- Notifications
You must be signed in to change notification settings - Fork7.7k
UpdateDnsNameList
forX509Certificate2
to useX509SubjectAlternativeNameExtension.EnumerateDnsNames
Method#24714
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
test/powershell/Modules/Microsoft.PowerShell.Security/CertificateProvider.Tests.ps1 OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
ArmaanMcleod commentedDec 28, 2024 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
@MaurizioFocareta Did you want to test these changes using a non-english locale to see if using .NET runtime approach fixes your problem? I'll keep looking to see if we can get the tests to verify it but for now we can probably do a manual test off this branch to see if it works for you 🙂. |
string parsedSubjectDistinguishedDnsName = cert.Subject.Substring(distinguishedNamePrefix.Length); | ||
DnsNameRepresentation dnsName = GetDnsNameRepresentation(parsedSubjectDistinguishedDnsName); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
@iSazonov I wonder if this can also be replaced withhttps://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x500distinguishedname.enumeraterelativedistinguishednames?view=net-9.0.
I don't think even distinguished name needs string parsing anymore.
ArmaanMcleodDec 29, 2024 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Actually will park this, just realised this will include all distinguished names outside ofCN=
. dotnet runtime probably needs to expose something for just common name without too much extra work. Right now you'd need to still check the OID during enumeration which is not ideal and probably leads to more complex code in its current state.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I think it would end up being something like:
privateconststringCommonNameOid="2.5.4.3";// Extract DNS name from Subject distinguished nameforeach(X500RelativeDistinguishedNamedistinguishedNameincert.SubjectName.EnumerateRelativeDistinguishedNames()){if(!distinguishedName.HasMultipleElements&&distinguishedName.GetSingleElementType().Value.Equals(CommonNameOid,StringComparison.OrdinalIgnoreCase)){DnsNameRepresentationdnsName=GetDnsNameRepresentation(distinguishedName.GetSingleElementValue());_dnsList.Add(dnsName);}}
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
The change is not related the PR. Please revert.
If you think original code has an issue, please open new issue to discuss.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Yeah so this was just referring to how distinguished names are handled. I have reverted that change and will open a new issue to discuss. This is resolved for this PR.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I don't see new commit.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I force pushed and removed the changes.
442149a
to18a73cd
Compare10d1785
intoPowerShell:masterUh oh!
There was an error while loading.Please reload this page.
KalleOlaviNiemitalo commentedDec 29, 2024
That makes sense; X509Certificate2.RawData is the entire certificate including all extensions, but the byte[] rawData parameter of the X509SubjectAlternativeNameExtension constructor must be only the single extension.
Because the prefix was added by unmanaged code in Windows, I expect it respectsSetThreadPreferredUILanguages rather thanCultureInfo.CurrentUICulture. The corresponding language pack for Windows might also have to be installed. |
Thanks@KalleOlaviNiemitalo. That makes a lot of sense. |
Uh oh!
There was an error while loading.Please reload this page.
PR Summary
Updated
DnsNameList
forX509Certificate2
to useX509SubjectAlternativeNameExtension.EnumerateDnsNames
method. This replaces theDNS Name=
prefix + OID 2.5.29.17 checking code which is error prone when using different language clients.Using the
public X509SubjectAlternativeNameExtension (byte[] rawData, bool critical = false)
constructor withcert.RawData
did not work and resulted inCryptographicException
exceptions. Instead, what was much more robust was just casting the extension toX509SubjectAlternativeNameExtension
and then using theEnumerateDnsNames()
method.Also testing previous code with different culture/locale I could not get DNS name prefix to output in a different language, so that case is a bit difficult to reproduce. Although it seems like this is supposed to just work moving to the .NET
EnumerateDnsNames()
method. I am not even sure switching cultures is good enough to expose this problem and how it can even be validated in the tests.PR Context
Fixes#24594
PR Checklist
.h
,.cpp
,.cs
,.ps1
and.psm1
files have the correct copyright headerWIP:
or[ WIP ]
to the beginning of the title (theWIP
bot will keep its status check atPending
while the prefix is present) and remove the prefix when the PR is ready.- [ ] Issue filed:
(which runs in a different PS Host).