1027311 - Remove irrelevant and sometimes wrong extensions from certificates generated for xpcshell tests

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

In particular, these scripts all generate end-entity certificates with KU that includes crlSign and/or certKeySign. This causes the tests to fail with the fixes for bug 1006812.

Like I said when I originally reviewed (some of) these patches, we should not include any irrelevant certificate extensions in the test certificates. Otherwise, we may reject a certificate for a different reason than the test is expecting us to, due to the irrelevant extension. Or, perhaps the opposite (less likely).

I didn't fix every script. Instead I only fixed the ones that block bug 1006812 from landing.

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: fix-test_certificate_usages.patch

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: fix-test_ev_certs.patch

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: fix-test_cert_signatures.patch

Comment 4

[Camilo Viecco (:cviecco)]

Comment on attachment 8442387 [details] [diff] [review]
fix-test_ev_certs.patch

Review of attachment 8442387 [details] [diff] [review]:
-----------------------------------------------------------------

Almost r+, please keep the crl extension.

::: security/manager/ssl/tests/unit/test_ev_certs/generate.py
@@ -31,5 @@
>  aia_suffix ="/\n"
> -intermediate_crl = ("crlDistributionPoints = " +
> -                    "URI:http://crl.example.com:8888/root-ev.crl\n")
> -endentity_crl = ("crlDistributionPoints = " +
> -                 "URI:http://crl.example.com:8888/ee-crl.crl\n")

The idea of having the crls here is to ensure we are NOT contacting the crl server. Please leave this extension.

Comment 5

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: fix-test_ev_certs.patch [v2]

Thanks for the quick reviews! And, thanks for finding my bug. Here's a new version of the patch that restores the CRL-related parts of test_ev_certs/generate.py.

Comment 6

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Thanks for the quick reviews!

https://hg.mozilla.org/integration/mozilla-inbound/rev/bff8515586c2
https://hg.mozilla.org/integration/mozilla-inbound/rev/a14256377bea
https://hg.mozilla.org/integration/mozilla-inbound/rev/9bd1ca579412

Comment 7

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/bff8515586c2
https://hg.mozilla.org/mozilla-central/rev/a14256377bea
https://hg.mozilla.org/mozilla-central/rev/9bd1ca579412

Comment 8

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Uplifted since this is needed for uplifting the fix for bug 1031542:

https://hg.mozilla.org/releases/mozilla-aurora/rev/78ba74153e22
https://hg.mozilla.org/releases/mozilla-aurora/rev/b531c1bdf5d1
https://hg.mozilla.org/releases/mozilla-aurora/rev/5cd90587db41

https://hg.mozilla.org/releases/mozilla-beta/rev/e34f2301a59f
https://hg.mozilla.org/releases/mozilla-beta/rev/4c72b9539a94
https://hg.mozilla.org/releases/mozilla-beta/rev/e60e210dbfc0