158239 - SEC_FindCrlByKeyOnSlot could do a partial CRL decode

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Julien Pierre]

There is no need to do a full decode in this case, since we don't need the entries.

Comment 1

[Julien Pierre]

Attachment: patch to do partial CRL decode in SEC_FindCrlByKeyOnSlot

This patches optimizes SEC_FindCrlByKeyOnSlot, which is notably used in
crl_storeCRL to skip the unnecessary decoding of entries. This can be done
because both of these functions are unexported.

This patch modifies SEC_FindCrlByName which is an exported function, and calls
SEC_FindCrlByKeyOnSlot. The change is to complete the CRL decoding so that it
still returns a fully-decoded CRL.

Comment 2

[Julien Pierre]

I have implemented this optimization in a different way in the CRL cache
implementation. SEC_FindCrlByKeyOnSlot now takes the decodeoptions as an
argument. crl_storeCrl passes CRL_DECODE_SKIP_ENTRIES to do the partial decode.
Marking fixed.