Name Constraint for IP subnets is expecting a plain IP instead of subnet

natan-abolafya commented 3 years ago

Describe the bug It's really cool to see that the Name Constraints is already supported. As I was creating new CA certificates to test some implementation around this extension, I couldn't create a proper IP one. As documented here, the expected value for IP constraint is supposed to represent a subnet:

IPAddress = 192.168.0.0, 255.255.255.0 ; format: {IP network address},{Subnet Mask}

But when I try to create one, KeyStore Explorer expects a plain IP. It also fails to parse it when it's created by openssl with that format. (Screenshots and examples below)

To Reproduce Steps to reproduce the behavior:

Create a new KeyStore - PKCS#12
Right-click and "Generate a new key pair". Click OK to generate RSA key.
Enter details for your cert if you want and then click "Add Extensions".
Click "+" and choose "Name Constraints"
Click "+" on either Permitted or Excluded section.
Click the icon for "General name" and choose "IP Address".
Enter "192.168.0.0, 255.255.255.0" into "General Name Value" and press OK.
It will show an error saying "Not a valid IPv4 or IPv6 address".

Expected behavior It accepts the value. And it shouldn't accept the expected input of plain IP. (Unless you want to automatically append , 255.255.255.255)

Screenshots

Also, here is a CA file with a proper name constraints:

How KeyStore Explorer parses it:

How Windows parses it:

Environment

Version of KSE: 5.4.4
Version of Java: jdk-11.0.11.9-hotspot
Platform (OS): Windows 10

kaikramer commented 3 years ago

Thanks for reporting!

kaikramer commented 3 years ago

Some thoughts on the input format:

{IP network address}, {Subnet Mask} is how Microsoft's certreq.exe expects the input data, which is not necessarily the best or most common way to write an IP range.

Normally one would write it like this (see RFC 4632): 192.168.1.0/24 (which means a 24 bit or 255.255.255.0 mask)

On the other hand, 192.168.1.0, 255.255.255.0 might be easier to understand and that's how it is stored in the extension anyway...

natan-abolafya commented 3 years ago

yeah, while I'd prefer the 192.168.1.0/24 notation in general also, I'd go for sticking to what X509 uses.

kaikramer commented 2 years ago

Closing tickets in preparation for release of KSE 5.5.0

kaikramer / keystore-explorer

Name Constraint for IP subnets is expecting a plain IP instead of subnet #298