Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

encoding/asn1: PrintableString does not match the standard #10416

Closed
signalsensefred opened this issue Apr 10, 2015 · 5 comments
Closed

encoding/asn1: PrintableString does not match the standard #10416

signalsensefred opened this issue Apr 10, 2015 · 5 comments
Assignees
Milestone

Comments

@signalsensefred
Copy link

@signalsensefred signalsensefred commented Apr 10, 2015

At the moment, encoding/asn1.isPrintable (http://golang.org/src/encoding/asn1/asn1.go#L324) is missing several characters from those described for PrintableString in section 5.11 of http://luca.ntop.org/Teaching/Appunti/asn1.html, to wit the characters in the string "('+,-."

This is a critical issue because it means that crypto/x509, which does depends on encoding/asn1, cannot load a lot of certificates.

@mikioh mikioh changed the title ASN.1 PrintableString does not match the standard encoding/asn1: PrintableString does not match the standard Apr 12, 2015
@minux
Copy link
Member

@minux minux commented Apr 12, 2015

/cc @agl

@minux minux added the repo-main label Apr 12, 2015
@minux minux added this to the Go1.5Maybe milestone Apr 12, 2015
@agl agl self-assigned this Apr 12, 2015
@agl
Copy link
Contributor

@agl agl commented Apr 12, 2015

Based on the code that your referenced[1], the lines

 '\'' <= b && b <= ')' ||
 '+' <= b && b <= '/' ||

Handle the characters ' ( ) + , - . / as required I believe. Can you give an example of a certificate that can't be parsed because of this?

[1] https://golang.org/src/encoding/asn1/asn1.go#L324

@agl agl closed this Apr 12, 2015
@signalsensefred
Copy link
Author

@signalsensefred signalsensefred commented Apr 13, 2015

Maybe I have the root cause wrong. Here is a certificate and key, and an example program to demonstrate:

package main

import (
    "crypto/tls"
    "fmt"
    "io/ioutil"
)

func main() {
    certBuf, err := ioutil.ReadFile("bug-cert.pem")
    if err != nil {
        fmt.Printf("%v", err)
        return
    }
    keyBuf, err := ioutil.ReadFile("bug-key.pem")
    if err != nil {
        fmt.Printf("%v", err)
        return
    }

    cert, err := tls.X509KeyPair(certBuf, keyBuf)
    if err != nil {
        fmt.Printf("%v", err)
        return
    }

    fmt.Printf("Block %v", cert)
}

bug-cert.pem contains:

-----BEGIN CERTIFICATE-----
MIIEBTCCAu2gAwIBAgIEVSvuSzANBgkqhkiG9w0BAQsFADB1MQswCQYDVQQGEwJV
UzEZMBcGA1UEChMQU2lnbmFsU2Vuc2UgSW5jLjEQMA4GA1UECxMHcnN5c2xvZzEQ
MA4GA1UEBxMHU2VhdHRsZTETMBEGA1UECBMKV2FzaGluZ3RvbjESMBAGA1UEAxMJ
c3lzbG9nX2NhMB4XDTE1MDQxMzE2MjY1MVoXDTE4MDEwNzE2MjY1MVowYTELMAkG
A1UEBhMCVVMxGTAXBgNVBAoTEFNpZ25hbFNlbnNlIEluYy4xEDAOBgNVBAsTB3Jz
eXNsb2cxEDAOBgNVBAcTB1NlYXR0bGUxEzARBgNVBAgTCldhc2hpbmd0b24wggFS
MA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQDDTyQhdhbJww56/lNleC12Rg2/
RNnhiPfTVAZPEpewDJg4rQDJkGGkwUn7Et0eRZyhL4aAuyre8/c8fETAwH435Ajz
r/uXbZt2+kUqccdgj3lYjD2LGAG7GXBnbXwNtEkzecqiZBa3qO9NfOOGRupJOLjQ
e1TKR1WVn6eOGnAxuwwnA9+oSqKktZl6n3b2ObMj9RZeWb80UQGWEFbbBTQEJSqJ
VCqZfeknBnjHOmdjd/9s7Mz6Z2CZdzw6esZxMPJIFH1JjwyBl1LMSRn/hftrw4S6
Z1A7r+JqITTYtAEMR+A93vs1peL1KPJT0n//ZEvzaBiFulyey2tgywFZpUzC5mQK
H3qlwpRHHYsVkbP7fvSzSXxmdcXP6ErK3GBkRqWsp16DCTg89lgHO5bBk10VAgMB
AAGjgYAwfjAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEF
BQcDATAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQWBBQRR+9JuAOum9Kgr07ViUpB
tCI1ejAfBgNVHSMEGDAWgBTxZBdnqpws3U9BpMTqJqg7buZzhzANBgkqhkiG9w0B
AQsFAAOCAQEAcdFJsQ266uLF2Ps2bwggwSEFDHKIEPuQ5/ccp42ZAtJIByY8xIWB
vIhST4V3iabWq6t1n69DumWDFEAUZ6gCDd52YXZU5UFrUuA+kFlA86NosTOezllY
9CDLqEe/5feo2qC42P1LgOYIm1LWCfTMGwffosaXM5B/jP8aWfOwqld5Fua7mZ8q
nc8V7Ie7NhkbO5IkQj9jiiiyV1XKyRW2amc2woxULVZTJbljp+tv2VAfYdyXWtxD
Y4iajsvkK0utjFHCoIeAtmtzbq94bQJz/qoCqJ60JiUCC3qrpqOumZMRV3+RqwSm
LCUAgHcHNjhnZE8KsuQBHgMIGgqBRNhWBg==
-----END CERTIFICATE-----

and bug-key.pem contains:

-----BEGIN RSA PRIVATE KEY-----
MIIFewIBAAKCATEAw08kIXYWycMOev5TZXgtdkYNv0TZ4Yj301QGTxKXsAyYOK0A
yZBhpMFJ+xLdHkWcoS+GgLsq3vP3PHxEwMB+N+QI86/7l22bdvpFKnHHYI95WIw9
ixgBuxlwZ218DbRJM3nKomQWt6jvTXzjhkbqSTi40HtUykdVlZ+njhpwMbsMJwPf
qEqipLWZep929jmzI/UWXlm/NFEBlhBW2wU0BCUqiVQqmX3pJwZ4xzpnY3f/bOzM
+mdgmXc8OnrGcTDySBR9SY8MgZdSzEkZ/4X7a8OEumdQO6/iaiE02LQBDEfgPd77
NaXi9SjyU9J//2RL82gYhbpcnstrYMsBWaVMwuZkCh96pcKURx2LFZGz+370s0l8
ZnXFz+hKytxgZEalrKdegwk4PPZYBzuWwZNdFQIDAQABAoIBMAjlro4trH0Vey/k
LRVmw59rMo4fi1NoY23Hmp/4h1t4P2j5jJsiDiisu3uKEPOjlS6MlTKBFENi1sT1
HkavnjBanYPIZQwxbI8feI4l78C42HzNqrIO7mlBD+tORAP1zg3fwvjh2V0Vf41G
nrDLwzmBsX2h2Kt8U2xFASOKlcjWLggK96HZgI5DTZIV+Jvf5gbBz/qNWRX/dEF3
WwC11+wH8logfnA5Q3zD/RTMhfB/Jd1GglHFMNGkIEPsjW8BYp/KcmKeLiNwO9St
xbTAGdRD8RhtfWNwOKIwwFhMzC8Gvrct6VH0DvEB+6kuP4ZUZW3RGq+cV3++ftRT
IsZJnOUbuocWJ/dw7fr4KKONSYgJJBy081IeGp+8U0lEE+Ld7vuBrpDU6pHRkEo6
HNKmJ3ECgZkAzQKcNU0Cv24DX5k6I5aXgMVHJbURFuI+NWcGKGaST4Nz6RBSJONd
8LKPhBz3/OrqskgiYFjGQFcsiaFOCqdyFGjgaagBYAYeqdz02VRpbq2BXVqyg0iP
0DXzK6QEi+O7qdNB/rQLMat3veDiarKualP8jlPES/cgi9sr2FHurfIIGpzBN2Ry
mY0+S91ZhBPFYkf+ye6/iR0CgZkA8+LYt0PD5By5cpyCw0B+E9T+k51HOFJ8V2KE
99CKdWHnjPRTIZ0EYsOaTzdueu9DQ0XjuSKK3Ea6nvkmfiLJpzYrWo5dcKJxQz9K
Yl+ugf5ut3j7kdKpdWtZsz2hJAb93xDGcKr4ipZqAcxmmkCaiZExZhSDLzluj3GZ
VGonP9bDVQs36l2F8ay1bM9RhK3q2hGFVqQC2lkCgZkAkFO4GSYgOxh+M30yGv/X
pQY9smQopc2dMgdXpHWhp2zJ21hsHCAdcGik9MNYKqxPkjeKS/3zhDRa3IG86W88
tvWml3t5jFqCl99AWQg+OXbYzhod9qLM7C4vBZgwwzMOWN6rZV7nSo6GfByoCanF
dIGwGZsLZNeUCCHCWkZEHB16axHUTOTgcQ2ov8wTSxKIMUqyKwNzwFkCgZhZMX1Q
iNf7dQXdhJ/OCKgTWLJCCiMh1gjjbIR0nTAF/ehRBInioSoZdK/aiMs+6oIO+GBw
NNHT/YoC2dvaBZ76KDVyyN4jc0U48syhbZzEreiP8Q8QJZsT9k633rIwGt591gS8
78o15Qyf28EqaLYb2Z3XV2kivD5S95i75pa0IjcNwyyP6eQynpc7VBbcDz70wbOi
HBlvAQKBmGj5RTXdmevzdE5gJwA06j6K0IOxA+rwxlqGzAgEaWDwnJPBYGEGfJH+
lf2eMrDSjdmThzsOi1T4IwpPMwtFzaILUtTJu0LA3egNVI9vajnxxSjn3s2hLRO7
KbY51zt3MZGb86pHo46gSRvUgcFbcY5q7aUWvUt79lvz1jXJB86DO7CQIWmWHeC7
2SNOq2csZXOE2ZK/+1sT
-----END RSA PRIVATE KEY-----
@agl
Copy link
Contributor

@agl agl commented Apr 13, 2015

That certificate contains an underscore in a PrintableString, which is, indeed, invalid, no? https://en.wikipedia.org/wiki/PrintableString

@signalsensefred
Copy link
Author

@signalsensefred signalsensefred commented Apr 14, 2015

Oh for heavens sake. I'm an idiot. Sorry to bother you all with this.

@golang golang locked and limited conversation to collaborators Jun 25, 2016
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
4 participants
You can’t perform that action at this time.