trust: Use term 'attached extensions' instead of 'stapled'

The term 'stapled extensions' is confusing because it overloads
terminology used with OSCP stapling.

Suggested by Daniel Kahn Gillmor.

diff --git a/trust/builder.c b/trust/builder.c
index 5066dc66d7110419810bf080003298327f7f7614..4c62fac683b0d9bb46d349a181410534c68dd9f7 100644 (file)
--- a/trust/builder.c
+++ b/trust/builder.c
@@ -130,7 +130,7 @@ lookup_extension (p11_builder *builder,
        if (public_key == NULL || public_key->type == CKA_INVALID)
                public_key = p11_attrs_find_valid (cert, CKA_PUBLIC_KEY_INFO);
 
-       /* Look for a stapled certificate extension */
+       /* Look for an attached certificate extension */
        if (public_key != NULL) {
                memcpy (match, public_key, sizeof (CK_ATTRIBUTE));
                obj = p11_index_find (index, match, -1);
@@ -592,7 +592,7 @@ calc_certificate_category (p11_builder *builder,
                /*
                 * If there is no basic constraints extension, and the CA version is
                 * v1, and is self-signed, then we assume this is a certificate authority.
-                * So we add a BasicConstraints stapled certificate extension
+                * So we add a BasicConstraints attached certificate extension
                 */
                is_ca = 1;
 

diff --git a/trust/enumerate.c b/trust/enumerate.c
index d469b5c1c1d05a9ebfc1400537e7a1adee293667..dd3da3aac41a22e38565f1d1cd7116146890364b 100644 (file)
--- a/trust/enumerate.c
+++ b/trust/enumerate.c
@@ -51,10 +51,10 @@
 #include <string.h>
 
 static bool
-load_stapled_extension (p11_dict *stapled,
-                        p11_dict *asn1_defs,
-                        const unsigned char *der,
-                        size_t len)
+load_attached_extension (p11_dict *attached,
+                         p11_dict *asn1_defs,
+                         const unsigned char *der,
+                         size_t len)
 {
        char message[ASN1_MAX_ERROR_DESCRIPTION_SIZE];
        node_asn *ext;
@@ -66,7 +66,7 @@ load_stapled_extension (p11_dict *stapled,
 
        ext = p11_asn1_decode (asn1_defs, "PKIX1.Extension", der, len, message);
        if (ext == NULL) {
-               p11_message ("couldn't parse stapled certificate extension: %s", message);
+               p11_message ("couldn't parse attached certificate extension: %s", message);
                return false;
        }
 
@@ -83,21 +83,21 @@ load_stapled_extension (p11_dict *stapled,
        oid = memdup (der + start, length);
        return_val_if_fail (oid != NULL, false);
 
-       if (!p11_dict_set (stapled, oid, ext))
+       if (!p11_dict_set (attached, oid, ext))
                return_val_if_reached (false);
 
        return true;
 }
 
 static p11_dict *
-load_stapled_extensions (p11_enumerate *ex,
-                         CK_ATTRIBUTE *spki)
+load_attached_extensions (p11_enumerate *ex,
+                          CK_ATTRIBUTE *spki)
 {
        CK_OBJECT_CLASS extension = CKO_X_CERTIFICATE_EXTENSION;
        CK_ATTRIBUTE *attrs;
        P11KitIter *iter;
        CK_RV rv = CKR_OK;
-       p11_dict *stapled;
+       p11_dict *attached;
 
        CK_ATTRIBUTE match[] = {
                { CKA_CLASS, &extension, sizeof (extension) },
@@ -108,12 +108,12 @@ load_stapled_extensions (p11_enumerate *ex,
                { CKA_VALUE, },
        };
 
-       stapled = p11_dict_new (p11_oid_hash, p11_oid_equal,
+       attached = p11_dict_new (p11_oid_hash, p11_oid_equal,
                                free, p11_asn1_free);
 
        /* No ID to use, just short circuit */
        if (!spki->pValue || !spki->ulValueLen)
-               return stapled;
+               return attached;
 
        iter = p11_kit_iter_new (NULL, 0);
        p11_kit_iter_add_filter (iter, match, 2);
@@ -126,9 +126,9 @@ load_stapled_extensions (p11_enumerate *ex,
                        attrs = p11_attrs_buildn (NULL, template, 1);
                        rv = p11_kit_iter_load_attributes (iter, attrs, 1);
                        if (rv == CKR_OK) {
-                               if (!load_stapled_extension (stapled, ex->asn1_defs,
-                                                            attrs[0].pValue,
-                                                            attrs[0].ulValueLen)) {
+                               if (!load_attached_extension (attached, ex->asn1_defs,
+                                                             attrs[0].pValue,
+                                                             attrs[0].ulValueLen)) {
                                        rv = CKR_GENERAL_ERROR;
                                }
                        }
@@ -137,13 +137,13 @@ load_stapled_extensions (p11_enumerate *ex,
        }
 
        if (rv != CKR_OK && rv != CKR_CANCEL) {
-               p11_message ("couldn't load stapled extensions for certificate: %s", p11_kit_strerror (rv));
-               p11_dict_free (stapled);
-               stapled = NULL;
+               p11_message ("couldn't load attached extensions for certificate: %s", p11_kit_strerror (rv));
+               p11_dict_free (attached);
+               attached = NULL;
        }
 
        p11_kit_iter_free (iter);
-       return stapled;
+       return attached;
 }
 
 static bool
@@ -153,8 +153,8 @@ extract_purposes (p11_enumerate *ex)
        unsigned char *value = NULL;
        size_t length;
 
-       if (ex->stapled) {
-               ext = p11_dict_get (ex->stapled, P11_OID_EXTENDED_KEY_USAGE);
+       if (ex->attached) {
+               ext = p11_dict_get (ex->attached, P11_OID_EXTENDED_KEY_USAGE);
                if (ext != NULL) {
                        value = p11_asn1_read (ext, "extnValue", &length);
                        return_val_if_fail (value != NULL, false);
@@ -314,8 +314,8 @@ extract_info (p11_enumerate *ex)
 
        attr = p11_attrs_find_valid (ex->attrs, CKA_PUBLIC_KEY_INFO);
        if (attr) {
-               ex->stapled = load_stapled_extensions (ex, attr);
-               if (!ex->stapled)
+               ex->attached = load_attached_extensions (ex, attr);
+               if (!ex->attached)
                        return false;
        }
 
@@ -337,8 +337,8 @@ extract_clear (p11_enumerate *ex)
        ex->cert_der = NULL;
        ex->cert_len = 0;
 
-       p11_dict_free (ex->stapled);
-       ex->stapled = NULL;
+       p11_dict_free (ex->attached);
+       ex->attached = NULL;
 
        p11_array_free (ex->purposes);
        ex->purposes = NULL;

diff --git a/trust/enumerate.h b/trust/enumerate.h
index 8a18b0665a96d0221ff59275cb86ed9818a17ab6..411820a09eb2152839df9e23b31b6f0bd3048449 100644 (file)
--- a/trust/enumerate.h
+++ b/trust/enumerate.h
@@ -80,7 +80,7 @@ typedef struct {
        size_t cert_len;
 
        /* DER OID -> CK_ATTRIBUTE list */
-       p11_dict *stapled;
+       p11_dict *attached;
 
        /* Set of OID purposes as strings */
        p11_array *purposes;

diff --git a/trust/extract-openssl.c b/trust/extract-openssl.c
index 912c90de3651919b41e68307d80a65492a3c5589..d622d7ad798ffb10bd76c1c7aeca9d54347b2b71 100644 (file)
--- a/trust/extract-openssl.c
+++ b/trust/extract-openssl.c
@@ -110,8 +110,8 @@ load_usage_ext (p11_enumerate *ex,
        node_asn *ext = NULL;
        size_t length;
 
-       if (ex->stapled)
-               ext = p11_dict_get (ex->stapled, ext_oid);
+       if (ex->attached)
+               ext = p11_dict_get (ex->attached, ext_oid);
        if (ext == NULL) {
                *oids = NULL;
                return true;
@@ -230,8 +230,8 @@ write_keyid (p11_enumerate *ex,
        size_t length = 0;
        int ret;
 
-       if (ex->stapled)
-               ext = p11_dict_get (ex->stapled, P11_OID_SUBJECT_KEY_IDENTIFIER);
+       if (ex->attached)
+               ext = p11_dict_get (ex->attached, P11_OID_SUBJECT_KEY_IDENTIFIER);
        if (ext != NULL) {
                value = p11_asn1_read (ext, "extnValue", &length);
                return_val_if_fail (value != NULL, false);

diff --git a/trust/parser.c b/trust/parser.c
index ff0f15f151c6cc5cf31ed77a9d84cf25c3463ac6..7f523e9cf27086197b8867acce8620c90fbd02c8 100644 (file)
--- a/trust/parser.c
+++ b/trust/parser.c
@@ -251,13 +251,13 @@ extension_attrs (p11_parser *parser,
 }
 
 static CK_ATTRIBUTE *
-stapled_attrs (p11_parser *parser,
-               CK_ATTRIBUTE *id,
-               CK_ATTRIBUTE *public_key_info,
-               const char *oid_str,
-               const unsigned char *oid_der,
-               bool critical,
-               node_asn *ext)
+attached_attrs (p11_parser *parser,
+                CK_ATTRIBUTE *id,
+                CK_ATTRIBUTE *public_key_info,
+                const char *oid_str,
+                const unsigned char *oid_der,
+                bool critical,
+                node_asn *ext)
 {
        CK_ATTRIBUTE *attrs;
        unsigned char *der;
@@ -302,13 +302,13 @@ load_seq_of_oid_str (node_asn *node,
 }
 
 static CK_ATTRIBUTE *
-stapled_eku_attrs (p11_parser *parser,
-                   CK_ATTRIBUTE *id,
-                   CK_ATTRIBUTE *public_key_info,
-                   const char *oid_str,
-                   const unsigned char *oid_der,
-                   bool critical,
-                   p11_dict *oid_strs)
+attached_eku_attrs (p11_parser *parser,
+                    CK_ATTRIBUTE *id,
+                    CK_ATTRIBUTE *public_key_info,
+                    const char *oid_str,
+                    const unsigned char *oid_der,
+                    bool critical,
+                    p11_dict *oid_strs)
 {
        CK_ATTRIBUTE *attrs;
        p11_dictiter iter;
@@ -353,7 +353,7 @@ stapled_eku_attrs (p11_parser *parser,
        }
 
 
-       attrs = stapled_attrs (parser, id, public_key_info, oid_str, oid_der, critical, dest);
+       attrs = attached_attrs (parser, id, public_key_info, oid_str, oid_der, critical, dest);
        asn1_delete_structure (&dest);
 
        return attrs;
@@ -416,10 +416,10 @@ build_openssl_extensions (p11_parser *parser,
         */
 
        if (trust) {
-               attrs = stapled_eku_attrs (parser, id, public_key_info,
-                                          P11_OID_EXTENDED_KEY_USAGE_STR,
-                                          P11_OID_EXTENDED_KEY_USAGE,
-                                          true, trust);
+               attrs = attached_eku_attrs (parser, id, public_key_info,
+                                           P11_OID_EXTENDED_KEY_USAGE_STR,
+                                           P11_OID_EXTENDED_KEY_USAGE,
+                                           true, trust);
                return_val_if_fail (attrs != NULL, NULL);
                sink_object (parser, attrs);
        }
@@ -433,10 +433,10 @@ build_openssl_extensions (p11_parser *parser,
         */
 
        if (reject && p11_dict_size (reject) > 0) {
-               attrs = stapled_eku_attrs (parser, id, public_key_info,
-                                          P11_OID_OPENSSL_REJECT_STR,
-                                          P11_OID_OPENSSL_REJECT,
-                                          false, reject);
+               attrs = attached_eku_attrs (parser, id, public_key_info,
+                                           P11_OID_OPENSSL_REJECT_STR,
+                                           P11_OID_OPENSSL_REJECT,
+                                           false, reject);
                return_val_if_fail (attrs != NULL, NULL);
                sink_object (parser, attrs);
        }

diff --git a/trust/test-builder.c b/trust/test-builder.c
index 51d499ce135034013622dab152b31921ab0607fe..bf1eed1eeb73defb565b55702327eacdbfdd37cc 100644 (file)
--- a/trust/test-builder.c
+++ b/trust/test-builder.c
@@ -399,7 +399,7 @@ test_build_certificate_staple_ca (void)
 {
        CK_ULONG category = 2; /* CA */
 
-       CK_ATTRIBUTE stapled[] = {
+       CK_ATTRIBUTE attached[] = {
                { CKA_CLASS, &certificate_extension, sizeof (certificate_extension) },
                { CKA_OBJECT_ID, (void *)P11_OID_BASIC_CONSTRAINTS, sizeof (P11_OID_BASIC_CONSTRAINTS) },
                { CKA_VALUE, "\x30\x0f\x06\x03\x55\x1d\x13\x01\x01\xff\x04\x05\x30\x03\x01\x01\xff", 17 },
@@ -423,10 +423,10 @@ test_build_certificate_staple_ca (void)
        CK_ATTRIBUTE *extra;
        CK_RV rv;
 
-       /* Adding the stapled extension *first*, and then the certificate */
+       /* Adding the attached extension *first*, and then the certificate */
 
-       /* Add a stapled certificate */
-       rv = p11_index_add (test.index, stapled, 4, NULL);
+       /* Add a attached certificate */
+       rv = p11_index_add (test.index, attached, 4, NULL);
        assert_num_eq (CKR_OK, rv);
 
        attrs = NULL;
@@ -439,7 +439,7 @@ test_build_certificate_staple_ca (void)
 
        /*
         * Even though the certificate is not a valid CA, the presence of the
-        * stapled certificate extension transforms it into a CA.
+        * attached certificate extension transforms it into a CA.
         */
        test_check_attrs (expected, attrs);
        p11_attrs_free (attrs);
@@ -450,7 +450,7 @@ test_build_certificate_staple_ca_backwards (void)
 {
        CK_ULONG category = 2; /* CA */
 
-       CK_ATTRIBUTE stapled[] = {
+       CK_ATTRIBUTE attached[] = {
                { CKA_CLASS, &certificate_extension, sizeof (certificate_extension) },
                { CKA_OBJECT_ID, (void *)P11_OID_BASIC_CONSTRAINTS, sizeof (P11_OID_BASIC_CONSTRAINTS) },
                { CKA_VALUE, "\x30\x0f\x06\x03\x55\x1d\x13\x01\x01\xff\x04\x05\x30\x03\x01\x01\xff", 17 },
@@ -474,18 +474,18 @@ test_build_certificate_staple_ca_backwards (void)
        CK_ATTRIBUTE *attrs;
        CK_OBJECT_HANDLE handle;
 
-       /* Adding the certificate *first*, and then the stapled extension */
+       /* Adding the certificate *first*, and then the attached extension */
 
        rv = p11_index_add (test.index, input, 4, &handle);
        assert_num_eq (CKR_OK, rv);
 
-       /* Add a stapled certificate */
-       rv = p11_index_add (test.index, stapled, 4, NULL);
+       /* Add a attached certificate */
+       rv = p11_index_add (test.index, attached, 4, NULL);
        assert_num_eq (CKR_OK, rv);
 
        /*
         * Even though the certificate is not a valid CA, the presence of the
-        * stapled certificate extension transforms it into a CA.
+        * attached certificate extension transforms it into a CA.
         */
        attrs = p11_index_lookup (test.index, handle);
        test_check_attrs (expected, attrs);
@@ -2074,7 +2074,7 @@ test_changed_staple_ca (void)
 {
        CK_ULONG category = 0;
 
-       CK_ATTRIBUTE stapled[] = {
+       CK_ATTRIBUTE attached[] = {
                { CKA_CLASS, &certificate_extension, sizeof (certificate_extension) },
                { CKA_OBJECT_ID, (void *)P11_OID_BASIC_CONSTRAINTS, sizeof (P11_OID_BASIC_CONSTRAINTS) },
                { CKA_VALUE, "\x30\x0c\x06\x03\x55\x1d\x13\x04\x05\x30\x03\x01\x01\xff", 14 },
@@ -2108,8 +2108,8 @@ test_changed_staple_ca (void)
        category = 0;
        assert (p11_index_find (test.index, match, -1) == 0);
 
-       /* Add a stapled basic constraint */
-       rv = p11_index_add (test.index, stapled, 4, NULL);
+       /* Add a attached basic constraint */
+       rv = p11_index_add (test.index, attached, 4, NULL);
        assert_num_eq (CKR_OK, rv);
 
        /* Now should be a CA */
@@ -2122,7 +2122,7 @@ test_changed_staple_ca (void)
 static void
 test_changed_staple_ku (void)
 {
-       CK_ATTRIBUTE stapled_ds_and_np[] = {
+       CK_ATTRIBUTE attached_ds_and_np[] = {
                { CKA_CLASS, &certificate_extension, sizeof (certificate_extension) },
                { CKA_OBJECT_ID, (void *)P11_OID_KEY_USAGE, sizeof (P11_OID_KEY_USAGE) },
                { CKA_VALUE, "\x30\x0c\x06\x03\x55\x1d\x0f\x04\x05\x03\x03\x07\xc0\x00", 14 },
@@ -2168,7 +2168,7 @@ test_changed_staple_ku (void)
        p11_index_load (test.index);
        rv = p11_index_take (test.index, p11_attrs_dup (input), NULL);
        assert_num_eq (CKR_OK, rv);
-       rv = p11_index_take (test.index, p11_attrs_dup (stapled_ds_and_np), NULL);
+       rv = p11_index_take (test.index, p11_attrs_dup (attached_ds_and_np), NULL);
        assert_num_eq (CKR_OK, rv);
        p11_index_finish (test.index);
 

diff --git a/trust/test-enumerate.c b/trust/test-enumerate.c
index 930b6455b554aaf6c15c2a88469a7035f0f972bd..424437e3062ba2e19a0926a13040e0c45a433f6d 100644 (file)
--- a/trust/test-enumerate.c
+++ b/trust/test-enumerate.c
@@ -278,7 +278,7 @@ test_info_limit_purposes (void)
        mock_module_add_object (MOCK_SLOT_ONE_ID, cacert3_trusted);
        mock_module_add_object (MOCK_SLOT_ONE_ID, extension_eku_server_client);
 
-       /* This should not match the above, with the stapled certificat ext */
+       /* This should not match the above, with the attached certificat ext */
        assert_ptr_eq (NULL, test.ex.limit_to_purposes);
        p11_enumerate_opt_purpose (&test.ex, "1.1.1");
        assert_ptr_not_null (test.ex.limit_to_purposes);

diff --git a/trust/test-parser.c b/trust/test-parser.c
index be5e49642a4bbe5ef4053e40dff02f291f36e9d0..201ed81d965839febc6e354c52728f25c7810f3a 100644 (file)
--- a/trust/test-parser.c
+++ b/trust/test-parser.c
@@ -233,7 +233,7 @@ test_parse_openssl_trusted (void)
        /*
         * Should have gotten:
         * - 1 certificate
-        * - 2 stapled extensions
+        * - 2 attached extensions
         */
        assert_num_eq (3, test.parsed->num);
 
@@ -317,7 +317,7 @@ test_parse_openssl_distrusted (void)
        /*
         * Should have gotten:
         * - 1 certificate
-        * - 2 stapled extensions
+        * - 2 attached extensions
         */
        assert_num_eq (3, test.parsed->num);
        cert = parsed_attrs (certificate_match, -1);