string handling in hx509

[Love Hörnquist Åstrand]

Matthieu,

> I'm trying to use heimdal x509 implementation.
> 
> I have problems with decoding a certificate issued by a Windows 2008 R2 server (attached).
> 
> The problem I guess lies in the fact that the name in the certificate is in UTF-16 and the code in der_get_general_string seems not to be ready for this as it expect to have NULLs at the end of the string only (if any).
> 
> Gnutls and openssl have no pbs dealing with it so it seems to be quite valid.

The string is a PRINTABLE STRING and 37.4 in X680 lists the characters valid in printable string, and they are:

	A ... Z a ... z 0, 1, ... 9 (space) ' ( ) + , - . / : = ?

NUL is not among them, it seems to be that this is a bug in code that the certificate.

That said, I'm sure we can work around string types and just treat all of them as octet strings instead when dealing with X509 certificates given that is probably hard to get msft to update their broken code.

Love


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3815 bytes
Desc: not available
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20100808/20d63986/attachment.bin>