406647 - libpkix does not use user defined revocation checkers

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Alexei Volkov]

Attachment: Prepend use defined revChecker list.

pkix_Build_ValidationCheckers(pkix_build.c) does not use revocation checker list defined by user. Instead, it recreate the list and adds(if revCheckDelayed flag set) only one checker called "DefaultRevChecker".

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 291300 [details] [diff] [review]
Prepend use defined revChecker list.

Alexei, If I understand it correctly, this patch will have 
the effect that each call to this function will modify the 
list of revCheckers that has previously been attached to the 
procParams, by appending the "default rev checker" to it.

Should we instead make a copy of the procParam's list of 
revCheckers, and append the default revchecker to that copy?

Can a caller save and re-use the list of revCheckers in 
multiple subsequence (or concurrent) calls?  

If so, the list of revcheckers will grow with each call.  
If the procParam's list of revCheckers CANNOT be (re)used 
in multiple calls, either sequentially or concurrently, 
then this is not a problem.

Comment 2

[Alexei Volkov]

I was taking in consideration only two cases of pkix api usages: CERT_PKIXVerifyCert and cert_VerifyCertChainPkix. Both of them create new processing parameters which implies use of new revChecker list.

For general case would be cleaner to copy members of the revocation list into the state revocation list or at least duplicate the first. 

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 291300 [details] [diff] [review]
Prepend use defined revChecker list.

> For general case would be cleaner to copy members of the revocation list 
> into the state revocation list 

Yes, please do that.

Comment 4

[Alexei Volkov]

Attachment: Patch v2.

Duplicating the list before using it in forward build state.

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 291917 [details] [diff] [review]
Patch v2.

r=nelson

Comment 6

[Alexei Volkov]

/cvsroot/mozilla/security/nss/lib/libpkix/pkix/top/pkix_build.c,v  <--  pkix_build.c
new revision: 1.15; previous revision: 1.14