Bug 730792 - Enable new security checks for updates without the service. r=rstrong

modules/libmar/tests/unit/test_sign_verify.js

@@ -57,8 +57,7 @@ function run_test() {
 
     // The XPCShell test wiki indicates this is the preferred way for 
     // Windows detection.
-    var isWindows = ("@mozilla.org/windows-registry-key;1" 
-                     in Cc);
+    var isWindows = ("@mozilla.org/windows-registry-key;1" in Cc);
 
     // Setup the command line arguments to create the MAR.
     // Windows vs. Linux/Mac/... have different command line for verification 

toolkit/mozapps/update/nsUpdateService.js

@@ -151,15 +151,6 @@ const SERVICE_UPDATER_IDENTITY_ERROR       = 16004;
 const SERVICE_STILL_APPLYING_ON_SUCCESS    = 16005;
 const SERVICE_STILL_APPLYING_ON_FAILURE    = 16006;
 
-// Updater MAR security errors
-const CERT_LOAD_ERROR                         = 17;
-const CERT_HANDLING_ERROR                     = 18;
-const CERT_VERIFY_ERROR                       = 19;
-const ARCHIVE_NOT_OPEN                        = 20;
-const COULD_NOT_READ_PRODUCT_INFO_BLOCK_ERROR = 21;
-const MAR_CHANNEL_MISMATCH_ERROR              = 22;
-const VERSION_DOWNGRADE_ERROR                 = 23;
-
 const CERT_ATTR_CHECK_FAILED_NO_UPDATE  = 100;
 const CERT_ATTR_CHECK_FAILED_HAS_UPDATE = 101;
 const BACKGROUNDCHECK_MULTIPLE_FAILURES = 110;
@@ -1424,14 +1415,7 @@ UpdateService.prototype = {
             update.errorCode == SERVICE_UPDATER_COMPARE_ERROR ||
             update.errorCode == SERVICE_UPDATER_IDENTITY_ERROR ||
             update.errorCode == SERVICE_STILL_APPLYING_ON_SUCCESS ||
-            update.errorCode == SERVICE_STILL_APPLYING_ON_FAILURE ||
-            update.errorCode == CERT_LOAD_ERROR ||
-            update.errorCode == CERT_HANDLING_ERROR ||
-            update.errorCode == CERT_VERIFY_ERROR ||
-            update.errorCode == ARCHIVE_NOT_OPEN ||
-            update.errorCode == COULD_NOT_READ_PRODUCT_INFO_BLOCK_ERROR ||
-            update.errorCode == MAR_CHANNEL_MISMATCH_ERROR ||
-            update.errorCode == VERSION_DOWNGRADE_ERROR) {
+            update.errorCode == SERVICE_STILL_APPLYING_ON_FAILURE) {
           var failCount = getPref("getIntPref", 
                                   PREF_APP_UPDATE_SERVICE_ERRORS, 0);
           var maxFail = getPref("getIntPref", 

toolkit/mozapps/update/updater/updater.cpp

@@ -1563,23 +1563,9 @@ ReadMARChannelIDs(const NS_tchar *path, MARChannelStringTable *results)
   return result;
 }
 
-struct UpdateThreadData 
-{
-  UpdateThreadData(bool performMARChecks) :
-    mPerformMARChecks(performMARChecks)
-  {
-  }
-
-  bool mPerformMARChecks;
-};
-
 static void
 UpdateThreadFunc(void *param)
 {
-  UpdateThreadData *threadData = reinterpret_cast<UpdateThreadData*>(param);
-  bool performMARChecks = threadData && threadData->mPerformMARChecks;
-  delete threadData;
-  
   // open ZIP archive and process...
   int rv;
   NS_tchar dataFile[MAXPATHLEN];
@@ -1588,30 +1574,28 @@ UpdateThreadFunc(void *param)
 
   rv = gArchiveReader.Open(dataFile);
 
-  if (performMARChecks) {
 #ifdef MOZ_VERIFY_MAR_SIGNATURE
-    if (rv == OK) {
-      rv = gArchiveReader.VerifySignature();
-    }
-
-    if (rv == OK) {
-      NS_tchar updateSettingsPath[MAX_TEXT_LEN];
-      NS_tsnprintf(updateSettingsPath, 
-                   sizeof(updateSettingsPath) / sizeof(updateSettingsPath[0]),
-                   NS_T("%supdate-settings.ini"), gDestPath);
-      MARChannelStringTable MARStrings;
-      if (ReadMARChannelIDs(updateSettingsPath, &MARStrings) != OK) {
-        // If we can't read from update-settings.ini then we shouldn't impose
-        // a MAR restriction.  Some installations won't even include this file.
-        MARStrings.MARChannelID[0] = '\0';
-      }
-
-      rv = gArchiveReader.VerifyProductInformation(MARStrings.MARChannelID,
-                                                   MOZ_APP_VERSION);
-    }
-#endif
+  if (rv == OK) {
+    rv = gArchiveReader.VerifySignature();
   }
 
+  if (rv == OK) {
+    NS_tchar updateSettingsPath[MAX_TEXT_LEN];
+    NS_tsnprintf(updateSettingsPath, 
+                 sizeof(updateSettingsPath) / sizeof(updateSettingsPath[0]),
+                 NS_T("%supdate-settings.ini"), gDestPath);
+    MARChannelStringTable MARStrings;
+    if (ReadMARChannelIDs(updateSettingsPath, &MARStrings) != OK) {
+      // If we can't read from update-settings.ini then we shouldn't impose
+      // a MAR restriction.  Some installations won't even include this file.
+      MARStrings.MARChannelID[0] = '\0';
+    }
+
+    rv = gArchiveReader.VerifyProductInformation(MARStrings.MARChannelID,
+                                                 MOZ_APP_VERSION);
+  }
+#endif
+
   if (rv == OK) {
     rv = DoUpdate();
     gArchiveReader.Close();
@@ -2123,7 +2107,7 @@ int NS_main(int argc, NS_tchar **argv)
   // before QuitProgressUI has been called, so wait for UpdateThreadFunc to
   // terminate.
   Thread t;
-  if (t.Run(UpdateThreadFunc, new UpdateThreadData(usingService)) == 0) {
+  if (t.Run(UpdateThreadFunc, NULL) == 0) {
     ShowProgressUI();
   }
   t.Join();