Reduce sensitive language

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

diff --git a/bootstrap b/bootstrap
index 5f1b1b70c08cb94d688a3eff934c7ba96462c64c..ae428fcf4e0662505a3136e5d0f9be661f5e92f0 100755 (executable)
--- a/bootstrap
+++ b/bootstrap
@@ -368,7 +368,7 @@ gitignore_entries() {
 # If $STR is not already on a line by itself in $FILE, insert it at the start.
 # Entries are inserted at the start of the ignore list to ensure existing
 # entries starting with ! are not overridden.  Such entries support
-# whitelisting exceptions after a more generic blacklist pattern.
+# allowlisting exceptions after a more generic blocklist pattern.
 insert_if_absent() {
   file=$1
   str=$2

diff --git a/configure.ac b/configure.ac
index 96894b0be3f572dba9af1c55dccfc9a0e8794b2e..15e3f40af5d81fc567b42df455f8f029082c4d2b 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -1119,9 +1119,14 @@ AC_ARG_WITH([default-crl-file],
   [AS_HELP_STRING([--with-default-crl-file=FILE],
     [use the given CRL file as default])])
 
+AC_ARG_WITH([default-blocklist-file],
+  [AS_HELP_STRING([--with-default-blocklist-file=FILE],
+    [use the given certificate blocklist file as default])])
+
 AC_ARG_WITH([default-blacklist-file],
   [AS_HELP_STRING([--with-default-blacklist-file=FILE],
-    [use the given certificate blacklist file as default])])
+    [use --with-default-blocklist-file instead])],
+  [AC_MSG_ERROR([use --with-default-blocklist-file instead])])
 
 if test "x$with_default_trust_store_file" != x; then
   AC_DEFINE_UNQUOTED([DEFAULT_TRUST_STORE_FILE],
@@ -1133,9 +1138,9 @@ if test "x$with_default_crl_file" != x; then
     ["$with_default_crl_file"], [use the given CRL file])
 fi
 
-if test "x$with_default_blacklist_file" != x; then
-  AC_DEFINE_UNQUOTED([DEFAULT_BLACKLIST_FILE],
-    ["$with_default_blacklist_file"], [use the given certificate blacklist file])
+if test "x$with_default_blocklist_file" != x; then
+  AC_DEFINE_UNQUOTED([DEFAULT_BLOCKLIST_FILE],
+    ["$with_default_blocklist_file"], [use the given certificate blocklist file])
 fi
 
 dnl Guile bindings.
@@ -1462,7 +1467,7 @@ AC_MSG_NOTICE([System files:
   Trust store pkcs11:   $with_default_trust_store_pkcs11
   Trust store dir:      $with_default_trust_store_dir
   Trust store file:     $with_default_trust_store_file
-  Blacklist file:       $with_default_blacklist_file
+  Blocklist file:       $with_default_blocklist_file
   CRL file:             $with_default_crl_file
   Configuration file:   $system_config_file
   DNSSEC root key file: $unbound_root_key_file

diff --git a/doc/cha-intro-tls.texi b/doc/cha-intro-tls.texi
index 6600fe989091adccbc2ccef9369629488ca573bb..18f7e03baeec604c148db2641410d72511e715ce 100644 (file)
--- a/doc/cha-intro-tls.texi
+++ b/doc/cha-intro-tls.texi
@@ -662,10 +662,10 @@ via @funcref{gnutls_handshake_set_timeout}.
 
 Note however, that the API ensures that the early return will not happen
 if the false start requirements are not satisfied. That is, on ciphersuites which are not
-whitelisted for false start or on insufficient key sizes, the handshake
+enabled for false start or on insufficient key sizes, the handshake
 process will complete properly (i.e., no early return). To verify that false start was used you
 may use @funcref{gnutls_session_get_flags} and check for the @acronym{GNUTLS_SFLAGS_FALSE_START}
-flag. For GnuTLS the false start is whitelisted for the following
+flag. For GnuTLS the false start is enabled for the following
 key exchange methods (see @xcite{RFC7918} for rationale)
 @itemize
 @item DHE

diff --git a/doc/cha-tokens.texi b/doc/cha-tokens.texi
index 1ae054045f6de6e81c7ede2c25add0974aee59e6..89d23e7489cb5e760cc67aad9e2755e89cb6081b 100644 (file)
--- a/doc/cha-tokens.texi
+++ b/doc/cha-tokens.texi
@@ -511,7 +511,7 @@ and it provides access to the trusted Root CA certificates in a system. That
 provides a more dynamic list of Root CA certificates, as opposed to a static
 list in a file or directory.
 
-That store, allows for blacklisting of CAs or certificates, as well as
+That store, allows for distrusting of CAs or certificates, as well as
 categorization of the Root CAs (Web verification, Code signing, etc.), in
 addition to restricting their purpose via stapled extensions@footnote{See
 the 'Restricting the scope of CA certificates' post at @url{https://nmav.gnutls.org/2016/06/restricting-scope-of-ca-certificates.html}}.

diff --git a/lib/auth/srp_kx.c b/lib/auth/srp_kx.c
index e6ecf24623a893ec53086df2938b67218f53bbd4..ece1853c30ad3a4916d2843f8a13df7276386a38 100644 (file)
--- a/lib/auth/srp_kx.c
+++ b/lib/auth/srp_kx.c
@@ -985,7 +985,7 @@ _gnutls_proc_srp_server_kx(gnutls_session_t session, uint8_t * data,
         */
        if ((ret = check_g_n(data_g, _n_g, data_n, _n_n)) < 0) {
                _gnutls_audit_log(session,
-                                 "SRP group parameters are not in the white list; rejecting.\n");
+                                 "Unknown SRP group parameters; rejecting.\n");
                return gnutls_assert_val(ret);
        }
 

diff --git a/lib/pkcs11.c b/lib/pkcs11.c
index 3ece1d9f8d770f959755a2df91516e7c5fca4f61..d47dd9ee694cebadb5bc3c50730f5363ede293a0 100644 (file)
--- a/lib/pkcs11.c
+++ b/lib/pkcs11.c
@@ -4690,7 +4690,7 @@ _gnutls_pkcs11_crt_is_known(const char *url, gnutls_x509_crt_t cert,
  * in the specified token. This is useful in combination with 
  * %GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_TRUSTED or
  * %GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_DISTRUSTED,
- * to check whether a CA is present or a certificate is blacklisted in
+ * to check whether a CA is present or a certificate is distrusted in
  * a trust PKCS #11 module.
  *
  * This function can be used with a @url of "pkcs11:", and in that case all modules

diff --git a/lib/system/certs.c b/lib/system/certs.c
index 611c645e0517d4f96d354315b08f1d5ed0e632a1..c06b82354bb838ef57f7e381720234e5d00242fe 100644 (file)
--- a/lib/system/certs.c
+++ b/lib/system/certs.c
@@ -137,10 +137,10 @@ add_system_trust(gnutls_x509_trust_list_t list,
                r += ret;
 #endif
 
-#ifdef DEFAULT_BLACKLIST_FILE
-       ret = gnutls_x509_trust_list_remove_trust_file(list, DEFAULT_BLACKLIST_FILE, GNUTLS_X509_FMT_PEM);
+#ifdef DEFAULT_BLOCKLIST_FILE
+       ret = gnutls_x509_trust_list_remove_trust_file(list, DEFAULT_BLOCKLIST_FILE, GNUTLS_X509_FMT_PEM);
        if (ret < 0) {
-               _gnutls_debug_log("Could not load blacklist file '%s'\n", DEFAULT_BLACKLIST_FILE);
+               _gnutls_debug_log("Could not load blocklist file '%s'\n", DEFAULT_BLOCKLIST_FILE);
        }
 #endif
 
@@ -200,10 +200,10 @@ int add_system_trust(gnutls_x509_trust_list_t list, unsigned int tl_flags,
                CertCloseStore(store, 0);
        }
 
-#ifdef DEFAULT_BLACKLIST_FILE
-       ret = gnutls_x509_trust_list_remove_trust_file(list, DEFAULT_BLACKLIST_FILE, GNUTLS_X509_FMT_PEM);
+#ifdef DEFAULT_BLOCKLIST_FILE
+       ret = gnutls_x509_trust_list_remove_trust_file(list, DEFAULT_BLOCKLIST_FILE, GNUTLS_X509_FMT_PEM);
        if (ret < 0) {
-               _gnutls_debug_log("Could not load blacklist file '%s'\n", DEFAULT_BLACKLIST_FILE);
+               _gnutls_debug_log("Could not load blocklist file '%s'\n", DEFAULT_BLOCKLIST_FILE);
        }
 #endif
 
@@ -333,10 +333,10 @@ int add_system_trust(gnutls_x509_trust_list_t list, unsigned int tl_flags,
                CFRelease(certs);
        }
 
-#ifdef DEFAULT_BLACKLIST_FILE
-       ret = gnutls_x509_trust_list_remove_trust_file(list, DEFAULT_BLACKLIST_FILE, GNUTLS_X509_FMT_PEM);
+#ifdef DEFAULT_BLOCKLIST_FILE
+       ret = gnutls_x509_trust_list_remove_trust_file(list, DEFAULT_BLOCKLIST_FILE, GNUTLS_X509_FMT_PEM);
        if (ret < 0) {
-               _gnutls_debug_log("Could not load blacklist file '%s'\n", DEFAULT_BLACKLIST_FILE);
+               _gnutls_debug_log("Could not load blocklist file '%s'\n", DEFAULT_BLOCKLIST_FILE);
        }
 #endif
 

diff --git a/lib/x509/verify-high.c b/lib/x509/verify-high.c
index 5698d4f372d7d49511d179747c3348ccf2c2a9de..3b9a1011d04d58de02f84e27818959d736c2b5bb 100644 (file)
--- a/lib/x509/verify-high.c
+++ b/lib/x509/verify-high.c
@@ -209,10 +209,10 @@ gnutls_x509_trust_list_deinit(gnutls_x509_trust_list_t list,
        if (!list)
                return;
 
-       for (j = 0; j < list->blacklisted_size; j++) {
-               gnutls_x509_crt_deinit(list->blacklisted[j]);
+       for (j = 0; j < list->distrusted_size; j++) {
+               gnutls_x509_crt_deinit(list->distrusted[j]);
        }
-       gnutls_free(list->blacklisted);
+       gnutls_free(list->distrusted);
 
        for (j = 0; j < list->keep_certs_size; j++) {
                gnutls_x509_crt_deinit(list->keep_certs[j]);
@@ -635,7 +635,7 @@ int ret;
  *
  * Note that this function can accept certificates and authorities
  * not yet known. In that case they will be kept in a separate
- * black list that will be used during certificate verification.
+ * block list that will be used during certificate verification.
  * Unlike gnutls_x509_trust_list_add_cas() there is no deinitialization
  * restriction for  certificate list provided in this function.
  *
@@ -677,24 +677,24 @@ gnutls_x509_trust_list_remove_cas(gnutls_x509_trust_list_t list,
                        }
                }
 
-               if (unlikely(INT_ADD_OVERFLOW(list->blacklisted_size, 1))) {
+               if (unlikely(INT_ADD_OVERFLOW(list->distrusted_size, 1))) {
                        return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
                }
 
-               /* Add the CA (or plain) certificate to the black list as well.
+               /* Add the CA (or plain) certificate to the block list as well.
                 * This will prevent a subordinate CA from being valid, and
                 * ensure that a server certificate will also get rejected.
                 */
-               list->blacklisted =
-                       _gnutls_reallocarray_fast(list->blacklisted,
-                                                 list->blacklisted_size + 1,
-                                                 sizeof(list->blacklisted[0]));
-               if (list->blacklisted == NULL)
+               list->distrusted =
+                       _gnutls_reallocarray_fast(list->distrusted,
+                                                 list->distrusted_size + 1,
+                                                 sizeof(list->distrusted[0]));
+               if (list->distrusted == NULL)
                        return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
 
-               list->blacklisted[list->blacklisted_size] = crt_cpy(clist[i]);
-               if (list->blacklisted[list->blacklisted_size] != NULL)
-                       list->blacklisted_size++;
+               list->distrusted[list->distrusted_size] = crt_cpy(clist[i]);
+               if (list->distrusted[list->distrusted_size] != NULL)
+                       list->distrusted_size++;
        }
 
        return r;
@@ -1297,17 +1297,17 @@ int gnutls_x509_trust_list_get_issuer_by_subject_key_id(gnutls_x509_trust_list_t
 }
 
 static
-int check_if_in_blacklist(gnutls_x509_crt_t * cert_list, unsigned int cert_list_size,
-       gnutls_x509_crt_t * blacklist, unsigned int blacklist_size)
+int check_if_in_blocklist(gnutls_x509_crt_t * cert_list, unsigned int cert_list_size,
+       gnutls_x509_crt_t * blocklist, unsigned int blocklist_size)
 {
 unsigned i, j;
 
-       if (blacklist_size == 0)
+       if (blocklist_size == 0)
                return 0;
 
        for (i=0;i<cert_list_size;i++) {
-               for (j=0;j<blacklist_size;j++) {
-                       if (gnutls_x509_crt_equals(cert_list[i], blacklist[j]) != 0) {
+               for (j=0;j<blocklist_size;j++) {
+                       if (gnutls_x509_crt_equals(cert_list[i], blocklist[j]) != 0) {
                                return 1;
                        }
                }
@@ -1573,8 +1573,8 @@ gnutls_x509_trust_list_verify_crt2(gnutls_x509_trust_list_t list,
                                    1]->raw_issuer_dn.size);
        hash %= list->size;
 
-       ret = check_if_in_blacklist(cert_list, cert_list_size,
-               list->blacklisted, list->blacklisted_size);
+       ret = check_if_in_blocklist(cert_list, cert_list_size,
+               list->distrusted, list->distrusted_size);
        if (ret != 0) {
                *voutput = 0;
                *voutput |= GNUTLS_CERT_REVOKED;
@@ -1767,8 +1767,8 @@ gnutls_x509_trust_list_verify_named_crt(gnutls_x509_trust_list_t list,
                          cert->raw_issuer_dn.size);
        hash %= list->size;
 
-       ret = check_if_in_blacklist(&cert, 1,
-               list->blacklisted, list->blacklisted_size);
+       ret = check_if_in_blocklist(&cert, 1,
+               list->distrusted, list->distrusted_size);
        if (ret != 0) {
                *voutput = 0;
                *voutput |= GNUTLS_CERT_REVOKED;

diff --git a/lib/x509/verify-high.h b/lib/x509/verify-high.h
index 4cbb29a9c83f2774b6424234a05cc24cf638a389..f2061492fc500b0347633310f237a88074e30316 100644 (file)
--- a/lib/x509/verify-high.h
+++ b/lib/x509/verify-high.h
@@ -32,8 +32,8 @@ struct gnutls_x509_trust_list_st {
         */
        gnutls_datum_t x509_rdn_sequence;
 
-       gnutls_x509_crt_t *blacklisted;
-       unsigned int blacklisted_size;
+       gnutls_x509_crt_t *distrusted;
+       unsigned int distrusted_size;
 
        /* certificates that will be deallocated when this struct
         * will be deinitialized */

diff --git a/lib/x509/verify-high2.c b/lib/x509/verify-high2.c
index 16d757cf8a67f9cf919250fbadeb72a2e7bee4af..eaaaa8b89708aa5c31337b0bd078d767bf0bc2aa 100644 (file)
--- a/lib/x509/verify-high2.c
+++ b/lib/x509/verify-high2.c
@@ -136,7 +136,7 @@ gnutls_x509_trust_list_add_trust_mem(gnutls_x509_trust_list_t list,
  * @type: The format of the certificates
  *
  * This function will remove the provided certificate authorities
- * from the trusted list, and add them into a black list when needed. 
+ * from the trusted list, and add them into a block list when needed. 
  *
  * See also gnutls_x509_trust_list_remove_cas().
  *
@@ -524,7 +524,7 @@ gnutls_x509_trust_list_add_trust_dir(gnutls_x509_trust_list_t list,
  * @type: The format of the certificates
  *
  * This function will remove the given certificate authorities
- * from the trusted list, and add them into a black list when needed. 
+ * from the trusted list, and add them into a block list when needed. 
  * PKCS 11 URLs are also accepted, instead
  * of files, by this function.
  *

diff --git a/lib/x509/verify.c b/lib/x509/verify.c
index c7e35f7cae84fe87fed4a614b1573a05ffd8f88e..eac8a2adb8b622f5c4755080cc608476415bd6fa 100644 (file)
--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
@@ -1236,7 +1236,7 @@ _gnutls_pkcs11_verify_crt_status(gnutls_x509_trust_list_t tlist,
                return status;
        }
 
-       /* check for blacklists */
+       /* check for blocklists */
        for (i = 0; i < clist_size; i++) {
                if (gnutls_pkcs11_crt_is_known (url, certificate_list[i], 
                        GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE|
@@ -1295,8 +1295,8 @@ _gnutls_pkcs11_verify_crt_status(gnutls_x509_trust_list_t tlist,
                goto cleanup;
        }
 
-       /* check if the raw issuer is blacklisted (it can happen if
-        * the issuer is both in the trusted list and the blacklisted)
+       /* check if the raw issuer is distrusted (it can happen if
+        * the issuer is both in the trusted list and the distrusted)
         */
        if (gnutls_pkcs11_crt_is_known (url, issuer,
                GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE|

diff --git a/src/p11tool-options.json b/src/p11tool-options.json
index 28ef2fc441076cc7b582df3930f512238ffe7a0e..75b98e825f05812bce8406d62a34c2659a3dc410 100644 (file)
--- a/src/p11tool-options.json
+++ b/src/p11tool-options.json
@@ -255,7 +255,7 @@
         },
         {
           "long-option": "mark-distrusted",
-          "description": "When retrieving objects, it requires the objects to be distrusted (blacklisted)",
+          "description": "When retrieving objects, it requires the objects to be distrusted",
           "detail": "Ensures that the objects retrieved have the CKA_X_TRUST flag.\nThis is p11-kit trust module extension, thus this flag is only valid with\np11-kit registered trust modules.",
           "conflicts": [
             "mark-trusted"
@@ -438,4 +438,4 @@
       ]
     }
   ]
-}
\ No newline at end of file
+}