '/^CKA_VALUE/{flag=1;next}/^END/{flag=0}flag{printf $0}' \
|
||||||
@ -569,28 +617,8 @@ for tempfile in ${TEMPDIR}/certs/*.tmp; do
|
|||||||
# Get p11-kit label, oid, and values
|
# Get p11-kit label, oid, and values
|
||||||
get_p11_label "${tempfile}"
|
get_p11_label "${tempfile}"
|
||||||
|
|
||||||
# if distrusted at all, x-distrusted
|
# Get p11 trust and OID values
|
||||||
if test "${satrust}" == "p" -o "${smtrust}" == "p" -o "${cstrust}" == "p"
|
get_p11_trust
|
||||||
then
|
|
||||||
# if any distrusted, x-distrusted
|
|
||||||
p11trust="x-distrusted: true"
|
|
||||||
p11oid="1.3.6.1.4.1.3319.6.10.1"
|
|
||||||
p11value="0.%06%0a%2b%06%01%04%01%99w%06%0a%01%04 0%1e%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03"
|
|
||||||
else
|
|
||||||
p11trust="trusted: true"
|
|
||||||
p11oid="2.5.29.37"
|
|
||||||
trustp11="p11"
|
|
||||||
if test "${satrust}" == "C"; then
|
|
||||||
trustp11="${trustp11}sa"
|
|
||||||
fi
|
|
||||||
if test "${smtrust}" == "C"; then
|
|
||||||
trustp11="${trustp11}sm"
|
|
||||||
fi
|
|
||||||
if test "${cstrust}" == "C"; then
|
|
||||||
trustp11="${trustp11}cs"
|
|
||||||
fi
|
|
||||||
get-p11-val "${trustp11}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Get a hash for the cert
|
# Get a hash for the cert
|
||||||
keyhash=$("${OPENSSL}" x509 -noout -in tempfile.crt -hash)
|
keyhash=$("${OPENSSL}" x509 -noout -in tempfile.crt -hash)
|
||||||
@ -601,21 +629,8 @@ for tempfile in ${TEMPDIR}/certs/*.tmp; do
|
|||||||
|
|
||||||
# Place certificate into trust anchors dir
|
# Place certificate into trust anchors dir
|
||||||
anchorfile="${TEMPDIR}/pki/anchors/${keyhash}.pem"
|
anchorfile="${TEMPDIR}/pki/anchors/${keyhash}.pem"
|
||||||
echo "[p11-kit-object-v1]" >> "${anchorfile}"
|
moz_trust="true"
|
||||||
echo "label: \"${p11label}\"" >> "${anchorfile}"
|
write_anchor
|
||||||
echo "class: x-certificate-extension" >> "${anchorfile}"
|
|
||||||
echo "object-id: ${p11oid}" >> "${anchorfile}"
|
|
||||||
echo "value: \"${p11value}\"" >> "${anchorfile}"
|
|
||||||
echo "modifiable: false" >> "${anchorfile}"
|
|
||||||
echo "${certkey}" >> "${anchorfile}"
|
|
||||||
echo "" >> "${anchorfile}"
|
|
||||||
echo "[p11-kit-object-v1]" >> "${anchorfile}"
|
|
||||||
echo "label: \"${p11label}\"" >> "${anchorfile}"
|
|
||||||
echo "${p11trust}" >> "${anchorfile}"
|
|
||||||
echo "nss-mozilla-ca-policy: true" >> "${anchorfile}"
|
|
||||||
echo "modifiable: false" >> "${anchorfile}"
|
|
||||||
echo "${certcer}" >> "${anchorfile}"
|
|
||||||
echo "${certtxt}" | sed 's@^@#@' >> "${anchorfile}"
|
|
||||||
echo "Added to p11-kit anchor directory with trust '${satrust},${smtrust},${cstrust}'."
|
echo "Added to p11-kit anchor directory with trust '${satrust},${smtrust},${cstrust}'."
|
||||||
|
|
||||||
# Import all certificates with trust args to the temporary NSS DB
|
# Import all certificates with trust args to the temporary NSS DB
|
||||||
@ -755,45 +770,13 @@ if test -d "${LOCALDIR}"; then
|
|||||||
# Place certificate into trust anchors dir
|
# Place certificate into trust anchors dir
|
||||||
get_p11_label "${cert}"
|
get_p11_label "${cert}"
|
||||||
|
|
||||||
# if distrusted at all, x-distrusted
|
# Get p11 trust and OID values
|
||||||
if test "${satrust}" == "p" -o "${smtrust}" == "p" -o "${cstrust}" == "p"
|
get_p11_trust
|
||||||
then
|
|
||||||
# if any distrusted, x-distrusted
|
|
||||||
p11trust="x-distrusted: true"
|
|
||||||
p11oid="1.3.6.1.4.1.3319.6.10.1"
|
|
||||||
p11value="0.%06%0a%2b%06%01%04%01%99w%06%0a%01%04 0%1e%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03"
|
|
||||||
else
|
|
||||||
p11trust="trusted: true"
|
|
||||||
p11oid="2.5.29.37"
|
|
||||||
trustp11="p11"
|
|
||||||
if test "${satrust}" == "C"; then
|
|
||||||
trustp11="${trustp11}sa"
|
|
||||||
fi
|
|
||||||
if test "${smtrust}" == "C"; then
|
|
||||||
trustp11="${trustp11}sm"
|
|
||||||
fi
|
|
||||||
if test "${cstrust}" == "C"; then
|
|
||||||
trustp11="${trustp11}cs"
|
|
||||||
fi
|
|
||||||
get-p11-val "${trustp11}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
|
# Place certificate into trust anchors dir
|
||||||
anchorfile="${DESTDIR}${ANCHORDIR}/${keyhash}.pem"
|
anchorfile="${DESTDIR}${ANCHORDIR}/${keyhash}.pem"
|
||||||
|
moz_trust="false"
|
||||||
echo "[p11-kit-object-v1]" >> "${anchorfile}"
|
write_anchor
|
||||||
echo "label: \"${p11label}\"" >> "${anchorfile}"
|
|
||||||
echo "class: x-certificate-extension" >> "${anchorfile}"
|
|
||||||
echo "object-id: ${p11oid}" >> "${anchorfile}"
|
|
||||||
echo "value: \"${p11value}\"" >> "${anchorfile}"
|
|
||||||
echo "modifiable: false" >> "${anchorfile}"
|
|
||||||
echo "${certkey}" >> "${anchorfile}"
|
|
||||||
echo "" >> "${anchorfile}"
|
|
||||||
echo "[p11-kit-object-v1]" >> "${anchorfile}"
|
|
||||||
echo "label: \"${p11label}\"" >> "${anchorfile}"
|
|
||||||
echo "${p11trust}" >> "${anchorfile}"
|
|
||||||
echo "modifiable: false" >> "${anchorfile}"
|
|
||||||
echo "${certcer}" >> "${anchorfile}"
|
|
||||||
echo "${certtxt}" | sed 's@^@#@' >> "${anchorfile}"
|
|
||||||
echo "Added to p11-kit anchor directory with trust '${satrust},${smtrust},${cstrust}'."
|
echo "Added to p11-kit anchor directory with trust '${satrust},${smtrust},${cstrust}'."
|
||||||
|
|
||||||
# Add to Shared NSS DB
|
# Add to Shared NSS DB
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user