540049 - Investigate two places where libpkix may report a certificate as revoked incorrectly

Status: RESOLVED WONTFIX

(NSS :: Libraries, defect, P5)

Description

[Wan-Teh Chang]

Alexei:

This is the remaining work of bug 515279 comment 10.

I searched for "PKIX_RevStatus_Revoked" in the NSS source tree and
inspected all occurrences.

1. This one I'm not sure about.  Please review it:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/libpkix/pkix/checker/pkix_revocationchecker.c&rev=1.10&mark=449#420 

2. In pkix_pl_Pk11CertStore_CheckRevByCrl, if the
cert_CheckCertRevocationStatus call fails, we set
pkixRevStatus to PKIX_RevStatus_Revoked:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_pk11certstore.c&rev=1.17&mark=543,548#539

This is overly strict because cert_CheckCertRevocationStatus
may fail with these error codes:
SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE
SEC_ERROR_REVOKED_CERTIFICATE

SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE should not cause us
to set pkixRevStatus to PKIX_RevStatus_Revoked.

cert_CheckCertRevocationStatus could use some cleanup. It
may report that the cert is revoked in two ways:
- return SECSuccess and set *revStatus to
  certRevocationStatusRevoked
- return SECFailure and set error code to
  SEC_ERROR_REVOKED_CERTIFICATE
This is confusing and probably wrong.  Perhaps it should
only use the first method.  Please review
cert_CheckCertRevocationStatus carefully.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee is inactive on Bugzilla, so the assignee is being reset.