bug 1591691 - avoid network I/O when importing enterprise roots on Windows r=mhowell

Differential Revision: https://phabricator.services.mozilla.com/D51007

--HG--
extra : moz-landing-system : lando
This commit is contained in:
Dana Keeler 2019-10-31 00:36:53 +00:00
Родитель 8846cf3d21
Коммит 18ab5dba01
1 изменённых файлов: 11 добавлений и 2 удалений

Просмотреть файл

@ -92,9 +92,18 @@ static void CertIsTrustAnchorForTLSServerAuth(PCCERT_CONTEXT certificate,
memset(&chainPara, 0, sizeof(CERT_CHAIN_PARA)); memset(&chainPara, 0, sizeof(CERT_CHAIN_PARA));
chainPara.cbSize = sizeof(CERT_CHAIN_PARA); chainPara.cbSize = sizeof(CERT_CHAIN_PARA);
chainPara.RequestedUsage = certUsage; chainPara.RequestedUsage = certUsage;
// Disable anything that could result in network I/O.
DWORD flags = CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY |
CERT_CHAIN_CACHE_ONLY_URL_RETRIEVAL |
CERT_CHAIN_DISABLE_AUTH_ROOT_AUTO_UPDATE |
// mingw's version of wincrypt.h doesn't define this flag (bug 1592792).
# if defined(CERT_CHAIN_DISABLE_AIA)
CERT_CHAIN_DISABLE_AIA;
# else
0x00002000;
# endif
if (!CertGetCertificateChain(nullptr, certificate, nullptr, nullptr, if (!CertGetCertificateChain(nullptr, certificate, nullptr, nullptr,
&chainPara, 0, nullptr, &pChainContext)) { &chainPara, flags, nullptr, &pChainContext)) {
MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("CertGetCertificateChain failed")); MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("CertGetCertificateChain failed"));
return; return;
} }