1808413 - keyusage and nscerttype flags without keywords trigger infinite loop during interactive mode

Status: RESOLVED WORKSFORME

(NSS :: Tools, defect)

Description

[whoneyc]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0

Steps to reproduce:

Tested on Ubuntu 18.04 and Kubuntu 22.04.1 LTS x86_64.

On the Ubuntu box, this was a fresh install of nss with no other Mozilla products installed on the system. I created the default directory $HOME/.pki/nssdb and initialized databases with certutil -N -d sql:$HOME/.pki/nssdb.

I attempted to perform a function listed as an example in the man pages under "Creating a Certificate" in "Usage and Examples". Specifically, I tried:

certutil -S -s "CN=Example CA" -n my-ca-cert -x -t "C,C,C" -1 -2 -5 -m 3650

Actual results:

The interactive portion without using a keyword for the numbered arguments prompts the user to select a type:

                0 - Digital Signature
                1 - Non-repudiation
                2 - Key encipherment
                3 - Data encipherment
                4 - Key agreement
                5 - Cert signing key
                6 - CRL signing key
                Other to finish
>

I tried each number (and even using "Other") and the prompt reappears, seemingly infinitely.

Poking this a bit more, I can get a similar infinite loop to appear when I use the -1 and -5 arguments alone, but not the -2.

I exited the loop with SIGINT.

Expected results:

The response should be recorded based on the user input and not enter an infinite loop.

This bug appears remarkably similar to https://bugzilla.mozilla.org/show_bug.cgi?id=286505, but I did not want to necro a closed bug that is old enough to smoke and die for its country.

Comment 1

[John Schanck [:jschanck]]

I wasn't able to reproduce this. The interface is not very intuitive, but typing "Other" won't exit the loop. Here "Other to finish" means "some other number". Does the prompt reappear when you enter, say, 9?

Comment 2

[whoneyc]

(In reply to John Schanck [:jschanck] from comment #1)

I wasn't able to reproduce this. The interface is not very intuitive, but typing "Other" won't exit the loop. Here "Other to finish" means "some other number". Does the prompt reappear when you enter, say, 9?

Correct, using 9 exits the loop. This may be a PEBKAC error. Is there supposed to be a function when I enter a number between 0-6?

Comment 3

[John Schanck [:jschanck]]

The options aren't mutually exclusive, so the prompt re-appears when you enter a value in 0-6 to allow you to select multiple options.

Not an ideal interface, but I don't think we'll change it.

Comment 4

[whoneyc]

(In reply to John Schanck [:jschanck] from comment #3)

The options aren't mutually exclusive, so the prompt re-appears when you enter a value in 0-6 to allow you to select multiple options.

Not an ideal interface, but I don't think we'll change it.

Ah, so it is working as intended, and I misunderstood the function. Not a bug. Recommend closing.