Skip to content

Commit e33bae9

Browse files
mtgagmtgweb-flowchristopher-hendersonzakird
authored
Update single email subject if present (#802)
* lint about the encoding of qcstatements for PSD2 * Revert "lint about the encoding of qcstatements for PSD2" This reverts commit 6c23670. * util: gtld_map autopull updates for 2021-10-21T07:25:20 UTC * always check and perform the operation in the execution * synchronised with project * synchronised with project * synchronised with project * synchronised with project * added same lint for subject values instead of SAN values * resolved conflict issue * addressed review comments and hint to citation from #795 --------- Co-authored-by: mtg <[email protected]> Co-authored-by: GitHub <[email protected]> Co-authored-by: Christopher Henderson <[email protected]> Co-authored-by: Zakir Durumeric <[email protected]>
1 parent 7c899ea commit e33bae9

File tree

5 files changed

+225
-0
lines changed

5 files changed

+225
-0
lines changed

‎v3/lints/cabf_smime_br/lint_single_email_subject_if_present.go‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
/*
2+
* ZLint Copyright 2024 Regents of the University of Michigan
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License"); you may not
5+
* use this file except in compliance with the License. You may obtain a copy
6+
* of the License at http://www.apache.org/licenses/LICENSE-2.0
7+
*
8+
* Unless required by applicable law or agreed to in writing, software
9+
* distributed under the License is distributed on an "AS IS" BASIS,
10+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
11+
* implied. See the License for the specific language governing
12+
* permissions and limitations under the License.
13+
*/
14+
15+
package cabf_smime_br
16+
17+
import (
18+
"fmt"
19+
"net/mail"
20+
21+
"github.com/zmap/zcrypto/x509"
22+
"github.com/zmap/zlint/v3/lint"
23+
"github.com/zmap/zlint/v3/util"
24+
)
25+
26+
func init() {
27+
lint.RegisterCertificateLint(&lint.CertificateLint{
28+
LintMetadata: lint.LintMetadata{
29+
Name: "e_single_email_subject_if_present",
30+
Description: "If present, the subject:emailAddress SHALL contain a single Mailbox Address",
31+
Citation: "7.1.4.2.2.h",
32+
Source: lint.CABFSMIMEBaselineRequirements,
33+
EffectiveDate: util.CABF_SMIME_BRs_1_0_0_Date,
34+
},
35+
Lint: NewSingleEmailSubjectIfPresent,
36+
})
37+
}
38+
39+
type singleEmailSubjectIfPresent struct{}
40+
41+
func NewSingleEmailSubjectIfPresent() lint.LintInterface {
42+
return &singleEmailSubjectIfPresent{}
43+
}
44+
45+
func (l *singleEmailSubjectIfPresent) CheckApplies(c *x509.Certificate) bool {
46+
emailAddress := c.Subject.EmailAddress
47+
return util.IsSubscriberCert(c) && emailAddress != nil && len(emailAddress) != 0 && util.IsSMIMEBRCertificate(c)
48+
}
49+
50+
func (l *singleEmailSubjectIfPresent) Execute(c *x509.Certificate) *lint.LintResult {
51+
for _, email := range c.Subject.EmailAddress {
52+
if _, err := mail.ParseAddress(email); err != nil {
53+
return &lint.LintResult{
54+
Status: lint.Error,
55+
Details: fmt.Sprintf("subject:emailAddress was present and contained an invalid email address (%s)", email),
56+
}
57+
}
58+
}
59+
return &lint.LintResult{Status: lint.Pass}
60+
}

‎v3/lints/cabf_smime_br/lint_single_email_subject_if_present_test.go‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
package cabf_smime_br
2+
3+
import (
4+
"testing"
5+
6+
"github.com/zmap/zlint/v3/lint"
7+
"github.com/zmap/zlint/v3/test"
8+
)
9+
10+
func TestSingleEmailSubjectIfPresent(t *testing.T) {
11+
testCases := []struct {
12+
Name string
13+
InputFilename string
14+
ExpectedResult lint.LintStatus
15+
}{
16+
{
17+
Name: "error - email address present in subjectDN with multiple values",
18+
InputFilename: "smime/twoEmailAddressesInSubjectDN.pem",
19+
ExpectedResult: lint.Error,
20+
},
21+
{
22+
Name: "pass - email address present in subjectDN with one value",
23+
InputFilename: "smime/oneEmailAddressInSubjectDN.pem",
24+
ExpectedResult: lint.Pass,
25+
},
26+
{
27+
Name: "na - no email address present in subjectDN",
28+
InputFilename: "smime/noEmailAddressInSubjectDN.pem",
29+
ExpectedResult: lint.NA,
30+
},
31+
}
32+
for _, tc := range testCases {
33+
t.Run(tc.Name, func(t *testing.T) {
34+
result := test.TestLint("e_single_email_subject_if_present", tc.InputFilename)
35+
if result.Status != tc.ExpectedResult {
36+
t.Errorf("expected result %v was %v - details: %v", tc.ExpectedResult, result.Status, result.Details)
37+
}
38+
})
39+
}
40+
}

‎v3/testdata/smime/noEmailAddressInSubjectDN.pem‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
Certificate:
2+
Data:
3+
Version: 3 (0x2)
4+
Serial Number:
5+
42:17:33:09:8d:0d:17:ce:1e:5c:97:77
6+
Signature Algorithm: ecdsa-with-SHA256
7+
Issuer: CN = Lint CA, O = Lint, C = DE
8+
Validity
9+
Not Before: Sep 1 00:00:00 2023 GMT
10+
Not After : Sep 1 00:00:00 2024 GMT
11+
Subject: CN = SMIME, O = Lint, C = DE
12+
Subject Public Key Info:
13+
Public Key Algorithm: id-ecPublicKey
14+
Public-Key: (256 bit)
15+
pub:
16+
04:fc:9d:49:5c:28:e0:11:83:2e:f2:eb:91:54:31:
17+
24:b6:78:82:5f:ee:42:29:8e:c8:c3:c1:00:1c:66:
18+
d7:51:96:5d:28:a2:fd:1e:dc:a2:97:e5:e9:ce:53:
19+
58:4b:fb:0a:46:df:42:ff:35:c8:8e:27:48:96:4e:
20+
46:4e:32:68:20
21+
ASN1 OID: prime256v1
22+
NIST CURVE: P-256
23+
X509v3 extensions:
24+
X509v3 Certificate Policies:
25+
Policy: 2.23.140.1.5.1.2
26+
27+
Signature Algorithm: ecdsa-with-SHA256
28+
30:45:02:21:00:e7:47:dc:26:b3:2e:3b:fe:d7:af:a5:bc:63:
29+
94:ba:94:bd:38:7c:3c:ec:40:fa:38:39:29:ae:77:c0:3c:14:
30+
06:02:20:71:cf:42:af:f3:1b:b9:90:27:d2:bc:76:67:c0:00:
31+
dd:59:54:61:95:b8:66:5f:c3:4e:99:6c:a2:58:0f:b6:e2
32+
-----BEGIN CERTIFICATE-----
33+
MIIBbDCCARKgAwIBAgIMQhczCY0NF84eXJd3MAoGCCqGSM49BAMCMC4xEDAOBgNV
34+
BAMMB0xpbnQgQ0ExDTALBgNVBAoMBExpbnQxCzAJBgNVBAYTAkRFMB4XDTIzMDkw
35+
MTAwMDAwMFoXDTI0MDkwMTAwMDAwMFowLDEOMAwGA1UEAwwFU01JTUUxDTALBgNV
36+
BAoMBExpbnQxCzAJBgNVBAYTAkRFMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
37+
/J1JXCjgEYMu8uuRVDEktniCX+5CKY7Iw8EAHGbXUZZdKKL9Htyil+XpzlNYS/sK
38+
Rt9C/zXIjidIlk5GTjJoIKMYMBYwFAYDVR0gBA0wCzAJBgdngQwBBQECMAoGCCqG
39+
SM49BAMCA0gAMEUCIQDnR9wmsy47/tevpbxjlLqUvTh8POxA+jg5Ka53wDwUBgIg
40+
cc9Cr/MbuZAn0rx2Z8AA3VlUYZW4Zl/DTplsolgPtuI=
41+
-----END CERTIFICATE-----

‎v3/testdata/smime/oneEmailAddressInSubjectDN.pem‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
Certificate:
2+
Data:
3+
Version: 3 (0x2)
4+
Serial Number:
5+
89:20:fd:0d:4f:59:a1:79:ff:86:e5:26
6+
Signature Algorithm: ecdsa-with-SHA256
7+
Issuer: CN = Lint CA, O = Lint, C = DE
8+
Validity
9+
Not Before: Sep 1 00:00:00 2023 GMT
10+
Not After : Sep 1 00:00:00 2024 GMT
11+
Subject: emailAddress = [email protected], O = Lint, C = DE
12+
Subject Public Key Info:
13+
Public Key Algorithm: id-ecPublicKey
14+
Public-Key: (256 bit)
15+
pub:
16+
04:91:d8:6e:7f:71:94:58:a1:2d:2b:fd:0c:e2:51:
17+
1a:69:a5:2b:43:46:3d:1e:0c:e4:21:d4:29:a6:c3:
18+
9a:c5:07:df:9d:9a:81:05:04:92:43:45:4b:46:e3:
19+
24:e5:ba:5e:a6:70:a1:8e:b1:f8:d6:f4:be:d1:46:
20+
b5:91:af:50:61
21+
ASN1 OID: prime256v1
22+
NIST CURVE: P-256
23+
X509v3 extensions:
24+
X509v3 Certificate Policies:
25+
Policy: 2.23.140.1.5.1.2
26+
27+
Signature Algorithm: ecdsa-with-SHA256
28+
30:46:02:21:00:f3:c0:3b:a7:6e:c2:e9:a7:31:c5:8c:ef:7c:
29+
c5:3e:73:56:27:e4:af:dd:fe:5c:42:68:de:b8:e1:0a:b3:98:
30+
46:02:21:00:84:56:5e:50:93:17:17:8c:86:3c:93:56:8f:79:
31+
03:5e:53:01:f3:c9:4d:d2:4b:ea:6f:46:7b:ac:32:0d:c6:ad
32+
-----BEGIN CERTIFICATE-----
33+
MIIBgDCCASWgAwIBAgINAIkg/Q1PWaF5/4blJjAKBggqhkjOPQQDAjAuMRAwDgYD
34+
VQQDDAdMaW50IENBMQ0wCwYDVQQKDARMaW50MQswCQYDVQQGEwJERTAeFw0yMzA5
35+
MDEwMDAwMDBaFw0yNDA5MDEwMDAwMDBaMD4xIDAeBgkqhkiG9w0BCQEWEXpsaW50
36+
QGV4YW1wbGUuY29tMQ0wCwYDVQQKDARMaW50MQswCQYDVQQGEwJERTBZMBMGByqG
37+
SM49AgEGCCqGSM49AwEHA0IABJHYbn9xlFihLSv9DOJRGmmlK0NGPR4M5CHUKabD
38+
msUH352agQUEkkNFS0bjJOW6XqZwoY6x+Nb0vtFGtZGvUGGjGDAWMBQGA1UdIAQN
39+
MAswCQYHZ4EMAQUBAjAKBggqhkjOPQQDAgNJADBGAiEA88A7p27C6acxxYzvfMU+
40+
c1Yn5K/d/lxCaN644QqzmEYCIQCEVl5QkxcXjIY8k1aPeQNeUwHzyU3SS+pvRnus
41+
Mg3GrQ==
42+
-----END CERTIFICATE-----

‎v3/testdata/smime/twoEmailAddressesInSubjectDN.pem‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
Certificate:
2+
Data:
3+
Version: 3 (0x2)
4+
Serial Number:
5+
11:58:a9:ab:65:63:46:e7:02:8f:b3:eb
6+
Signature Algorithm: ecdsa-with-SHA256
7+
Issuer: CN = Lint CA, O = Lint, C = DE
8+
Validity
9+
Not Before: Sep 1 00:00:00 2023 GMT
10+
Not After : Sep 1 00:00:00 2024 GMT
11+
Subject: emailAddress = [email protected] [email protected], O = Lint, C = DE
12+
Subject Public Key Info:
13+
Public Key Algorithm: id-ecPublicKey
14+
Public-Key: (256 bit)
15+
pub:
16+
04:91:ee:42:50:c4:da:48:da:63:04:bd:e0:30:54:
17+
3e:65:b7:c8:17:1a:c1:38:4d:f4:a6:91:3b:03:0c:
18+
d2:36:cf:f1:72:d9:b3:4c:d4:39:9e:a4:d0:b5:27:
19+
d2:50:74:9f:80:b2:ac:d2:fa:af:ed:bd:de:8b:3e:
20+
52:d7:08:77:a2
21+
ASN1 OID: prime256v1
22+
NIST CURVE: P-256
23+
X509v3 extensions:
24+
X509v3 Certificate Policies:
25+
Policy: 2.23.140.1.5.1.2
26+
27+
Signature Algorithm: ecdsa-with-SHA256
28+
30:46:02:21:00:98:5f:ff:ba:1f:32:88:63:1f:cd:6d:f9:fb:
29+
81:82:48:c1:d9:2d:fb:84:5b:6e:6d:74:87:7f:61:ca:a3:a5:
30+
a7:02:21:00:c8:f2:5b:c7:96:1c:3c:67:b5:4d:eb:27:4d:71:
31+
fa:86:6b:c0:c4:a8:fd:d1:8e:dc:3b:17:f9:1f:ca:3c:ff:f3
32+
-----BEGIN CERTIFICATE-----
33+
MIIBkjCCATegAwIBAgIMEVipq2VjRucCj7PrMAoGCCqGSM49BAMCMC4xEDAOBgNV
34+
BAMMB0xpbnQgQ0ExDTALBgNVBAoMBExpbnQxCzAJBgNVBAYTAkRFMB4XDTIzMDkw
35+
MTAwMDAwMFoXDTI0MDkwMTAwMDAwMFowUTEzMDEGCSqGSIb3DQEJARYkemxpbnRA
36+
ZXhhbXBsZS5jb20gc2Vjb25kQGV4YW1wbGUuY29tMQ0wCwYDVQQKDARMaW50MQsw
37+
CQYDVQQGEwJERTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJHuQlDE2kjaYwS9
38+
4DBUPmW3yBcawThN9KaROwMM0jbP8XLZs0zUOZ6k0LUn0lB0n4CyrNL6r+293os+
39+
UtcId6KjGDAWMBQGA1UdIAQNMAswCQYHZ4EMAQUBAjAKBggqhkjOPQQDAgNJADBG
40+
AiEAmF//uh8yiGMfzW35+4GCSMHZLfuEW25tdId/YcqjpacCIQDI8lvHlhw8Z7VN
41+
6ydNcfqGa8DEqP3Rjtw7F/kfyjz/8w==
42+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)