1280276 - Feature Request: Get a full list of CRL distributionpoints

Status: RESOLVED WORKSFORME

(NSS :: Libraries, defect)

Description

[Tuomo Soini]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Build ID: 20160608223209

Steps to reproduce:

Currently, CERT_DecodeCRLDistributionPoints() does not support getting the entire list of a certificate's CRL distribution points.


Actual results:

 This means if the only entry returned fails, the next entry of the list is not attempted and certificate validation fails when an up to date CRL is not found.


Expected results:

The feature request is for an API that allows the caller to get the entire list, so the next distributionpoint can be attempted on failure of the first distributionpoint. 

If this is not possible, perhaps the API could be extended to allow one to request the first distributionpoint using a certain transport URI - i.e. HTTPS, LDAP, ... so that at least different transports can be attempted.

Comment 1

[Kai Engert [:KaiE:]]

Could you please attach an example certificate for testing?

Comment 2

[Kai Engert [:KaiE:]]

Are you sure that API only returns the first entry?
The examples I see at least indicate otherwise, but lacking an example, I haven't tested it.

First, the API is named in the plural, which suggests it returns everything
  CERT_DecodeCRLDistributionPoints

Second, look at the example code in certutil that uses it, 
  secu_PrintCRLDistPtsExtension

Currently found here:
  https://hg.mozilla.org/projects/nss/file/tip/cmd/lib/secutil.c#l1900

    dPoints = CERT_DecodeCRLDistributionPoints(pool, value);
    if (dPoints && dPoints->distPoints && dPoints->distPoints[0]) {
        CRLDistributionPoint **pPoints = dPoints->distPoints;
        CRLDistributionPoint *pPoint;
        while (NULL != (pPoint = *pPoints++)) {

This suggests the API returns a list, and application code can iterate the list already.

Comment 3

[Tuomo Soini]

Attachment: salofw_salo_fi.crt

Certificate with multiple distribution points.

Comment 4

[Kai Engert [:KaiE:]]

Thank you for attaching the example.

I've tested with certutil, and found that it prints multiple entries.

In your example, the CRL DP is of type CERTGeneralName, which isn't just a name, but also a node type of a linked list.

certutil calls secu_PrintGeneralNames. That contains a loop which uses CERT_GetNextGeneralName to retrieve additional names. It can apparently be used to retrieve all CRL DPs.

I believe this bug is worksforme, unless you can show us an example cert, where certutil is unable to dump all entries.