wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-05 07:18:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #1338 - Followup: certdb: propagate trust information if trust

Browse source 
module is loaded afterwards,

Summary: When the builtin trust module is loaded after some temp certs
being created, these temp certs are usually not accompanied by trust
information. This causes a problem in UXP as it loads the module from a
separate thread while accessing the network cache which populates temp
certs.

This change makes it properly roll up the trust information, if a temp
cert doesn't have trust information.
This commit is contained in:
Daiki Ueno 2020-01-10 20:34:53 +01:00 • committed by Roy Tam
commit 75fdf9c3b0
1 changed files with 22 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

30
security/nss/lib/pki/pki3hack.c
View file

@ -921,14 +921,28 @@ stan_GetCERTCertificate(NSSCertificate *c, PRBool forceUpdate)
}
if (!cc->nssCertificate || forceUpdate) {
fill_CERTCertificateFields(c, cc, forceUpdate);
} else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess &&
!c->object.cryptoContext) {
/* if it's a perm cert, it might have been stored before the
* trust, so look for the trust again. But a temp cert can be
* ignored.
*/
CERTCertTrust *trust = NULL;
trust = nssTrust_GetCERTCertTrustForCert(c, cc);
} else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess) {
CERTCertTrust *trust;
if (!c->object.cryptoContext) {
/* If it's a perm cert, it might have been stored before the
* trust, so look for the trust again.
*/
trust = nssTrust_GetCERTCertTrustForCert(c, cc);
} else {
/* If it's a temp cert, it might have been stored before the
* builtin trust module is loaded, so look for the trust
* again, but don't set the empty trust if it is not found.
*/
NSSTrust *t = nssTrustDomain_FindTrustForCertificate(c->object.cryptoContext->td, c);
if (!t) {
goto loser;
}
trust = cert_trust_from_stan_trust(t, cc->arena);
nssTrust_Destroy(t);
if (!trust) {
goto loser;
}
}
CERT_LockCertTrust(cc);
cc->trust = trust;