github.com/zmap/zlint@v1.1.0/lints/lint_ext_san_space_dns_name.go (about)

     1  package lints
     2  
     3  /*
     4   * ZLint Copyright 2018 Regents of the University of Michigan
     5   *
     6   * Licensed under the Apache License, Version 2.0 (the "License"); you may not
     7   * use this file except in compliance with the License. You may obtain a copy
     8   * of the License at http://www.apache.org/licenses/LICENSE-2.0
     9   *
    10   * Unless required by applicable law or agreed to in writing, software
    11   * distributed under the License is distributed on an "AS IS" BASIS,
    12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
    13   * implied. See the License for the specific language governing
    14   * permissions and limitations under the License.
    15   */
    16  
    17  /************************************************************************
    18  RFC 5280: 4.2.1.6
    19  When the subjectAltName extension contains a domain name system
    20     label, the domain name MUST be stored in the dNSName (an IA5String).
    21     The name MUST be in the "preferred name syntax", as specified by
    22     Section 3.5 of [RFC1034] and as modified by Section 2.1 of
    23     [RFC1123].  Note that while uppercase and lowercase letters are
    24     allowed in domain names, no significance is attached to the case.  In
    25     addition, while the string " " is a legal domain name, subjectAltName
    26     extensions with a dNSName of " " MUST NOT be used.  Finally, the use
    27     of the DNS representation for Internet mail addresses
    28     (subscriber.example.com instead of subscriber@example.com) MUST NOT
    29     be used; such identities are to be encoded as rfc822Name.  Rules for
    30     encoding internationalized domain names are specified in Section 7.2.
    31  ************************************************************************/
    32  
    33  import (
    34  	"github.com/zmap/zcrypto/x509"
    35  	"github.com/zmap/zlint/util"
    36  )
    37  
    38  type SANIsSpaceDNS struct{}
    39  
    40  func (l *SANIsSpaceDNS) Initialize() error {
    41  	return nil
    42  }
    43  
    44  func (l *SANIsSpaceDNS) CheckApplies(c *x509.Certificate) bool {
    45  	return util.IsExtInCert(c, util.SubjectAlternateNameOID)
    46  }
    47  
    48  func (l *SANIsSpaceDNS) Execute(c *x509.Certificate) *LintResult {
    49  	for _, dns := range c.DNSNames {
    50  		if dns == " " {
    51  			return &LintResult{Status: Error}
    52  		}
    53  	}
    54  	return &LintResult{Status: Pass}
    55  }
    56  
    57  func init() {
    58  	RegisterLint(&Lint{
    59  		Name:          "e_ext_san_space_dns_name",
    60  		Description:   "The dNSName ` ` MUST NOT be used",
    61  		Citation:      "RFC 5280: 4.2.1.6",
    62  		Source:        RFC5280,
    63  		EffectiveDate: util.RFC2459Date,
    64  		Lint:          &SANIsSpaceDNS{},
    65  	})
    66  }