extend certMatchesPolicy to support google_x509

Signed-off-by: linus-sun <[email protected]>

pkg/identity/identity.go

@@ -16,6 +16,7 @@ package identity
 
 import (
 	"crypto/x509"
+	"crypto/x509/pkix"
 	"encoding/asn1"
 	"encoding/json"
 	"errors"
@@ -274,11 +275,60 @@ func OIDMatchesPolicy[Certificate *x509.Certificate | *google_x509.Certificate](
 	return false, nil, "", nil
 }
 
+// getSubjectAlternateNames extracts all subject alternative names from
+// the certificate, including email addresses, DNS, IP addresses, URIs, and OtherName SANs
+// duplicate of cryptoutils function GetSubjectAlternateNames to match in case of google_x509 fork certificate
+func getSubjectAlternateNames[Certificate *x509.Certificate | *google_x509.Certificate](certificate Certificate) []string {
+	sans := []string{}
+	switch cert := any(certificate).(type) {
+	case *x509.Certificate:
+		sans = append(sans, cert.DNSNames...)
+		sans = append(sans, cert.EmailAddresses...)
+		for _, ip := range cert.IPAddresses {
+			sans = append(sans, ip.String())
+		}
+		for _, uri := range cert.URIs {
+			sans = append(sans, uri.String())
+		}
+		// ignore error if there's no OtherName SAN
+		otherName, _ := cryptoutils.UnmarshalOtherNameSAN(cert.Extensions)
+		if len(otherName) > 0 {
+			sans = append(sans, otherName)
+		}
+		return sans
+	case *google_x509.Certificate:
+		sans = append(sans, cert.DNSNames...)
+		sans = append(sans, cert.EmailAddresses...)
+		for _, ip := range cert.IPAddresses {
+			sans = append(sans, ip.String())
+		}
+		for _, uri := range cert.URIs {
+			sans = append(sans, uri.String())
+		}
+		// ignore error if there's no OtherName SAN
+		pkixExts := []pkix.Extension{}
+		for _, googleExt := range cert.Extensions {
+			pkixExt := pkix.Extension{
+				Id:       (asn1.ObjectIdentifier)(googleExt.Id),
+				Critical: googleExt.Critical,
+				Value:    googleExt.Value,
+			}
+			pkixExts = append(pkixExts, pkixExt)
+		}
+		otherName, _ := cryptoutils.UnmarshalOtherNameSAN(pkixExts)
+		if len(otherName) > 0 {
+			sans = append(sans, otherName)
+		}
+		return sans
+	}
+	return sans
+}
+
 // CertMatchesPolicy returns true if a certificate contains a given subject and optionally a given issuer
 // expectedSub and expectedIssuers can be regular expressions
 // CertMatchesPolicy also returns the matched subject and issuer on success
-func CertMatchesPolicy(cert *x509.Certificate, expectedSub string, expectedIssuers []string) (bool, string, string, error) {
-	sans := cryptoutils.GetSubjectAlternateNames(cert)
+func CertMatchesPolicy[Certificate *x509.Certificate | *google_x509.Certificate](cert Certificate, expectedSub string, expectedIssuers []string) (bool, string, string, error) {
+	sans := getSubjectAlternateNames(cert)
 	var issuer string
 	var err error
 	issuer, err = getExtension(cert, certExtensionOIDCIssuerV2)

pkg/identity/identity_test.go

@@ -447,3 +447,24 @@ func TestCertMatches(t *testing.T) {
 		t.Errorf("expected subject %s and issuer %s, received subject %s and issuer %s", emailAddr, issuer, receivedSub, receivedIssuer)
 	}
 }
+
+func TestGoogleCertMatches(t *testing.T) {
+	emailAddr := "[email protected]"
+	issuer := "test-issuer"
+	cert := &google_x509.Certificate{
+		EmailAddresses: []string{emailAddr},
+		Extensions: []google_pkix.Extension{
+			{
+				Id:    (google_asn1.ObjectIdentifier)(certExtensionOIDCIssuer),
+				Value: []byte(issuer),
+			},
+		},
+	}
+	matches, receivedSub, receivedIssuer, err := CertMatchesPolicy(cert, emailAddr, []string{issuer})
+	if !matches || err != nil {
+		t.Errorf("Expected true without error, got %v, error %v", matches, err)
+	}
+	if receivedSub != emailAddr || receivedIssuer != issuer {
+		t.Errorf("expected subject %s and issuer %s, received subject %s and issuer %s", emailAddr, issuer, receivedSub, receivedIssuer)
+	}
+}