1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
|
From 5bc704e6a0de57d451cf551d74fa8543fc7ec9a0 Mon Sep 17 00:00:00 2001
From: "Jan Alexander Steffens (heftig)" <jan.steffens@gmail.com>
Date: Tue, 10 Sep 2019 18:08:25 +0000
Subject: [PATCH] Build and install libnssckbi-p11-kit.so
Create an additional library which is a copy of p11-kit-trust.so but
uses the same label for root certs as libnssckbi.so:
"Builtin Object Token" instead of "Default Trust".
https://bugs.freedesktop.org/show_bug.cgi?id=66161
---
trust/Makefile.am | 14 ++++++++++++++
trust/meson.build | 13 +++++++++++++
trust/module.c | 12 +++++++++++-
3 files changed, 38 insertions(+), 1 deletion(-)
diff --git a/trust/Makefile.am b/trust/Makefile.am
index b050a8f..4943aba 100644
--- a/trust/Makefile.am
+++ b/trust/Makefile.am
@@ -66,6 +66,20 @@ p11_kit_trust_la_LDFLAGS = \
p11_kit_trust_la_SOURCES = $(TRUST_SRCS) trust/module-init.c
+libnssckbi_compatdir = $(libdir)
+libnssckbi_compat_LTLIBRARIES = \
+ libnssckbi-p11-kit.la
+
+libnssckbi_p11_kit_la_CFLAGS = \
+ -DLIBNSSCKBI_COMPAT \
+ $(p11_kit_trust_la_CFLAGS)
+
+libnssckbi_p11_kit_la_LIBADD = $(p11_kit_trust_la_LIBADD)
+
+libnssckbi_p11_kit_la_LDFLAGS = $(p11_kit_trust_la_LDFLAGS)
+
+libnssckbi_p11_kit_la_SOURCES = $(p11_kit_trust_la_SOURCES)
+
libtrust_testable_la_LDFLAGS = \
-no-undefined
diff --git a/trust/meson.build b/trust/meson.build
index c5b978b..14993e5 100644
--- a/trust/meson.build
+++ b/trust/meson.build
@@ -58,6 +58,19 @@ shared_module('p11-kit-trust',
install: true,
install_dir: prefix / p11_module_path)
+shared_module('libnssckbi-p11-kit',
+ libtrust_sources,
+ 'module-init.c',
+ name_prefix: '',
+ c_args: p11_kit_trust_c_args + ['-DLIBNSSCKBI_COMPAT'],
+ dependencies: [libp11_library_dep] + libtasn1_deps,
+ link_args: p11_module_ldflags,
+ link_depends: [p11_module_symbol_map,
+ p11_module_symbol_def],
+ link_with: libtrust_data,
+ vs_module_defs: p11_module_symbol_def,
+ install: true)
+
libtrust_testable_c_args = [
'-DP11_DEFAULT_TRUST_PREFIX="@0@"'.format(meson.current_build_dir() / 'default'),
'-DP11_SYSTEM_TRUST_PREFIX="@0@"'.format(meson.current_build_dir() / 'system')
diff --git a/trust/module.c b/trust/module.c
index ec3333d..9204673 100644
--- a/trust/module.c
+++ b/trust/module.c
@@ -201,7 +201,11 @@ create_tokens_inlock (p11_array *tokens,
int flags;
} labels[] = {
{ "~/", "User Trust", P11_TOKEN_FLAG_NONE },
+#ifdef LIBNSSCKBI_COMPAT
+ { P11_DEFAULT_TRUST_PREFIX, "Builtin Object Token", P11_TOKEN_FLAG_WRITE_PROTECTED },
+#else
{ P11_DEFAULT_TRUST_PREFIX, "Default Trust", P11_TOKEN_FLAG_WRITE_PROTECTED },
+#endif
{ P11_SYSTEM_TRUST_PREFIX, "System Trust", P11_TOKEN_FLAG_NONE },
{ NULL },
};
@@ -534,8 +538,14 @@ sys_C_GetSlotInfo (CK_SLOT_ID id,
info->flags = CKF_TOKEN_PRESENT;
memcpy ((char*)info->manufacturerID, MANUFACTURER_ID, 32);
+#ifdef LIBNSSCKBI_COMPAT
+ /* Change description to match libnssckbi so HPKP works in Chromium */
+ if (strcmp (p11_token_get_label (token), "Builtin Object Token") == 0)
+ path = "NSS Builtin Objects";
+ else
+#endif
+ path = p11_token_get_path (token);
/* If too long, copy the first 64 characters into buffer */
- path = p11_token_get_path (token);
length = strlen (path);
if (length > sizeof (info->slotDescription))
length = sizeof (info->slotDescription);
--
2.23.0
|
