970810 - Modify name constraints tests to test insanity::pkix

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

We need to modify test_name_constraints.js to test insanity::pkix as well as the classic certificate verification. This requires us to change how we decide which error code to return from insanity::pkix. That requires the refactoring in bug 915931.

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Camilo decided not to modify the name constraint tests to add insanity::pkix support in bug 900727, so we need to reopen this.

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: name-constraints-tests-insanity.patch

I had to modify generate.py to remove the extra EKUs (in particular, Object Signing). I also added explicitly-documented cases for the special handling of EKU. Even though those tests are technically redundant, it is useful to call them out separately.

I looked at the classic NSS code:

	    PRBool getSubjectCN = (!count && certUsage == certUsageSSLServer);
	    subjectNameList = 
	    	CERT_GetConstrainedCertificateNames(subjectCert, arena,
		                                    getSubjectCN);

That is the same logic that insanity::pkix uses, EXCEPT for the counting of sub-CA certificates is slightly different.

Comment 4

[Camilo Viecco (:cviecco)]

Comment on attachment 8376786 [details] [diff] [review]
name-constraints-tests-insanity.patch

Review of attachment 8376786 [details] [diff] [review]:
-----------------------------------------------------------------

r+ assuming this actually passes the tests. I tried to do the insanity switch on 900727 but I was not getting namespace errors when using insanity but unknown issuer.

Comment 5

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

(In reply to Camilo Viecco (:cviecco) from comment #4)
> r+ assuming this actually passes the tests. I tried to do the insanity
> switch on 900727 but I was not getting namespace errors when using insanity
> but unknown issuer.

Yes, that's because you were missing the patch in bug 973268, which this bug depends on. Also, I see I forgot to attach the patch to bug 973268. Will do that later today.

Comment 6

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e931f64fda23

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/e931f64fda23

Comment 8

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Uplifted to Mozilla-Aurora, a=test-only:
https://hg.mozilla.org/releases/mozilla-aurora/rev/88cb27a425af