2021048 - QWACs: processing of certificate policies extension doesn't account for non-empty policyQualifiers

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Dana Keeler (she/her) [:keeler]]

The QWACs implementation doesn't take into account that a PolicyInformation can have a non-empty policyQualifiers.

Comment 1

[Dana Keeler (she/her) [:keeler]]

Attachment: Bug 2021048 - pycert: move from rfc2459 to rfc5280 and rfc8017 r?jschanck

For certificates, RFCs 5280 and 8017 are the relevant ones we should be using.

Comment 2

[Dana Keeler (she/her) [:keeler]]

Attachment: Bug 2021048 - QWACs: ignore policyQualifiers r?jschanck

When looking for required policies, we may encounter unknown policies. We
should ignore those entirely, which means ignoring any policyQualifiers that
might be present. For known policies, the QWAC specifications don't mention
policyQualifiers one way or another, so for maximum compatibility, we ignore
them.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/c098d314dd2f
https://hg.mozilla.org/integration/autoland/rev/d6faa7c1b9f4
pycert: move from rfc2459 to rfc5280 and rfc8017 r=jschanck

Comment 4

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/d6faa7c1b9f4

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/929665c263f5
https://hg.mozilla.org/integration/autoland/rev/081337f2c680
QWACs: ignore policyQualifiers r=jschanck

Comment 6

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/081337f2c680