Merge pull request #11226 from zmstone/zmstone/public_key-tolerate-DC-PrintableString

fix: tolerate DomainComponent encoded as PrintableString

OTP-20338

Author: IngelaAndin

lib/public_key/asn1/OTP-PKIX.asn1

@@ -41,7 +41,7 @@ IMPORTS
        at-x520OrganizationName, at-x520OrganizationalUnitName, at-x520Title,
        at-x520dnQualifier, at-x520SerialNumber, at-x520Pseudonym,
        at-domainComponent, at-emailAddress,
-       id-at-commonName, id-at-countryName, id-emailAddress,
+       id-at-commonName, id-at-countryName, id-domainComponent, id-emailAddress,
        ub-emailaddress-length,
        Validity, Version, SubjectPublicKeyInfo,
        UniqueIdentifier, DirectoryString{},
@@ -141,12 +141,15 @@ OTPSupportedAttributes ATTRIBUTE ::= {
     at-x520LocalityName | at-x520StateOrProvinceName |
     at-x520OrganizationName | at-x520OrganizationalUnitName |
     at-x520Title | at-x520dnQualifier | otp-at-x520countryName |
-    at-x520SerialNumber | at-x520Pseudonym | at-domainComponent |
+    at-x520SerialNumber | at-x520Pseudonym | otp-at-domainComponent |
     otp-at-emailAddress, ... }
 
 otp-at-x520countryName ATTRIBUTE ::= {
     TYPE OTP-X520countryName IDENTIFIED BY id-at-countryName }
 
+otp-at-domainComponent ATTRIBUTE ::= {
+    TYPE OTP-DomainComponent IDENTIFIED BY id-domainComponent }
+
 otp-at-emailAddress ATTRIBUTE ::= {
     TYPE OTP-emailAddress IDENTIFIED BY id-emailAddress }
 
@@ -162,6 +165,15 @@ OTP-X520countryName ::= CHOICE {
     wrong             UTF8String      (SIZE (2..3))
 }
 
+-- We accept PrintableString encoding of DomainComponent
+-- which should be IA5String per RFC 2247, but some devices
+-- use PrintableString.
+
+OTP-DomainComponent ::= CHOICE {
+    correct IA5String,
+    wrong PrintableString
+}
+
 OTP-emailAddress ::= CHOICE {
     correct IA5String (SIZE (1..ub-emailaddress-length)),
     wrong UTF8String

lib/public_key/src/pubkey_cert_records.erl

@@ -111,6 +111,8 @@ enc_transform(#'AttributeTypeAndValue'{type=Id, value=Value0}) ->
     case Id of
         ?'id-at-countryName' ->
             #'SingleAttribute'{type=Id, value={correct, Value0}};
+        ?'id-domainComponent' ->
+            #'SingleAttribute'{type=Id, value={correct, Value0}};
         ?'id-emailAddress' ->
             #'SingleAttribute'{type=Id, value={correct, Value0}};
         _ ->
@@ -161,6 +163,8 @@ dec_transform(#'SingleAttribute'{type=Id,value=Value0}) ->
     case {Id, Value0} of
         {?'id-at-countryName', {_,String}} ->
             #'AttributeTypeAndValue'{type=Id, value=String};
+        {?'id-domainComponent', {_,String}} ->
+            #'AttributeTypeAndValue'{type=Id, value=String};
         {?'id-emailAddress', {_,String}} ->
             #'AttributeTypeAndValue'{type=Id, value=String};
         {_, _} ->

lib/public_key/test/public_key_SUITE.erl

@@ -121,6 +121,8 @@
          pkix_countryname/1,
          pkix_emailaddress/0,
          pkix_emailaddress/1,
+         pkix_domaincomponent/0,
+         pkix_domaincomponent/1,
          pkix_long_commonname/0,
          pkix_long_commonname/1,
          pkix_decode_cert/0,
@@ -220,6 +222,7 @@ all() ->
      pkix_cmp,
      pkix_countryname,
      pkix_emailaddress,
+     pkix_domaincomponent,
      pkix_long_commonname,
      pkix_decode_cert,
      pkix_decode_cert_empty_rdns,
@@ -1226,6 +1229,18 @@ pkix_emailaddress(Config) when is_list(Config) ->
     check_emailaddress(Issuer),
     check_emailaddress(Subj).
 
+%%--------------------------------------------------------------------
+pkix_domaincomponent() ->
+    [{doc, "Test workaround for certs that code domainComponent as printableString"}].
+pkix_domaincomponent(Config) when is_list(Config) ->
+    Cert = incorrect_domaincomponent_pkix_cert(),
+    OTPCert = public_key:pkix_decode_cert(Cert, otp),
+    TBSCert = OTPCert#'OTPCertificate'.tbsCertificate,
+    Issuer = TBSCert#'OTPTBSCertificate'.issuer,
+    Subj   = TBSCert#'OTPTBSCertificate'.subject,
+    check_domaincomponent(Issuer),
+    check_domaincomponent(Subj).
+
 %%--------------------------------------------------------------------
 pkix_long_commonname() ->
     [{doc, "Test workaround for certs with CommonName longer than 64 characters"}].
@@ -2468,6 +2483,22 @@ do_check_emailaddress([#'AttributeTypeAndValue'{type = ?'id-emailAddress',
 do_check_emailaddress([_| Rest]) ->
     do_check_emailaddress(Rest).
 
+check_domaincomponent({rdnSequence,DirName}) ->
+    do_check_domaincomponent(lists:append(DirName), ["com", "example"]).
+do_check_domaincomponent(_, []) ->
+    ok;
+do_check_domaincomponent([], Missing) ->
+    ct:fail({missing_domain_component, Missing});
+do_check_domaincomponent([#'AttributeTypeAndValue'{type = ?'id-domainComponent',
+                                                   value = Value}|Rest],
+                         [Value|Expected]) ->
+    do_check_domaincomponent(Rest, Expected);
+do_check_domaincomponent([#'AttributeTypeAndValue'{type = ?'id-domainComponent',
+                                                   value = Value}|_], _) ->
+    ct:fail({incorrect_domain_component, Value});
+do_check_domaincomponent([_| Rest], Expected) ->
+    do_check_domaincomponent(Rest, Expected).
+
 check_commonname({rdnSequence, DirName}, ExpectedCN) ->
     do_check_commonname(DirName, ExpectedCN).
 check_cert_commonname(#'OTPCertificate'{tbsCertificate = TBSCert}, ExpectedCN) ->
@@ -2616,6 +2647,53 @@ long_commonname_pkix_cert() ->
 incorrect_emailaddress_pkix_cert() ->
     <<48,130,3,74,48,130,2,50,2,9,0,133,49,203,25,198,156,252,230,48,13,6,9,42,134, 72,134,247,13,1,1,5,5,0,48,103,49,11,48,9,6,3,85,4,6,19,2,65,85,49,19,48,17, 6,3,85,4,8,12,10,83,111,109,101,45,83,116,97,116,101,49,33,48,31,6,3,85,4,10, 12,24,73,110,116,101,114,110,101,116,32,87,105,100,103,105,116,115,32,80,116, 121,32,76,116,100,49,32,48,30,6,9,42,134,72,134,247,13,1,9,1,12,17,105,110, 118,97,108,105,100,64,101,109,97,105,108,46,99,111,109,48,30,23,13,49,51,49, 49,48,55,50,48,53,54,49,56,90,23,13,49,52,49,49,48,55,50,48,53,54,49,56,90, 48,103,49,11,48,9,6,3,85,4,6,19,2,65,85,49,19,48,17,6,3,85,4,8,12,10,83,111, 109,101,45,83,116,97,116,101,49,33,48,31,6,3,85,4,10,12,24,73,110,116,101, 114,110,101,116,32,87,105,100,103,105,116,115,32,80,116,121,32,76,116,100,49, 32,48,30,6,9,42,134,72,134,247,13,1,9,1,12,17,105,110,118,97,108,105,100,64, 101,109,97,105,108,46,99,111,109,48,130,1,34,48,13,6,9,42,134,72,134,247,13, 1,1,1,5,0,3,130,1,15,0,48,130,1,10,2,130,1,1,0,190,243,49,213,219,60,232,105, 1,127,126,9,130,15,60,190,78,100,148,235,246,223,21,91,238,200,251,84,55,212, 78,32,120,61,85,172,0,144,248,5,165,29,143,79,64,178,51,153,203,76,115,238, 192,49,173,37,121,203,89,62,157,13,181,166,30,112,154,40,202,140,104,211,157, 73,244,9,78,236,70,153,195,158,233,141,42,238,2,143,160,225,249,27,30,140, 151,176,43,211,87,114,164,108,69,47,39,195,123,185,179,219,28,218,122,53,83, 77,48,81,184,14,91,243,12,62,146,86,210,248,228,171,146,225,87,51,146,155, 116,112,238,212,36,111,58,41,67,27,6,61,61,3,84,150,126,214,121,57,38,12,87, 121,67,244,37,45,145,234,131,115,134,58,194,5,36,166,52,59,229,32,47,152,80, 237,190,58,182,248,98,7,165,198,211,5,31,231,152,116,31,108,71,218,64,188, 178,143,27,167,79,15,112,196,103,116,212,65,197,94,37,4,132,103,91,217,73, 223,207,185,7,153,221,240,232,31,44,102,108,82,83,56,242,210,214,74,71,246, 177,217,148,227,220,230,4,176,226,74,194,37,2,3,1,0,1,48,13,6,9,42,134,72, 134,247,13,1,1,5,5,0,3,130,1,1,0,89,247,141,154,173,123,123,203,143,85,28,79, 73,37,164,6,17,89,171,224,149,22,134,17,198,146,158,192,241,41,253,58,230, 133,71,189,43,66,123,88,15,242,119,227,249,99,137,61,200,54,161,0,177,167, 169,114,80,148,90,22,97,78,162,181,75,93,209,116,245,46,81,232,64,157,93,136, 52,57,229,113,197,218,113,93,42,161,213,104,205,137,30,144,183,58,10,98,47, 227,177,96,40,233,98,150,209,217,68,22,221,133,27,161,152,237,46,36,179,59, 172,97,134,194,205,101,137,71,192,57,153,20,114,27,173,233,166,45,56,0,61, 205,45,202,139,7,132,103,248,193,157,184,123,43,62,172,236,110,49,62,209,78, 249,83,219,133,1,213,143,73,174,16,113,143,189,41,84,60,128,222,30,177,104, 134,220,52,239,171,76,59,176,36,113,176,214,118,16,44,235,21,167,199,216,200, 76,219,142,248,13,70,145,205,216,230,226,148,97,223,216,179,68,209,222,63, 140,137,24,164,192,149,194,79,119,247,75,159,49,116,70,241,70,116,11,40,119, 176,157,36,160,102,140,255,34,248,25,231,136,59>>.
 
+incorrect_domaincomponent_pkix_cert() ->
+    %% Self-signed certificate with issuer and subject
+    %% "DC=com, DC=example, CN=example.com" where the DC values are
+    %% encoded as PrintableString instead of IA5String required by
+    %% RFC 2247.
+    <<48,130,3,105,48,130,2,81,160,3,2,1,2,2,20,69,242,99,206,90,182,17,163,244,
+      197,227,78,235,109,218,226,72,205,102,15,48,13,6,9,42,134,72,134,247,13,
+      1,1,11,5,0,48,68,49,19,48,17,6,10,9,146,38,137,147,242,44,100,1,25,19,3,
+      99,111,109,49,23,48,21,6,10,9,146,38,137,147,242,44,100,1,25,19,7,101,120,
+      97,109,112,108,101,49,20,48,18,6,3,85,4,3,12,11,101,120,97,109,112,108,101,
+      46,99,111,109,48,30,23,13,50,54,48,55,50,52,49,51,49,56,53,51,90,23,13,51,
+      54,48,55,50,49,49,51,49,56,53,51,90,48,68,49,19,48,17,6,10,9,146,38,137,
+      147,242,44,100,1,25,19,3,99,111,109,49,23,48,21,6,10,9,146,38,137,147,242,
+      44,100,1,25,19,7,101,120,97,109,112,108,101,49,20,48,18,6,3,85,4,3,12,11,
+      101,120,97,109,112,108,101,46,99,111,109,48,130,1,34,48,13,6,9,42,134,72,
+      134,247,13,1,1,1,5,0,3,130,1,15,0,48,130,1,10,2,130,1,1,0,151,217,205,139,
+      75,105,61,111,255,220,54,87,10,189,29,104,157,65,44,128,189,179,83,246,65,
+      63,186,93,195,95,27,187,110,117,58,230,102,33,131,139,216,169,215,76,108,
+      96,218,57,150,161,151,180,119,96,185,87,115,243,230,68,186,167,119,245,210,
+      45,69,191,154,80,17,181,97,73,1,36,229,249,238,246,241,115,105,140,76,117,
+      163,162,14,49,249,119,88,174,49,157,200,236,120,38,27,251,131,198,237,13,
+      245,250,124,170,216,177,249,206,175,84,52,53,168,230,25,139,174,23,227,214,
+      177,106,153,237,50,227,162,103,101,201,181,80,135,104,120,149,26,177,32,
+      147,90,216,128,103,107,53,139,127,48,217,223,32,51,191,59,215,99,232,186,
+      26,225,37,11,237,237,102,83,42,194,66,84,60,11,39,90,88,170,52,169,87,48,
+      250,157,18,15,36,251,50,65,144,99,22,240,216,186,34,153,82,109,250,120,101,
+      239,148,126,142,79,52,41,99,170,142,143,28,118,179,41,118,217,0,28,39,139,
+      105,128,248,13,81,50,212,156,231,44,50,181,146,82,62,163,49,122,83,188,158,
+      119,13,185,45,77,117,2,3,1,0,1,163,83,48,81,48,29,6,3,85,29,14,4,22,4,20,
+      133,44,240,59,241,73,217,139,156,146,117,215,76,51,106,87,21,9,228,225,48,
+      31,6,3,85,29,35,4,24,48,22,128,20,133,44,240,59,241,73,217,139,156,146,117,
+      215,76,51,106,87,21,9,228,225,48,15,6,3,85,29,19,1,1,255,4,5,48,3,1,1,255,
+      48,13,6,9,42,134,72,134,247,13,1,1,11,5,0,3,130,1,1,0,73,188,255,75,104,
+      241,99,133,166,43,98,208,122,221,67,119,94,178,159,210,154,131,66,242,248,
+      161,219,78,136,105,169,65,41,255,158,34,26,193,153,199,123,62,185,26,48,
+      150,209,94,167,158,82,165,201,69,196,232,119,137,184,147,77,62,136,93,45,
+      58,84,39,60,154,223,89,69,74,117,66,88,54,132,68,57,91,226,18,197,69,148,
+      38,138,111,172,11,210,205,163,51,231,50,160,181,48,56,230,104,63,240,255,
+      193,111,165,173,66,42,29,167,119,248,32,37,205,98,115,245,145,191,9,11,96,
+      139,208,42,55,226,31,90,180,64,173,210,232,214,223,142,177,204,107,74,13,
+      155,188,13,148,13,169,153,77,18,60,23,116,192,100,142,176,17,149,134,169,
+      172,62,121,84,253,165,149,141,46,191,39,182,12,220,29,168,69,160,202,93,
+      36,246,131,209,51,26,61,109,127,123,209,180,30,171,217,89,104,230,99,156,
+      209,207,144,248,28,114,235,69,183,21,17,167,223,175,68,210,238,128,18,116,
+      109,195,230,63,172,89,223,201,202,213,12,44,26,95,181,25,48,138,85,164,9,
+      18,203,107,22,160,137,50>>.
+
 hardcode_rsa_key(1) ->
     #'RSAPrivateKey'{
        version = 'two-prime',