Attachment #598452 for bug #724929

Attachment #598452: Make sure the offending trustwave intermediates are not trusted in mozilla, v3 for bug #724929

(-)mozilla/security/nss/lib/ckfw/builtins/certdata.c (-5 / +63 lines)

Line	Link Here

Lines 35-41	Link Here

 * ***** END LICENSE BLOCK ***** */

 * ***** END LICENSE BLOCK ***** */

#ifdef DEBUG

#ifdef DEBUG

static const char CVS_ID[] = "@(#) $RCSfile: certdata.c,v $ $Revision: 1.84 $ $Date: 2012/01/17 22:02:37 $""; @(#) $RCSfile: certdata.c,v $ $Revision: 1.84 $ $Date: 2012/01/17 22:02:37 $";

static const char CVS_ID[] = "@(#) $RCSfile: certdata.txt,v $ $Revision: 1.81 $ $Date: 2012/01/17 22:02:37 $""; @(#) $RCSfile: certdata.perl,v $ $Revision: 1.13 $ $Date: 2010/03/26 22:06:47 $";

#endif /* DEBUG */

#endif /* DEBUG */

#ifndef BUILTINS_H

#ifndef BUILTINS_H

Lines 1075-1080	Link Here

1075

static const CK_ATTRIBUTE_TYPE nss_builtins_types_339 [] = {

1075

static const CK_ATTRIBUTE_TYPE nss_builtins_types_339 [] = {

1076

 CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERT_SHA1_HASH,  CKA_CERT_MD5_HASH,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED

1076

 CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERT_SHA1_HASH,  CKA_CERT_MD5_HASH,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED

1077

};

1077

};

1078

static const CK_ATTRIBUTE_TYPE nss_builtins_types_340 [] = {

1079

 CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED

1080

};

1081

static const CK_ATTRIBUTE_TYPE nss_builtins_types_341 [] = {

1082

 CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED

1083

};

1078

#ifdef DEBUG

1084

#ifdef DEBUG

1079

static const NSSItem nss_builtins_items_0 [] = {

1085

static const NSSItem nss_builtins_items_0 [] = {

1080

  { (void *)&cko_data, (PRUint32)sizeof(CK_OBJECT_CLASS) },

1086

  { (void *)&cko_data, (PRUint32)sizeof(CK_OBJECT_CLASS) },

Lines 1083-1089	Link Here

1083

  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },

1089

  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },

1084

  { (void *)"CVS ID", (PRUint32)7 },

1090

  { (void *)"CVS ID", (PRUint32)7 },

1085

  { (void *)"NSS", (PRUint32)4 },

1091

  { (void *)"NSS", (PRUint32)4 },

1086

  { (void *)"@(#) $RCSfile: certdata.c,v $ $Revision: 1.84 $ $Date: 2012/01/17 22:02:37 $""; @(#) $RCSfile: certdata.c,v $ $Revision: 1.84 $ $Date: 2012/01/17 22:02:37 $", (PRUint32)160 }

1092

  { (void *)"@(#) $RCSfile: certdata.txt,v $ $Revision: 1.81 $ $Date: 2012/01/17 22:02:37 $""; @(#) $RCSfile: certdata.perl,v $ $Revision: 1.13 $ $Date: 2010/03/26 22:06:47 $", (PRUint32)160 }

1087

};

1093

};

1088

#endif /* DEBUG */

1094

#endif /* DEBUG */

1089

static const NSSItem nss_builtins_items_1 [] = {

1095

static const NSSItem nss_builtins_items_1 [] = {

Lines 22713-22718	Link Here

22713

  { (void *)&ckt_nss_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },

22719

  { (void *)&ckt_nss_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },

22714

  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }

22720

  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }

22715

};

22721

};

22722

static const NSSItem nss_builtins_items_340 [] = {

22723

  { (void *)&cko_nss_trust, (PRUint32)sizeof(CK_OBJECT_CLASS) },

22724

  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },

22725

  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },

22726

  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },

22727

  { (void *)"MITM subCA 1 - bug 724929", (PRUint32)26 },

22728

  { (void *)"\060\201\253\061\013\060\011\006\003\125\004\006\023\002\125\123"

22729

"\061\021\060\017\006\003\125\004\010\023\010\111\154\154\151\156"

22730

"\157\151\163\061\020\060\016\006\003\125\004\007\023\007\103\150"

22731

"\151\143\141\147\157\061\041\060\037\006\003\125\004\012\023\030"

22732

"\124\162\165\163\164\167\141\166\145\040\110\157\154\144\151\156"

22733

"\147\163\054\040\111\156\143\056\061\063\060\061\006\003\125\004"

22734

"\003\023\052\124\162\165\163\164\167\141\166\145\040\117\162\147"

22735

"\141\156\151\172\141\164\151\157\156\040\111\163\163\165\151\156"

22736

"\147\040\103\101\054\040\114\145\166\145\154\040\062\061\037\060"

22737

"\035\006\011\052\206\110\206\367\015\001\011\001\026\020\143\141"

22738

"\100\164\162\165\163\164\167\141\166\145\056\143\157\155"

22739

, (PRUint32)174 },

22740

  { (void *)"\002\004\153\111\322\005"

22741

, (PRUint32)6 },

22742

  { (void *)&ckt_nss_not_trusted, (PRUint32)sizeof(CK_TRUST) },

22743

  { (void *)&ckt_nss_not_trusted, (PRUint32)sizeof(CK_TRUST) },

22744

  { (void *)&ckt_nss_not_trusted, (PRUint32)sizeof(CK_TRUST) },

22745

  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }

22746

};

22747

static const NSSItem nss_builtins_items_341 [] = {

22748

  { (void *)&cko_nss_trust, (PRUint32)sizeof(CK_OBJECT_CLASS) },

22749

  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },

22750

  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },

22751

  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },

22752

  { (void *)"MITM subCA 2 - bug 724929", (PRUint32)26 },

22753

  { (void *)"\060\201\253\061\013\060\011\006\003\125\004\006\023\002\125\123"

22754

"\061\021\060\017\006\003\125\004\010\023\010\111\154\154\151\156"

22755

"\157\151\163\061\020\060\016\006\003\125\004\007\023\007\103\150"

22756

"\151\143\141\147\157\061\041\060\037\006\003\125\004\012\023\030"

22757

"\124\162\165\163\164\167\141\166\145\040\110\157\154\144\151\156"

22758

"\147\163\054\040\111\156\143\056\061\063\060\061\006\003\125\004"

22759

"\003\023\052\124\162\165\163\164\167\141\166\145\040\117\162\147"

22760

"\141\156\151\172\141\164\151\157\156\040\111\163\163\165\151\156"

22761

"\147\040\103\101\054\040\114\145\166\145\154\040\062\061\037\060"

22762

"\035\006\011\052\206\110\206\367\015\001\011\001\026\020\143\141"

22763

"\100\164\162\165\163\164\167\141\166\145\056\143\157\155"

22764

, (PRUint32)174 },

22765

  { (void *)"\002\004\153\111\322\006"

22766

, (PRUint32)6 },

22767

  { (void *)&ckt_nss_not_trusted, (PRUint32)sizeof(CK_TRUST) },

22768

  { (void *)&ckt_nss_not_trusted, (PRUint32)sizeof(CK_TRUST) },

22769

  { (void *)&ckt_nss_not_trusted, (PRUint32)sizeof(CK_TRUST) },

22770

  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }

22771

};

22716

22772

22717

builtinsInternalObject

22773

builtinsInternalObject

22718

nss_builtins_data[] = {

22774

nss_builtins_data[] = {

Lines 23057-23067	Link Here

23057

  { 11, nss_builtins_types_336, nss_builtins_items_336, {NULL} },

23113

  { 11, nss_builtins_types_336, nss_builtins_items_336, {NULL} },

23058

  { 13, nss_builtins_types_337, nss_builtins_items_337, {NULL} },

23114

  { 13, nss_builtins_types_337, nss_builtins_items_337, {NULL} },

23059

  { 11, nss_builtins_types_338, nss_builtins_items_338, {NULL} },

23115

  { 11, nss_builtins_types_338, nss_builtins_items_338, {NULL} },

23060

  { 13, nss_builtins_types_339, nss_builtins_items_339, {NULL} }

23116

  { 13, nss_builtins_types_339, nss_builtins_items_339, {NULL} },

23117

  { 11, nss_builtins_types_340, nss_builtins_items_340, {NULL} },

23118

  { 11, nss_builtins_types_341, nss_builtins_items_341, {NULL} }

23061

};

23119

};

23062

const PRUint32

23120

const PRUint32

23063

#ifdef DEBUG

23121

#ifdef DEBUG

23064

  nss_builtins_nObjects = 339+1;

23122

  nss_builtins_nObjects = 341+1;

23065

#else

23123

#else

23066

  nss_builtins_nObjects = 339;

23124

  nss_builtins_nObjects = 341;

23067

#endif /* DEBUG */

23125

#endif /* DEBUG */

(-)mozilla/security/nss/lib/ckfw/builtins/certdata.txt (+58 lines)

Line	Link Here

Lines 23413-23415	Link Here

23413

CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR

23413

CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR

23414

CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR

23414

CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR

23415

CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE

23415

CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE

23416

23417

# Explicitly Distrust "MITM subCA 1 - bug 724929"

23418

# Issuer: "E=ca@trustwave.com,CN="Trustwave Organization Issuing CA, Level 2",O="Trustwave Holdings, Inc.",L=Chicago,ST=Illinois,C=US"

23419

# Serial Number: 1800000005 (0x6b49d205)

23420

CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST

23421

CKA_TOKEN CK_BBOOL CK_TRUE

23422

CKA_PRIVATE CK_BBOOL CK_FALSE

23423

CKA_MODIFIABLE CK_BBOOL CK_FALSE

23424

CKA_LABEL UTF8 "MITM subCA 1 - bug 724929"

23425

CKA_ISSUER MULTILINE_OCTAL

23426

\060\201\253\061\013\060\011\006\003\125\004\006\023\002\125\123

23427

\061\021\060\017\006\003\125\004\010\023\010\111\154\154\151\156

23428

\157\151\163\061\020\060\016\006\003\125\004\007\023\007\103\150

23429

\151\143\141\147\157\061\041\060\037\006\003\125\004\012\023\030

23430

\124\162\165\163\164\167\141\166\145\040\110\157\154\144\151\156

23431

\147\163\054\040\111\156\143\056\061\063\060\061\006\003\125\004

23432

\003\023\052\124\162\165\163\164\167\141\166\145\040\117\162\147

23433

\141\156\151\172\141\164\151\157\156\040\111\163\163\165\151\156

23434

\147\040\103\101\054\040\114\145\166\145\154\040\062\061\037\060

23435

\035\006\011\052\206\110\206\367\015\001\011\001\026\020\143\141

23436

\100\164\162\165\163\164\167\141\166\145\056\143\157\155

23437

END

23438

CKA_SERIAL_NUMBER MULTILINE_OCTAL

23439

\002\004\153\111\322\005

23440

END

23441

CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_NOT_TRUSTED

23442

CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_NOT_TRUSTED

23443

CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_NOT_TRUSTED

23444

CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE

23445

23446

# Explicitly Distrust "MITM subCA 2 - bug 724929"

23447

# Issuer: "E=ca@trustwave.com,CN="Trustwave Organization Issuing CA, Level 2",O="Trustwave Holdings, Inc.",L=Chicago,ST=Illinois,C=US"

23448

# Serial Number: 1800000006 (0x6b49d206)

23449

CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST

23450

CKA_TOKEN CK_BBOOL CK_TRUE

23451

CKA_PRIVATE CK_BBOOL CK_FALSE

23452

CKA_MODIFIABLE CK_BBOOL CK_FALSE

23453

CKA_LABEL UTF8 "MITM subCA 2 - bug 724929"

23454

CKA_ISSUER MULTILINE_OCTAL

23455

\060\201\253\061\013\060\011\006\003\125\004\006\023\002\125\123

23456

\061\021\060\017\006\003\125\004\010\023\010\111\154\154\151\156

23457

\157\151\163\061\020\060\016\006\003\125\004\007\023\007\103\150

23458

\151\143\141\147\157\061\041\060\037\006\003\125\004\012\023\030

23459

\124\162\165\163\164\167\141\166\145\040\110\157\154\144\151\156

23460

\147\163\054\040\111\156\143\056\061\063\060\061\006\003\125\004

23461

\003\023\052\124\162\165\163\164\167\141\166\145\040\117\162\147

23462

\141\156\151\172\141\164\151\157\156\040\111\163\163\165\151\156

23463

\147\040\103\101\054\040\114\145\166\145\154\040\062\061\037\060

23464

\035\006\011\052\206\110\206\367\015\001\011\001\026\020\143\141

23465

\100\164\162\165\163\164\167\141\166\145\056\143\157\155

23466

END

23467

CKA_SERIAL_NUMBER MULTILINE_OCTAL

23468

\002\004\153\111\322\006

23469

END

23470

CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_NOT_TRUSTED

23471

CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_NOT_TRUSTED

23472

CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_NOT_TRUSTED

23473

CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE

(-)mozilla/security/nss/lib/ckfw/builtins/nssckbi.h (-2 / +2 lines)

Line	Link Here

Lines 77-84	Link Here

 * of the comment in the CK_VERSION type definition.

 * of the comment in the CK_VERSION type definition.

*/

*/

#define NSS_BUILTINS_LIBRARY_VERSION_MAJOR 1

#define NSS_BUILTINS_LIBRARY_VERSION_MAJOR 1

#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 89

#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 90

#define NSS_BUILTINS_LIBRARY_VERSION "1.89"

#define NSS_BUILTINS_LIBRARY_VERSION "1.90"

/* These version numbers detail the semantic changes to the ckfw engine. */

/* These version numbers detail the semantic changes to the ckfw engine. */

#define NSS_BUILTINS_HARDWARE_VERSION_MAJOR 1

#define NSS_BUILTINS_HARDWARE_VERSION_MAJOR 1

Return to bug 724929