mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Backed out changeset 3afdc3253979 (bug 622859) for breaking m1 tests

This commit is contained in:
Carsten "Tomcat" Book 2014-10-17 13:14:29 +02:00
Родитель d893b9cc90
Коммит e5ad1e7db2
10 изменённых файлов: 33 добавлений и 49 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

7
security/apps/AppTrustDomain.cpp
Просмотреть файл

@ -30,8 +30,6 @@ using namespace mozilla::pkix;
extern PRLogModuleInfo* gPIPNSSLog;
#endif
static const unsigned int MINIMUM_NON_ECC_BITS = 2048;
namespace mozilla { namespace psm {
AppTrustDomain::AppTrustDomain(ScopedCERTCertList& certChain, void* pinArg)
@ -215,7 +213,7 @@ AppTrustDomain::VerifySignedData(const SignedDataWithSignature& signedData,
Input subjectPublicKeyInfo)
{
return ::mozilla::pkix::VerifySignedData(signedData, subjectPublicKeyInfo,
MINIMUM_NON_ECC_BITS, mPinArg);
mPinArg);
}
Result
@ -249,8 +247,7 @@ AppTrustDomain::IsChainValid(const DERArray& certChain, Time time)
Result
AppTrustDomain::CheckPublicKey(Input subjectPublicKeyInfo)
{
return ::mozilla::pkix::CheckPublicKey(subjectPublicKeyInfo,
MINIMUM_NON_ECC_BITS);
return ::mozilla::pkix::CheckPublicKey(subjectPublicKeyInfo);
}
} } // namespace mozilla::psm

25
security/certverifier/CertVerifier.cpp
Просмотреть файл

@ -211,7 +211,7 @@ CertVerifier::VerifyCert(CERTCertificate* cert, SECCertificateUsage usage,
// just use trustEmail as it is the closest alternative.
NSSCertDBTrustDomain trustDomain(trustEmail, ocspFetching, mOCSPCache,
pinArg, ocspGETConfig, pinningDisabled,
false, nullptr, builtChain);
nullptr, builtChain);
rv = BuildCertChain(trustDomain, certDER, time,
EndEntityOrCA::MustBeEndEntity,
KeyUsage::digitalSignature,
@ -236,7 +236,7 @@ CertVerifier::VerifyCert(CERTCertificate* cert, SECCertificateUsage usage,
ocspFetching == NSSCertDBTrustDomain::NeverFetchOCSP
? NSSCertDBTrustDomain::LocalOnlyOCSPForEV
: NSSCertDBTrustDomain::FetchOCSPForEV,
mOCSPCache, pinArg, ocspGETConfig, mPinningMode, true,
mOCSPCache, pinArg, ocspGETConfig, mPinningMode,
hostname, builtChain);
rv = BuildCertChainForOneKeyUsage(trustDomain, certDER, time,
KeyUsage::digitalSignature,// (EC)DHE
@ -261,7 +261,7 @@ CertVerifier::VerifyCert(CERTCertificate* cert, SECCertificateUsage usage,
// Now try non-EV.
NSSCertDBTrustDomain trustDomain(trustSSL, ocspFetching, mOCSPCache,
pinArg, ocspGETConfig, mPinningMode,
false, hostname, builtChain);
hostname, builtChain);
rv = BuildCertChainForOneKeyUsage(trustDomain, certDER, time,
KeyUsage::digitalSignature, // (EC)DHE
KeyUsage::keyEncipherment, // RSA
@ -275,7 +275,7 @@ CertVerifier::VerifyCert(CERTCertificate* cert, SECCertificateUsage usage,
case certificateUsageSSLCA: {
NSSCertDBTrustDomain trustDomain(trustSSL, ocspFetching, mOCSPCache,
pinArg, ocspGETConfig, pinningDisabled,
false, nullptr, builtChain);
nullptr, builtChain);
rv = BuildCertChain(trustDomain, certDER, time,
EndEntityOrCA::MustBeCA, KeyUsage::keyCertSign,
KeyPurposeId::id_kp_serverAuth,
@ -286,7 +286,7 @@ CertVerifier::VerifyCert(CERTCertificate* cert, SECCertificateUsage usage,
case certificateUsageEmailSigner: {
NSSCertDBTrustDomain trustDomain(trustEmail, ocspFetching, mOCSPCache,
pinArg, ocspGETConfig, pinningDisabled,
false, nullptr, builtChain);
nullptr, builtChain);
rv = BuildCertChain(trustDomain, certDER, time,
EndEntityOrCA::MustBeEndEntity,
KeyUsage::digitalSignature,
@ -301,7 +301,7 @@ CertVerifier::VerifyCert(CERTCertificate* cert, SECCertificateUsage usage,
// based on the result of the verification(s).
NSSCertDBTrustDomain trustDomain(trustEmail, ocspFetching, mOCSPCache,
pinArg, ocspGETConfig, pinningDisabled,
false, nullptr, builtChain);
nullptr, builtChain);
rv = BuildCertChain(trustDomain, certDER, time,
EndEntityOrCA::MustBeEndEntity,
KeyUsage::keyEncipherment, // RSA
@ -320,8 +320,7 @@ CertVerifier::VerifyCert(CERTCertificate* cert, SECCertificateUsage usage,
case certificateUsageObjectSigner: {
NSSCertDBTrustDomain trustDomain(trustObjectSigning, ocspFetching,
mOCSPCache, pinArg, ocspGETConfig,
pinningDisabled, false, nullptr,
builtChain);
pinningDisabled, nullptr, builtChain);
rv = BuildCertChain(trustDomain, certDER, time,
EndEntityOrCA::MustBeEndEntity,
KeyUsage::digitalSignature,
@ -349,15 +348,15 @@ CertVerifier::VerifyCert(CERTCertificate* cert, SECCertificateUsage usage,
}
NSSCertDBTrustDomain sslTrust(trustSSL, ocspFetching, mOCSPCache, pinArg,
ocspGETConfig, pinningDisabled, false,
nullptr, builtChain);
ocspGETConfig, pinningDisabled, nullptr,
builtChain);
rv = BuildCertChain(sslTrust, certDER, time, endEntityOrCA,
keyUsage, eku, CertPolicyId::anyPolicy,
stapledOCSPResponse);
if (rv == Result::ERROR_UNKNOWN_ISSUER) {
NSSCertDBTrustDomain emailTrust(trustEmail, ocspFetching, mOCSPCache,
pinArg, ocspGETConfig, pinningDisabled,
false, nullptr, builtChain);
nullptr, builtChain);
rv = BuildCertChain(emailTrust, certDER, time, endEntityOrCA,
keyUsage, eku, CertPolicyId::anyPolicy,
stapledOCSPResponse);
@ -365,8 +364,8 @@ CertVerifier::VerifyCert(CERTCertificate* cert, SECCertificateUsage usage,
NSSCertDBTrustDomain objectSigningTrust(trustObjectSigning,
ocspFetching, mOCSPCache,
pinArg, ocspGETConfig,
pinningDisabled, false,
nullptr, builtChain);
pinningDisabled, nullptr,
builtChain);
rv = BuildCertChain(objectSigningTrust, certDER, time,
endEntityOrCA, keyUsage, eku,
CertPolicyId::anyPolicy, stapledOCSPResponse);

10
security/certverifier/NSSCertDBTrustDomain.cpp
Просмотреть файл

@ -35,9 +35,6 @@ extern PRLogModuleInfo* gCertVerifierLog;
static const uint64_t ServerFailureDelaySeconds = 5 * 60;
static const unsigned int MINIMUM_NON_ECC_BITS_DV = 1024;
static const unsigned int MINIMUM_NON_ECC_BITS_EV = 2048;
namespace mozilla { namespace psm {
const char BUILTIN_ROOTS_MODULE_DEFAULT_NAME[] = "Builtin Roots Module";
@ -56,7 +53,6 @@ NSSCertDBTrustDomain::NSSCertDBTrustDomain(SECTrustType certDBTrustType,
/*optional but shouldn't be*/ void* pinArg,
CertVerifier::ocsp_get_config ocspGETConfig,
CertVerifier::PinningMode pinningMode,
bool forEV,
/*optional*/ const char* hostname,
/*optional*/ ScopedCERTCertList* builtChain)
: mCertDBTrustType(certDBTrustType)
@ -65,7 +61,6 @@ NSSCertDBTrustDomain::NSSCertDBTrustDomain(SECTrustType certDBTrustType,
, mPinArg(pinArg)
, mOCSPGetConfig(ocspGETConfig)
, mPinningMode(pinningMode)
, mMinimumNonECCBits(forEV ? MINIMUM_NON_ECC_BITS_EV : MINIMUM_NON_ECC_BITS_DV)
, mHostname(hostname)
, mBuiltChain(builtChain)
{
@ -231,7 +226,7 @@ NSSCertDBTrustDomain::VerifySignedData(const SignedDataWithSignature& signedData
Input subjectPublicKeyInfo)
{
return ::mozilla::pkix::VerifySignedData(signedData, subjectPublicKeyInfo,
mMinimumNonECCBits, mPinArg);
mPinArg);
}
Result
@ -668,8 +663,7 @@ NSSCertDBTrustDomain::IsChainValid(const DERArray& certArray, Time time)
Result
NSSCertDBTrustDomain::CheckPublicKey(Input subjectPublicKeyInfo)
{
return ::mozilla::pkix::CheckPublicKey(subjectPublicKeyInfo,
mMinimumNonECCBits);
return ::mozilla::pkix::CheckPublicKey(subjectPublicKeyInfo);
}
namespace {

2
security/certverifier/NSSCertDBTrustDomain.h
Просмотреть файл

@ -54,7 +54,6 @@ public:
OCSPCache& ocspCache, void* pinArg,
CertVerifier::ocsp_get_config ocspGETConfig,
CertVerifier::PinningMode pinningMode,
bool forEV,
/*optional*/ const char* hostname = nullptr,
/*optional out*/ ScopedCERTCertList* builtChain = nullptr);
@ -107,7 +106,6 @@ private:
void* mPinArg; // non-owning!
const CertVerifier::ocsp_get_config mOCSPGetConfig;
CertVerifier::PinningMode mPinningMode;
const unsigned int mMinimumNonECCBits;
const char* mHostname; // non-owning - only used for pinning checks
ScopedCERTCertList* mBuiltChain; // non-owning
};

7
security/pkix/include/pkix/pkixnss.h
Просмотреть файл

@ -34,7 +34,6 @@ namespace mozilla { namespace pkix {
// Verify the given signed data using the given public key.
Result VerifySignedData(const SignedDataWithSignature& sd,
Input subjectPublicKeyInfo,
unsigned int minimumNonECCBits,
void* pkcs11PinArg);
// Computes the SHA-1 hash of the data in the current item.
@ -51,10 +50,8 @@ Result VerifySignedData(const SignedDataWithSignature& sd,
Result DigestBuf(Input item, /*out*/ uint8_t* digestBuf,
size_t digestBufLen);
// Checks, for RSA keys and DSA keys, that the modulus is at least the given
// number of bits.
Result CheckPublicKey(Input subjectPublicKeyInfo,
unsigned int minimumNonECCBits);
// Checks, for RSA keys and DSA keys, that the modulus is at least 1024 bits.
Result CheckPublicKey(Input subjectPublicKeyInfo);
Result MapPRErrorCodeToResult(PRErrorCode errorCode);
PRErrorCode MapResultToPRErrorCode(Result result);

18
security/pkix/lib/pkixnss.cpp
Просмотреть файл

@ -39,7 +39,7 @@ namespace mozilla { namespace pkix {
typedef ScopedPtr<SECKEYPublicKey, SECKEY_DestroyPublicKey> ScopedSECKeyPublicKey;
Result
CheckPublicKeySize(Input subjectPublicKeyInfo, unsigned int minimumNonECCBits,
CheckPublicKeySize(Input subjectPublicKeyInfo,
/*out*/ ScopedSECKeyPublicKey& publicKey)
{
SECItem subjectPublicKeyInfoSECItem =
@ -54,13 +54,16 @@ CheckPublicKeySize(Input subjectPublicKeyInfo, unsigned int minimumNonECCBits,
return MapPRErrorCodeToResult(PR_GetError());
}
static const unsigned int MINIMUM_NON_ECC_BITS = 1024;
switch (publicKey.get()->keyType) {
case ecKey:
// TODO(bug 1077790): We should check which curve.
// TODO(bug 622859): We should check which curve.
return Success;
case dsaKey: // fall through
case rsaKey:
if (SECKEY_PublicKeyStrengthInBits(publicKey.get()) < minimumNonECCBits) {
// TODO(bug 622859): Enforce a minimum of 2048 bits for EV certs.
if (SECKEY_PublicKeyStrengthInBits(publicKey.get()) < MINIMUM_NON_ECC_BITS) {
return Result::ERROR_INADEQUATE_KEY_SIZE;
}
break;
@ -78,16 +81,15 @@ CheckPublicKeySize(Input subjectPublicKeyInfo, unsigned int minimumNonECCBits,
}
Result
CheckPublicKey(Input subjectPublicKeyInfo, unsigned int minimumNonECCBits)
CheckPublicKey(Input subjectPublicKeyInfo)
{
ScopedSECKeyPublicKey unused;
return CheckPublicKeySize(subjectPublicKeyInfo, minimumNonECCBits, unused);
return CheckPublicKeySize(subjectPublicKeyInfo, unused);
}
Result
VerifySignedData(const SignedDataWithSignature& sd,
Input subjectPublicKeyInfo, unsigned int minimumNonECCBits,
void* pkcs11PinArg)
Input subjectPublicKeyInfo, void* pkcs11PinArg)
{
SECOidTag pubKeyAlg;
SECOidTag digestAlg;
@ -140,7 +142,7 @@ VerifySignedData(const SignedDataWithSignature& sd,
Result rv;
ScopedSECKeyPublicKey pubKey;
rv = CheckPublicKeySize(subjectPublicKeyInfo, minimumNonECCBits, pubKey);
rv = CheckPublicKeySize(subjectPublicKeyInfo, pubKey);
if (rv != Success) {
return rv;
}

4
security/pkix/test/gtest/pkixbuild_tests.cpp
Просмотреть файл

@ -169,7 +169,7 @@ private:
Input subjectPublicKeyInfo)
{
return ::mozilla::pkix::VerifySignedData(signedData, subjectPublicKeyInfo,
MINIMUM_TEST_KEY_BITS, nullptr);
nullptr);
}
virtual Result DigestBuf(Input item, /*out*/ uint8_t *digestBuf,
@ -352,7 +352,7 @@ public:
Input subjectPublicKeyInfo)
{
return ::mozilla::pkix::VerifySignedData(signedData, subjectPublicKeyInfo,
MINIMUM_TEST_KEY_BITS, nullptr);
nullptr);
}
virtual Result DigestBuf(Input, /*out*/uint8_t*, size_t)

2
security/pkix/test/gtest/pkixcert_signature_algorithm_tests.cpp
Просмотреть файл

@ -111,7 +111,7 @@ private:
{
EXPECT_NE(SignatureAlgorithm::unsupported_algorithm, signedData.algorithm);
return ::mozilla::pkix::VerifySignedData(signedData, subjectPublicKeyInfo,
MINIMUM_TEST_KEY_BITS, nullptr);
nullptr);
}
virtual Result DigestBuf(Input, uint8_t*, size_t)

5
security/pkix/test/lib/pkixtestnss.cpp
Просмотреть файл

@ -259,7 +259,7 @@ Result
TestCheckPublicKey(Input subjectPublicKeyInfo)
{
InitNSSIfNeeded();
return CheckPublicKey(subjectPublicKeyInfo, MINIMUM_TEST_KEY_BITS);
return CheckPublicKey(subjectPublicKeyInfo);
}
Result
@ -267,8 +267,7 @@ TestVerifySignedData(const SignedDataWithSignature& signedData,
Input subjectPublicKeyInfo)
{
InitNSSIfNeeded();
return VerifySignedData(signedData, subjectPublicKeyInfo,
MINIMUM_TEST_KEY_BITS, nullptr);
return VerifySignedData(signedData, subjectPublicKeyInfo, nullptr);
}
Result

2
security/pkix/test/lib/pkixtestutil.h
Просмотреть файл

@ -33,8 +33,6 @@
#include "pkix/pkixtypes.h"
#include "pkix/ScopedPtr.h"
static const unsigned int MINIMUM_TEST_KEY_BITS = 1024;
namespace mozilla { namespace pkix { namespace test {
typedef std::basic_string<uint8_t> ByteString;