From 6978e35bf56a342eccc06b3c1b10b5a6fbb2c261 Mon Sep 17 00:00:00 2001 From: David Keeler Date: Wed, 11 Mar 2015 11:11:22 -0700 Subject: [PATCH] bug 1138332 - re-allow overrides for certificates signed by non-CA certificates r=mmc --HG-- extra : amend_source : 92a2dcf71daa6b31be0dcae628a13b13b0fc443a --- security/manager/ssl/src/NSSErrorsService.cpp | 1 + .../ssl/src/SSLServerCertVerification.cpp | 2 ++ .../ssl/tests/unit/test_cert_overrides.js | 10 ++++++++-- .../manager/ssl/tests/unit/tlsserver/cert9.db | Bin 294912 -> 294912 bytes .../unit/tlsserver/cmd/BadCertServer.cpp | 1 + .../tests/unit/tlsserver/generate_certs.sh | 2 ++ .../manager/ssl/tests/unit/tlsserver/key4.db | Bin 491520 -> 524288 bytes 7 files changed, 14 insertions(+), 2 deletions(-) diff --git a/security/manager/ssl/src/NSSErrorsService.cpp b/security/manager/ssl/src/NSSErrorsService.cpp index a4d689d1c83a..bc90c75dcb7c 100644 --- a/security/manager/ssl/src/NSSErrorsService.cpp +++ b/security/manager/ssl/src/NSSErrorsService.cpp @@ -151,6 +151,7 @@ ErrorIsOverridable(PRErrorCode code) case mozilla::pkix::MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE: case mozilla::pkix::MOZILLA_PKIX_ERROR_NOT_YET_VALID_ISSUER_CERTIFICATE: case mozilla::pkix::MOZILLA_PKIX_ERROR_V1_CERT_USED_AS_CA: + case SEC_ERROR_CA_CERT_INVALID: case SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED: case SEC_ERROR_EXPIRED_CERTIFICATE: case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE: diff --git a/security/manager/ssl/src/SSLServerCertVerification.cpp b/security/manager/ssl/src/SSLServerCertVerification.cpp index c074da8ee4ed..7180437b98a6 100644 --- a/security/manager/ssl/src/SSLServerCertVerification.cpp +++ b/security/manager/ssl/src/SSLServerCertVerification.cpp @@ -300,6 +300,7 @@ MapOverridableErrorToProbeValue(PRErrorCode errorCode) switch (errorCode) { case SEC_ERROR_UNKNOWN_ISSUER: return 2; + case SEC_ERROR_CA_CERT_INVALID: return 3; case SEC_ERROR_UNTRUSTED_ISSUER: return 4; case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE: return 5; case SEC_ERROR_UNTRUSTED_CERT: return 6; @@ -370,6 +371,7 @@ DetermineCertOverrideErrors(CERTCertificate* cert, const char* hostName, case SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED: case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE: case SEC_ERROR_UNKNOWN_ISSUER: + case SEC_ERROR_CA_CERT_INVALID: case mozilla::pkix::MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY: case mozilla::pkix::MOZILLA_PKIX_ERROR_INADEQUATE_KEY_SIZE: case mozilla::pkix::MOZILLA_PKIX_ERROR_V1_CERT_USED_AS_CA: diff --git a/security/manager/ssl/tests/unit/test_cert_overrides.js b/security/manager/ssl/tests/unit/test_cert_overrides.js index 859a6e7486e4..2244c6299efc 100644 --- a/security/manager/ssl/tests/unit/test_cert_overrides.js +++ b/security/manager/ssl/tests/unit/test_cert_overrides.js @@ -53,7 +53,7 @@ function check_telemetry() { .snapshot(); do_check_eq(histogram.counts[ 0], 0); do_check_eq(histogram.counts[ 2], 7); // SEC_ERROR_UNKNOWN_ISSUER - do_check_eq(histogram.counts[ 3], 0); // SEC_ERROR_CA_CERT_INVALID + do_check_eq(histogram.counts[ 3], 1); // SEC_ERROR_CA_CERT_INVALID do_check_eq(histogram.counts[ 4], 0); // SEC_ERROR_UNTRUSTED_ISSUER do_check_eq(histogram.counts[ 5], 1); // SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE do_check_eq(histogram.counts[ 6], 0); // SEC_ERROR_UNTRUSTED_CERT @@ -75,7 +75,7 @@ function check_telemetry() { do_check_eq(keySizeHistogram.counts[0], 0); do_check_eq(keySizeHistogram.counts[1], 0); // 0 successful verifications of 2048-bit keys do_check_eq(keySizeHistogram.counts[2], 4); // 4 successful verifications of 1024-bit keys - do_check_eq(keySizeHistogram.counts[3], 47); // 47 verification failures + do_check_eq(keySizeHistogram.counts[3], 49); // 49 verification failures run_next_test(); } @@ -194,6 +194,12 @@ function add_simple_tests() { run_next_test(); }); + // Due to compatibility issues, we allow overrides for certificates issued by + // certificates that are not valid CAs. + add_cert_override_test("end-entity-issued-by-non-CA.example.com", + Ci.nsICertOverrideService.ERROR_UNTRUSTED, + getXPCOMStatusFromNSS(SEC_ERROR_CA_CERT_INVALID)); + add_cert_override_test("inadequate-key-size-ee.example.com", Ci.nsICertOverrideService.ERROR_UNTRUSTED, getXPCOMStatusFromNSS(MOZILLA_PKIX_ERROR_INADEQUATE_KEY_SIZE)); diff --git a/security/manager/ssl/tests/unit/tlsserver/cert9.db b/security/manager/ssl/tests/unit/tlsserver/cert9.db index ec74aea2feb7457b07ebcf51214ccc859826e058..d39c77e9c3cbcecb7b229cbc36e9df5f56e77e88 100644 GIT binary patch delta 1985 zcmb_d3p7+|9KVklGh}AUV?3fXv}SE(MnsQ|WQs&hC5Mu9vV_H&8S^k}2BktmbLaMA ztw$-<5!u-`(VLagLkDSzP;4HR)Km_8FSXlt>U7$(-@V_x|L_05-~adB-}k%!E0^oZ z<$4)YL90x&rJ&X6%>`pHA~}JOz<#o%R&qh|3pRKT&Qq~L$cLwL0il^%Ol_C|F(`Uw z0Q%ON3Mk)NrT~IlGt`%x0fp+01Y{9mgm)Mv$-!^}?;)=pjgf{}@%=$M$Ta04_>_J;6bQMA%CvQ?&e`I&ct&<$|;X zzXYRLf&rDP2Vl(&eR={8*Ttn!zjoPRxZN5W<(hqG)N`B)ccSq=4WgB7h6bTsF;!!ggTUvDs`V);tGC zemX0XPw)0hnJ0O2ih`a4pO?q}=?0wMOOA%vwH8xUe`qtF^=W zLaJTx{Qe`d(crGK?0&l@PuGjq{VnM`?iChkO8d^GYD5Rg1I6d{SFJaE$uirzCLSqD zoww+GhurbuDx;uoHGR;RXh~)0D!%u=u7(#^Sd4bI3C6VT=GG4r%l~{4ai2Z%vO+$$ z!_{=3c6ji;{m9yxkq&_ zuYMvNSl-pRaA0vw1J~U@-6qeD70}Ls7$>_ccWxUsK`X2uM zHd&-MIAvwpS(iw7*Lpk$TJs4hGUWyFS7*|giWi%Q8L^26oC1q?RYi+u`<3qgwGP#F zv?2&vS{JiA-VDI z)$RwU_cpP740K%j!c?yU6ZTj(3Vo=^5I(q|S_Vls_#-8bHjf^@>RXW=Z8X0qnK*~b4zxm84!NWYUq-`oYQ!G#Y zgYwDsO7&an+v+||En(Wt+*Z=I-I0-ry%?lAaC+VkCXVfWB}`@9A`>g-F;quYYFGTP zxLL8Gx})Z7<)7_R4NSs}%=0Q*A)2-WHD$6ubS?YA6vxgyu{35XJ9Df|`LFVaH5xVi zHSslWl~XFK%U6|8tbb8|zKW^x<1rKBRhXNaq@uz{UO3?1RVg4+Cd$!U2qzPnopFdatN(n}<5~cv4M(?1%q7QqSKqDx_ zR0)TUg~AB;4K_NjaGb=|atfPMgSY7}b{ao;?E@A;P{GE;z09`vu zw=fepya@^kfee1q(f{o5p9KOSeMYeKj|n*0`2B+~{@3fT{!SJEUHR$l3GXgwWo;#F zZSmK9^?ud~{r^%R2Gaex;8&e6V4dITgaK>+PAAM)>nHuN|6dGPfHZ$9_&1#}V2z`6 zvA+hS{##uDr1sYU#Rvl?@V%QdN6?Ew2!GIOdNGn^C2%XS zvKodV2?atx2EfWh8VoyqFiV&!R5}C>IQ)nH@o^Gq*tc|0Ugmg5e??#|+l#yaJC6}l zlE?ZNzSb=-EUFvX>}J2TXXd~LheDXeI8Cdy5)P&UTkc%5Oa#xPH>V3tGz;BcLBF5M zv!VW0PhhAV$;gHi7?(4mR_ZT{LrtR?rUqwcKEHPgRn9P70T|(x6{7so&i`OAJ1;dw zZz^!4#Am3lm2-%E<71wD)8nRA<=~@irC!I`SiKuULK;X8c4h(uT=Fb;W+DUwjWalo zLKG{Dg`TAjqX59e0UY#0hEoBl_JSS^HmpEs)2cb zX58z5Oh~wU1BzSRbe<60{nmgHo|0ooBy+MENln)K%t!U%?#73O!AiMe9Y3nsO~n!? zghXfcOBG)ox3Mn25{stltB^9zid-%J?~`XJX}t@&NpG+@Z)G@_8Owf`+{lUrWl(nR z+y;d>-sjuG-F)mdV=&-RkrXuvn2Vg_(AN}b_5*s(Mn$57?I300Mvl zAwVQnrwDoy?KBeg7FspLhoG3ZrsM-Bgpa0xfIvtHkW?71k_jKka)j-LtCD`lsovPP zZuO5(>BemZn-1$B$u@+BQm^rm$*p0+zJ@>D6q3E`T3J~Y zFTZFk&}hrD{v(^aWSr(fp@C;uKW?>k>YYRIv~W9mJaJ?tCENGB+I-NWcPC7xYB#o- zA(J&7c_pIfG+<9rq{a=nZ0nlyTrN|^dEeeWB9`~e@?AEHp<6YR*JXmnzwXinZ8WS! zzy7j6H2p;7LRvmcgKeI{3G`b*) z#7_7`v#Vhla|Cg;K2X(`ey`$-xIp<6WgK&ybq9=N!%IG&?rc;&Wy9*ULJ{Z@Xf&OB z!60j-kpPwAyDqX1Pt>0sjw(1(>2*(2kT`$opv&4dwfDC)FX6PeB!onV{3h@h^zh#| z5Y6X`RIoEsSI3qk1Oe`!wC0Tbc}!RD=8x$)u`QHj2c&gp@I<`ASL+R4bsh??Ad6K{ z_xcilS|veuxv1rA%pA~{eV5HWp~X#@nSCcL*e=hw%_#IW#13)Hc#ef*y*&?RsWb{! zy-GCda?**(g*(4oM8E_?Z-GrVt>NKST$4nAg+cvm*U!>N4n3za6-c6nR(w7`US)HyqTT#LV+ zHN9dzQ>CcR_nFt}IDJOhv7yWRd#q+2Y#GnS?;%#RDD9ZS*21fvo)mAWsd2l?3%@7M zGC81;?3i}{3el)?_UrBX!qm?i%8vY}rF>+IJGE_zMz3#cHI@(X*csV07~k1@sdOFR z!bZx=b$drwAd>U|#Lu$%Eh0wM=C0G?y=cE#b}FAlk@lC_FNb|Z#n5@YuynH%W3^+?1wJtH*M&`F3&N+1#10O+Iys`n^Ej0{D># z2_mzlxyOcEGO105?`ictqEYFNcy>OzZ$TdIPxvQgYw{3D=QfB&J2n#AA5})%OS(Yc z?m=)bR?pIty24He+RjctUQ+(Pc)V!)xcGe}5~}bKauJ|>1uX-xJCEs=9C$Os`Tk`{ z@?D(?O7!uC4f*1@K6!2E6j|ztr4HXdv#kVH?IFQyBlYHsMKf&A$b@saNS|ig;isu3 z74u5xTIYwY)2&uB5ZBaT_wA*c5|0y&Qp((Sa;gQ@H z$p3G3JG=<^b#*)H+x5?@TUG&itM;1Ds?zMh#Z{@!UL9qlSgsr)0nH8!K4`606R?$~M@!p8kh(YGqUa^FDA&v@v&-M>$=+&`YNK{I*-?=BzoJpJJ z8?4?TX<}w2kxkeAcnvFW*SyA3h%(zZ^NMJT%*q-PviXa z_qf%j_*=bDey-k7RM92fh25s)hxrN&>|1mQUw`K+^g+lP6YZ^Gz;*u)d6SH|W#ghY zKkDs2BucLvvdZoby-6voUB}SB=ul2)`Zy?X^(48>vSanOS#S*7fX`LRY`Y6?b|<^- z#viu4N$U*vt(zSKTD;^;;QwiLJAtknqE?n%@WgjMfqj#M*vx`8D3uP+2g3692t2BS4^TuHl_PEef+C zYPH(7YvViC{FHxwq((1wHP%-slxA2s?~^0<)BN|k3DRbYE{t%`%cKF>XqIya6ILtB zQY?Nu$6#|WTLB?D0r9rtzNH_1?7sxL4rA0u%2Tq^&0)=TxBO{~PewByC@m#pBCG{_ z7FGL6bU_0dChzk@GO3oxvRdS0a6_ePZZ&Wpg|JGqz*ntjaa&Cs3kA}CR1@7>+}25z zA64T&!!Nu;nT{EFz_P+t&Zaz#d2fkoR?8K0^=7(sQBSSNyUsL9I(LC)>xT4eTw2Hc z311CjbUcZhnO3Xpx?#44Xtx;m-or(#82%X@BUvZ=cP|Sdzm21WwD0Pn*BN{E%LrC1 z2IGy!l%umlxX5_x;7-^SZ!1)NrycNm;A)Y`a*Vk!@BSqNQNRw=NMQ5JXa_XuHzxKKtiPc^jnTUO| zo1@aZKrPQjG%9E%C%^b~p>q@!-vPIH0KF%1iGpYpZ2o}$>qg|m*T=9uQD4rGMMg}c zuN0eqw-SU(T75+A_3)tZ?nSjhwE?HJF^)O|+~2a58U|WYG(rbiCK{J($y{YeWEnm; ze)$~Yks3OhgrRsrsVp152*1#cxpJ3Q7GNDrH^C-&iw}#FtFsH^-1XIT$w6f@@&>-U z?HJfNOz_dkHW2Oa_tT!Z;mB#IaGM+~gjn={kxz2-^3*Kc^59HI# zms$%_$F(eb#um?M6fu}ktrpo?wTk$LG|DZJNXa93Icey)i=YWYxfb0H71`-YiY8$n zK9YVZsrukq`gt`5wKK(>>U&&v)R5yA0%@KJ!M}3kq;F=UNzz+>kW(o#3wN_suexlT z9uK2-TpQtmhH89SZ^|>f*fvfyTJR<=;!8rb`WbQ%K3jO+Wmmd0ooEz3ijaw+uoY~r z%VK3%*XHn~5#P>~G8A5-ggMY4uby`?eC7IF4sjC?d}gpWHM6~!e2t=XXfPb%CLJ?w zkP$NB)EPnJ1c*h%HB6_@IV)Fs^B)T?eyg*ggz98GmkBRR)WAGpyFHZKvvmH2^?BRr zGiTk&yazencAiug{|>%EV_j%58f)?>hiJ4h5N{FbzZN0DZB{z_Oz8@=eRqy%ba1T5 z2<4AZy|yWm`SqISaKME9t9>VuiuKz5!AW(?MroesB456E)Rhm3l~V~RL$qfeaCAMP zzU_KP##hxd9l9EEZaWHJ(x~#PcyU`U@=>36&9*5jh;q}?f}>r7J5`MA)Aj+H`QGjB zmut#t=C^L&+}49L-M$PYZ$8d@;TfWlOm{{h>vAIsZ+DTRLxVf6nvg?|lU-v2y> zZ_9`rE^k5AjR7z@h`@2eI(E{N9Dp_odJ;q#Xn(Wi=IH=$|2O_ze&N28z7jr3-mBiq zUO6{*Z|Hkgc#;#Y0Eayof?2~*P}x5(aQ|h;2K)9ggol~BtwL&2KO4YOi_5YQTX2Z# zT+wE8fBe~3z_|P)0>t=8 zh!wWEiqHxu($`d0!h4Q>q;;hd>_1iZ?O;;r!{SIockpTT#sQH(2L>~-M_FD>`#hA& z@gUY!c;nQEeI8TRcbEL`3))7~(-J5~e?!TFL3x-wXwS@ zwrMKZKW`#SzLj%Fm)Oa`@r6ClmvNn6?%kf8cXHw4WyAI92YCu3;|;SHO1u0C6oVrv z*w2iFO%ygmV+o!zYw~Am7pYahP>1KY+PG_dSFoYXX zGhMq;_Bz#5(rQ){0BL+0ljV?e*oywq5Lq_@q&gI$*I7tf@^t~0dOD1@4=B1Tcb-M} z6JTNN-dV;D@*fbf+1f-)wRuvgJ4+XHA#c;(>BI?(75}FpK7GCn#RZAOgx#R4|GFDQ z++oE&ZiMhMcMNyr;%i*rIShZ&IQ@)W_<0PF{6U6MMruXz`tV9qA(63(?X#wKW%raA zQTrqumQ58gyucZ6E71<$e7ClH$x*Q%EEbSPhe15 zre6h0=A6R<6{&>`e=sCaO|>)bCz0;k43&7Rk%4wp4P7Ff6@a zhV|!0Au(9ilbnr(ByU6;KS|Hy$3N~D@H8^nKd^Ao!eaw1x;8tA6k(o;-Ocp5Sx4yx zlvBl5!A<9Q6N5)6>Y5$2VvUuSFM*=_H`OL>-OL#a-k39lC~N}&MLP#lr2%Q zh}0qbKwW-9_y+r_A$Rqj$XP<~7^IR=94>imDa!F~rBt172v0 zW&kqG`r*mXW2#Img=-lffCv!nBOw;VU~#3lRBG4y+D}nJb*7!U=lS0IHzmHF9yZ!? zUqwq&T6c+*uig4BCu~O~=!doPfP4=3_Aa57X85)9F%Zn$lBu3Pfui*{lpn!zY0k^G zXJ-wz_^1T85Sjzdy9`|owvd8ZoP9o!A@mqQq);uptDkySdhv1ZN6JqEGEYmjIF41; zuXFhtIS3Bq{_4kjK=7lf|Ra{vDDkphe#(-hZvF${{+hoQ*CKImdBR?NN(kB$@~j zqvdCC{HVLrZl*X>?8UTh=A*zjhf=FGJ(m9vZkS$2fT$e}VX-Gb%(^sVLq;>Q7)mr} z_v^FP4UH%4&`JD~oRE^RFzOS<~< I^#=z32kX_`wg3PC delta 267 zcmZo@P-tk7n;^}~&A`CGKT*M+k$YpplK;%6bt+TY8N;?FGH$G$tk58~U8Rok0V7cO z$8`1v#_Y|44Q+MXfBa+Q0f|LUWoH5jJ+Iv!S;w>*n~;!c)fI*sqdK)Z`La4|42d6@s%%Fgng zX}c0LOCIC)87wR-3^pq?ykMH{V9LTfJ*tI`zg@zD1&CR