mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-12 12:55:46 +00:00
backout bug 985021 (8d622f4ec6e9) for another build breakage on a CLOSED TREE r=backout
This commit is contained in:
parent
85e409d130
commit
e79c0e95dc
@ -147,62 +147,6 @@ CheckCertificatePolicies(BackCert& cert, EndEntityOrCA endEntityOrCA,
|
|||||||
return RecoverableError;
|
return RecoverableError;
|
||||||
}
|
}
|
||||||
|
|
||||||
// BasicConstraints ::= SEQUENCE {
|
|
||||||
// cA BOOLEAN DEFAULT FALSE,
|
|
||||||
// pathLenConstraint INTEGER (0..MAX) OPTIONAL }
|
|
||||||
der::Result
|
|
||||||
DecodeBasicConstraints(const SECItem* encodedBasicConstraints,
|
|
||||||
CERTBasicConstraints& basicConstraints)
|
|
||||||
{
|
|
||||||
PR_ASSERT(encodedBasicConstraints);
|
|
||||||
if (!encodedBasicConstraints) {
|
|
||||||
return der::Fail(SEC_ERROR_INVALID_ARGS);
|
|
||||||
}
|
|
||||||
|
|
||||||
basicConstraints.isCA = false;
|
|
||||||
basicConstraints.pathLenConstraint = 0;
|
|
||||||
|
|
||||||
der::Input input;
|
|
||||||
if (input.Init(encodedBasicConstraints->data, encodedBasicConstraints->len)
|
|
||||||
!= der::Success) {
|
|
||||||
return der::Fail(SEC_ERROR_EXTENSION_VALUE_INVALID);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (der::ExpectTagAndIgnoreLength(input, der::SEQUENCE) != der::Success) {
|
|
||||||
return der::Fail(SEC_ERROR_EXTENSION_VALUE_INVALID);
|
|
||||||
}
|
|
||||||
|
|
||||||
bool isCA = false;
|
|
||||||
if (der::OptionalBoolean(input, isCA) != der::Success) {
|
|
||||||
return der::Fail(SEC_ERROR_EXTENSION_VALUE_INVALID);
|
|
||||||
}
|
|
||||||
basicConstraints.isCA = isCA;
|
|
||||||
|
|
||||||
if (input.Peek(der::INTEGER)) {
|
|
||||||
SECItem pathLenConstraintEncoded;
|
|
||||||
if (der::Integer(input, pathLenConstraintEncoded) != der::Success) {
|
|
||||||
return der::Fail(SEC_ERROR_EXTENSION_VALUE_INVALID);
|
|
||||||
}
|
|
||||||
long pathLenConstraint = DER_GetInteger(&pathLenConstraintEncoded);
|
|
||||||
if (pathLenConstraint >= std::numeric_limits<int>::max() ||
|
|
||||||
pathLenConstraint < 0) {
|
|
||||||
return der::Fail(SEC_ERROR_EXTENSION_VALUE_INVALID);
|
|
||||||
}
|
|
||||||
basicConstraints.pathLenConstraint = static_cast<int>(pathLenConstraint);
|
|
||||||
// TODO(bug 985025): If isCA is false, pathLenConstraint MUST NOT
|
|
||||||
// be included (as per RFC 5280 section 4.2.1.9), but for compatibility
|
|
||||||
// reasons, we don't check this for now.
|
|
||||||
} else if (basicConstraints.isCA) {
|
|
||||||
// If this is a CA but the path length is omitted, it is unlimited.
|
|
||||||
basicConstraints.pathLenConstraint = CERT_UNLIMITED_PATH_CONSTRAINT;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (der::End(input) != der::Success) {
|
|
||||||
return der::Fail(SEC_ERROR_EXTENSION_VALUE_INVALID);
|
|
||||||
}
|
|
||||||
return der::Success;
|
|
||||||
}
|
|
||||||
|
|
||||||
// RFC5280 4.2.1.9. Basic Constraints (id-ce-basicConstraints)
|
// RFC5280 4.2.1.9. Basic Constraints (id-ce-basicConstraints)
|
||||||
Result
|
Result
|
||||||
CheckBasicConstraints(const BackCert& cert,
|
CheckBasicConstraints(const BackCert& cert,
|
||||||
@ -212,9 +156,10 @@ CheckBasicConstraints(const BackCert& cert,
|
|||||||
{
|
{
|
||||||
CERTBasicConstraints basicConstraints;
|
CERTBasicConstraints basicConstraints;
|
||||||
if (cert.encodedBasicConstraints) {
|
if (cert.encodedBasicConstraints) {
|
||||||
if (DecodeBasicConstraints(cert.encodedBasicConstraints,
|
SECStatus rv = CERT_DecodeBasicConstraintValue(&basicConstraints,
|
||||||
basicConstraints) != der::Success) {
|
cert.encodedBasicConstraints);
|
||||||
return RecoverableError;
|
if (rv != SECSuccess) {
|
||||||
|
return MapSECStatus(rv);
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
// Synthesize a non-CA basic constraints by default
|
// Synthesize a non-CA basic constraints by default
|
||||||
|
@ -380,23 +380,6 @@ Boolean(Input& input, /*out*/ bool& value)
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// This is for any BOOLEAN DEFAULT FALSE.
|
|
||||||
// (If it is present and false, this is a bad encoding.)
|
|
||||||
inline Result
|
|
||||||
OptionalBoolean(Input& input, /*out*/ bool& value)
|
|
||||||
{
|
|
||||||
value = false;
|
|
||||||
if (input.Peek(BOOLEAN)) {
|
|
||||||
if (Boolean(input, value) != Success) {
|
|
||||||
return Failure;
|
|
||||||
}
|
|
||||||
if (!value) {
|
|
||||||
return Fail(SEC_ERROR_BAD_DER);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return Success;
|
|
||||||
}
|
|
||||||
|
|
||||||
inline Result
|
inline Result
|
||||||
Enumerated(Input& input, uint8_t& value)
|
Enumerated(Input& input, uint8_t& value)
|
||||||
{
|
{
|
||||||
|
Loading…
Reference in New Issue
Block a user