1712848 - avoid SecCertificateCopyNormalizedIssuerSequence and SecCertificateCopyNormalizedSubjectSequence in osclientcerts

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P3)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

SecCertificateCopyNormalizedIssuerSequence and SecCertificateCopyNormalizedSubjectSequence normalize DN sequences (shocking, I know). This means that if the output from these functions is used to identify certificates, naively comparing bytes will result in mismatches. Since normalization is unnecessary and unwanted, we should avoid these functions in oscilentcerts.

[Tracking Requested - why for this release]: osclientcerts is enabled by default in 90. It would be best if it didn't ship with this still an open issue.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: Bug 1712848 - avoid OS APIs that normalize distinguished names in osclientcerts r?rmf

SecCertificateCopyNormalizedIssuerSequence and
SecCertificateCopyNormalizedSubjectSequence normalize DN sequences (shocking, I
know). This means that if the output from these functions is used to identify
certificates, naively comparing bytes will result in mismatches. Since
normalization is unnecessary and unwanted, we should avoid these functions in
osclientcerts.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cc4d270b482a
avoid OS APIs that normalize distinguished names in osclientcerts r=rmf

Comment 3

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/cc4d270b482a