Limit wildcard DNS ID support to names of the form *.example.com (not foo*.example.com)

RESOLVED FIXED in mozilla37

Status

()

defect
RESOLVED FIXED
4 years ago
3 years ago

People

(Reporter: briansmith, Assigned: briansmith)

Tracking

({dev-doc-complete, site-compat})

Trunk
mozilla37
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

I've never seen a cert with a name of the form foo*.example.com, but mozilla::pkix supports that name form.

RFC 6125 says such names are valid, but it also says that *foo.example.com and foo*bar.example.com are valid, and we already chose not to support them.

Now, Chromium is limiting its support for wildcards to the *.example.com form. This change is consistent with what they are doing.
Attachment #8532350 - Flags: review?(dkeeler)
Comment on attachment 8532350 [details] [diff] [review]
remove-unusual-wildcard-support.patch

Review of attachment 8532350 [details] [diff] [review]:
-----------------------------------------------------------------

Great - r=me with nit addressed.

::: security/pkix/lib/pkixnames.cpp
@@ +1578,5 @@
> +    if (rv != Success) {
> +      assert(false);
> +      return false;
> +    }
> +    

nit: trailing whitespace
Attachment #8532350 - Flags: review?(dkeeler) → review+
https://hg.mozilla.org/mozilla-central/rev/4530482cc605
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Flags: in-testsuite+
Resolution: --- → FIXED

Updated

3 years ago
Depends on: 1155821
You need to log in before you can comment on or make changes to this bug.