summaryrefslogtreecommitdiff
path: root/rhbz-1400293-fix-mozilla-1324096.patch
diff options
context:
space:
mode:
Diffstat (limited to 'rhbz-1400293-fix-mozilla-1324096.patch')
-rw-r--r--rhbz-1400293-fix-mozilla-1324096.patch72
1 files changed, 72 insertions, 0 deletions
diff --git a/rhbz-1400293-fix-mozilla-1324096.patch b/rhbz-1400293-fix-mozilla-1324096.patch
new file mode 100644
index 0000000..4a2691e
--- /dev/null
+++ b/rhbz-1400293-fix-mozilla-1324096.patch
@@ -0,0 +1,72 @@
+diff --git a/security/certverifier/CertVerifier.cpp b/security/certverifier/CertVerifier.cpp
+--- a/security/certverifier/CertVerifier.cpp
++++ b/security/certverifier/CertVerifier.cpp
+@@ -120,16 +120,20 @@ IsCertChainRootBuiltInRoot(const UniqueC
+ }
+ CERTCertificate* root = rootNode->cert;
+ if (!root) {
+ return Result::FATAL_ERROR_LIBRARY_FAILURE;
+ }
+ return IsCertBuiltInRoot(root, result);
+ }
+
++// The term "builtin root" traditionally refers to a root CA certificate that
++// has been added to the NSS trust store, because it has been approved
++// for inclusion according to the Mozilla CA policy, and might be accepted
++// by Mozilla applications as an issuer for certificates seen on the public web.
+ Result
+ IsCertBuiltInRoot(CERTCertificate* cert, bool& result)
+ {
+ result = false;
+ #ifdef DEBUG
+ nsCOMPtr<nsINSSComponent> component(do_GetService(PSM_COMPONENT_CONTRACTID));
+ if (!component) {
+ return Result::FATAL_ERROR_LIBRARY_FAILURE;
+@@ -142,25 +146,38 @@ IsCertBuiltInRoot(CERTCertificate* cert,
+ return Success;
+ }
+ #endif // DEBUG
+ AutoSECMODListReadLock lock;
+ for (SECMODModuleList* list = SECMOD_GetDefaultModuleList(); list;
+ list = list->next) {
+ for (int i = 0; i < list->module->slotCount; i++) {
+ PK11SlotInfo* slot = list->module->slots[i];
+- // PK11_HasRootCerts should return true if and only if the given slot has
+- // an object with a CKA_CLASS of CKO_NETSCAPE_BUILTIN_ROOT_LIST, which
+- // should be true only of the builtin root list.
+- // If we can find a copy of the given certificate on the slot with the
+- // builtin root list, that certificate must be a builtin.
+- if (PK11_IsPresent(slot) && PK11_HasRootCerts(slot) &&
+- PK11_FindCertInSlot(slot, cert, nullptr) != CK_INVALID_HANDLE) {
+- result = true;
+- return Success;
++ // We're searching for the "builtin root module", which is a module that
++ // contains an object with a CKA_CLASS of CKO_NETSCAPE_BUILTIN_ROOT_LIST.
++ // We use PK11_HasRootCerts() to identify a module with that property.
++ // In the past, we exclusively used the PKCS#11 module named nssckbi,
++ // which is provided by the NSS library.
++ // Nowadays, some distributions use a replacement module, which contains
++ // the builtin roots, but which also contains additional CA certificates,
++ // such as CAs trusted in a local deployment.
++ // We want to be able to distinguish between these two categories,
++ // because a CA, which may issue certificates for the public web,
++ // is expected to comply with additional requirements.
++ // If the certificate has attribute CKA_NSS_MOZILLA_CA_POLICY set to true,
++ // then we treat it as a "builtin root".
++ if (PK11_IsPresent(slot) && PK11_HasRootCerts(slot)) {
++ CK_OBJECT_HANDLE handle = PK11_FindCertInSlot(slot, cert, nullptr);
++ if (handle != CK_INVALID_HANDLE &&
++ PK11_HasAttributeSet(slot, handle, CKA_NSS_MOZILLA_CA_POLICY,
++ false)) {
++ // Attribute was found, and is set to true
++ result = true;
++ break;
++ }
+ }
+ }
+ }
+ return Success;
+ }
+
+ static Result
+ BuildCertChainForOneKeyUsage(NSSCertDBTrustDomain& trustDomain, Input certDER,
bgstack15