635778 - Need an API to pass user defined cert chain when SSL socket is set up

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Comment 1

[Alexei Volkov]

This api is needed to bypass nss chain generation at socket set up time. It will also allow callers to set up sockets with a specific user define certificate chains.

Comment 2

[Alexei Volkov]

Attachment: Patch v1: add new function that allows to pass user cert chain

Comment 3

[Robert Relyea]

Comment on attachment 514086 [details] [diff] [review]
Patch v1: add new function that allows to pass user cert chain

r+ for the code.

I'd like Nelson's comments on whether or not this is a good idea.

bob

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 514086 [details] [diff] [review]
Patch v1: add new function that allows to pass user cert chain

r=nelson

Comment 5

[Alexei Volkov]

checked into trunk.

Comment 6

[Alexei Volkov]

committed into trunk and branch.

Comment 7

[Wan-Teh Chang]

Alexei: please make two changes.

1. List the "const CERTCertificateList *certChainOpt" parameter
after the closely related "CERTCertificate *cert" parameter.
This is the order in which they are listed in the
ssl_ConfigSecureServer function.

2. Please remove the "Opt" at the end of the function name,
unless it is meaningful.  I don't know what "Opt" means.
Does it mean an optional argument that can be NULL?  I
have only seen this naming convention used in the 'arenaOpt'
parameter commonly used in Stan code.

I think "WithCertChain" is clearer than "WithChainOpt".

Re: documentation
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/ssl/ssl.h&rev=1.40&mark=376#375

Change "caller certificate chain" to "caller-supplied certificate chain".
You should document that
    If certChain is NULL, tries to find one.

Comment 8

[Nelson Bolyard (seldom reads bugmail)]

Opt names a pointer parameter that is allowed to be NULL.
NULL does not result in an INVALID_ARGUMENT error.
It was used in the Stan project and by Julien (IINM).
Use by others has been merely occasional.

Comment 9

[Wan-Teh Chang]

Attachment: Supplemental cleanup patch

Rename SSL_ConfigSecureServerWithChainOpt to
SSL_ConfigSecureServerWithCertChain.  List the certChainOpt
argument immediately after the cert argument.  Improve comments.

In the interest of time, I checked in the patch on the NSS
trunk (NSS 3.13) and NSS_3_12_BRANCH (NSS 3.12.10) before
getting a review.  Please undo the changes you don't like.