Fix imported server certs being distrusted in NSS 3.13.

net/third_party/mozilla_security_manager/nsNSSCertTrust.h

 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
  *
  * Software distributed under the License is distributed on an "AS IS" basis,
  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
@@ skipping 47 matching lines @@
   nsNSSCertTrust(unsigned int ssl, unsigned int email, unsigned int objsign);
   nsNSSCertTrust(CERTCertTrust *t);
   virtual ~nsNSSCertTrust();
 
   /* query */
   PRBool HasAnyCA();
   PRBool HasAnyUser();
   PRBool HasCA(PRBool checkSSL = PR_TRUE, 
                PRBool checkEmail = PR_TRUE,  
                PRBool checkObjSign = PR_TRUE);
-  PRBool HasPeer(PRBool checkSSL = PR_TRUE, 
-                 PRBool checkEmail = PR_TRUE,  
-                 PRBool checkObjSign = PR_TRUE);
+  PRBool HasTerminalRecord(PRBool checkSSL = PR_TRUE, 

[wtc, 2012/03/30 22:00:50]

HasExplicitTrustOrDistrust may be a better name for
this function.  But HasTerminalRecord reflects the underlying
NSS code more closely.

+                           PRBool checkEmail = PR_TRUE,  
+                           PRBool checkObjSign = PR_TRUE);

[Ryan Sleevi, 2012/03/29 23:35:13]

Is this our code or is this upstream?

Does the license block need to be updated?

[wtc, 2012/03/30 22:00:50]

These files are our permanent fork of Mozilla's certificate
UI code (called Personal Security Manager).  We don't need
to merge with the current upstream.  But we need to keep
the MPL license.

   PRBool HasUser(PRBool checkSSL = PR_TRUE, 
                  PRBool checkEmail = PR_TRUE,  
                  PRBool checkObjSign = PR_TRUE);
   PRBool HasTrustedCA(PRBool checkSSL = PR_TRUE, 
                       PRBool checkEmail = PR_TRUE,  
                       PRBool checkObjSign = PR_TRUE);
   PRBool HasTrustedPeer(PRBool checkSSL = PR_TRUE, 
                         PRBool checkEmail = PR_TRUE,  
                         PRBool checkObjSign = PR_TRUE);
 
   /* common defaults */
   /* equivalent to "c,c,c" */
   void SetValidCA();
   /* equivalent to "C,C,C" */
   void SetTrustedServerCA();
   /* equivalent to "CT,CT,CT" */
   void SetTrustedCA();
   /* equivalent to "p,," */
-  void SetValidServerPeer();
+  void SetTerminalServerRecord();

[wtc, 2012/03/30 22:00:50]

This function should be named SetDistrustedServer.

[mattm, 2012/03/30 22:16:56]

But a trusted server cert should have CERTDB_TRUSTED | CERTDB_TERMINAL_RECORD,
the way I was using it was to first set the SetTerminalServerRecord() and then
AddPeerTrust, calling it SetDistrustedServer would make that code confusing. 
But perhaps it makes more sense to change the AddPeerTrust to add the
CERTDB_TERMINAL_RECORD too (is there any reason you would want to have
CERTDB_TRUSTED without CERTDB_TERMINAL_RECORD?)

[wtc, 2012/03/30 22:39:08]

I see.  Yes, that would make the code confusing.
I suspect CERTDB_TRUSTED is ignored if CERTDB_TERMINAL_RECORD
is not set.  Here is the NSS code:
http://mxr.mozilla.org/security/ident?i=CERTDB_TRUSTED

You see that when NSS sets CERTDB_TRUSTED, it always
sets CERTDB_TERMINAL_RECORD at the same time.

Similarly, NSS code that tests CERTDB_TRUSTED seems
to always test CERTDB_TERMINAL_RECORD first.  For
example, the cert_CheckLeafTrust function works that
way:
http://mxr.mozilla.org/security/ident?i=cert_CheckLeafTrust

   /* equivalent to "p,p,p" */
-  void SetValidPeer();
+  void SetTerminalRecord();

[wtc, 2012/03/30 22:00:50]

This should be named SetDistrustedCert.

   /* equivalent to "P,P,P" */
   void SetTrustedPeer();

[wtc, 2012/03/30 22:00:50]

This should be named SetTrustedCert to avoid the use of
"Peer".

   /* equivalent to "u,u,u" */
   void SetUser();
 
   /* general setters */
   /* read: "p, P, c, C, T, u, w" */
   void SetSSLTrust(PRBool peer, PRBool tPeer,
                    PRBool ca,   PRBool tCA, PRBool tClientCA,
                    PRBool user, PRBool warn); 
 
   void SetEmailTrust(PRBool peer, PRBool tPeer,
@@ skipping 15 matching lines @@
 private:
   void addTrust(unsigned int *t, unsigned int v);
   void removeTrust(unsigned int *t, unsigned int v);
   PRBool hasTrust(unsigned int t, unsigned int v);
   CERTCertTrust mTrust;
 };
 
 }  // namespace mozilla_security_manager
 
 #endif  // NET_THIRD_PARTY_MOZILLA_SECURITY_MANAGER_NSNSSCERTTRUST_H_