Limit scope for cn checking in SAN (#825)

* lint about the encoding of qcstatements for PSD2 * Revert "lint about the encoding of qcstatements for PSD2" This reverts commit 6c23670. * util: gtld_map autopull updates for 2021-10-21T07:25:20 UTC * always check and perform the operation in the execution * synchronised with project * synchronised with project * synchronised with project * synchronised with project * fixed merge error * synchronised with project * address comments of PR #809 * trying to decrease cyclomatic complexity * reverted commit in this branch --------- Co-authored-by: mtg <[email protected]> Co-authored-by: GitHub <[email protected]> Co-authored-by: Christopher Henderson <[email protected]>
zmap · Apr 7, 2024 · 308a138 · 308a138
1 parent 2980c72
commit 308a138
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 10 deletions.
diff --git a/v3/lints/cabf_smime_br/mailbox_address_from_san.go b/v3/lints/cabf_smime_br/mailbox_address_from_san.go
@@ -44,7 +44,19 @@ func NewMailboxAddressFromSAN() lint.LintInterface {
 
 // CheckApplies is returns true if the certificate's policies assert that it conforms to the SMIME BRs
 func (l *MailboxAddressFromSAN) CheckApplies(c *x509.Certificate) bool {
-	return util.IsSMIMEBRCertificate(c) && util.IsSubscriberCert(c)
+
+	if !(util.IsSMIMEBRCertificate(c) && util.IsSubscriberCert(c)) {
+		return false
+	}
+
+	toFindMailboxAddresses := getMailboxAddressesFromDistinguishedName(c.Subject, util.IsMailboxValidatedCertificate(c))
+
+	for _, dirName := range c.DirectoryNames {
+		toFindMailboxAddresses = append(toFindMailboxAddresses, getMailboxAddressesFromDistinguishedName(dirName, false)...)
+	}
+
+	return len(toFindMailboxAddresses) > 0
+
 }
 
 // Execute checks all the places where Mailbox Addresses may be found in an SMIME certificate and confirms that they are present in the SAN rfc822Name or SAN otherName
@@ -55,10 +67,11 @@ func (l *MailboxAddressFromSAN) Execute(c *x509.Certificate) *lint.LintResult {
 	}
 
 	// build list of Mailbox addresses from subject:commonName, subject:emailAddress, dirName
-	toFindMailboxAddresses := getMailboxAddressesFromDistinguishedName(c.Subject)
+
+	toFindMailboxAddresses := getMailboxAddressesFromDistinguishedName(c.Subject, util.IsMailboxValidatedCertificate(c))
 
 	for _, dirName := range c.DirectoryNames {
-		toFindMailboxAddresses = append(toFindMailboxAddresses, getMailboxAddressesFromDistinguishedName(dirName)...)
+		toFindMailboxAddresses = append(toFindMailboxAddresses, getMailboxAddressesFromDistinguishedName(dirName, false)...)
 	}
 
 	sanNames := map[string]bool{}
@@ -90,12 +103,14 @@ func (l *MailboxAddressFromSAN) Execute(c *x509.Certificate) *lint.LintResult {
 	return &lint.LintResult{Status: lint.Pass}
 }
 
-func getMailboxAddressesFromDistinguishedName(name pkix.Name) []string {
+func getMailboxAddressesFromDistinguishedName(name pkix.Name, includeCN bool) []string {
 	mailboxAddresses := []string{}
 
-	for _, commonName := range name.CommonNames {
-		if util.IsMailboxAddress(commonName) {
-			mailboxAddresses = append(mailboxAddresses, commonName)
+	if includeCN {
+		for _, commonName := range name.CommonNames {
+			if util.IsMailboxAddress(commonName) {
+				mailboxAddresses = append(mailboxAddresses, commonName)
+			}
 		}
 	}
 

diff --git a/v3/lints/cabf_smime_br/mailbox_address_from_san_test.go b/v3/lints/cabf_smime_br/mailbox_address_from_san_test.go
@@ -45,13 +45,13 @@ func TestMailboxAddressFromSANLint(t *testing.T) {
 			Name:          "pass - only contains one san:emailAddress value",
 			InputFilename: "WithOnlySANEmail.pem",
 
-			ExpectedResult: lint.Pass,
+			ExpectedResult: lint.NA,
 		},
 		{
 			Name:          "pass - only contains one san:otherName value",
 			InputFilename: "WithOnlySANOtherName.pem",
 
-			ExpectedResult: lint.Pass,
+			ExpectedResult: lint.NA,
 		},
 		{
 			Name:          "NE - before effective date",
@@ -97,7 +97,7 @@ func TestMailboxAddressFromSANLint(t *testing.T) {
 			Name:          "pass - subject:commonName is personal name, san:emailAddress contains an email",
 			InputFilename: "sponsorValidatedMultipurposePersonalNameInCN.pem",
 
-			ExpectedResult: lint.Pass,
+			ExpectedResult: lint.NA,
 		},
 	}