From 7a0eb56466eb26704fad49caec228ba21831761e Mon Sep 17 00:00:00 2001 From: Filippo Valsorda Date: Fri, 7 Sep 2018 12:58:14 -0400 Subject: [PATCH] crypto/x509: allow ":" in Common Name hostnames At least one popular service puts a hostname which contains a ":" in the Common Name field. On the other hand, I don't know of any name constrained certificates that only work if we ignore such CNs. Updates #24151 Change-Id: I2d813e3e522ebd65ab5ea5cd83390467a869eea3 Reviewed-on: https://go-review.googlesource.com/134076 Run-TryBot: Filippo Valsorda Reviewed-by: Adam Langley TryBot-Result: Gobot Gobot --- src/crypto/x509/verify.go | 4 ++-- src/crypto/x509/verify_test.go | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/crypto/x509/verify.go b/src/crypto/x509/verify.go index 4c2ff7b7c4..91be7c05f9 100644 --- a/src/crypto/x509/verify.go +++ b/src/crypto/x509/verify.go @@ -894,8 +894,8 @@ func validHostname(host string) bool { if c == '-' && j != 0 { continue } - if c == '_' { - // _ is not a valid character in hostnames, but it's commonly + if c == '_' || c == ':' { + // Not valid characters in hostnames, but commonly // found in deployments outside the WebPKI. continue } diff --git a/src/crypto/x509/verify_test.go b/src/crypto/x509/verify_test.go index 7684145839..0e24d3b5da 100644 --- a/src/crypto/x509/verify_test.go +++ b/src/crypto/x509/verify_test.go @@ -1881,6 +1881,7 @@ func TestValidHostname(t *testing.T) { {"foo.*.example.com", false}, {"exa_mple.com", true}, {"foo,bar", false}, + {"project-dev:us-central1:main", true}, } for _, tt := range tests { if got := validHostname(tt.host); got != tt.want { -- 2.48.1