-
Notifications
You must be signed in to change notification settings - Fork 356
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: Refactor ParseDN
function to fix resource usage and invalid parsings (fixes #487)
#497
Conversation
Additionally, results of some benchmarking benchmark: Summary
Old implementation:
New implementation::
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, except for the comment typo
} | ||
|
||
var rawValue asn1.RawValue | ||
result, err := asn1.Unmarshal(decoded, &rawValue) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@cpuschma @johnweldon
Great to see you are improving this function!
There is one small issue with this approach that I also figured out too late: asn1.Unmarshal(
only supports DER parsing, while the github.com/go-asn1-ber/asn1-ber
library supports BER parsing too.
This means that parseDN deviates from the RFC, possibly resulting in unexpected limitations for the user.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'll look into this and also extend the test cases. We didn't catch on that either. Thank you for pointing this out, @inteon!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I also have some extra testcases that might be useful. Will create a PR soon.
This PR reworks the
ParseDN
function, which has been very resource consuming for reading one byte at a time and couldn't handle certain characters. This implementation is based upon inteons PR for cert-manager, which wasn't fully compatible with the RFC 4514.This PR also:
hex
enchex
to it's original namehex
for better readabiltyParseDN
test failuresIf this resolves the reported problems, we can revert #466.