diff options
| author | wtc@chromium.org <wtc@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-08-08 02:33:22 +0000 |
|---|---|---|
| committer | wtc@chromium.org <wtc@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-08-08 02:33:22 +0000 |
| commit | e8637201ee40d8a09066ff2204a1b05594eefdf1 (patch) | |
| tree | fd1ab2e9182601cab897469fe0cf6f43d76bf0fe /net | |
| parent | 3cdf89094d2fc9bdd326f05dd9d2cc661f686e54 (diff) | |
| download | chromium_src-e8637201ee40d8a09066ff2204a1b05594eefdf1.zip chromium_src-e8637201ee40d8a09066ff2204a1b05594eefdf1.tar.gz chromium_src-e8637201ee40d8a09066ff2204a1b05594eefdf1.tar.bz2 | |
Use strict revocation flags only for EV verification.
TBR=ukai
BUG=10911,13336
TEST=Visit https://migs.mastercard.com.au/ma/. Chromium
should not say the cert is revoked.
Review URL: http://codereview.chromium.org/165206
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@22857 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'net')
| -rw-r--r-- | net/base/x509_certificate_nss.cc | 17 |
1 files changed, 14 insertions, 3 deletions
diff --git a/net/base/x509_certificate_nss.cc b/net/base/x509_certificate_nss.cc index 89a61f4..e96acbb 100644 --- a/net/base/x509_certificate_nss.cc +++ b/net/base/x509_certificate_nss.cc @@ -364,11 +364,22 @@ SECStatus PKIXVerifyCert(X509Certificate::OSCertHandle cert_handle, CERT_REV_M_TEST_USING_THIS_METHOD | CERT_REV_M_ALLOW_NETWORK_FETCHING | CERT_REV_M_ALLOW_IMPLICIT_DEFAULT_SOURCE | - CERT_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE | CERT_REV_M_STOP_TESTING_ON_FRESH_INFO; PRUint64 revocation_method_independent_flags = - CERT_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST | - CERT_REV_MI_REQUIRE_SOME_FRESH_INFO_AVAILABLE; + CERT_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST; + if (policy_oids && num_policy_oids > 0) { + // EV verification requires revocation checking. Consider the certificate + // revoked if we don't have revocation info. + // TODO(wtc): Add a bool parameter to expressly specify we're doing EV + // verification or we want strict revocation flags. + revocation_method_flags |= CERT_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE; + revocation_method_independent_flags |= + CERT_REV_MI_REQUIRE_SOME_FRESH_INFO_AVAILABLE; + } else { + revocation_method_flags |= CERT_REV_M_SKIP_TEST_ON_MISSING_SOURCE; + revocation_method_independent_flags |= + CERT_REV_MI_NO_OVERALL_INFO_REQUIREMENT; + } PRUint64 method_flags[2]; method_flags[cert_revocation_method_crl] = revocation_method_flags; method_flags[cert_revocation_method_ocsp] = revocation_method_flags; |