339737 - LIBPKIX OCSP checking calls CERT_VerifyCert

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P1)

Description

[Richard N. Freedman]

The new OCSP handler written for libpkix uses the old ocsp routines to construct, encode, decode, etc., the ocsp messages. But handling of the ocsp response includes a call to CERT_VerifyOCSPResponseSignature, which calls ocsp_CheckSignature, which calls CERT_VerifyCert. This last routine, of course, lacks all the new features painstakingly added to libpkix.

A new routine will be written for verifying the signature of the ocsp response without using CERT_VerifyCert, using instead the libpkix replacement.

Comment 1

[Julien Pierre]

This task was supposed to have been completed by Richard.

Comment 2

[Alexei Volkov]

Need to verify if it was completed. P2 for now

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

P1 for NSS 3.12

Comment 4

[Julien Pierre]

It appears to be fixed in PKIX_PL_OcspResponse_UseBuildChain in pkix_pl_ocspresponse.c .

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

Agreed.  This was fixed on the old PKIX branch before that was merged 
to the trunk.

Comment 6

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Please reopen this bug. (For some reason, I can't reopen it.) Even though PKIX_PL_OcspResponse_UseBuildChain exists, it is never used. Consequently, when we are using libpkix as a replacement for the old cert chain validation logic, internally libpkix uses the old logic to validate OCSP responses and their cert chains. The call stack is like this:

   pkix_OcspChecker_CheckExternal 
      pkix_pl_OcspResponse_VerifySignature
          ...
          CERT_FindCertIssuer
          ...
          ocsp_GetSignerCertificate
              ...
              CERT_FindCertByName
              ...
          ...
          pkix_pl_OcspResponse_VerifyResponse
              ...
              CERT_VerifyCertChain
              ...

All of the ocsp_* and CERT_* calls in this call stack are wrong, because they use the old certificate "FindBest" selection logic.

Comment 7

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Never mind, do not re-open this. See bug 551429 comment 11.