921893 - Verify certificate key usage extension in insanity::pkix

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: Verify key usage extension in insanity::pkix

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8370953 [details] [diff] [review]
Verify key usage extension in insanity::pkix

Review of attachment 8370953 [details] [diff] [review]:
-----------------------------------------------------------------

Cool.

::: security/insanity/lib/pkixcheck.cpp
@@ +63,5 @@
> +  }
> +
> +  SECItem tmpItem;
> +  Result rv = MapSECStatus(SEC_QuickDERDecodeItem(arena, &tmpItem,
> +                              SEC_ASN1_GET(SEC_BitStringTemplate),

The indentation here is a bit of a bummer. Maybe have an intermediate variable, assign it the result of SEC_QuickDERDecodeItem, and MapSECStatus that result? Ugh. That probably won't work because of SEC_ASN1_GET(SEC_BitStringTemplate), though... Oh, well. No big deal if this doesn't look super pretty.

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e550cbd8d393

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/e550cbd8d393

Comment 5

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Comment on attachment 8370953 [details] [diff] [review]
Verify key usage extension in insanity::pkix

[Approval Request Comment]
See bug 878932 comment 37.

Comment 6

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8370953 [details] [diff] [review]
Verify key usage extension in insanity::pkix

Uplifted granted to the patches relative to the new feature: "Add insanity::pkix as certificate verification option"
Lukas and I discussed with Brian and we think it is important to have this feature for 29 (but disabled by default).
It is early in the aurora process and they have plenty of tests for these feature (and to make sure that the current behaviors are still performing correctly).

Comment 7

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/d61793abbcbe