mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-12-04 11:26:09 +00:00
67fc934d4b
During path building, mozilla::pkix filters out candidate certificates provided by trust domains where the subject distinguished name does not match the issuer distinguished name of the certificate it's trying to find an issuer for. However, if there's a problem decoding the candidate issuer certificate, mozilla::pkix will make a note of this error, regardless of if that certificate was potentially a suitable issuer. If no trusted path is found, the error from that unrelated certificate may ultimately be returned by mozilla::pkix, resulting in confusion. Before this patch, NSSCertDBTrustDomain could cause this behavior by blithely passing every known 3rd party certificate to mozilla::pkix (other sources of certificates already filter on subject distinguished name). This patch adds filtering to 3rd party certificates as well. Differential Revision: https://phabricator.services.mozilla.com/D48120 --HG-- extra : moz-landing-system : lando |
||
|---|---|---|
| .. | ||
| tests/gtest | ||
| BRNameMatchingPolicy.cpp | ||
| BRNameMatchingPolicy.h | ||
| CertVerifier.cpp | ||
| CertVerifier.h | ||
| ExtendedValidation.cpp | ||
| ExtendedValidation.h | ||
| moz.build | ||
| NSSCertDBTrustDomain.cpp | ||
| NSSCertDBTrustDomain.h | ||
| OCSPCache.cpp | ||
| OCSPCache.h | ||
| OCSPVerificationTrustDomain.cpp | ||
| OCSPVerificationTrustDomain.h | ||
| TrustOverride-AppleGoogleDigiCertData.inc | ||
| TrustOverride-GlobalSignData.inc | ||
| TrustOverride-StartComAndWoSignData.inc | ||
| TrustOverride-SymantecData.inc | ||
| TrustOverride-TestImminentDistrustData.inc | ||
| TrustOverrideUtils.h | ||