945857 - Remove the security.fresh_revocation_info.require preference

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

+++ This bug was initially created as a clone of Bug #917047 +++

The security.fresh_revocation_info.require preference is intended to be like security.OCSP.require, except that security.OCSP.require is only for OCSP, but security.fresh_revocation_info.require allows fallback to CRLs. This option was added when the switch to make libpkix the default cert verification library was added.

We do not need both preferences. If CRL fallback is enabled then the security.OCSP.require preference should allow CRL fallback in the libpkix code. In other words, everywhere we respect the value of security.fresh_revocation_info.require, we should use the security.OCSP.require preference instead.

Besides removing the references to this pref in nsNSSComponent, we also need to remove the corresponding constructor parameter and member variable from CertVerifier.

Comment 1

[raymond [:retornam] (inactive)]

Hi Brian,
I will take this.

Comment 2

[raymond [:retornam] (inactive)]

Attachment: bug-945857.patch

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Comment on attachment 8345562 [details] [diff] [review]
bug-945857.patch

Review of attachment 8345562 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks for the patch. Just one minor issue.

::: security/manager/ssl/src/CertVerifier.cpp
@@ +378,5 @@
>      // avoiding the network is good, let's try local first
>      CERT_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST
>  
>      // is overall revocation requirement strict or relaxed?
> +    | CERT_REV_MI_NO_OVERALL_INFO_REQUIREMENT;

Please change this to just:

  rev.leafTests.cert_rev_method_independent_flags =
  rev.chainTests.cert_rev_method_independent_flags =
    // avoiding the network is good, let's try local first
    CERT_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST;

Note that CERT_REV_MI_NO_OVERALL_INFO_REQUIREMENT == 0.

Comment 4

[raymond [:retornam] (inactive)]

Attachment: bug-945857.patch

Comment 5

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/464ec8159135

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/464ec8159135