928141 - Add a build variable NSS_PKIX_NO_LDAP to conditionally disable the LDAP code in libpkix

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Wan-Teh Chang]

Attachment: Remove LDAP support from libpkix

The LDAP support in libpkix is often a surprise to us during debugging.
I don't think NSS needs to support LDAP URLs in the AIA extension.

The attached patch removes the LDAP code from libpkix. In addition, the
following files should be removed:

lib/libpkix/pkix_pl_nss/module/pkix_pl_ldapcertstore.c
lib/libpkix/pkix_pl_nss/module/pkix_pl_ldapcertstore.h
lib/libpkix/pkix_pl_nss/module/pkix_pl_ldapdefaultclient.c
lib/libpkix/pkix_pl_nss/module/pkix_pl_ldapdefaultclient.h
lib/libpkix/pkix_pl_nss/module/pkix_pl_ldaprequest.c
lib/libpkix/pkix_pl_nss/module/pkix_pl_ldaprequest.h
lib/libpkix/pkix_pl_nss/module/pkix_pl_ldapresponse.c
lib/libpkix/pkix_pl_nss/module/pkix_pl_ldapresponse.h
lib/libpkix/pkix_pl_nss/module/pkix_pl_ldapt.h
lib/libpkix/pkix_pl_nss/module/pkix_pl_ldaptemplates.c

Do you see any problem with removing LDAP support? Maybe we will fail some
NIST PKITS tests?

Comment 1

[Wan-Teh Chang]

Attachment: Remove LDAP support from libpkix, v1.1

I forgot to remove the declaration of pkix_pl_InfoAccess_ParseLocation.

The NSS test suite all.sh passed with this patch applied.

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Comment on attachment 818775 [details] [diff] [review]
Remove LDAP support from libpkix, v1.1

Review of attachment 818775 [details] [diff] [review]:
-----------------------------------------------------------------

I did not review the patch carefully because I assume rsleevi and wtc did. I definitely support removing the LDAP code as a risk-reduction, security-improving measure.

Comment 3

[Wan-Teh Chang]

Attachment: Add a build variable NSS_PKIX_NO_LDAP to conditionally disable the LDAP code in libpkix

I don't have time to rewrite the libpkix default LDAP client to use the
OpenLDAP or Windows LDAP API.  So I decided to add a build option to
disable the LDAP code in libpkix.

I welcome suggestions for a better name of the build variable, such as
NSS_PKIX_DISABLE_LDAP or NSS_LIBPKIX_NO_LDAP.

Comment 4

[Robert Relyea]

Comment on attachment 8359521 [details] [diff] [review]
Add a build variable NSS_PKIX_NO_LDAP to conditionally disable the LDAP code in libpkix

r+ rrelyea

Comment 5

[Ryan Sleevi]

Comment on attachment 8359521 [details] [diff] [review]
Add a build variable NSS_PKIX_NO_LDAP to conditionally disable the LDAP code in libpkix

Review of attachment 8359521 [details] [diff] [review]:
-----------------------------------------------------------------

r+, as I already reviewed this for Chromium.

Comment 6

[Wan-Teh Chang]

Patch checked in: https://hg.mozilla.org/projects/nss/rev/a8b668fd72f7

Summary updated to reflect the final change.