Better x509->email support

[errror]

Version

6.2.60~dfsg-4

Installation method

deb from debian.org

Expected behavior

Recently updated perl-crypt-openssl-x509 1.9.9 returns all email addresses from a X509 certificate via ->email attribute seperated by whitespace. Split this result into a list of email addresses when using them to get the email addresses of an S/MIME certificate.

Actual behavior

$x509->email is used as a single email address (with spaces if certificate contains multiple addresses).

Additional information

I have prepared a patch for sympa-6.2.60, see below. As I have no easy way to run&test current HEAD version, I currently cannot provide a proper pull request, sorry.

--- /usr/share/sympa/lib/Sympa/Tools/SMIME.pm	2021-02-07 17:02:26.000000000 +0100
+++ -	2021-07-29 14:00:23.610747890 +0200
@@ -188,7 +188,12 @@
             $res{email}{lc($email)} = 1;
         }
     } elsif ($x509->email) {
-        $res{email}{lc($x509->email)} = 1;
+        $log->syslog('debug3', 'x509->email="%s"', $x509->email);
+        my @emails_from_x509_email = split(/\s+/, $x509->email);
+        foreach my $email (@emails_from_x509_email) {
+            $log->syslog('debug3', 'adding email "%s" from x509->email', $email);
+            $res{email}{lc($email)} = 1;
+        }
     }
     # Check key usage roughy.
     my %purposes = $x509->extensions_by_name->{keyUsage}->hash_bit_string;

[ikedas]

This issue was solved on #1196 in different way with Crypt::OpenSSL::x509 1.8.8, and the fix was included in Sympa 6.2.64.

Your solution looks simpler, but requires recent version of Crypt::OpenSSL::x509 1.9.9 (cf. dsully/perl-crypt-openssl-x509#88).

[errror]

That's fine. As I can only test with 6.2.60 I didn't see, that it was fixed by other means. However, the current code still uses $x509->email. Maybe you should enhance it with split(/\s+/, $x509->email) to support Crypt::OpenSSL::x509 1.9.9 if installed. As older versions supply the string without spaces, you should be backward compatible still.

[ikedas]

@errror , if possible, could you please check this patch (for 6.2.60)?

I rethought the earlier version of Crypt::OpenSSL::X509 would be dropped.

[errror]

@errror , if possible, could you please check this patch (for 6.2.60)?

Yes, it works!

[ikedas]

Merged. @errror , thanks you for improvement!