54272 - PSM should not crash when using v2 CRLs

Status: VERIFIED WORKSFORME

(Core :: Security: PSM, defect, P3)

Description

[Javier Delgadillo]

This is a bug for PSM tracking the NSS bug 54271.

When that bug is fixed, this bug can be closed.

Comment 1

[Wan-Teh Chang]

NSS bug 54271 is a duplicate of NSS bug 53126.
Make this bug depend on bug 53126 instead.

Comment 2

[John Unruh]

Changing QA contact to nitinp

Comment 3

[John Unruh]

Reassigning to javi.

Comment 4

[Bob Lord]

Target -> 2.0

Comment 5

[Javier Delgadillo]

I believe ddrinan is working on CRL's in PSM 2

Comment 6

[David P. Drinan]

Fixed in PSM 2.0

Comment 7

[John Unruh]

Marking fixed per ddrinan's comments. Where can I download v2 CRLs to verify 
this?

Comment 8

[Bob Lord]

Reopening.  The underlying bug in NSS has only just now been found.  This bug
can't be resolved until the NSS bug is in place.

Comment 9

[Bob Lord]

Also, the original Summary was "PSM should not crash when *downloading* v2
CRLs".  I've changed it to "PSM should not crash when *using* v2 CRLs".

Comment 10

[Robert Relyea]

If this is tied to the NSS fix, the Summary should be 'PSM should accept v2 CRLs
without critical extensions'. 

As far as the original bug, the original title was correct. PSM was crashing
when it tried to load a CRL that NSS didn't like. That particular bug appears to
be fixed.

bob

Comment 11

[Bob Lord]

The basic idea is "v2 CRLs should work". :-)

Comment 12

[Bob Lord]

Nominating PDT so it makes RTM.

Comment 13

[Javier Delgadillo]

thomaks set up an in-house CMS server and I was successfully able to import a v2
CRL.  It also successfully displayed in the CRL manager.  Notice the version
number in the DER dump.

 Certificate Revocation List: 
        Data: 
            Version:  v2
            Signature Algorithm: SHA1withRSA - 1.2.840.113549.1.1.5
            Issuer: CN=Certificate Manager,O=x121x,C=US
            This Update: Friday, June 22, 2001 2:51:53 PM PDT America/Los_Angeles
            Next Update: Friday, June 22, 2001 3:11:53 PM PDT America/Los_Angeles
            Revoked Certificates: 1-4 of 4
                Serial Number: 0x8
                Revocation Date: Friday, June 22, 2001 1:07:03 PM PDT
America/Los_Angeles
                Serial Number: 0x7
                Revocation Date: Friday, June 22, 2001 1:07:02 PM PDT
America/Los_Angeles
                Serial Number: 0x6
                Revocation Date: Friday, June 22, 2001 1:07:02 PM PDT
America/Los_Angeles
                Serial Number: 0x5
                Revocation Date: Friday, June 22, 2001 1:07:02 PM PDT
America/Los_Angeles
        Extensions: 
            Identifier: CRL Number - 2.5.29.20
                Critical: no 
                Number: 463
        Signature: 
            Algorithm: SHA1withRSA - 1.2.840.113549.1.1.5
            Signature: 
                08:0A:88:49:22:9B:3F:7F:66:D0:8C:AD:FC:3F:1F:6E:
                6A:90:28:2D:ED:09:00:02:4A:61:A5:87:ED:2A:45:56:
                7F:BC:EB:91:C2:56:9B:F9:4C:57:CC:5B:47:61:D9:29:
                8A:71:5F:7E:85:17:C7:42:17:3B:87:DE:EE:29:02:92

Comment 14

[Bob Lord]

I'd really like mrb to help confirm that this works now, if he has some time.

Comment 15

[John Unruh]

Verified per javi's evidence. mrb, reopen if v2 crls crash for you.