From c3ec00a15295120481e4b845e36ccf324dc6b669 Mon Sep 17 00:00:00 2001 From: janekptacijarabaci Date: Mon, 23 Apr 2018 09:10:12 +0200 Subject: moebius#119: (Windows) Security - Certificate Stores - NSSCertDBTrustDomain allows end-entities to be their own trust anchors https://github.com/MoonchildProductions/moebius/pull/119 --- security/certverifier/CertVerifier.cpp | 3 +-- security/certverifier/NSSCertDBTrustDomain.cpp | 6 ++++- security/manager/ssl/tests/unit/test_cert_trust.js | 28 +++++++++++++++++++--- 3 files changed, 31 insertions(+), 6 deletions(-) (limited to 'security') diff --git a/security/certverifier/CertVerifier.cpp b/security/certverifier/CertVerifier.cpp index 61d8fcdb8..2957a269f 100644 --- a/security/certverifier/CertVerifier.cpp +++ b/security/certverifier/CertVerifier.cpp @@ -224,8 +224,7 @@ CertVerifier::VerifySignedCertificateTimestamps( CERTCertListNode* issuerNode = CERT_LIST_NEXT(endEntityNode); if (!issuerNode || CERT_LIST_END(issuerNode, builtChain)) { // Issuer certificate is required for SCT verification. - // TODO(bug 1294580): change this to Result::FATAL_ERROR_INVALID_ARGS - return Success; + return Result::FATAL_ERROR_INVALID_ARGS; } CERTCertificate* endEntity = endEntityNode->cert; diff --git a/security/certverifier/NSSCertDBTrustDomain.cpp b/security/certverifier/NSSCertDBTrustDomain.cpp index 1fe27b760..b4e12fe9c 100644 --- a/security/certverifier/NSSCertDBTrustDomain.cpp +++ b/security/certverifier/NSSCertDBTrustDomain.cpp @@ -245,7 +245,11 @@ NSSCertDBTrustDomain::GetCertTrust(EndEntityOrCA endEntityOrCA, // For TRUST, we only use the CERTDB_TRUSTED_CA bit, because Goanna hasn't // needed to consider end-entity certs to be their own trust anchors since // Goanna implemented nsICertOverrideService. - if (flags & CERTDB_TRUSTED_CA) { + // Of course, for this to work as expected, we need to make sure we're + // inquiring about the trust of a CA and not an end-entity. If an end-entity + // has the CERTDB_TRUSTED_CA bit set, Gecko does not consider it to be a + // trust anchor; it must inherit its trust. + if (flags & CERTDB_TRUSTED_CA && endEntityOrCA == EndEntityOrCA::MustBeCA) { if (policy.IsAnyPolicy()) { trustLevel = TrustLevel::TrustAnchor; return Success; diff --git a/security/manager/ssl/tests/unit/test_cert_trust.js b/security/manager/ssl/tests/unit/test_cert_trust.js index 622678c7a..bf081f1bd 100644 --- a/security/manager/ssl/tests/unit/test_cert_trust.js +++ b/security/manager/ssl/tests/unit/test_cert_trust.js @@ -208,9 +208,31 @@ function run_test() { setCertTrust(ca_cert, ",,"); setCertTrust(int_cert, ",,"); - // It turns out that if an end-entity certificate is manually trusted, it can - // be the root of its own verified chain. This will be removed in bug 1294580. - setCertTrust(ee_cert, "C,,"); + // If an end-entity certificate is manually trusted, it may not be the root of + // its own verified chain. In general this will cause "unknown issuer" errors + // unless a CA trust anchor can be found. + setCertTrust(ee_cert, "CTu,CTu,CTu"); + checkCertErrorGeneric(certdb, ee_cert, SEC_ERROR_UNKNOWN_ISSUER, + certificateUsageSSLServer); + checkCertErrorGeneric(certdb, ee_cert, SEC_ERROR_UNKNOWN_ISSUER, + certificateUsageSSLClient); + checkCertErrorGeneric(certdb, ee_cert, SEC_ERROR_UNKNOWN_ISSUER, + certificateUsageEmailSigner); + checkCertErrorGeneric(certdb, ee_cert, SEC_ERROR_UNKNOWN_ISSUER, + certificateUsageEmailRecipient); + checkCertErrorGeneric(certdb, ee_cert, SEC_ERROR_UNKNOWN_ISSUER, + certificateUsageObjectSigner); + + // Now make a CA trust anchor available. + setCertTrust(ca_cert, "CTu,CTu,CTu"); checkCertErrorGeneric(certdb, ee_cert, PRErrorCodeSuccess, certificateUsageSSLServer); + checkCertErrorGeneric(certdb, ee_cert, PRErrorCodeSuccess, + certificateUsageSSLClient); + checkCertErrorGeneric(certdb, ee_cert, PRErrorCodeSuccess, + certificateUsageEmailSigner); + checkCertErrorGeneric(certdb, ee_cert, PRErrorCodeSuccess, + certificateUsageEmailRecipient); + checkCertErrorGeneric(certdb, ee_cert, PRErrorCodeSuccess, + certificateUsageObjectSigner); } -- cgit v1.2.3