From a205ee7040b74ff67717ba44723abbdc0dab02e1 Mon Sep 17 00:00:00 2001 From: wolfbeast <mcwerewolf@wolfbeast.com> Date: Tue, 31 Mar 2020 09:44:30 +0200 Subject: Issue #1280 - Un-bust certerror pages and ForgetAboutSite --- security/manager/ssl/SSLServerCertVerification.cpp | 23 +++++----------------- 1 file changed, 5 insertions(+), 18 deletions(-) (limited to 'security/manager') diff --git a/security/manager/ssl/SSLServerCertVerification.cpp b/security/manager/ssl/SSLServerCertVerification.cpp index af985eb92..37a3b809f 100644 --- a/security/manager/ssl/SSLServerCertVerification.cpp +++ b/security/manager/ssl/SSLServerCertVerification.cpp @@ -425,11 +425,9 @@ CertErrorRunnable::CheckCertOverrides() uint32_t remaining_display_errors = mCollectedErrors; - // If this is an HTTP Strict Transport Security host or a pinned host and the - // certificate is bad, don't allow overrides (RFC 6797 section 12.1, - // HPKP draft spec section 2.6). + // If this is an HTTP Strict Transport Security host, don't allow overrides + // RFC 6797 section 12.1. bool strictTransportSecurityEnabled = false; - bool hasPinningInformation = false; nsCOMPtr<nsISiteSecurityService> sss(do_GetService(NS_SSSERVICE_CONTRACTID)); if (!sss) { MOZ_LOG(gPIPNSSLog, LogLevel::Debug, @@ -449,21 +447,10 @@ CertErrorRunnable::CheckCertOverrides() return new SSLServerCertVerificationResult(mInfoObject, mDefaultErrorCodeToReport); } - nsrv = sss->IsSecureHost(nsISiteSecurityService::HEADER_HPKP, - mInfoObject->GetHostNameRaw(), - mProviderFlags, - nullptr, - &hasPinningInformation); - if (NS_FAILED(nsrv)) { - MOZ_LOG(gPIPNSSLog, LogLevel::Debug, - ("[%p][%p] checking for HPKP failed\n", mFdForLogging, this)); - return new SSLServerCertVerificationResult(mInfoObject, - mDefaultErrorCodeToReport); - } - if (!strictTransportSecurityEnabled && !hasPinningInformation) { + if (!strictTransportSecurityEnabled) { MOZ_LOG(gPIPNSSLog, LogLevel::Debug, - ("[%p][%p] no HSTS or HPKP - overrides allowed\n", + ("[%p][%p] no HSTS - overrides allowed\n", mFdForLogging, this)); nsCOMPtr<nsICertOverrideService> overrideService = do_GetService(NS_CERTOVERRIDE_CONTRACTID); @@ -497,7 +484,7 @@ CertErrorRunnable::CheckCertOverrides() } } else { MOZ_LOG(gPIPNSSLog, LogLevel::Debug, - ("[%p][%p] HSTS or HPKP - no overrides allowed\n", + ("[%p][%p] HSTS - no overrides allowed\n", mFdForLogging, this)); } -- cgit v1.2.3