charlieegan3
commented
1 year ago Hi, thanks for opening the issue. I think there are two things here we need to work out:
- what these other bytes are in the email san value here
- what OPA could to do make the data available.
Email SAN format
I'm not sure what's going on here and have created this Go program to demonstrate the issue: https://go.dev/play/p/AqUUuwPs2yd.
package main
import (
"bytes"
"crypto/ed25519"
"crypto/rand"
"crypto/x509"
"crypto/x509/pkix"
"encoding/asn1"
"encoding/json"
"encoding/pem"
"fmt"
)
func main() {
// parse and extract email from example CSR
rawCSR := `-----BEGIN CERTIFICATE REQUEST-----
MIICnDCCAYQCAQAwGjEYMBYGA1UEAwwPM2dvYXRzLmFjbWUuY29tMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAuLTGpuFQyUDPZAqCw7sqO352GYG8AfkjP5eUCXjdWgmZqvnfGODmJ1Lp
3xndPwfEdr+g3Bgg/ZEFyi67bePEo9+mzGJRSxerC/sMs/9vduNBwQrYAK1AvdlfHk9Lh5K86y6M
+JgvFiZOYzI3mEpX1bMiOajk+pQtB+x66xfPE1mWcjY5TLBHvzhfyKXMRVayxUPb80FuWGsVXd+S
c8jvunG4qf51ZF4omV/koc4z2RaY+s4eaB4z3zaH23FK5kW+APt5krBxM082kfsSDo3zMJ1hY0Op
IqRagNYHlFLDeG1N5MGJJ/CBfq4QDudtVVetr5sEq2REBqCkAwVtytv2qQIDAQABoD0wOwYJKoZI
hvcNAQkOMS4wLDAqBgNVHREEIzAhoB8GCisGAQQBgjcUAgOgEQwPM2dvYXRzQGFjbWUuY29tMA0G
CSqGSIb3DQEBCwUAA4IBAQB+YDsTOg2/+Jd3SMrbB3y5qzx17wYfIKec6j6wNYDv7grnFL3kNXDG
SVU3UM1j07rfe/zb19ilSydcCqSM9cT466PxGvnVuBxXzlrZmVCl0agpidwKhF9JT6dH7F4+Lr+8
t89uTGhAX2f0XnYgR0fhMMQRdZ32yfNCz5oWf7OIKJTFNgy1r69+RI13aY+W79f7PS9HU9FIfJyj
uUDkDUb6Rp/7Jo8qknDkiiTI2cSHzQhOdUIQbasNy1ZeDmdpofjCW6+WQJvz8Xzj9NUSQEjoQbq0
enV5YeJkS8ZDUyJ6baKdaNFVsoyG4aMqm5Ru0WLSAlb9/lMaZ7Ew8HVM2SDY
-----END CERTIFICATE REQUEST-----`
p, _ := pem.Decode([]byte(rawCSR))
if p != nil && p.Type != "CERTIFICATE REQUEST" {
panic("invalid PEM-encoded certificate signing request")
}
rawCSRParsed, err := x509.ParseCertificateRequest(p.Bytes)
if err != nil {
panic(err)
}
var rawCSRExtValues []asn1.RawValue
_, err = asn1.Unmarshal(rawCSRParsed.Extensions[0].Value, &rawCSRExtValues)
if err != nil {
panic(err)
}
bs, err := json.MarshalIndent(rawCSRExtValues, "", " ")
if err != nil {
panic(err)
}
fmt.Println("provided CSR email SAN value")
fmt.Println(string(rawCSRExtValues[0].Bytes))
fmt.Println(string(bs))
// Create a fresh CR for comparison
_, privateKey, err := ed25519.GenerateKey(rand.Reader)
if err != nil {
panic(err)
}
// 1 is nameTypeEmail
derBytes, err := asn1.Marshal([]asn1.RawValue{asn1.RawValue{Tag: 1, Class: 2, Bytes: []byte("3goats@acme.com")}})
if err != nil {
panic(err)
}
req := &x509.CertificateRequest{
ExtraExtensions: []pkix.Extension{
{
Id: []int{2, 5, 29, 17}, // oidExtensionSubjectAltName
Value: derBytes,
},
},
}
newCSR, err := x509.CreateCertificateRequest(rand.Reader, req, privateKey)
if err != nil {
panic(err)
}
buf := bytes.NewBuffer([]byte{})
err = pem.Encode(buf, &pem.Block{Type: "CERTIFICATE REQUEST", Bytes: newCSR})
if err != nil {
panic(err)
}
newCSRDecoded, _ := pem.Decode(buf.Bytes())
newCSRParsed, err := x509.ParseCertificateRequest(newCSRDecoded.Bytes)
if err != nil {
panic(err)
}
var newCSRExtValues []asn1.RawValue
_, err = asn1.Unmarshal(newCSRParsed.Extensions[0].Value, &newCSRExtValues)
if err != nil {
panic(err)
}
bs, err = json.MarshalIndent(newCSRExtValues, "", " ")
if err != nil {
panic(err)
}
fmt.Println("\n---\nnew CSR email SAN value")
fmt.Println(string(newCSRExtValues[0].Bytes))
fmt.Println(string(bs))
}I get this output:
provided CSR email SAN value
+�7�
3goats@acme.com
[
{
"Class": 2,
"Tag": 0,
"IsCompound": true,
"Bytes": "BgorBgEEAYI3FAIDoBEMDzNnb2F0c0BhY21lLmNvbQ==",
"FullBytes": "oB8GCisGAQQBgjcUAgOgEQwPM2dvYXRzQGFjbWUuY29t"
}
]
---
new CSR email SAN value
3goats@acme.com
[
{
"Class": 2,
"Tag": 1,
"IsCompound": false,
"Bytes": "M2dvYXRzQGFjbWUuY29t",
"FullBytes": "gQ8zZ29hdHNAYWNtZS5jb20="
}
]It appears some additional bytes are presenting in the value in the example CSR provided. I'm not sure where these are coming from and they're not present when I recreate a comparable CSR from scratch in Go with the same email.
@3goats, can you share any details about where this CSR is coming from and why we might be seeing this?
what OPA could to do?
If we added a built-in wrapping asn1.Unmarshal which unmarshalled to a []asn1.RawValue that might be suitable?
3goats
SpectralHiss
inteon
stale[bot]
Hi as per item 490 in the discussion area I need to properly decode the SAN values for an X.509 certificate request.
e.g.
It appears the the SAN Extension does not get decoded during the parse and remains as a DER encoded, ASN.1 value. e.g. the output of the y value above is:
Here's an example CSR that contains the SAN extension: