github.com/zmap/zlint@v1.1.0/lints/lint_ext_san_dns_not_ia5_string.go (about)

     1  package lints
     2  
     3  /*
     4   * ZLint Copyright 2018 Regents of the University of Michigan
     5   *
     6   * Licensed under the Apache License, Version 2.0 (the "License"); you may not
     7   * use this file except in compliance with the License. You may obtain a copy
     8   * of the License at http://www.apache.org/licenses/LICENSE-2.0
     9   *
    10   * Unless required by applicable law or agreed to in writing, software
    11   * distributed under the License is distributed on an "AS IS" BASIS,
    12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
    13   * implied. See the License for the specific language governing
    14   * permissions and limitations under the License.
    15   */
    16  
    17  /********************************************************************
    18  RFC 5280: 4.2.1.6
    19  When the subjectAltName extension contains a domain name system
    20  label, the domain name MUST be stored in the dNSName (an IA5String).
    21  The name MUST be in the "preferred name syntax", as specified by
    22  Section 3.5 of [RFC1034] and as modified by Section 2.1 of
    23  [RFC1123].  Note that while uppercase and lowercase letters are
    24  allowed in domain names, no significance is attached to the case.  In
    25  addition, while the string " " is a legal domain name, subjectAltName
    26  extensions with a dNSName of " " MUST NOT be used.  Finally, the use
    27  of the DNS representation for Internet mail addresses
    28  (subscriber.example.com instead of subscriber@example.com) MUST NOT
    29  be used; such identities are to be encoded as rfc822Name.  Rules for
    30  encoding internationalized domain names are specified in Section 7.2.
    31  ********************************************************************/
    32  
    33  import (
    34  	"github.com/zmap/zcrypto/x509"
    35  	"github.com/zmap/zlint/util"
    36  )
    37  
    38  type SANDNSNotIA5String struct{}
    39  
    40  func (l *SANDNSNotIA5String) Initialize() error {
    41  	return nil
    42  }
    43  
    44  func (l *SANDNSNotIA5String) CheckApplies(c *x509.Certificate) bool {
    45  	return util.IsExtInCert(c, util.SubjectAlternateNameOID)
    46  }
    47  
    48  func (l *SANDNSNotIA5String) Execute(c *x509.Certificate) *LintResult {
    49  	ext := util.GetExtFromCert(c, util.SubjectAlternateNameOID)
    50  	if ext == nil {
    51  		return &LintResult{Status: Fatal}
    52  	}
    53  	ok, err := util.AllAlternateNameWithTagAreIA5(ext, util.DNSNameTag)
    54  	if err != nil {
    55  		return &LintResult{Status: Fatal}
    56  	}
    57  	if ok {
    58  		return &LintResult{Status: Pass}
    59  	} else {
    60  		return &LintResult{Status: Error}
    61  	}
    62  }
    63  func init() {
    64  	RegisterLint(&Lint{
    65  		Name:          "e_ext_san_dns_not_ia5_string",
    66  		Description:   "dNSNames MUST be IA5 strings",
    67  		Citation:      "RFC 5280: 4.2.1.6",
    68  		Source:        RFC5280,
    69  		EffectiveDate: util.RFC2459Date,
    70  		Lint:          &SANDNSNotIA5String{},
    71  	})
    72  }