nss: add option to use p11-kit #96763

rnhmjoj · 2020-08-31T12:50:37Z

Motivation for this change

The original motivation is #8247

After multiple attempts it seems I have finally understood how to use p11-kit-trust.
So far I've only built nss and tested the system trust store is used by qtwebengine.
Firefox and other Mozilla programs should be tested as well.

This commit adds an option to replace libnssckbi with the p11-kit-trust1 module. It makes all NSS application (like Firefox, Chromium, etc.) use the system trust store (/etc/ssl/certs/ in NixOS) and other PKCS#11 modules without ad-hoc configuration. Enabling the option will additionally generate a p11-kit compatible
module of the Mozilla CA bundle.

This approach was first implemented in Fedora2 and other distributions like Arch Linux, later. The certdata2pem.py script is in fact taken, and some of the build code adapted, from the ca-certificates Fedora package3.

Things done

ajs124 · 2020-09-02T01:29:08Z

I might be mixing things up, but certdata2pem is already how nixpkgs/nixos is getting its ca certs. From nss. So why extract them here again?

rnhmjoj · 2020-09-02T05:58:58Z

Because I didn't know that: I thought cacert was a different CA bundle. I'll remove that part, thank you.

rnhmjoj · 2020-09-02T16:42:18Z

Done. I removed the (duplicated) part.

rnhmjoj · 2020-10-08T16:37:47Z

ping

rnhmjoj · 2020-10-14T17:06:27Z

So, do you have any objection?

I'd like for nss to use the system trust store in /etc/ssl/certs. That way is possibile to take control of the validation in chromium, firefox and basically all other browsers by setting security.pki in NixOS. I can't think of any unwanted side effects of this change.

ajs124 · 2020-10-14T17:38:09Z

No objections, but I also don't feel comfortable approving/merging this, because I don't feel like I know enough about nss and/or p11-kit.

nixos-discourse · 2020-10-16T10:28:04Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-in-distress/3604/35

andir · 2020-11-19T15:42:35Z

pkgs/development/libraries/nss/default.nix

@@ -126,6 +133,11 @@ in stdenv.mkDerivation rec {
    chmod 0755 $out/bin/nss-config
  '';

+  postInstall = stdenv.lib.optionalString useP11kit ''
+    # Replace built-in trust with p11-kit connection
+    ln -sf ${p11-kit}/lib/pkcs11/p11-kit-trust.so $out/lib/libnssckbi.so


So, how do we gurantee that the ABI between this "fake" output and the one defined in the header files matches? Is that defined in the PKCS#11 standard?

It's a good question: the library is designed to be used like this, so I assume it's ABI compatible with nss, but I'm not sure.

Even if it is, this could be an issue if nss introduces an ABI incompatible change and Nixpkgs is updated before p11-kit. It should be noted p11-kit is maintained and used by red hat, so it should be update quickly enough.

andir · 2020-11-19T17:03:11Z

This commit adds an option to replace libnssckbi with the p11-kit-trust1 module. It makes all NSS application (like Firefox, Chromium, etc.) use the system trust store (/etc/ssl/certs/ in NixOS) and other PKCS#11 modules without ad-hoc configuration. Enabling the option will additionally generate a p11-kit compatible
module of the Mozilla CA bundle.

What was the situation before that? Did all the applications linking to NSS use the bundled trust store that came with NSS? I still wonder if there wouldn't be a better way to deal with this but I fear NSS doesn't really care much about system wide certs.

rnhmjoj · 2020-11-19T17:14:25Z

Did all the applications linking to NSS use the bundled trust store that came with NSS?

I think so, certainly they aren't using the system wide store.

I still wonder if there wouldn't be a better way to deal with this but I fear NSS doesn't really care much about system wide certs.

Probably not, red hat/fedora was in the same situation and p11-kit is what they came up with.

SuperSandro2000 · 2020-11-23T12:09:52Z

Can you please target staging with the mass rebuild and fix the merge conflict?

pkgs/development/libraries/nss/default.nix

rnhmjoj · 2021-01-10T17:44:58Z

I added a test to check that the security.pki options are working in every major browser engine.
Programs based on openssl and gnutls should already be working, nss-based browsers needs this PR.

Building this on staging would probably take days, but you can avoid the rebuilds by running it from master and using replaceRuntimeDependencies as follows:

{ system.replaceRuntimeDependencies =
    let 
      nss-p11kit = pkgs.nss.overrideDerivation (old: {
        postInstall = ''
          # Replace built-in trust with p11-kit connection
          ln -sf ${pkgs.p11-kit}/lib/pkcs11/p11-kit-trust.so $out/lib/libnssckbi.so
        '';
      });
    in [{ original = pkgs.nss; replacement = nss-p11kit; }];
}

rnhmjoj · 2021-01-11T11:17:48Z

@GrahamcOfBorg eval

SuperSandro2000 · 2021-01-11T17:21:27Z

Staging is broken right now.

rnhmjoj · 2021-01-11T18:25:18Z

I saw FRidh pushed a commit to fix the eval but it's still broken (differently).

FRidh · 2021-01-11T18:42:05Z

yes another fix in e3961ff

rnhmjoj · 2021-01-11T22:59:02Z

@GrahamcOfBorg test custom-ca

pkgs/development/libraries/nss/default.nix

rnhmjoj · 2021-01-13T08:58:38Z

Thanks to the test, I'm now pretty confident this PR won't wreak havoc on Nixpkgs.
If you have no more changes to suggest I'd go on and try to merge it.

tfc · 2021-01-18T18:07:12Z

Wow, the integration test is awesome. Thanks for that!

This commit adds an option to replace libnssckbi with the p11-kit-trust[1] module. It makes all NSS application (like Firefox, Chromium, etc.) use the system trust store (/etc/ssl/certs/ in NixOS) and other PKCS#11 modules without ad-hoc configuration. This approach was first implemented in Fedora[2] and other distributions like Arch Linux, later. [1]: https://p11-glue.github.io/p11-glue/p11-kit/manual/trust-nss.html [2]: https://fedoraproject.org/wiki/Features/SharedSystemCertificates

This is a NixOS test for the security.pki options.

rnhmjoj · 2021-01-24T13:44:37Z

Wow, the integration test is awesome. Thanks for that!

Thank you!

I have fixed the conflict (stdenv.lib -> lib change) and rebased. I tested again nixosTests.firefox, nixosTests.chromium and nixosTests.custom-ca and everything still looks ok. I'll try merge it now.

flokli · 2022-05-07T17:43:15Z

@rnhmjoj the commit message says:

This commit adds an option to replace libnssckbi with the
p11-kit-trust[1] module. It makes all NSS application (like Firefox,
Chromium, etc.) use the system trust store (/etc/ssl/certs/ in NixOS)
and other PKCS#11 modules without ad-hoc configuration.

It however seems p11-kit doesn't properly discover PKCS#11 modules on NixOS. I opened #171978.

rnhmjoj requested a review from vcunat August 31, 2020 12:51

ofborg bot added 10.rebuild-darwin: 11-100 10.rebuild-linux: 501+ 10.rebuild-linux: 501-1000 labels Aug 31, 2020

rnhmjoj force-pushed the p11kit branch from ff1940c to 0138eb4 Compare September 2, 2020 16:40

rnhmjoj force-pushed the p11kit branch from 0138eb4 to b954b3a Compare October 16, 2020 10:16

rnhmjoj requested review from tfc and andir October 29, 2020 08:08

andir reviewed Nov 19, 2020

View reviewed changes

SuperSandro2000 reviewed Nov 23, 2020

View reviewed changes

pkgs/development/libraries/nss/default.nix Outdated Show resolved Hide resolved

rnhmjoj force-pushed the p11kit branch from b954b3a to 996436f Compare November 23, 2020 16:18

rnhmjoj requested review from cdepillabout, Ericson2314, FRidh, joachifm, jonringer, matthewbauer, thoughtpolice and zowoq as code owners November 23, 2020 16:18

rnhmjoj changed the base branch from master to staging November 23, 2020 16:18

ofborg bot removed 6.topic: stdenv Standard environment 8.has: changelog 8.has: documentation 8.has: module (update) labels Dec 28, 2020

rnhmjoj force-pushed the p11kit branch 3 times, most recently from 81c0389 to bef086f Compare January 11, 2021 11:13

rnhmjoj force-pushed the p11kit branch from bef086f to 6727f67 Compare January 11, 2021 19:45

ofborg bot added the 6.topic: nixos label Jan 11, 2021

SuperSandro2000 reviewed Jan 12, 2021

View reviewed changes

pkgs/development/libraries/nss/default.nix Outdated Show resolved Hide resolved

pkgs/development/libraries/nss/default.nix Outdated Show resolved Hide resolved

rnhmjoj force-pushed the p11kit branch 2 times, most recently from 9b2866b to 2a1c8c3 Compare January 13, 2021 08:50

rnhmjoj force-pushed the p11kit branch from 2a1c8c3 to 8af90f7 Compare January 18, 2021 09:16

rnhmjoj added 2 commits January 24, 2021 10:50

nixos/tests/custom-ca: init

cc8a422

This is a NixOS test for the security.pki options.

rnhmjoj force-pushed the p11kit branch from 8af90f7 to cc8a422 Compare January 24, 2021 09:51

rnhmjoj merged commit c49c092 into NixOS:staging Jan 24, 2021

rnhmjoj mentioned this pull request Feb 22, 2021

SSL certificates: figure out how libs/apps find them by default #8247

Open

sigprof mentioned this pull request Jun 7, 2021

Firefox shows public certificate authorities as “not recognized by Mozilla” #126065

Closed

rnhmjoj deleted the p11kit branch July 10, 2023 14:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

nss: add option to use p11-kit #96763

nss: add option to use p11-kit #96763

rnhmjoj commented Aug 31, 2020 •

edited

ajs124 commented Sep 2, 2020

rnhmjoj commented Sep 2, 2020

rnhmjoj commented Sep 2, 2020

rnhmjoj commented Oct 8, 2020

rnhmjoj commented Oct 14, 2020

ajs124 commented Oct 14, 2020

nixos-discourse commented Oct 16, 2020

andir Nov 19, 2020

rnhmjoj Nov 19, 2020

andir commented Nov 19, 2020

rnhmjoj commented Nov 19, 2020

SuperSandro2000 commented Nov 23, 2020 •

edited

rnhmjoj commented Jan 10, 2021 •

edited

rnhmjoj commented Jan 11, 2021

SuperSandro2000 commented Jan 11, 2021

rnhmjoj commented Jan 11, 2021

FRidh commented Jan 11, 2021

rnhmjoj commented Jan 11, 2021

rnhmjoj commented Jan 13, 2021

tfc commented Jan 18, 2021

rnhmjoj commented Jan 24, 2021

flokli commented May 7, 2022

nss: add option to use p11-kit #96763

nss: add option to use p11-kit #96763

Conversation

rnhmjoj commented Aug 31, 2020 • edited

Motivation for this change

Things done

ajs124 commented Sep 2, 2020

rnhmjoj commented Sep 2, 2020

rnhmjoj commented Sep 2, 2020

rnhmjoj commented Oct 8, 2020

rnhmjoj commented Oct 14, 2020

ajs124 commented Oct 14, 2020

nixos-discourse commented Oct 16, 2020

andir Nov 19, 2020

Choose a reason for hiding this comment

rnhmjoj Nov 19, 2020

Choose a reason for hiding this comment

andir commented Nov 19, 2020

rnhmjoj commented Nov 19, 2020

SuperSandro2000 commented Nov 23, 2020 • edited

rnhmjoj commented Jan 10, 2021 • edited

rnhmjoj commented Jan 11, 2021

SuperSandro2000 commented Jan 11, 2021

rnhmjoj commented Jan 11, 2021

FRidh commented Jan 11, 2021

rnhmjoj commented Jan 11, 2021

rnhmjoj commented Jan 13, 2021

tfc commented Jan 18, 2021

rnhmjoj commented Jan 24, 2021

flokli commented May 7, 2022

rnhmjoj commented Aug 31, 2020 •

edited

SuperSandro2000 commented Nov 23, 2020 •

edited

rnhmjoj commented Jan 10, 2021 •

edited