From a78db879b31b072c37c6d46cc404d8e131d54349 Mon Sep 17 00:00:00 2001 From: Roland Shoemaker Date: Tue, 12 Apr 2022 21:22:22 -0700 Subject: [PATCH] crypto/x509: omit empty extensions SEQUENCE In CreateCertificate, if there are no extensions, don't include the extensions SEQUENCE in the encoded certificate. Why, you might ask, does the encoding/asn1 tag 'optional' not do the same thing as 'omitempty'? Good question, no clue, fixing that would probably break things in horrific ways. Fixes #52319 Change-Id: I84fdd5ff3e4e0b0a59e3bf86e7439753b1e1477b Reviewed-on: https://go-review.googlesource.com/c/go/+/399827 Run-TryBot: Roland Shoemaker TryBot-Result: Gopher Robot Reviewed-by: Damien Neil Reviewed-by: Roland Shoemaker Auto-Submit: Roland Shoemaker --- src/crypto/x509/x509.go | 2 +- src/crypto/x509/x509_test.go | 24 ++++++++++++++++++++++++ 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/src/crypto/x509/x509.go b/src/crypto/x509/x509.go index bcc14a0056..e28e213dc1 100644 --- a/src/crypto/x509/x509.go +++ b/src/crypto/x509/x509.go @@ -155,7 +155,7 @@ type tbsCertificate struct { PublicKey publicKeyInfo UniqueId asn1.BitString `asn1:"optional,tag:1"` SubjectUniqueId asn1.BitString `asn1:"optional,tag:2"` - Extensions []pkix.Extension `asn1:"optional,explicit,tag:3"` + Extensions []pkix.Extension `asn1:"omitempty,optional,explicit,tag:3"` } type dsaAlgorithmParameters struct { diff --git a/src/crypto/x509/x509_test.go b/src/crypto/x509/x509_test.go index d8dde25019..818a9750c3 100644 --- a/src/crypto/x509/x509_test.go +++ b/src/crypto/x509/x509_test.go @@ -3568,3 +3568,27 @@ func TestRevocationListCheckSignatureFrom(t *testing.T) { }) } } + +func TestOmitEmptyExtensions(t *testing.T) { + k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) + if err != nil { + t.Fatal(err) + } + tmpl := &Certificate{ + SerialNumber: big.NewInt(1), + Subject: pkix.Name{ + CommonName: ":)", + }, + NotAfter: time.Now().Add(time.Hour), + NotBefore: time.Now().Add(-time.Hour), + } + der, err := CreateCertificate(rand.Reader, tmpl, tmpl, k.Public(), k) + if err != nil { + t.Fatal(err) + } + + emptyExtSeq := []byte{0xA3, 0x02, 0x30, 0x00} + if bytes.Contains(der, emptyExtSeq) { + t.Error("DER encoding contains the an empty extensions SEQUENCE") + } +} -- 2.50.0