1071308 - remove the libpkix-style chain validation callback from CertVerifier

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Dana Keeler (she/her) [:keeler]]

Currently we use a CERTChainVerifyCallback structure to pass around information needed to implement pinning checks in CertVerifier/NSSCertDBTrustDomain. This is an unnecessary legacy setup we can get rid of to simplify the implementation.

Comment 1

[Dana Keeler (she/her) [:keeler]]

Attachment: patch 1/2: some cleanup

Comment 2

[Dana Keeler (she/her) [:keeler]]

Attachment: patch 2/2: remove callback

Comment 3

[Camilo Viecco (:cviecco)]

Comment on attachment 8493426 [details] [diff] [review]
patch 2/2: remove callback

Review of attachment 8493426 [details] [diff] [review]:
-----------------------------------------------------------------

::: security/certverifier/CertVerifier.cpp
@@ +81,5 @@
>    return SECSuccess;
>  }
>  
> +Result
> +CertListContainsExpectedKeys(const CERTCertList* certList,

my only complain is about this name. I would have called it doPinningChecks (as it it related only to pinning) btw dont you need to declare this in the ".h" so that  NSSCertDBTrustDomain.cpp can access it?

Comment 4

[Dana Keeler (she/her) [:keeler]]

Attachment: patch 2/2: remove callback v2

Thanks for the reviews. I kept the name as-is since I think it describes that function's purpose better.

https://tbpl.mozilla.org/?tree=Try&rev=f919d653e95a

Comment 5

[Dana Keeler (she/her) [:keeler]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9dc5491eb546
https://hg.mozilla.org/integration/mozilla-inbound/rev/4f90b7fb1918

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/9dc5491eb546
https://hg.mozilla.org/mozilla-central/rev/4f90b7fb1918