527508 - libpkix: need to check crl issuer key usages before downloading a crl using CRLDP

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Alexei Volkov]

Attachment: check key usage of the crl issuer cert

Current code in pkix_crlchecker.c does not verify key usage on the issuer cert at all. The verification is done only inside of a crlcache after an attempt to import a crl.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Did all.sh pass with this patch in place?

Comment 2

[Alexei Volkov]

all.sh passed.

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 411236 [details] [diff] [review]
check key usage of the crl issuer cert

r=nelson for 3.12.6, to be checked in after 3.12.5 is released.

Comment 4

[Kai Engert [:KaiE:]]

Look like this was forgotten?

I guess I should check this in now.

Comment 5

[Kai Engert [:KaiE:]]

Checking in libpkix/pkix/checker/pkix_crlchecker.c;
/cvsroot/mozilla/security/nss/lib/libpkix/pkix/checker/pkix_crlchecker.c,v  <--  pkix_crlchecker.c
new revision: 1.7; previous revision: 1.6
done

Comment 6

[Kai Engert [:KaiE:]]

3.12 branch:

Checking in lib/libpkix/pkix/checker/pkix_crlchecker.c;
/cvsroot/mozilla/security/nss/lib/libpkix/pkix/checker/pkix_crlchecker.c,v  <--  pkix_crlchecker.c
new revision: 1.6.6.1; previous revision: 1.6
done