Feature/iran root ca g3

CUSTOM_ANDROID_BUILD.md

@@ -0,0 +1,153 @@
+# Firewolf Android Build Guide
+
+This repository contains a custom GeckoView build with these changes:
+
+- Islamic Republic of Iran Root CA-G3 added to the NSS built-in trust store.
+- NSS built-in certificate library version updated.
+- Certificate Transparency configured in telemetry-only mode for the GeckoView Example test application.
+- Verified against `https://new.pki.co.ir/`.
+
+> Security notice: CT telemetry-only mode is currently for testing. Before production release, replace the global CT behavior with a narrowly scoped exemption for the approved private PKI root.
+
+## Branch
+
+```text
+feature/iran-root-ca-g3
+```
+
+## Tested environment
+
+- macOS on Apple Silicon
+- Android NDK r29, revision `29.0.14206865`
+- Android SDK at `$HOME/Library/Android/sdk`
+- Java 17 installed by Mozilla bootstrap
+- ARM64 Android device or emulator
+
+## Clone
+
+```bash
+git clone --branch feature/iran-root-ca-g3 https://gitlab.pki.co.ir/a.rabiei/firewolf.git
+cd firewolf
+```
+
+## Bootstrap
+
+```bash
+./mach bootstrap
+```
+
+Select:
+
+```text
+4. GeckoView/Firefox for Android
+```
+
+Accept all required Android licenses.
+
+## Environment
+
+Install Android NDK revision `29.0.14206865`, then set paths according to the local machine:
+
+```bash
+export ANDROID_SDK_ROOT="$HOME/Library/Android/sdk"
+export ANDROID_HOME="$ANDROID_SDK_ROOT"
+export ANDROID_NDK_HOME="/Applications/AndroidNDK14206865.app/Contents/NDK"
+```
+
+Verify the NDK:
+
+```bash
+cat "$ANDROID_NDK_HOME/source.properties"
+```
+
+Expected output includes:
+
+```text
+Pkg.Revision = 29.0.14206865
+```
+
+## Build
+
+```bash
+./mach build
+```
+
+## APK
+
+The GeckoView Example debug APK is generated at:
+
+```text
+obj-aarch64-unknown-linux-android/gradle/build/mobile/android/geckoview_example/outputs/apk/debug/geckoview_example-debug.apk
+```
+
+## Install on a device
+
+Enable Developer Options and USB Debugging, then connect the device:
+
+```bash
+ADB="$HOME/Library/Android/sdk/platform-tools/adb"
+APK="obj-aarch64-unknown-linux-android/gradle/build/mobile/android/geckoview_example/outputs/apk/debug/geckoview_example-debug.apk"
+
+"$ADB" devices
+"$ADB" uninstall org.mozilla.geckoview_example || true
+"$ADB" install "$APK"
+```
+
+Launch:
+
+```bash
+"$ADB" shell monkey -p org.mozilla.geckoview_example -c android.intent.category.LAUNCHER 1
+```
+
+Open:
+
+```text
+https://new.pki.co.ir/
+```
+
+## Modified files
+
+NSS trust store:
+
+```text
+security/nss/lib/ckfw/builtins/certdata.txt
+```
+
+NSS built-in certificate library version:
+
+```text
+security/nss/lib/ckfw/builtins/nssckbi.h
+```
+
+GeckoView Example CT configuration:
+
+```text
+mobile/android/geckoview_example/src/main/java/org/mozilla/geckoview_example/GeckoViewActivity.java
+```
+
+## Verify the embedded root
+
+```bash
+APK_CHECK_DIR="$(mktemp -d)"
+
+unzip -p "$APK" lib/arm64-v8a/libxul.so > "$APK_CHECK_DIR/libxul.so"
+
+/usr/bin/strings "$APK_CHECK_DIR/libxul.so" \
+  | grep -F "Islamic Republic of Iran Root CA-G3"
+```
+
+Root SHA-256 fingerprint:
+
+```text
+AA:7F:F6:37:D0:61:29:5A:6A:00:3E:9D:66:21:A5:4F:47:80:BA:E7:AE:F9:60:43:A7:1B:7C:2A:F2:76:D5:56
+```
+
+## Certificate Transparency
+
+The GeckoView Example currently uses:
+
+```java
+setCertificateTransparencyMode(1)
+```
+
+Mode `1` keeps CT telemetry enabled but does not reject a certificate because it has no valid SCT. This setting applies to all sites loaded by the test application and must be reviewed before production use.

mobile/android/geckoview_example/src/main/java/org/mozilla/geckoview_example/GeckoViewActivity.java

@@ -891,7 +891,7 @@ protected void onCreate(Bundle savedInstanceState) {
 
     if (sGeckoRuntime == null) {
       final GeckoRuntimeSettings.Builder runtimeSettingsBuilder =
-          new GeckoRuntimeSettings.Builder();
+    new GeckoRuntimeSettings.Builder();
 
       if (BuildConfig.DEBUG) {
         // In debug builds, we want to load JavaScript resources fresh with
@@ -923,7 +923,11 @@ protected void onCreate(Bundle savedInstanceState) {
           .globalPrivacyControlEnabled(mGlobalPrivacyControlEnabled.value())
           .aboutConfigEnabled(true);
 
-      sGeckoRuntime = GeckoRuntime.create(this, runtimeSettingsBuilder.build());
+
+
+
+      sGeckoRuntime = GeckoRuntime.create(
+          this, runtimeSettingsBuilder.build().setCertificateTransparencyMode(1));
 
       sExtensionManager = new WebExtensionManager(sGeckoRuntime, mTabSessionManager);
       mTabSessionManager.setTabObserver(sExtensionManager);

security/nss/lib/ckfw/builtins/certdata.txt

@@ -25597,3 +25597,176 @@ CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+
+#
+# Certificate "Islamic Republic of Iran Root CA-G3"
+#
+# Issuer: CN=Islamic Republic of Iran Root CA-G3,OU=Root CA,O=I.R.Government,C=IR
+# Serial Number:3e:bd:d7:3e:73:6a:8f:a8:46:78:07:99:ce:60:2a:75
+# Subject: CN=Islamic Republic of Iran Root CA-G3,OU=Root CA,O=I.R.Government,C=IR
+# Not Valid Before: Tue May 07 07:11:44 2019
+# Not Valid After : Sat May 07 07:19:33 2039
+# Fingerprint (SHA-256): AA:7F:F6:37:D0:61:29:5A:6A:00:3E:9D:66:21:A5:4F:47:80:BA:E7:AE:F9:60:43:A7:1B:7C:2A:F2:76:D5:56
+# Fingerprint (SHA1): 59:35:6E:A4:22:99:D6:A1:0A:F3:24:4E:E0:82:1F:49:ED:AF:5D:CB
+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "Islamic Republic of Iran Root CA-G3"
+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+CKA_SUBJECT MULTILINE_OCTAL
+\060\146\061\013\060\011\006\003\125\004\006\023\002\111\122\061
+\027\060\025\006\003\125\004\012\023\016\111\056\122\056\107\157
+\166\145\162\156\155\145\156\164\061\020\060\016\006\003\125\004
+\013\023\007\122\157\157\164\040\103\101\061\054\060\052\006\003
+\125\004\003\023\043\111\163\154\141\155\151\143\040\122\145\160
+\165\142\154\151\143\040\157\146\040\111\162\141\156\040\122\157
+\157\164\040\103\101\055\107\063
+END
+CKA_ID UTF8 "0"
+CKA_ISSUER MULTILINE_OCTAL
+\060\146\061\013\060\011\006\003\125\004\006\023\002\111\122\061
+\027\060\025\006\003\125\004\012\023\016\111\056\122\056\107\157
+\166\145\162\156\155\145\156\164\061\020\060\016\006\003\125\004
+\013\023\007\122\157\157\164\040\103\101\061\054\060\052\006\003
+\125\004\003\023\043\111\163\154\141\155\151\143\040\122\145\160
+\165\142\154\151\143\040\157\146\040\111\162\141\156\040\122\157
+\157\164\040\103\101\055\107\063
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\020\076\275\327\076\163\152\217\250\106\170\007\231\316\140
+\052\165
+END
+CKA_VALUE MULTILINE_OCTAL
+\060\202\005\230\060\202\003\200\240\003\002\001\002\002\020\076
+\275\327\076\163\152\217\250\106\170\007\231\316\140\052\165\060
+\015\006\011\052\206\110\206\367\015\001\001\013\005\000\060\146
+\061\013\060\011\006\003\125\004\006\023\002\111\122\061\027\060
+\025\006\003\125\004\012\023\016\111\056\122\056\107\157\166\145
+\162\156\155\145\156\164\061\020\060\016\006\003\125\004\013\023
+\007\122\157\157\164\040\103\101\061\054\060\052\006\003\125\004
+\003\023\043\111\163\154\141\155\151\143\040\122\145\160\165\142
+\154\151\143\040\157\146\040\111\162\141\156\040\122\157\157\164
+\040\103\101\055\107\063\060\036\027\015\061\071\060\065\060\067
+\060\067\061\061\064\064\132\027\015\063\071\060\065\060\067\060
+\067\061\071\063\063\132\060\146\061\013\060\011\006\003\125\004
+\006\023\002\111\122\061\027\060\025\006\003\125\004\012\023\016
+\111\056\122\056\107\157\166\145\162\156\155\145\156\164\061\020
+\060\016\006\003\125\004\013\023\007\122\157\157\164\040\103\101
+\061\054\060\052\006\003\125\004\003\023\043\111\163\154\141\155
+\151\143\040\122\145\160\165\142\154\151\143\040\157\146\040\111
+\162\141\156\040\122\157\157\164\040\103\101\055\107\063\060\202
+\002\042\060\015\006\011\052\206\110\206\367\015\001\001\001\005
+\000\003\202\002\017\000\060\202\002\012\002\202\002\001\000\300
+\213\151\232\140\011\331\102\366\272\155\275\270\310\235\156\206
+\354\076\144\243\032\077\164\374\101\126\013\303\116\256\256\021
+\144\135\147\231\071\054\135\332\344\372\142\055\052\014\362\075
+\170\055\314\356\055\307\034\174\211\033\245\027\234\063\304\325
+\001\162\373\144\331\152\045\120\347\241\331\257\054\243\240\150
+\314\155\276\063\156\037\105\227\062\240\345\374\140\111\376\251
+\166\304\252\162\275\001\242\303\314\232\224\220\273\070\102\010
+\164\101\202\063\114\217\066\316\175\337\344\345\120\147\207\162
+\173\222\135\366\241\371\243\102\065\300\140\350\147\145\027\253
+\150\161\306\030\337\273\157\274\177\376\041\267\014\254\250\333
+\341\302\356\377\367\005\176\075\351\205\006\236\000\124\010\176
+\030\030\217\067\201\345\153\260\311\226\263\152\377\070\340\333
+\236\051\030\011\364\253\235\235\115\115\121\005\231\326\117\046
+\233\147\353\217\222\034\141\341\107\061\135\160\242\074\111\243
+\175\020\150\256\106\175\346\052\067\370\367\077\304\005\175\144
+\172\042\313\356\177\275\305\045\066\076\020\267\105\127\043\216
+\064\143\305\031\330\114\113\170\013\206\142\105\051\347\154\307
+\367\277\276\301\261\366\250\071\173\214\166\055\145\360\001\031
+\364\033\300\166\076\353\307\146\101\304\227\210\245\154\136\125
+\213\320\262\136\273\075\200\347\057\200\140\360\221\141\372\173
+\120\061\303\327\112\100\247\062\050\306\314\010\156\372\304\232
+\304\025\326\243\031\040\241\010\237\212\161\276\053\360\142\254
+\377\120\015\135\316\053\344\041\045\011\307\327\356\253\300\224
+\376\175\363\155\371\102\251\150\200\240\174\272\121\326\207\155
+\135\017\124\257\326\052\247\016\230\103\227\021\176\365\022\356
+\225\034\114\204\201\114\072\351\053\200\112\256\362\365\236\025
+\132\336\324\132\044\235\040\113\127\056\052\036\141\263\167\104
+\347\174\125\251\341\134\077\246\333\260\210\052\156\166\041\135
+\312\317\342\056\310\242\345\022\246\020\373\370\061\236\160\073
+\325\242\003\065\042\104\220\170\164\266\161\373\113\376\237\130
+\175\143\351\355\276\022\332\100\334\154\136\032\062\306\356\110
+\052\373\147\345\335\144\121\005\075\174\013\133\155\024\215\002
+\003\001\000\001\243\102\060\100\060\016\006\003\125\035\017\001
+\001\377\004\004\003\002\001\206\060\017\006\003\125\035\023\001
+\001\377\004\005\060\003\001\001\377\060\035\006\003\125\035\016
+\004\026\004\024\167\021\331\227\124\050\274\172\367\172\331\323
+\202\216\300\161\104\104\044\030\060\015\006\011\052\206\110\206
+\367\015\001\001\013\005\000\003\202\002\001\000\021\205\170\336
+\364\033\260\005\317\347\074\056\157\235\224\223\236\004\077\143
+\314\375\124\050\254\176\153\025\157\225\124\130\123\212\037\206
+\004\062\317\231\022\326\006\377\071\040\332\336\251\115\164\006
+\302\077\262\227\355\157\115\024\126\352\214\202\320\012\252\300
+\377\030\361\373\037\125\172\174\352\067\131\011\132\030\143\377
+\157\017\164\033\155\017\340\140\312\012\064\076\222\321\120\135
+\110\346\126\055\344\042\120\032\041\360\073\124\061\025\237\222
+\152\043\314\204\110\162\174\120\322\003\315\041\003\377\332\227
+\216\112\106\370\164\172\236\336\276\136\275\167\247\127\126\203
+\154\243\015\032\021\014\214\045\034\244\060\210\372\033\170\163
+\344\302\133\305\237\046\254\155\043\054\245\135\361\161\261\135
+\131\232\070\341\143\140\233\207\311\277\202\056\331\220\205\264
+\247\002\310\165\300\247\364\377\212\117\244\250\260\252\330\307
+\060\150\333\226\170\131\135\172\137\010\037\366\146\140\155\372
+\273\062\007\165\002\360\124\352\120\305\046\247\264\376\074\354
+\031\051\143\336\136\352\314\324\304\301\230\361\351\072\053\054
+\355\064\355\212\163\311\313\024\251\347\241\145\376\065\306\007
+\150\013\036\245\136\042\066\221\252\137\155\254\225\110\146\106
+\247\203\227\130\231\336\056\347\140\017\352\364\053\233\223\350
+\224\221\263\005\233\135\244\156\253\351\237\307\021\276\040\202
+\017\274\156\041\271\007\123\225\125\030\034\275\050\204\343\160
+\042\030\232\110\014\154\322\372\122\233\311\326\371\145\243\053
+\146\154\200\247\063\164\355\053\303\131\262\120\305\176\114\302
+\111\153\062\312\017\147\315\232\204\223\237\113\274\374\345\333
+\222\106\216\023\110\310\133\174\224\374\170\063\126\144\160\104
+\122\024\312\270\157\345\016\055\132\113\377\376\372\065\170\223
+\003\312\145\103\204\350\253\265\213\377\226\115\065\071\351\140
+\255\126\306\362\356\116\167\360\242\100\305\163\342\000\364\211
+\262\156\035\331\232\306\266\002\316\326\376\177\063\237\262\311
+\001\360\043\173\104\071\314\163\133\375\271\322\054\177\172\026
+\233\304\202\307\161\030\370\220\272\124\303\265\161\201\056\330
+\301\276\125\313\047\324\235\353\056\145\335\123
+END
+CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
+CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
+CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
+
+# Trust for "Islamic Republic of Iran Root CA-G3"
+# Issuer: CN=Islamic Republic of Iran Root CA-G3,OU=Root CA,O=I.R.Government,C=IR
+# Serial Number:3e:bd:d7:3e:73:6a:8f:a8:46:78:07:99:ce:60:2a:75
+# Subject: CN=Islamic Republic of Iran Root CA-G3,OU=Root CA,O=I.R.Government,C=IR
+# Not Valid Before: Tue May 07 07:11:44 2019
+# Not Valid After : Sat May 07 07:19:33 2039
+# Fingerprint (SHA-256): AA:7F:F6:37:D0:61:29:5A:6A:00:3E:9D:66:21:A5:4F:47:80:BA:E7:AE:F9:60:43:A7:1B:7C:2A:F2:76:D5:56
+# Fingerprint (SHA1): 59:35:6E:A4:22:99:D6:A1:0A:F3:24:4E:E0:82:1F:49:ED:AF:5D:CB
+CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "Islamic Republic of Iran Root CA-G3"
+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+\131\065\156\244\042\231\326\241\012\363\044\116\340\202\037\111
+\355\257\135\313
+END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\022\052\334\304\132\016\353\312\366\310\302\012\374\264\071\036
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\146\061\013\060\011\006\003\125\004\006\023\002\111\122\061
+\027\060\025\006\003\125\004\012\023\016\111\056\122\056\107\157
+\166\145\162\156\155\145\156\164\061\020\060\016\006\003\125\004
+\013\023\007\122\157\157\164\040\103\101\061\054\060\052\006\003
+\125\004\003\023\043\111\163\154\141\155\151\143\040\122\145\160
+\165\142\154\151\143\040\157\146\040\111\162\141\156\040\122\157
+\157\164\040\103\101\055\107\063
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\020\076\275\327\076\163\152\217\250\106\170\007\231\316\140
+\052\165
+END
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE

security/nss/lib/ckfw/builtins/nssckbi.h

@@ -46,8 +46,8 @@
  * It's recommend to switch back to 0 after having reached version 98/99.
  */
 #define NSS_BUILTINS_LIBRARY_VERSION_MAJOR 2
-#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 90
-#define NSS_BUILTINS_LIBRARY_VERSION "2.90"
+#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 92
+#define NSS_BUILTINS_LIBRARY_VERSION "2.92"
 
 /* These version numbers detail the semantic changes to the ckfw engine. */
 #define NSS_BUILTINS_HARDWARE_VERSION_MAJOR 1