Linux CheckX509IpAddress processes IP literals in CN on Linux when SAN is also present
Open
area-System.Security
os-linux
- Dominant language
- C#
- Stars
- 18.3k
- Forks
- 5.6k
- PR merge metrics
- PR metrics pending
Description
Traditionally, one can put IP address to CN and have that validated agains actual IP address.
However, when `SubjectAlternativeName` is present it should take precedence:
https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.6
The behavior is Linux specific and it works as expected when same validation runs on Windows.
Contributor guide
Research direction
Start by locating the Linux implementation and existing tests for CheckX509IpAddress, then compare its handling with the Windows validation path. Reproduce the case where an IP literal appears in CN alongside a SubjectAlternativeName, and consider the issue complete when SAN precedence matches RFC 5280 and the Windows behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, linux
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100