554425 - Remove support for Netscape SSL server names (SEC_OID_NS_CERT_EXT_SSL_SERVER_NAME)

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P2)

Description

[Matt McCutchen]

NSS currently recognizes a Netscape SSL server name (SEC_OID_NS_CERT_EXT_SSL_SERVER_NAME) in a certificate as an authorized hostname, overriding the common name.  According to bug 394919 comment #38, no one is using this feature and it can just be removed.  That will make our lives slightly easier in bug 394919.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Attachment: Patch v1 for NSS Trunk

Pretty simple.  
Bob, please review.

Comment 2

[Robert Relyea]

Comment on attachment 435486 [details] [diff] [review]
Patch v1 for NSS Trunk

r+ rrelyea

Comment 3

[Matt McCutchen]

Comment on attachment 435486 [details] [diff] [review]
Patch v1 for NSS Trunk

There are two places where the SEC_OID_NS_CERT_EXT_SSL_SERVER_NAME is used as a server name:

https://mxr.mozilla.org/mozilla/ident?i=SEC_OID_NS_CERT_EXT_SSL_SERVER_NAME&filter=security%2Fnss

You missed the important one, in CERT_VerifyCertName.  CERT_GetValidDNSPatternsFromCert is not used yet (see bug 411246).

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Attachment: Patch v2 for NSS trunk

Glad you caught that Matt, so I'll invite you to review this patch.

Comment 5

[Matt McCutchen]

Comment on attachment 436423 [details] [diff] [review]
Patch v2 for NSS trunk

The patch looks correct, though I haven't actually tested it (I am still setting up my Mozilla development environment).

Comment 6

[Robert Relyea]

Comment on attachment 436423 [details] [diff] [review]
Patch v2 for NSS trunk

r+ rrelyea

Comment 7

[Nelson Bolyard (seldom reads bugmail)]

Bug 554425: Remove support for Netscape's SSL server name extension 
r=[e-mail],[e-mail]

Checking in lib/certdb/certdb.c; new revision: 1.104; previous revision: 1.103