diff options
author | wolfbeast <mcwerewolf@wolfbeast.com> | 2020-03-28 01:06:56 +0100 |
---|---|---|
committer | wolfbeast <mcwerewolf@wolfbeast.com> | 2020-03-28 01:06:56 +0100 |
commit | 55aa6ce7b3eca4f0afe2ac6e63dee3ce7de800a3 (patch) | |
tree | ce0f64db14c8c1612727c3623ab94b69beedf6a4 /security/certverifier | |
parent | e9723a6fdbf15f7d61b5a32b0931507ee2cb772e (diff) | |
download | UXP-55aa6ce7b3eca4f0afe2ac6e63dee3ce7de800a3.tar UXP-55aa6ce7b3eca4f0afe2ac6e63dee3ce7de800a3.tar.gz UXP-55aa6ce7b3eca4f0afe2ac6e63dee3ce7de800a3.tar.lz UXP-55aa6ce7b3eca4f0afe2ac6e63dee3ce7de800a3.tar.xz UXP-55aa6ce7b3eca4f0afe2ac6e63dee3ce7de800a3.zip |
Issue #1280 - Part 1: Remove HPKP components.
This also removes leftover plumbing for storing preload information
in SiteSecurityService since no service still uses it.
Diffstat (limited to 'security/certverifier')
-rw-r--r-- | security/certverifier/NSSCertDBTrustDomain.cpp | 19 |
1 files changed, 0 insertions, 19 deletions
diff --git a/security/certverifier/NSSCertDBTrustDomain.cpp b/security/certverifier/NSSCertDBTrustDomain.cpp index cf48f6392..fff75ee88 100644 --- a/security/certverifier/NSSCertDBTrustDomain.cpp +++ b/security/certverifier/NSSCertDBTrustDomain.cpp @@ -12,7 +12,6 @@ #include "NSSErrorsService.h" #include "OCSPRequestor.h" #include "OCSPVerificationTrustDomain.h" -#include "PublicKeyPinningService.h" #include "cert.h" #include "certdb.h" #include "mozilla/Assertions.h" @@ -862,24 +861,6 @@ NSSCertDBTrustDomain::IsChainValid(const DERArray& certArray, Time time) if (rv != Success) { return rv; } - bool skipPinningChecksBecauseOfMITMMode = - (!isBuiltInRoot && mPinningMode == CertVerifier::pinningAllowUserCAMITM); - // If mHostname isn't set, we're not verifying in the context of a TLS - // handshake, so don't verify HPKP in those cases. - if (mHostname && (mPinningMode != CertVerifier::pinningDisabled) && - !skipPinningChecksBecauseOfMITMMode) { - bool enforceTestMode = - (mPinningMode == CertVerifier::pinningEnforceTestMode); - bool chainHasValidPins; - nsresult nsrv = PublicKeyPinningService::ChainHasValidPins( - certList, mHostname, time, enforceTestMode, chainHasValidPins); - if (NS_FAILED(nsrv)) { - return Result::FATAL_ERROR_LIBRARY_FAILURE; - } - if (!chainHasValidPins) { - return Result::ERROR_KEY_PINNING_FAILURE; - } - } mBuiltChain = Move(certList); |