1107790 - Remove support for absolute hostnames in presented DNS IDs and name constraints

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: remove-absolute-DNS-ID-cert-support.patch

I think we're being a little too liberal in supporting the absolute DNS ID syntax for presented IDs (hostnames in the CN of the subject, and DNSNames in SubjectAltName). RFC 5280 and related standards do not suggest any syntax that supports the trailing dot.

We still have to support absolute *reference DNS IDs*, but we should remove the support for the other forms.

Comment 1

[Dana Keeler (she/her) [:keeler]]

Comment on attachment 8532349 [details] [diff] [review]
remove-absolute-DNS-ID-cert-support.patch

Review of attachment 8532349 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM - just two items to address.

::: security/pkix/lib/pkixnames.cpp
@@ +757,5 @@
>          case GeneralNameType::dNSName:
>            matches = PresentedDNSIDMatchesReferenceDNSID(
>                        presentedID, ValidDNSIDMatchType::NameConstraint, base);
> +          if (!matches &&
> +              !IsValidDNSID(base, ValidDNSIDMatchType::NameConstraint)) {

I'm not sure I understand why we have '!matches &&' here - is that an optimization? (Because if matches is true, then we already know base is a valid DNSID as a name constraint.) We should probably document that, if so.

@@ +1072,5 @@
>        if (!isFirstPresentedByte && StartsWithIDNALabel(referenceDNSID)) {
>          return false;
>        }
> +    }
> +    else {

nit: '} else {' all on one line, unless there's a compelling reason not to

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/cfe200a463ab

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/cfe200a463ab

Comment 4

[Kohei Yoshino [:kohei]]

Added to the compat doc: https://developer.mozilla.org/en-US/Firefox/Releases/37/Site_Compatibility