Граф коммитов

264 Коммитов

Автор SHA1 Сообщение Дата
Cykesiopka 56c6899d8e Bug 1325107 - Stop using PR_ASSERT() in PSM. r=mgoodwin
PR_ASSERT() is an unnecessary dependency on NSPR.
We can use MOZ_ASSERT() instead, which accomplishes the same task but doesn't
depend on NSPR.

MozReview-Commit-ID: 9gyWUkv3KxQ

--HG--
extra : rebase_source : 313ce6c8de3db3ce72635e37f09d28316ae02c51
2017-01-02 14:11:30 +08:00
David Keeler d339ca2730 bug 1312827 - make the certificate blocklist only apply to TLS server certificates r=jcj,mgoodwin
(Note that content signature verification does not use the unified certificate
verifier and thus will still consult OneCRL.)

MozReview-Commit-ID: 6KvHOngpabT

--HG--
extra : rebase_source : 601f4d8d1c66befb77d0c07a2d84f3f04416f996
2016-12-22 16:57:20 -08:00
David Keeler 0e8a35a56d Backed out changeset 68d6f69e0837 (bug 1301407) for not being necessary any longer r=dragana
MozReview-Commit-ID: EcoJ3BEpRlQ

--HG--
extra : histedit_source : 98c0f5cf8f3f00afc581b746aca93e16c5997795
2016-12-21 16:22:04 -08:00
Cykesiopka e8b35af2ec Bug 1313715 - Avoid unnecessary uses of PR_SetError() under security/apps/ and security/certverifier/. r=keeler
The PR_SetError() + PR_GetError() pattern is error prone and unnecessary.

Also fixes Bug 1254403.

MozReview-Commit-ID: DRI69xY4vxC

--HG--
extra : rebase_source : aa07c0dfb5cc2a203e772b415b7a75b27d9bad3c
2016-12-14 20:10:25 +08:00
Wes Kocher d360bdebf5 Merge inbound to central, a=merge 2016-12-01 15:31:47 -08:00
Sergei Chernov 19e9f4d7ed Bug 1317951, part 2 - Certificate Transparency - basic support for disqualified logs. r=keeler
MozReview-Commit-ID: 4y2JYFnO9Xm

--HG--
extra : rebase_source : 3d6dbfa4d0a6a24dbd8907f42071943895ba068a
2016-11-29 22:51:46 +02:00
Sergei Chernov 08a30eac51 Bug 1317951, part 1 - Certificate Transparency - extracted verification related fields from SCT to a separate struct. r=keeler
MozReview-Commit-ID: 3iHUdZrzyXB

--HG--
extra : rebase_source : d5590733c87c3a8a525eb29dabfdb9be2822a0a6
2016-11-23 15:37:31 +02:00
Ms2ger b4ff4ad7ea Bug 1319831 - Clarify some code with explicit casts; r=Waldo 2016-12-01 09:23:21 +01:00
Ms2ger 53af63d8fa Bug 1319831 - Remove an unbalanced pragma from Vector.h; r=Waldo 2016-12-01 09:23:21 +01:00
Jonathan Hao 6fe3399188 Bug 1315143 - Disable warnings caused by including BasePrincipal.h r=Cykesiopka,keeler
--HG--
extra : rebase_source : 79e9d80eada5e4c0450852da4d0bbc42e5e9f1bf
2016-11-23 14:56:20 +08:00
Jonathan Hao 88a5aac5aa Bug 1315143 - Make OCSP use Origin Attribute framework (PSM). r=Cykesiopka,keeler
--HG--
extra : rebase_source : 6ee53f5f4ce6a0cc842eb27c6890bdfde9563237
2016-11-14 18:26:15 +08:00
Carsten "Tomcat" Book e7ca75286b Merge mozilla-central to inbound 2016-11-16 14:53:15 +01:00
Sergei Chernov fd387b2ec7 Bug 1308787 - Certificate Transparency - script for generating the static list of known logs. r=Cykesiopka,keeler
MozReview-Commit-ID: 9z7Ac5OQqOP

--HG--
extra : rebase_source : 99db3caf90f0cb109727787a24dd80022d9bb25e
2016-11-08 13:54:39 +02:00
Carsten "Tomcat" Book 788a6efc4c Backed out changeset 81a11a25d25d (bug 1315143) 2016-11-14 12:52:16 +01:00
Jonathan Hao 06ffb1f775 Bug 1315143 - Make OCSP use Origin Attribute framework (PSM). r=mayhemer
--HG--
extra : rebase_source : 5047ebd0245729109635ba5ad99dc3f6a18b57ae
2016-11-14 18:26:15 +08:00
David Keeler 8c2f5cbb94 bug 1301407 - add annotated crashes to find out why PSM initialization is failing r=dragana
Crash reports indicate LoadExtendedValidationInfo is failing. This adds
annotated crashes that should point us at exactly what is failing. (Note that
because Nightly builds aren't built with DEBUG defined, the majority of
LoadExtendedValidationInfo isn't even run, so we can ignore that code.)

--HG--
extra : amend_source : 0940efc65bb706b572f0699ab5c66b82d6591d30
2016-11-14 12:44:53 -08:00
Jonathan Hao 736db2051a Bug 1312794 - Annotate OCSP requests by first party domain. (adapted from Tor Browser patch #13670) r=keeler
--HG--
extra : rebase_source : 1ba4d78756f9170c1ba05738dda06b9ad00a3231
2016-11-03 17:53:52 +08:00
Jan de Mooij 31df59e394 Bug 1311996 - Fix code using pkix::Result to not conflict with the new mozilla::Result type. r=keeler 2016-10-31 10:05:13 +01:00
David Keeler 544761d217 bug 1309707 - revoke StartCom and WoSign certificates issued after 21 October 2016 r=Cykesiopka,jcj
MozReview-Commit-ID: 1itMZuWY9HO

--HG--
extra : rebase_source : 5e46c04d959ab1b6e7c961e0b5d4fff7ad6417bc
2016-10-12 17:02:33 -07:00
David Keeler b3a0669843 bug 1227638 - deterministically load EV information r=Cykesiopka,mgoodwin
Previously PSM would load EV information on-demand (i.e. just before verifying a
certificate). This simplifies this operation, removes a dubious optimization
(loading the EV information on another thread while opening a network
connection), and relocates the loading operation to when we are likely to have
good disk locality (i.e. when we've just loaded the built-in roots module).

This also removes the now-unused MOZ_NO_EV_CERTS build flag.

MozReview-Commit-ID: 8Rnl4ozF95V

--HG--
extra : rebase_source : 5b2e76079c256f7e3c55b1d4ec0d9f654fec44f6
2016-09-30 18:08:08 -07:00
Jonathan Hao 8c7b033b68 Bug 1264562 - Part 5: Double key OCSP cache with firstPartyDomain (adapted from Tor Browser patch #13670) r=keeler
--HG--
extra : rebase_source : cfca6f16dcd315c03704e75ed63181466a8eb5c4
2016-10-18 17:08:39 +08:00
Jonathan Hao d9e14ecf6a Bug 1264562 - Part 4: Instantiates an NSSCertDBTrustDomain containing the first party domain (adapted from Tor Browser patch #13670) r=keeler
--HG--
extra : rebase_source : c43aa11ae06a3281219d1c70c0ec274c258e43c8
2016-10-04 16:49:55 +08:00
Wes Kocher 13054d32fc Backed out changeset 003ec40aa484 (bug 1227638) for android Cpp failures a=backout 2016-10-17 15:08:41 -07:00
David Keeler ec181af1f7 bug 1227638 - deterministically load EV information r=Cykesiopka,mgoodwin
Previously PSM would load EV information on-demand (i.e. just before verifying a
certificate). This simplifies this operation, removes a dubious optimization
(loading the EV information on another thread while opening a network
connection), and relocates the loading operation to when we are likely to have
good disk locality (i.e. when we've just loaded the built-in roots module).

This also removes the now-unused MOZ_NO_EV_CERTS build flag.

MozReview-Commit-ID: 8Rnl4ozF95V

--HG--
extra : rebase_source : 344b68c81af1ed3fb038e4e96c3c50e939d32c3d
2016-09-30 18:08:08 -07:00
David Keeler 238b27055a bug 1282008 - update CNNIC whitelist to remove expired certificates r=rbarnes
MozReview-Commit-ID: 1OopsrAxXrv

--HG--
extra : rebase_source : 49813d3da508059f503304a98aa8a03777d4f4ce
2016-10-06 14:45:51 -07:00
Cykesiopka a5b764f858 Bug 495357 - Update some documentation concerning SaveIntermediateCerts(). r=kaie,me
Original patch by Wan-Teh Chang.

MozReview-Commit-ID: 3ElvC7DanYJ
2016-10-11 19:39:00 +02:00
Cykesiopka 275d94abd0 Bug 1296317 - Stop calling PR_SetError() in VerifyCert() and VerifySSLServerCert(). r=keeler
The PR_SetError() + PR_GetError() pattern currently used is error prone and
unnecessary. The functions involved can instead return mozilla::pkix::Result,
which is equally expressive and more robust.

MozReview-Commit-ID: Hkd39eqTvds

--HG--
extra : rebase_source : f09e37c6a3a930c30cce003139df86bc84d771ee
2016-10-10 15:44:41 +08:00
Cykesiopka ca5051d9c8 Bug 1296214 - Stop storing handle to CERTCertificate in ExtendedValidation.cpp. r=keeler
This may save us some memory and reduce the number of static constructors.

MozReview-Commit-ID: FNIkiFtRjfK

--HG--
extra : rebase_source : d2781f11db7a1f8370c0e6c6c8e6f0fb52122614
2016-10-06 16:43:45 +08:00
David Keeler 8d6b6a78fe bug 1243923 - add support for the CA/Browser Forum EV OID r=Cykesiopka,jcj
MozReview-Commit-ID: 4zqzistEhvo

--HG--
extra : rebase_source : 62d28c3715fcb225ec83ba422621dd3f8c40f708
2016-09-02 16:39:15 -07:00
Sergei Chernov 976d5c3f1d Bug 1293231 - Certificate Transparency - basic telemetry reports; r=Cykesiopka,keeler
MozReview-Commit-ID: EGvuZADObJo

--HG--
extra : rebase_source : 9a059c9f8e2fdf9bfc693b0b5649808b1beeb67b
2016-08-11 13:41:50 +03:00
David Keeler b1cb7643ef bug 1302140 - add policy to disable SHA-1 except for certificates issued by non-built-in CAs r=jcj,rbarnes
MozReview-Commit-ID: 2uwHPxk0VhZ

--HG--
extra : rebase_source : 1c7b5d2559139fa8286342decf4e4f7c83317e29
2016-09-14 15:11:15 -07:00
Sebastian Hengst d8888f81d1 Backed out changeset 2df66e8b7411 (bug 1302140) for Windows build bustage in CertVerifier.cpp. r=backout on a CLOSED TREE 2016-09-21 20:47:08 +02:00
David Keeler d374bc442a bug 1302140 - add policy to disable SHA-1 except for certificates issued by non-built-in CAs r=jcj,rbarnes
MozReview-Commit-ID: 2uwHPxk0VhZ

--HG--
extra : rebase_source : 5b1342abc2eb260ec91464b3a1d331baf8968460
2016-09-14 15:11:15 -07:00
Igor 60cd1e3bb7 Bug 1296180 - Replace more uses of PR_ARRAY_SIZE with mozilla::ArrayLength. r=keeler,mt 2016-09-09 13:17:52 -07:00
Cykesiopka 80c7f24081 Bug 1274135 - Replace char_ptr_cast() and uint8_t_ptr_cast() with mozilla::BitwiseCast. r=keeler,valentin
The functions aren't necessary now that we have BitwiseCast.

MozReview-Commit-ID: 2nzOuwAop4Y

--HG--
extra : rebase_source : 0cb2c16f484a81b2e77384564973b58ac2d10fb9
2016-09-08 20:46:26 +08:00
Ryan VanderMeulen 57d3c61d9b Backed out changeset db5d2a3899c0 (bug 1274135) for bustage. 2016-09-07 20:52:18 -04:00
Cykesiopka 0193f94d53 Bug 1274135 - Replace char_ptr_cast() and uint8_t_ptr_cast() with mozilla::BitwiseCast. r=keeler,valentin
The functions aren't necessary now that we have BitwiseCast.

MozReview-Commit-ID: 2nzOuwAop4Y

--HG--
extra : rebase_source : 196449249eec75b8eb10e59662231c3f4e83c268
2016-09-01 15:58:51 +08:00
Cykesiopka 2e47d34ebc Bug 1256302 - Remove CertVerifier::InitCertVerifierLog(). r=jcj 2016-09-02 10:45:47 +02:00
Kan-Ru Chen b6d880aca1 Bug 1297276 - Rename mfbt/unused.h to mfbt/Unused.h for consistency. r=froydnj
The patch is generated from following command:

  rgrep -l unused.h|xargs sed -i -e s,mozilla/unused.h,mozilla/Unused.h,

MozReview-Commit-ID: AtLcWApZfES


--HG--
rename : mfbt/unused.h => mfbt/Unused.h
2016-08-24 14:47:04 +08:00
Cykesiopka 9529f2321e Bug 1294011 - Obviate manual calls to SECITEM_FreeItem() in PSM. r=keeler
MozReview-Commit-ID: 7RNV0YNraBx

--HG--
extra : rebase_source : bd4c8981b52e3f5a504fc09958872415cf757eff
2016-08-13 21:45:00 +08:00
Cykesiopka 2c9b1285df Bug 1289455 - Obviate manual CERT_DestroyCertificate() calls in PSM. r=dkeeler
MozReview-Commit-ID: Aoi1VWvkNjp

--HG--
extra : transplant_source : B%8F9%E7%E8%84%7D%D1%7B%5Due%ED%9A%E8%DE%05%5B%E2D
2016-08-05 23:57:44 +08:00
Sergei Chernov 21be681857 Bug 1284256 - Certificate Transparency - verification of Signed Certificate Timestamps (RFC 6962); r=keeler, r=Cykesiopka
MozReview-Commit-ID: IgcnyBH4Up

--HG--
extra : transplant_source : %98%A3%5E%B4%DA%89qI1%01A%F8%FF%C7%1FS%D4%23v%B3
2016-07-05 08:35:06 +03:00
David Keeler 67199d7bf6 bug 1289885 - Enable VeriSign Class 3 Public PCA - G4 for EV in PSM r=jcj
MozReview-Commit-ID: GDZnZcVCNl6

--HG--
extra : rebase_source : ffdfa0fac7d4114e1251d00ced4c6ca7aab1ec86
2016-07-27 14:06:09 -07:00
Andi-Bogdan Postelnicu d19b17ffc3 Bug 1289366 - added return statement for CharToByte when assertion fails. r=keeler
MozReview-Commit-ID: LDAamOxHdli

--HG--
extra : rebase_source : 7a180b058c3d756074b4cb2f56356c41eaf9919d
2016-07-26 12:48:49 +03:00
Tom Tromey 5538d692d3 Bug 1286877 - do not set c-basic-offset for python-mode; r=gps
This removes the unnecessary setting of c-basic-offset from all
python-mode files.

This was automatically generated using

    perl -pi -e 's/; *c-basic-offset: *[0-9]+//'

... on the affected files.

The bulk of these files are moz.build files but there a few others as
well.

MozReview-Commit-ID: 2pPf3DEiZqx

--HG--
extra : rebase_source : 0a7dcac80b924174a2c429b093791148ea6ac204
2016-07-14 10:16:42 -06:00
David Keeler a77caa9d20 bug 1274677 - Enable Certplus and OpenTrust root certificates for EV in PSM r=Cykesiopka
MozReview-Commit-ID: 4rZ0NIEyKF6

--HG--
extra : rebase_source : 089184f70e3a6949da5211f464c51fb113db997a
2016-07-15 14:51:08 -07:00
Sergei Chernov edb1f658f6 Bug 1275238 - Certificate Transparency support in mozilla::pkix; r=keeler
MozReview-Commit-ID: HZwzSgxarTw

--HG--
extra : transplant_source : %BF%F9%A8T%C6x%82%03%3Ez%9F%3BT%E3%1B%11s%294%F4
2016-06-15 11:11:00 +03:00
David Keeler 3fed4e5ecc bug 1272858 - use a name-agnostic method to find the built-in root PKCS#11 slot r=Cykesiopka
Previously this implementation would use the expected names of the built-in
module and slot to get a handle on them. This doesn't work on distributions that
use other names. The new implementation searches through the slots from the
default module list for one where PK11_HasRootCerts returns true (which
indicates that NSS considers that slot to contain the default built-in root
list).

MozReview-Commit-ID: LmX27hQfFJU

--HG--
extra : rebase_source : 50383dcc77257fe08ce2c7d908e95cda7c4bbe9d
2016-06-23 15:43:47 -07:00
David Keeler baead5135e bug 1277240 - don't import trust anchors in SaveIntermediateCerts r=Cykesiopka
MozReview-Commit-ID: KHwA2LJSeUS

--HG--
extra : rebase_source : e1f7a469d2dc8608adf4b0172f99d9adb192bbb5
2016-06-02 13:17:14 -07:00
Sergei Chernov d46c2e938b Bug 1241574 - Certificate Transparency - base definitions and serialization to/from TLS wire format. r=keeler, r=Cykesiopka
MozReview-Commit-ID: KmJOr2crof7

--HG--
extra : transplant_source : %97%2A%03p%7CP%09%CA%60J%D22%91%3C%C1%C9%B8%C6%89%D8
2016-04-11 16:17:25 +03:00