zmap / zcrypto

Liberal Go TLS + X.509 Library for Research
Other
134 stars 83 forks source link

pkix: marshal nonstandard name attributes only once #365

Closed elliotcubit closed 1 year ago

elliotcubit commented 1 year ago

When a pkix.Name was filled using FillFromRDNSequence with attributes with OIDs not in this list:

2.5.4.3
2.5.4.5
2.5.4.6
2.5.4.7
2.5.4.8
2.5.4.9
2.5.4.10
2.5.4.11
2.5.4.17

Marshalling it would duplicate the OID/name+value of the attributes at the beginning of the RDNSequence.

For example, in this certificate, the emailAddress attribute is marshaled twice in the subject_dn string, despite only being present once in the source certificate.

The intention behind this removed snippet is unclear, and is mixed into a large commit that lacks commentary. Further, removing it does not cause test failures outside the modified tests, which had incorrect expected values.

Test using:

x509 $ go test ./...

This Censys query shows a subset of certs that present the problem.