8261513: Various BasicConstraintsExtension issues #20224
Conversation
…epresentation for unconstrained pathLens
|
👋 Welcome back blperez01! A progress list of the required criteria for merging this PR into |
|
❗ This change is not yet ready to be integrated. |
|
@blperez01 The following label will be automatically applied to this pull request:
When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command. |
openjdk
bot
added
security
Webrevs
|
|
@blperez01 This pull request has been inactive for more than 4 weeks and will be automatically closed if another 4 weeks passes without any activity. To avoid this, simply add a new comment to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration! |
|
@blperez01 This pull request has been inactive for more than 8 weeks and will now be automatically closed. If you would like to continue working on this pull request in the future, feel free to reopen it! This can be done using the |
|
/open |
|
@blperez01 This pull request is now open |
|
Re-opening PR |
There was a problem hiding this comment.
On line 143, we should throw an IOException if the decoded pathLenConstraint field is < 0. This is point #1 in the bug report.
| } else if (pathLen == Integer.MAX_VALUE) { | ||
| pathLenAsString = " no limit"; | ||
| if (pathLen < 0 || pathLen == Integer.MAX_VALUE) { | ||
| pathLenAsString = " unconstained"; |
There was a problem hiding this comment.
Typo: s/unconstained/unconstrained/
But I actually prefer the words "no limit" as that is what RFC 5280, section 4.2.1.9 uses, so please restore those words. You can use that term for the "undefined" case as well.
There was a problem hiding this comment.
On line 186, it's questionable if we need to set the critical flag to the value of the ca field. This was comment #6 in the bug report. RFC 5280 gives a few cases where it is acceptable to have a non-critical BasicConstraintsExtension with a ca field set to true. I would remove that and make sure all tests still pass.
Progress
Issue
Reviewing
Using
gitCheckout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/20224/head:pull/20224$ git checkout pull/20224Update a local copy of the PR:
$ git checkout pull/20224$ git pull https://git.openjdk.org/jdk.git pull/20224/headUsing Skara CLI tools
Checkout this PR locally:
$ git pr checkout 20224View PR using the GUI difftool:
$ git pr show -t 20224Using diff file
Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/20224.diff
Using Webrev
Link to Webrev Comment