KotJohansson/UXP-Fixed
1
0
Fork 0
mirror of https://github.com/ManchildProductions/UXP-Fixed.git synced 2026-05-27 04:00:55 +00:00
Code Issues Projects Releases Wiki Activity

moebius#119: (Windows) Security - Certificate Stores - NSSCertDBTrustDomain allows end-entities to be their own trust anchors

Browse Source 
https://github.com/MoonchildProductions/moebius/pull/119
This commit is contained in:
janekptacijarabaci
2018-04-23 09:10:12 +02:00
parent c30ebdac27
commit c3ec00a152
3 changed files with 31 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/certverifier/CertVerifier.cpp
+1 -2
View File
@@ -224,8 +224,7 @@ CertVerifier::VerifySignedCertificateTimestamps(
CERTCertListNode* issuerNode = CERT_LIST_NEXT(endEntityNode);
if (!issuerNode || CERT_LIST_END(issuerNode, builtChain)) {
// Issuer certificate is required for SCT verification.
// TODO(bug 1294580): change this to Result::FATAL_ERROR_INVALID_ARGS
return Success;
return Result::FATAL_ERROR_INVALID_ARGS;
}
CERTCertificate* endEntity = endEntityNode->cert;
security/certverifier/NSSCertDBTrustDomain.cpp
+5 -1
View File
@@ -245,7 +245,11 @@ NSSCertDBTrustDomain::GetCertTrust(EndEntityOrCA endEntityOrCA,
// For TRUST, we only use the CERTDB_TRUSTED_CA bit, because Goanna hasn't
// needed to consider end-entity certs to be their own trust anchors since
// Goanna implemented nsICertOverrideService.
if (flags & CERTDB_TRUSTED_CA) {
// Of course, for this to work as expected, we need to make sure we're
// inquiring about the trust of a CA and not an end-entity. If an end-entity
// has the CERTDB_TRUSTED_CA bit set, Gecko does not consider it to be a
// trust anchor; it must inherit its trust.
if (flags & CERTDB_TRUSTED_CA && endEntityOrCA == EndEntityOrCA::MustBeCA) {
if (policy.IsAnyPolicy()) {
trustLevel = TrustLevel::TrustAnchor;
return Success;
security/manager/ssl/tests/unit/test_cert_trust.js
+25 -3
View File
@@ -208,9 +208,31 @@ function run_test() {
setCertTrust(ca_cert, ",,");
setCertTrust(int_cert, ",,");
// It turns out that if an end-entity certificate is manually trusted, it can
// be the root of its own verified chain. This will be removed in bug 1294580.
setCertTrust(ee_cert, "C,,");
// If an end-entity certificate is manually trusted, it may not be the root of
// its own verified chain. In general this will cause "unknown issuer" errors
// unless a CA trust anchor can be found.
setCertTrust(ee_cert, "CTu,CTu,CTu");
checkCertErrorGeneric(certdb, ee_cert, SEC_ERROR_UNKNOWN_ISSUER,
certificateUsageSSLServer);
checkCertErrorGeneric(certdb, ee_cert, SEC_ERROR_UNKNOWN_ISSUER,
certificateUsageSSLClient);
checkCertErrorGeneric(certdb, ee_cert, SEC_ERROR_UNKNOWN_ISSUER,
certificateUsageEmailSigner);
checkCertErrorGeneric(certdb, ee_cert, SEC_ERROR_UNKNOWN_ISSUER,
certificateUsageEmailRecipient);
checkCertErrorGeneric(certdb, ee_cert, SEC_ERROR_UNKNOWN_ISSUER,
certificateUsageObjectSigner);
// Now make a CA trust anchor available.
setCertTrust(ca_cert, "CTu,CTu,CTu");
checkCertErrorGeneric(certdb, ee_cert, PRErrorCodeSuccess,
certificateUsageSSLServer);
checkCertErrorGeneric(certdb, ee_cert, PRErrorCodeSuccess,
certificateUsageSSLClient);
checkCertErrorGeneric(certdb, ee_cert, PRErrorCodeSuccess,
certificateUsageEmailSigner);
checkCertErrorGeneric(certdb, ee_cert, PRErrorCodeSuccess,
certificateUsageEmailRecipient);
checkCertErrorGeneric(certdb, ee_cert, PRErrorCodeSuccess,
certificateUsageObjectSigner);
}