Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-24 21:31:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1166031 - Update PSM xpcshell small RSA key test to reflect new error. r=Cykesiopka

Browse Source 
Previously NSS would accept smaller RSA key sizes than PSM would in TLS handshakes. Now that the limit is the same, NSS handles the handshake termination with a different error code before PSM can make its own policy decision.

--HG--
extra : rebase_source : ceb01cc28cb63e9ca52b935ea22d917d79dee1b9
This commit is contained in:
David Keeler 2015-05-21 12:57:03 -07:00
parent 5167199f60
commit 309d57da39
2 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
security/manager/ssl/tests/unit/head_psm.js
View File

@ -66,6 +66,7 @@ const SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED = SEC_ERROR_BASE + 176;
const SSL_ERROR_BAD_CERT_DOMAIN = SSL_ERROR_BASE + 12;
const SSL_ERROR_BAD_CERT_ALERT = SSL_ERROR_BASE + 17;
const SSL_ERROR_WEAK_SERVER_CERT_KEY = SSL_ERROR_BASE + 132;
const MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE = MOZILLA_PKIX_ERROR_BASE + 0;
const MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY = MOZILLA_PKIX_ERROR_BASE + 1;

11
security/manager/ssl/tests/unit/test_cert_overrides.js
View File

@ -42,7 +42,7 @@ function check_telemetry() {
do_check_eq(histogram.counts[10], 5); // SEC_ERROR_EXPIRED_CERTIFICATE
do_check_eq(histogram.counts[11], 2); // MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY
do_check_eq(histogram.counts[12], 1); // MOZILLA_PKIX_ERROR_V1_CERT_USED_AS_CA
do_check_eq(histogram.counts[13], 1); // MOZILLA_PKIX_ERROR_INADEQUATE_KEY_SIZE
do_check_eq(histogram.counts[13], 0); // MOZILLA_PKIX_ERROR_INADEQUATE_KEY_SIZE
do_check_eq(histogram.counts[14], 2); // MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE
do_check_eq(histogram.counts[15], 1); // MOZILLA_PKIX_ERROR_NOT_YET_VALID_ISSUER_CERTIFICATE
do_check_eq(histogram.counts[16], 2); // SEC_ERROR_INVALID_TIME
@ -54,7 +54,7 @@ function check_telemetry() {
do_check_eq(keySizeHistogram.counts[0], 0);
do_check_eq(keySizeHistogram.counts[1], 0); // 0 successful verifications of 2048-bit keys
do_check_eq(keySizeHistogram.counts[2], 4); // 4 successful verifications of 1024-bit keys
do_check_eq(keySizeHistogram.counts[3], 49); // 49 verification failures
do_check_eq(keySizeHistogram.counts[3], 48); // 48 verification failures
run_next_test();
}
@ -179,9 +179,10 @@ function add_simple_tests() {
Ci.nsICertOverrideService.ERROR_UNTRUSTED,
SEC_ERROR_CA_CERT_INVALID);
add_cert_override_test("inadequate-key-size-ee.example.com",
Ci.nsICertOverrideService.ERROR_UNTRUSTED,
MOZILLA_PKIX_ERROR_INADEQUATE_KEY_SIZE);
// This host presents a 1008-bit RSA key. NSS determines this key is too
// small and terminates the connection. The error is not overridable.
add_non_overridable_test("inadequate-key-size-ee.example.com",
SSL_ERROR_WEAK_SERVER_CERT_KEY);
}
function add_combo_tests() {