roytam1/UXP
1
0
Fork 0
mirror of https://github.com/roytam1/UXP.git synced 2026-07-20 22:18:32 +00:00
Code Issues Projects Releases Wiki Activity

security/pkix: align pkix with nss' mozpkix and fix CheckRevocation API type in application codes

Browse Source
This commit is contained in:
roytam1
2021-12-17 22:09:38 +08:00
parent a140666918
commit 2a8bbf94bb
11 changed files with 22 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/apps/AppTrustDomain.cpp
+1 -2
View File
@@ -291,8 +291,7 @@ AppTrustDomain::DigestBuf(Input item,
}
Result
AppTrustDomain::CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
/*optional*/ const Input*,
AppTrustDomain::CheckRevocation(EndEntityOrCA, const CertID&, Time, Time, Duration,
/*optional*/ const Input*,
/*optional*/ const Input*)
{
security/apps/AppTrustDomain.h
+2 -2
View File
@@ -35,10 +35,10 @@ public:
virtual Result CheckRevocation(mozilla::pkix::EndEntityOrCA endEntityOrCA,
const mozilla::pkix::CertID& certID,
mozilla::pkix::Time time,
mozilla::pkix::Time validityBeginning,
mozilla::pkix::Duration validityDuration,
/*optional*/ const mozilla::pkix::Input* stapledOCSPresponse,
/*optional*/ const mozilla::pkix::Input* aiaExtension,
/*optional*/ const mozilla::pkix::Input* sctExtension) override;
/*optional*/ const mozilla::pkix::Input* aiaExtension) override;
virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain,
mozilla::pkix::Time time,
const mozilla::pkix::CertPolicyId& requiredPolicy) override;
security/certverifier/CTLogVerifier.cpp
+2 -2
View File
@@ -41,8 +41,8 @@ public:
return Result::FATAL_ERROR_LIBRARY_FAILURE;
}
Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
const Input*, const Input*, const Input*) override
Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Time, Duration,
const Input*, const Input*) override
{
return Result::FATAL_ERROR_LIBRARY_FAILURE;
}
security/certverifier/NSSCertDBTrustDomain.cpp
+2 -2
View File
@@ -346,10 +346,10 @@ GetOCSPAuthorityInfoAccessLocation(const UniquePLArenaPool& arena,
Result
NSSCertDBTrustDomain::CheckRevocation(EndEntityOrCA endEntityOrCA,
const CertID& certID, Time time,
Time validityBeginning,
Duration validityDuration,
/*optional*/ const Input* stapledOCSPResponse,
/*optional*/ const Input* aiaExtension,
/*optional*/ const Input* sctExtension)
/*optional*/ const Input* aiaExtension)
{
// Actively distrusted certificates will have already been blocked by
// GetCertTrust.
security/certverifier/NSSCertDBTrustDomain.h
+2 -2
View File
@@ -132,10 +132,10 @@ public:
mozilla::pkix::EndEntityOrCA endEntityOrCA,
const mozilla::pkix::CertID& certID,
mozilla::pkix::Time time,
mozilla::pkix::Time validityBeginning,
mozilla::pkix::Duration validityDuration,
/*optional*/ const mozilla::pkix::Input* stapledOCSPResponse,
/*optional*/ const mozilla::pkix::Input* aiaExtension,
/*optional*/ const mozilla::pkix::Input* sctExtension)
/*optional*/ const mozilla::pkix::Input* aiaExtension)
override;
virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain,
security/certverifier/OCSPVerificationTrustDomain.cpp
+2 -2
View File
@@ -43,8 +43,8 @@ OCSPVerificationTrustDomain::IsChainValid(const DERArray&, Time, const CertPolic
Result
OCSPVerificationTrustDomain::CheckRevocation(EndEntityOrCA, const CertID&,
Time, Duration, const Input*,
const Input*, const Input*)
Time, Time, Duration, const Input*,
const Input*)
{
// We do not expect this to be called for OCSP signers
return Result::FATAL_ERROR_LIBRARY_FAILURE;
security/certverifier/OCSPVerificationTrustDomain.h
+2 -2
View File
@@ -66,10 +66,10 @@ public:
mozilla::pkix::EndEntityOrCA endEntityOrCA,
const mozilla::pkix::CertID& certID,
mozilla::pkix::Time time,
mozilla::pkix::Time validityBeginning,
mozilla::pkix::Duration validityDuration,
/*optional*/ const mozilla::pkix::Input* stapledOCSPResponse,
/*optional*/ const mozilla::pkix::Input* aiaExtension,
/*optional*/ const mozilla::pkix::Input* sctExtension)
/*optional*/ const mozilla::pkix::Input* aiaExtension)
override;
virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain,
security/manager/ssl/CSTrustDomain.cpp
+2 -2
View File
@@ -127,10 +127,10 @@ CSTrustDomain::FindIssuer(Input encodedIssuerName, IssuerChecker& checker,
Result
CSTrustDomain::CheckRevocation(EndEntityOrCA endEntityOrCA,
const CertID& certID, Time time,
Time validityBeginning,
Duration validityDuration,
/*optional*/ const Input* stapledOCSPresponse,
/*optional*/ const Input* aiaExtension,
/*optional*/ const Input* sctExtension)
/*optional*/ const Input* aiaExtension)
{
// We're relying solely on the CertBlocklist for revocation - and we're
// performing checks on this in GetCertTrust (as per nsNSSCertDBTrustDomain)
security/manager/ssl/CSTrustDomain.h
+2 -2
View File
@@ -34,10 +34,10 @@ public:
virtual Result CheckRevocation(
mozilla::pkix::EndEntityOrCA endEntityOrCA,
const mozilla::pkix::CertID& certID, mozilla::pkix::Time time,
mozilla::pkix::Time validityBeginning,
mozilla::pkix::Duration validityDuration,
/*optional*/ const mozilla::pkix::Input* stapledOCSPresponse,
/*optional*/ const mozilla::pkix::Input* aiaExtension,
/*optional*/ const mozilla::pkix::Input* sctExtension) override;
/*optional*/ const mozilla::pkix::Input* aiaExtension) override;
virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain,
mozilla::pkix::Time time,
const mozilla::pkix::CertPolicyId& requiredPolicy) override;
security/pkix/include/pkix/pkixtypes.h
+2 -2
View File
@@ -260,10 +260,10 @@ class TrustDomain {
virtual Result CheckRevocation(EndEntityOrCA endEntityOrCA,
const CertID& certID, Time time,
Time validityBeginning,
Duration validityDuration,
/*optional*/ const Input* stapledOCSPresponse,
/*optional*/ const Input* aiaExtension,
/*optional*/ const Input* sctExtension) = 0;
/*optional*/ const Input* aiaExtension) = 0;
// Check that the given digest algorithm is acceptable for use in signatures.
//
security/pkix/lib/pkixbuild.cpp
+3 -3
View File
@@ -234,9 +234,9 @@ PathBuildingStep::Check(Input potentialIssuerDER,
}
Duration validityDuration(notAfter, notBefore);
rv = trustDomain.CheckRevocation(subject.endEntityOrCA, certID, time,
validityDuration, stapledOCSPResponse,
subject.GetAuthorityInfoAccess(),
subject.GetSignedCertificateTimestamps());
notBefore, validityDuration,
stapledOCSPResponse,
subject.GetAuthorityInfoAccess());
if (rv != Success) {
// Since this is actually a problem with the current subject certificate
// (rather than the issuer), it doesn't make sense to keep going; all