401954 - Include latest NSS error strings

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Kai Engert [:KaiE:]]

FF 3 is supposed to ship with NSS 3.12

NSS 3.12 has some new error codes. I used the tool from bug 329017 to produce updated code and strings for PSM.

We should add the new strings in time before the localization freeze.

(Bob, Julien, Nelson, if you're aware of additional upcoming patches that will add error codes/strings, let's make sure we get them in soon.)

Comment 1

[Kai Engert [:KaiE:]]

Attachment: Patch v1

Comment 2

[Kai Engert [:KaiE:]]

Comment on attachment 286890 [details] [diff] [review]
Patch v1

If there will be a string freeze after M9, this should get in.

Comment 3

[Reed Loden [:reed]]

Comment on attachment 286890 [details] [diff] [review]
Patch v1

I'm pretty sure this won't compile. Where are these new errors declared? Shouldn't something be added to mozilla/security/nss/lib/util/secerr.h?

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 286890 [details] [diff] [review]
Patch v1

SEC_ERROR_OCSP_RESPONDER_CERT_INVALID=OCSP Trusted Responder Cert is invalid.
Saying that a cert is both trusted and invalid is a contradiction.
I propose to simply drop the word Trusted.

I'm going to check the NSS error string for this next.   If it also has
this contradiction, that's a bug that we should fix right away.

Comment 5

[Reed Loden [:reed]]

I just spoke with mconnor, and he told me that string freeze isn't at M9. M10 will be the slushy string freeze with M11 being hard freeze, most likely.

Comment 6

[Kai Engert [:KaiE:]]

(In reply to comment #4)
> SEC_ERROR_OCSP_RESPONDER_CERT_INVALID=OCSP Trusted Responder Cert is invalid.
> Saying that a cert is both trusted and invalid is a contradiction.
> I propose to simply drop the word Trusted.
> 
> I'm going to check the NSS error string for this next.   If it also has
> this contradiction, that's a bug that we should fix right away.


Nelson, these strings were directly taken from NSS.

I didn't change them.

The strings are simply a copy for the localization effort.
So, if you think these strings don't make sense, they should get fixed in NSS.

Comment 7

[Nelson Bolyard (seldom reads bugmail)]

Yes, the string is also wrong in NSS.
See bug 338986 comment 54

Comment 8

[Kai Engert [:KaiE:]]

(In reply to comment #3)
> (From update of attachment 286890 [details] [diff] [review])
> I'm pretty sure this won't compile. Where are these new errors declared?
> Shouldn't something be added to mozilla/security/nss/lib/util/secerr.h?

Reed, that header file already contains the new IDs.
Did you look in the wrong branch?

Comment 9

[Nelson Bolyard (seldom reads bugmail)]

Alexei tells me that this error applies only to user-configured OCSP 
responders.  The word "trusted" should be "User-configured" or 
"configured".  So I think the error message should be changed to

"Configured OCSP responder's certificate is invalid."

I will file an NSS bug about this.  I'd say that PSM should feel free
to fix this without waiting for NSS's error message to change first.

Comment 10

[Kai Engert [:KaiE:]]

(In reply to comment #9)
> I will file an NSS bug about this.  I'd say that PSM should feel free
> to fix this without waiting for NSS's error message to change first.

Thanks for the quick action, Nelson!

Comment 11

[Kai Engert [:KaiE:]]

Attachment: Patch v2

Comment 12

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 286947 [details] [diff] [review]
Patch v2

r=nelson

Comment 13

[Kai Engert [:KaiE:]]

fixed