757857 - certutil: create name constraints

Status: RESOLVED FIXED

(NSS :: Tools, defect)

Description

[Kai Engert [:KaiE:]]

The NSS certutil tool should be able to create name constraint extensions.

Comment 1

[Kai Engert [:KaiE:]]

Attachment: some initial code

Comment 2

[Kai Engert [:KaiE:]]

Attachment: Patch v2

Comment 3

[Kai Engert [:KaiE:]]

Comment on attachment 731194 [details] [diff] [review]
Patch v2

-GetGeneralName (PRArenaPool *arena)
+GetGeneralName(PRArenaPool *arena, CERTGeneralName *useExistingName, PRBool onlyOne)

The function GetGeneralName is able to store multiple names in one GetGeneralName. However, when trying to use a GeneralName with more than one entry, the code to encode name constraints will use only the first one.

Therefore I changed this utility function to optionally prompt the user only once.

Also, the name constraints code already allocates a GeneralName as part of another structure, therefore I changed this utility function to optionally use an existing one (instead of always allocation one).


Furthermore, the patch contains code to create a linked list, and setup pointers between list elements.

Note that I didn't write that code. I copied it unchanged from similar code in the certcgi.c file, so IMHO you don't need to review it.


Function CERT_EncodeNameConstraintsExtension already exists, this patch simply exports it.


At runtime, when using the --extNC option, the user will be prompted multiple times, and for each named entered, the user can decide if it's a permitted or an excluded name.

Comment 4

[Robert Relyea]

Comment on attachment 731194 [details] [diff] [review]
Patch v2

r+ rrelyea

Comment 5

[Kai Engert [:KaiE:]]

Checked in as
https://hg.mozilla.org/projects/nss/rev/d721bbf83740

Then I noticed that we already have a version 3.15 section in nss.dev, I cleaned it up with a follow up:
https://hg.mozilla.org/projects/nss/rev/f4f42609fa28