553512 - SEC_OID_X509_ANY_POLICY should not be an UNSUPPORTED_CERT_EXTENSION

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Wan-Teh Chang]

Attachment: Proposed patch

In NSS 3.12.4, SEC_OID_X509_ANY_POLICY was added (bug 391434).

    OD( x509CertificatePoliciesAnyPolicy, SEC_OID_X509_ANY_POLICY,
 	"Certificate Policies AnyPolicy",
        CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),

Since anyPolicy is not a certificate extension, it should be
INVALID_CERT_EXTENSION rather than UNSUPPORTED_CERT_EXTENSION.

See the following examples of adding certificate policy OIDs:

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/cmd/vfychain/vfychain.c&rev=1.30&mark=643,645,661#638

PSM adds EV certificate policy OIDs:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/manager/ssl/src/nsIdentityChecking.cpp&rev=1.26&mark=432-433#420

Comment 1

[Alexei Volkov]

Comment on attachment 433502 [details] [diff] [review]
Proposed patch

r=alexei

Comment 2

[Wan-Teh Chang]

I checked in the patch on the NSS trunk (NSS 3.12.7).

Checking in secoid.c;
/cvsroot/mozilla/security/nss/lib/util/secoid.c,v  <--  secoid.c
new revision: 1.57; previous revision: 1.56
done