Description of problem:
rhcs81 - UTF-8 support and X500Name pattern matching for Subject Name
Constraints - Request Rejected - Subject Name Not Matched
UID=???????,CN=???????
Requests seem to be rejected when adding pattern matching in a profile's
Subject Name Constraints with UTF-8 chars.
Version-Release number of selected component (if applicable):
Red Hat Enterprise Linux Server release 5.8 (Tikanga)
Linux ca1.example.com 2.6.18-308.16.1.el5 #1 SMP Tue Sep 18 07:21:07 EDT 2012
x86_64 x86_64 x86_64 GNU/Linux
pki-ca-8.1.1-1.el5pki
redhat-ds-base-8.2.10-3.el5dsrv
nss-3.13.5-4.el5_8
nss-3.13.5-4.el5_8
jss-4.2.6-21.99.el5idm
How reproducible:
always
Steps to Reproduce:
1. Have RHEL5 and RHCS 8.1 CA instance installed, configured, operational
2. Modify a profile, for example caUserCert.cfg to match some uid's starting
with a 8 bits UTF-8 chars:
vi /var/lib/pki-ca8/profiles/ca/caUserCert.cfg
...
policyset.userCertSet.1.constraint.params.pattern=UID=?.*
...
diff /var/lib/pki-ca8/profiles/ca/caUserCert.cfg
/var/lib/pki-ca8/profiles/ca/caUserCert.cfg.orig
17c17
< policyset.userCertSet.1.constraint.params.pattern=UID=?.*
---
> policyset.userCertSet.1.constraint.params.pattern=UID=.*
3. enroll using EE page, provide with a test subject name like
UID=???????,CN=???????
could be just
UID=?test,CN=test
Actual results:
EE enrollment page:
"
Certificate Profile
Sorry, your request has been rejected. The reason is "Request Rejected -
Subject Name Not Matched UID=???????,CN=???????"
Your request ID is 14.
"
debug log:
[28/Nov/2012:16:18:16][http-8444-Processor25]: SubjectNameConstraint: validate
cert subject =UID=???????,CN=???????
[28/Nov/2012:16:18:16][http-8444-Processor25]: SubjectNameConstraint:
validate() - sn500 dname = UID=???????,CN=???????
[28/Nov/2012:16:18:16][http-8444-Processor25]: SubjectNameConstraint:
validate() - sn500 not matching pattern UID=??.*
[28/Nov/2012:16:18:16][http-8444-Processor25]: ProfileSubmitServlet: submit
Subject Name Not Matched UID=???????,CN=???????
Expected results:
good pattern matching of
policyset.userCertSet.1.constraint.params.pattern=UID=?.*
for
UID=???????,CN=???????
or
UID=?test,CN=test
Additional info:
./pki/base/common/src/com/netscape/cms/profile/constraint/SubjectNameConstraint
.java:            CMS.debug("SubjectNameConstraint: validate() - sn500 is
null");
./pki/base/common/src/com/netscape/cms/profile/constraint/SubjectNameConstraint
.java:            CMS.debug("SubjectNameConstraint: validate() - sn500 "+
./pki/base/common/src/com/netscape/cms/profile/constraint/SubjectNameConstraint
.java:            CMS.debug("SubjectNameConstraint: validate() - sn500 not
matching pattern "+ getConfig(CONFIG_PATTERN));
less ./pki/base/common/src/com/netscape/cms/profile/constraint/SubjectNameConst
raint.java
...
        if (!sn500.toString().matches(getConfig(CONFIG_PATTERN))) {
            CMS.debug("SubjectNameConstraint: validate() - sn500 not matching
pattern "+ getConfig(CONFIG_PATTERN));
            throw new ERejectException(
                    CMS.getUserMessage(getLocale(request),
                        "CMS_PROFILE_SUBJECT_NAME_NOT_MATCHED",
                        sn500.toString()));
        }
    }
I am then lost with
sn500.toString
in
./pki/base/util/src/netscape/security/x509/X500Name.java
for
    public String toLdapDNString()
    public String toLdapDNString(LdapDNStrConverter ldapDNStrConverter)
    public String toString()
it seem like the issue may be around ldapDNStrConverter and/or
LdapDNStrConverter
to add UTF-8 support
it was very likely not designed for this feature, but I could be wrong.