summaryrefslogtreecommitdiffstats
path: root/security/certverifier
diff options
context:
space:
mode:
Diffstat (limited to 'security/certverifier')
-rw-r--r--security/certverifier/NSSCertDBTrustDomain.cpp42
-rw-r--r--security/certverifier/NSSCertDBTrustDomain.h3
2 files changed, 6 insertions, 39 deletions
diff --git a/security/certverifier/NSSCertDBTrustDomain.cpp b/security/certverifier/NSSCertDBTrustDomain.cpp
index 02a005f8b6..cfc17f46a7 100644
--- a/security/certverifier/NSSCertDBTrustDomain.cpp
+++ b/security/certverifier/NSSCertDBTrustDomain.cpp
@@ -861,10 +861,9 @@ Result NSSCertDBTrustDomain::CheckRevocationByOCSP(
Result stapledOCSPResponseResult = Success;
if (stapledOCSPResponse) {
bool expired;
- uint32_t ageInHours;
stapledOCSPResponseResult = VerifyAndMaybeCacheEncodedOCSPResponse(
certID, time, maxOCSPLifetimeInDays, *stapledOCSPResponse,
- ResponseWasStapled, expired, ageInHours);
+ ResponseWasStapled, expired);
Telemetry::AccumulateCategorical(
Telemetry::LABELS_CERT_REVOCATION_MECHANISMS::StapledOCSP);
if (stapledOCSPResponseResult == Success) {
@@ -1087,10 +1086,9 @@ Result NSSCertDBTrustDomain::SynchronousCheckRevocationWithServer(
// or unknown certificate, PR_GetError() will return the appropriate error.
// We actually ignore expired here.
bool expired;
- uint32_t ageInHours;
- rv = VerifyAndMaybeCacheEncodedOCSPResponse(
- certID, time, maxOCSPLifetimeInDays, response, ResponseIsFromNetwork,
- expired, ageInHours);
+ rv = VerifyAndMaybeCacheEncodedOCSPResponse(certID, time,
+ maxOCSPLifetimeInDays, response,
+ ResponseIsFromNetwork, expired);
// If the CRLite filter covers the certificate, compare the CRLite result
// with the OCSP fetching result. OCSP may have succeeded, said the
@@ -1109,11 +1107,6 @@ Result NSSCertDBTrustDomain::SynchronousCheckRevocationWithServer(
// CRLite says the certificate is revoked, but OCSP says it is OK.
Telemetry::AccumulateCategorical(
Telemetry::LABELS_CRLITE_VS_OCSP_RESULT::CRLiteRevOCSPOk);
-
- if (mCRLiteMode == CRLiteMode::ConfirmRevocations) {
- Telemetry::Accumulate(Telemetry::OCSP_AGE_AT_CRLITE_OVERRIDE,
- ageInHours);
- }
}
} else if (rv == Result::ERROR_REVOKED_CERTIFICATE) {
if (crliteResult == Success) {
@@ -1209,8 +1202,7 @@ Result NSSCertDBTrustDomain::HandleOCSPFailure(
Result NSSCertDBTrustDomain::VerifyAndMaybeCacheEncodedOCSPResponse(
const CertID& certID, Time time, uint16_t maxLifetimeInDays,
Input encodedResponse, EncodedResponseSource responseSource,
- /*out*/ bool& expired,
- /*out*/ uint32_t& ageInHours) {
+ /*out*/ bool& expired) {
Time thisUpdate(Time::uninitialized);
Time validThrough(Time::uninitialized);
@@ -1234,30 +1226,6 @@ Result NSSCertDBTrustDomain::VerifyAndMaybeCacheEncodedOCSPResponse(
return Result::FATAL_ERROR_LIBRARY_FAILURE; // integer overflow
}
}
- // The `thisUpdate` field holds the latest time at which the server knew the
- // response was correct. The age of the response is the time that has elapsed
- // since. We only use this for the telemetry defined in Bug 1794479.
- uint64_t timeInSeconds;
- uint64_t thisUpdateInSeconds;
- uint64_t ageInSeconds;
- SecondsSinceEpochFromTime(time, &timeInSeconds);
- SecondsSinceEpochFromTime(thisUpdate, &thisUpdateInSeconds);
- if (timeInSeconds >= thisUpdateInSeconds) {
- ageInSeconds = timeInSeconds - thisUpdateInSeconds;
- // ageInHours is 32 bits because of the telemetry api.
- if (ageInSeconds > UINT32_MAX) {
- // We could divide by 3600 before checking the UINT32_MAX bound, but if
- // ageInSeconds is more than UINT32_MAX then there's been some sort of
- // error.
- ageInHours = UINT32_MAX;
- } else {
- // We start at 1 and divide with truncation to reserve ageInHours=0 for
- // the case where `thisUpdate` is in the future.
- ageInHours = 1 + ageInSeconds / (60 * 60);
- }
- } else {
- ageInHours = 0;
- }
if (responseSource == ResponseIsFromNetwork || rv == Success ||
rv == Result::ERROR_REVOKED_CERTIFICATE ||
rv == Result::ERROR_OCSP_UNKNOWN_CERT) {
diff --git a/security/certverifier/NSSCertDBTrustDomain.h b/security/certverifier/NSSCertDBTrustDomain.h
index 129efd075f..a219082339 100644
--- a/security/certverifier/NSSCertDBTrustDomain.h
+++ b/security/certverifier/NSSCertDBTrustDomain.h
@@ -272,8 +272,7 @@ class NSSCertDBTrustDomain : public mozilla::pkix::TrustDomain {
Result VerifyAndMaybeCacheEncodedOCSPResponse(
const mozilla::pkix::CertID& certID, mozilla::pkix::Time time,
uint16_t maxLifetimeInDays, mozilla::pkix::Input encodedResponse,
- EncodedResponseSource responseSource, /*out*/ bool& expired,
- /*out*/ uint32_t& ageInHours);
+ EncodedResponseSource responseSource, /*out*/ bool& expired);
TimeDuration GetOCSPTimeout() const;
Result CheckRevocationByCRLite(const mozilla::pkix::CertID& certID,