Description
The X.509 SAN parser accepts rfc822Name email addresses with empty domains, such as local@. The parser checks that the value is IA5String but does not enforce the mailbox syntax required by the certificate profile.
No policy bypass has been shown. This is a parser/profile-conformance issue.
Specification
RFC 5280 Section 4.2.1.6 states that an rfc822Name is a Mailbox as defined in RFC 2821 Section 4.1.2. That mailbox syntax has the form Local-part@Domain, which requires a domain.
Code references
go/src/crypto/x509/parser.go:469 defines parseSANExtension.go/src/crypto/x509/parser.go:472 through go/src/crypto/x509/parser.go:477 handles rfc822Name by checking IA5String and appending the string to EmailAddresses.go/src/crypto/x509/parser.go:1389 through go/src/crypto/x509/parser.go:1404 show related relaxed domain-name checks, including empty-name compatibility comments.
Test case
This can become an X.509 parser test with a certificate containing a SAN rfc822Name of local@. The expected behavior would be ParseCertificate returning an error.
It could also be useful as an X.509 profile-conformance corpus case for invalid SAN email syntax.
Description
The X.509 SAN parser accepts
rfc822Nameemail addresses with empty domains, such aslocal@. The parser checks that the value is IA5String but does not enforce the mailbox syntax required by the certificate profile.No policy bypass has been shown. This is a parser/profile-conformance issue.
Specification
RFC 5280 Section 4.2.1.6 states that an
rfc822Nameis a Mailbox as defined in RFC 2821 Section 4.1.2. That mailbox syntax has the formLocal-part@Domain, which requires a domain.Code references
go/src/crypto/x509/parser.go:469definesparseSANExtension.go/src/crypto/x509/parser.go:472throughgo/src/crypto/x509/parser.go:477handlesrfc822Nameby checking IA5String and appending the string toEmailAddresses.go/src/crypto/x509/parser.go:1389throughgo/src/crypto/x509/parser.go:1404show related relaxed domain-name checks, including empty-name compatibility comments.Test case
This can become an X.509 parser test with a certificate containing a SAN
rfc822Nameoflocal@. The expected behavior would beParseCertificatereturning an error.It could also be useful as an X.509 profile-conformance corpus case for invalid SAN email syntax.