Issue 1589034: If the server's CertificateRequest message contains an empty...

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Issue 1589034: If the server's CertificateRequest message contains an empty... (Closed)

Created:
10 years, 8 months ago by wtc

Modified:
9 years, 7 months ago

Reviewers:
agl

CC:
chromium-reviews, darin-cc_chromium.org

Base URL:
svn://chrome-svn/chrome/trunk/src/

Visibility:
Public.

Description

If the server's CertificateRequest message contains an empty certificate_authorities list, it means client certificates issued by any CA are acceptable. NSS_CmpCertChainWCANames returns SECFailure in that case, so we need to test for that case. Improve error code mapping. Add a comment to note new NSS functions we can use in the future, and add a missing LeaveFunction call. R=agl BUG=16830 TEST=Visit a server that sends a CertificateRequest message with an empty certificate_authorities list. The client certificate selection dialog should pop up with all client certificates shown as eligible. Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=44442

Patch Set 1 #

Patch Set 2 : Also map SSL_ERROR_ILLEGAL_PARAMETER_ALERT. #

Patch Set 3 : More error code mapping improvements. #

Created: 10 years, 8 months ago

Download [raw] [tar.bz2]

		Unified diffs	Side-by-side diffs	Delta from patch set	Stats (+12 lines, -2 lines)			Patch
	M	net/socket/ssl_client_socket_nss.cc	View	1 2	5 chunks	+12 lines, -2 lines	0 comments	Download

Messages

Total messages: 2 (0 generated)

Expand Messages | Collapse Messages

wtc

If ca_names->nnames is 0, NSS_CmpCertChainWCANames returns SECFailure. See http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/ssl/cmpcert.c&rev=1.6&mark=58,71-73#52 This change is the most important ...

10 years, 8 months ago (2010-04-14 00:35:15 UTC) #1

LGTM

Expand Messages | Collapse Messages