Bug 406755, EV certs not recognized as EV with some cross-certification scenarios second landing attempt, earlier EV verification, patch 9 r=rrelyea also landing a regression fix, which applies to debug mode compilation code, only r=rrelyea blocking1.9=dsicore

security/manager/ssl/src/nsIdentityChecking.cpp

@@ -450,13 +450,15 @@ loadTestEVInfos()
         descriptor.EqualsLiteral(("2_readable_oid"))) {
       readable_oid = data;
       reader_position = pos_issuer;
+      continue;
     }
     else if (reader_position == pos_issuer &&
         descriptor.EqualsLiteral(("3_issuer"))) {
       issuer = data;
       reader_position = pos_serial;
+      continue;
     }
-    else if (reader_position == pos_readable_oid &&
+    else if (reader_position == pos_serial &&
         descriptor.EqualsLiteral(("4_serial"))) {
       serial = data;
       reader_position = pos_fingerprint;

security/manager/ssl/src/nsNSSCallbacks.cpp

@@ -914,7 +914,20 @@ SECStatus PR_CALLBACK AuthCertificateCallback(void* client_data, PRFileDesc* fd,
   CERTCertificateCleaner serverCertCleaner(serverCert);
 
   if (serverCert) {
+    nsNSSSocketInfo* infoObject = (nsNSSSocketInfo*) fd->higher->secret;
+    nsRefPtr<nsSSLStatus> status = infoObject->SSLStatus();
+    nsRefPtr<nsNSSCertificate> nsc;
+
+    if (!status || !status->mServerCert) {
+      nsc = new nsNSSCertificate(serverCert);
+    }
+
     if (SECSuccess == rv) {
+      if (nsc) {
+        PRBool dummyIsEV;
+        nsc->GetIsExtendedValidation(&dummyIsEV); // the nsc object will cache the status
+      }
+    
       CERTCertList *certList = CERT_GetCertChainFromCert(serverCert, PR_Now(), certUsageSSLCA);
 
       nsCOMPtr<nsINSSComponent> nssComponent;
@@ -958,15 +971,12 @@ SECStatus PR_CALLBACK AuthCertificateCallback(void* client_data, PRFileDesc* fd,
     // The connection may get terminated, for example, if the server requires
     // a client cert. Let's provide a minimal SSLStatus
     // to the caller that contains at least the cert and its status.
-    nsNSSSocketInfo* infoObject = (nsNSSSocketInfo*) fd->higher->secret;
-
-    nsRefPtr<nsSSLStatus> status = infoObject->SSLStatus();
     if (!status) {
       status = new nsSSLStatus();
       infoObject->SetSSLStatus(status);
     }
     if (status && !status->mServerCert) {
-      status->mServerCert = new nsNSSCertificate(serverCert);
+      status->mServerCert = nsc;
       PR_LOG(gPIPNSSLog, PR_LOG_DEBUG,
              ("AuthCertificateCallback setting NEW cert %p\n", status->mServerCert.get()));
     }

security/manager/ssl/src/nsNSSCertificateDB.cpp

@@ -87,7 +87,7 @@ NSSCleanupAutoPtrClass(CERTCertificateList, CERT_DestroyCertificateList)
 static NS_DEFINE_CID(kNSSComponentCID, NS_NSSCOMPONENT_CID);
 
 
-NS_IMPL_ISUPPORTS2(nsNSSCertificateDB, nsIX509CertDB, nsIX509CertDB2)
+NS_IMPL_THREADSAFE_ISUPPORTS2(nsNSSCertificateDB, nsIX509CertDB, nsIX509CertDB2)
 
 nsNSSCertificateDB::nsNSSCertificateDB()
 {