221646 - NSS fails 2 NIST test cases for Name Constraints.

Status: VERIFIED FIXED

(NSS :: Libraries, defect, P2)

Description

[Nelson Bolyard (seldom reads bugmail)]

Section 4.13: Name Constraints.  38 test cases.

    NSS fails 2 cases.  Is this a recent regression (last week or two)?

    19: involves a self-issued cert.  NSS says it's bad, NIST says good.
    Given that it's self issued, I don't think we care.

    36: URI name constraints.  NSS says it fails, NIST says it's good.

Comment 1

[Bishakha Banerjee]

I checked with an NSS of a month ago, as well as of 2 months ago. I get same
results as reported here. This is not a regression. Sorry, misread the results
last time.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

taking bug for NSS 3.9

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Case 36, reported above, does indeed reveal a flaw in NSS's new name 
constraints code. 

The constraint is an excluded URI name: "invalidcertificates.gov"
and the EE's URI is "http://testserver.invalidcertificates.gov/index.html".
NSS concludes that the URI matches the constraint, and it therefor excluded.
But RFC 3280 says (pg 38): "When the constraint does not begin with a period,
it specifies a host", (i.e., it does not specify a domain).  So, this is a 
false match.  

I will develop a patch for this.

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Attachment: patch v1

This patch creates separate comparison functions for URI and DNS names,
and makes them match the RFC3280 description more exactly.
This addresses the problem in test case 36, not case 19.

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

Adding Wan-Teh to CC list.  Wan-Teh, please review the above patch.

Comment 6

[Nelson Bolyard (seldom reads bugmail)]

I see one comment line that must be fixed for the URI comparison function.
The line that reads:
**  foo.bar.com      www.foo.bar.com      matches
should read
**  foo.bar.com      www.foo.bar.com      no match

Comment 7

[Nelson Bolyard (seldom reads bugmail)]

Attachment: patch v2

This patch corrects comments, and the behavior of empty URI constraints.

Comment 8

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 135527 [details] [diff] [review]
patch v1

This obsolete patch no longer needs to be reviewed. However, its successor does
need review.

Comment 9

[Wan-Teh Chang]

Comment on attachment 135528 [details] [diff] [review]
patch v2

r=wtc.

Comment 10

[Nelson Bolyard (seldom reads bugmail)]

Patch v2 above is checked in.  It fixes test case 36.

Steve Hanna and I discussed test case 19 briefly today, and I am going to 
take a fresh look at that bug (and other bugs involving self-issued certs)
in light of his comments.  So, I am leaving this bug open until I know
what we can/will do about test case 19.

Comment 11

[Nelson Bolyard (seldom reads bugmail)]

I am going to mark this bug fixed in NSS 3.9.
I am going to file a separate bug about NIST tests with self-signed certs 
in the chain.

Comment 12

[Bishakha Banerjee]

NSS now passes all NIST nameConstraints test, hence marking this VERIFIED. This
duplicates the VERIFIED in 231030 (NSS 3.9.1 target)