1474875 - Typo in policy handling for DTLS-VERSION-MAX

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement)

Description

[Kai Engert (:KaiE:)]

This commit
  https://hg.mozilla.org/projects/nss/rev/0d419662b42d

from bug 1009429 contains the following incorrect line:
   {CIPHER_NAME("DTLS-VERSION-MAX"), NSS_DTLS_VERSION_MIN_POLICY}

It should be:
   {CIPHER_NAME("DTLS-VERSION-MAX"), NSS_DTLS_VERSION_MAX_POLICY}

It means the policy configuration for DTLS currently isn't working.

Comment 1

[Kai Engert (:KaiE:)]

Attachment: 1474875-v1.patch

Comment 2

[Daiki Ueno [:ueno]]

Comment on attachment 8991300 [details] [diff] [review]
1474875-v1.patch

Review of attachment 8991300 [details] [diff] [review]:
-----------------------------------------------------------------

Sure, looks good to me.

Comment 3

[Daiki Ueno [:ueno]]

By the way, it would be nice if this is covered by the tests.

Comment 4

[Kai Engert (:KaiE:)]

(In reply to Daiki Ueno [:ueno] from comment #3)
> By the way, it would be nice if this is covered by the tests.

Agreed, but I currently don't see an easy way to do so. The NSS test tools don't support DTLS, so we probably cannot use tstclnt like it's done for the other sslpolicy.txt tests.

I suggest to implement a test as part of bug 1474887. For example, we would be able test that a configuration with {min=tls1.2, max=tls1.0} indeed produces an invalid configuration.

Comment 5

[Kai Engert (:KaiE:)]

https://hg.mozilla.org/projects/nss/rev/53c2ee896c57

Comment 6

[Eric Rescorla (:ekr)]

The NSS test tools do support DTLS.

1. We have extensive gtests
2. tstclnt supports DTLS as well, and there's even a test: https://searchfox.org/nss/source/tests/ssl/ssl.sh#1084

Please add some kind of test here.

Comment 7

[Kai Engert (:KaiE:)]

Thanks for the pointer!

Comment 8

[Kai Engert (:KaiE:)]

I've checked in new policy tests as part of bug 1474887. When reverting to the broken handling for DTLS-VERSION-MAX, the new test reports an error.