1537927 - IPsec usage is too restrictive for existing deployments

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P1)

Comment 1

[Robert Relyea]

OK, I pushed enter to soon and it created this bug without a full description. Here is the full description:

In bug 1252891 we added the a new IPSEC usage. The code was a compromise between strict and completely open usage. That compromise violated existing cert processing RFC's, namely the RFC requires that if you parse and extension, setting that extension to critical should not change how you parse said extension.

This created customer issues when they had keyUsage extensions, which were marked critical, but did not contain any IPSEC usage oids.
The libreSwan development team has suggested that IPSEC should accept all certificate usages. This seems problematic for the security team and the final agreement was that:

IPSEC should accept the current ipsec usages (including some deprecated usages), SSL server, SSL client, and S/MIME usages. Other specialized usages are still not accepted (code signing, OCSP and CRL signing, etc), and it's possible to issue IPSEC only certificates by using the IPSEC usages.

This new semantic also has the advantage of simplifying the previous IPSEC patch by making IPSEC work just like our SSLServer or S/MIME usages.

Comment 2

[Robert Relyea]

Attachment: Bug 1537927 - IPsec usage is too restrictive for existing deployments

try: -b do -p all -u all -t all -e all

Comment 3

[Robert Relyea]

https://treeherder.mozilla.org/#/jobs?repo=nss-try&revision=76cd0a2d5fcaae8b8490ac8eb76ef44fb6c2e485

Comment 4

[J.C. Jones [:jcj] (he/they)]

https://hg.mozilla.org/projects/nss/rev/aa6c5c33da26e412845347eb8dd818f33b72a6d5

Comment 5

[J.C. Jones [:jcj] (he/they)]

Bob, ABI check failures:

https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=244950795&repo=nss&lineNumber=3212

Looks like the ABI line numbers are slightly off.

Comment 6

[Robert Relyea]

Yup, Not sure why the nss-try build didn't catch it. Might have been a merge issue. Updated the ABI file.

bob

Comment 7

[Robert Relyea]

Ah, the try build didn't do ABI.

bob

Comment 8

[J.C. Jones [:jcj] (he/they)]

https://hg.mozilla.org/projects/nss/rev/e7128dd879c0f90dfc77b771eb8bd3cb1d6ad8b1