wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-08-15 08:53:07 +09:00
Code Issues Projects Releases Packages Wiki Activity

security/pkix: align pkix with nss' mozpkix and fix CheckRevocation API type in application codes

Browse source
This commit is contained in:
roytam1 2021-12-17 22:09:38 +08:00
commit 2a8bbf94bb
11 changed files with 22 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

3
security/apps/AppTrustDomain.cpp
View file

@ -291,8 +291,7 @@ AppTrustDomain::DigestBuf(Input item,
} }
Result Result
AppTrustDomain::CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration, AppTrustDomain::CheckRevocation(EndEntityOrCA, const CertID&, Time, Time, Duration,
/*optional*/ const Input*,
/*optional*/ const Input*, /*optional*/ const Input*,
/*optional*/ const Input*) /*optional*/ const Input*)
{ {

4
security/apps/AppTrustDomain.h
View file

@ -35,10 +35,10 @@ public:
virtual Result CheckRevocation(mozilla::pkix::EndEntityOrCA endEntityOrCA, virtual Result CheckRevocation(mozilla::pkix::EndEntityOrCA endEntityOrCA,
const mozilla::pkix::CertID& certID, const mozilla::pkix::CertID& certID,
mozilla::pkix::Time time, mozilla::pkix::Time time,
mozilla::pkix::Time validityBeginning,
mozilla::pkix::Duration validityDuration, mozilla::pkix::Duration validityDuration,
/*optional*/ const mozilla::pkix::Input* stapledOCSPresponse, /*optional*/ const mozilla::pkix::Input* stapledOCSPresponse,
/*optional*/ const mozilla::pkix::Input* aiaExtension, /*optional*/ const mozilla::pkix::Input* aiaExtension) override;
/*optional*/ const mozilla::pkix::Input* sctExtension) override;
virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain, virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain,
mozilla::pkix::Time time, mozilla::pkix::Time time,
const mozilla::pkix::CertPolicyId& requiredPolicy) override; const mozilla::pkix::CertPolicyId& requiredPolicy) override;

4
security/certverifier/CTLogVerifier.cpp
View file

@ -41,8 +41,8 @@ public:
return Result::FATAL_ERROR_LIBRARY_FAILURE; return Result::FATAL_ERROR_LIBRARY_FAILURE;
} }
Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration, Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Time, Duration,
const Input*, const Input*, const Input*) override const Input*, const Input*) override
{ {
return Result::FATAL_ERROR_LIBRARY_FAILURE; return Result::FATAL_ERROR_LIBRARY_FAILURE;
} }

4
security/certverifier/NSSCertDBTrustDomain.cpp
View file

@ -346,10 +346,10 @@ GetOCSPAuthorityInfoAccessLocation(const UniquePLArenaPool& arena,
Result Result
NSSCertDBTrustDomain::CheckRevocation(EndEntityOrCA endEntityOrCA, NSSCertDBTrustDomain::CheckRevocation(EndEntityOrCA endEntityOrCA,
const CertID& certID, Time time, const CertID& certID, Time time,
Time validityBeginning,
Duration validityDuration, Duration validityDuration,
/*optional*/ const Input* stapledOCSPResponse, /*optional*/ const Input* stapledOCSPResponse,
/*optional*/ const Input* aiaExtension, /*optional*/ const Input* aiaExtension)
/*optional*/ const Input* sctExtension)
{ {
// Actively distrusted certificates will have already been blocked by // Actively distrusted certificates will have already been blocked by
// GetCertTrust. // GetCertTrust.

4
security/certverifier/NSSCertDBTrustDomain.h
View file

@ -132,10 +132,10 @@ public:
mozilla::pkix::EndEntityOrCA endEntityOrCA, mozilla::pkix::EndEntityOrCA endEntityOrCA,
const mozilla::pkix::CertID& certID, const mozilla::pkix::CertID& certID,
mozilla::pkix::Time time, mozilla::pkix::Time time,
mozilla::pkix::Time validityBeginning,
mozilla::pkix::Duration validityDuration, mozilla::pkix::Duration validityDuration,
/*optional*/ const mozilla::pkix::Input* stapledOCSPResponse, /*optional*/ const mozilla::pkix::Input* stapledOCSPResponse,
/*optional*/ const mozilla::pkix::Input* aiaExtension, /*optional*/ const mozilla::pkix::Input* aiaExtension)
/*optional*/ const mozilla::pkix::Input* sctExtension)
override; override;
virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain, virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain,

4
security/certverifier/OCSPVerificationTrustDomain.cpp
View file

@ -43,8 +43,8 @@ OCSPVerificationTrustDomain::IsChainValid(const DERArray&, Time, const CertPolic
Result Result
OCSPVerificationTrustDomain::CheckRevocation(EndEntityOrCA, const CertID&, OCSPVerificationTrustDomain::CheckRevocation(EndEntityOrCA, const CertID&,
Time, Duration, const Input*, Time, Time, Duration, const Input*,
const Input*, const Input*) const Input*)
{ {
// We do not expect this to be called for OCSP signers // We do not expect this to be called for OCSP signers
return Result::FATAL_ERROR_LIBRARY_FAILURE; return Result::FATAL_ERROR_LIBRARY_FAILURE;

4
security/certverifier/OCSPVerificationTrustDomain.h
View file

@ -66,10 +66,10 @@ public:
mozilla::pkix::EndEntityOrCA endEntityOrCA, mozilla::pkix::EndEntityOrCA endEntityOrCA,
const mozilla::pkix::CertID& certID, const mozilla::pkix::CertID& certID,
mozilla::pkix::Time time, mozilla::pkix::Time time,
mozilla::pkix::Time validityBeginning,
mozilla::pkix::Duration validityDuration, mozilla::pkix::Duration validityDuration,
/*optional*/ const mozilla::pkix::Input* stapledOCSPResponse, /*optional*/ const mozilla::pkix::Input* stapledOCSPResponse,
/*optional*/ const mozilla::pkix::Input* aiaExtension, /*optional*/ const mozilla::pkix::Input* aiaExtension)
/*optional*/ const mozilla::pkix::Input* sctExtension)
override; override;
virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain, virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain,

4
security/manager/ssl/CSTrustDomain.cpp
View file

@ -127,10 +127,10 @@ CSTrustDomain::FindIssuer(Input encodedIssuerName, IssuerChecker& checker,
Result Result
CSTrustDomain::CheckRevocation(EndEntityOrCA endEntityOrCA, CSTrustDomain::CheckRevocation(EndEntityOrCA endEntityOrCA,
const CertID& certID, Time time, const CertID& certID, Time time,
Time validityBeginning,
Duration validityDuration, Duration validityDuration,
/*optional*/ const Input* stapledOCSPresponse, /*optional*/ const Input* stapledOCSPresponse,
/*optional*/ const Input* aiaExtension, /*optional*/ const Input* aiaExtension)
/*optional*/ const Input* sctExtension)
{ {
// We're relying solely on the CertBlocklist for revocation - and we're // We're relying solely on the CertBlocklist for revocation - and we're
// performing checks on this in GetCertTrust (as per nsNSSCertDBTrustDomain) // performing checks on this in GetCertTrust (as per nsNSSCertDBTrustDomain)

4
security/manager/ssl/CSTrustDomain.h
View file

@ -34,10 +34,10 @@ public:
virtual Result CheckRevocation( virtual Result CheckRevocation(
mozilla::pkix::EndEntityOrCA endEntityOrCA, mozilla::pkix::EndEntityOrCA endEntityOrCA,
const mozilla::pkix::CertID& certID, mozilla::pkix::Time time, const mozilla::pkix::CertID& certID, mozilla::pkix::Time time,
mozilla::pkix::Time validityBeginning,
mozilla::pkix::Duration validityDuration, mozilla::pkix::Duration validityDuration,
/*optional*/ const mozilla::pkix::Input* stapledOCSPresponse, /*optional*/ const mozilla::pkix::Input* stapledOCSPresponse,
/*optional*/ const mozilla::pkix::Input* aiaExtension, /*optional*/ const mozilla::pkix::Input* aiaExtension) override;
/*optional*/ const mozilla::pkix::Input* sctExtension) override;
virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain, virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain,
mozilla::pkix::Time time, mozilla::pkix::Time time,
const mozilla::pkix::CertPolicyId& requiredPolicy) override; const mozilla::pkix::CertPolicyId& requiredPolicy) override;

4
security/pkix/include/pkix/pkixtypes.h
View file

@ -260,10 +260,10 @@ class TrustDomain {
virtual Result CheckRevocation(EndEntityOrCA endEntityOrCA, virtual Result CheckRevocation(EndEntityOrCA endEntityOrCA,
const CertID& certID, Time time, const CertID& certID, Time time,
Time validityBeginning,
Duration validityDuration, Duration validityDuration,
/*optional*/ const Input* stapledOCSPresponse, /*optional*/ const Input* stapledOCSPresponse,
/*optional*/ const Input* aiaExtension, /*optional*/ const Input* aiaExtension) = 0;
/*optional*/ const Input* sctExtension) = 0;
// Check that the given digest algorithm is acceptable for use in signatures. // Check that the given digest algorithm is acceptable for use in signatures.
// //

6
security/pkix/lib/pkixbuild.cpp
View file

@ -234,9 +234,9 @@ PathBuildingStep::Check(Input potentialIssuerDER,
} }
Duration validityDuration(notAfter, notBefore); Duration validityDuration(notAfter, notBefore);
rv = trustDomain.CheckRevocation(subject.endEntityOrCA, certID, time, rv = trustDomain.CheckRevocation(subject.endEntityOrCA, certID, time,
validityDuration, stapledOCSPResponse, notBefore, validityDuration,
subject.GetAuthorityInfoAccess(), stapledOCSPResponse,
subject.GetSignedCertificateTimestamps()); subject.GetAuthorityInfoAccess());
if (rv != Success) { if (rv != Success) {
// Since this is actually a problem with the current subject certificate // Since this is actually a problem with the current subject certificate
// (rather than the issuer), it doesn't make sense to keep going; all // (rather than the issuer), it doesn't make sense to keep going; all