SubjectAlternativeNameBuilder.AddDnsName throws ArgumentException

[amaltinsky]

Description

Calling SubjectAlternativeNameBuilder.AddDnsName() with a name that ends with - results in an ArgumentException although it's a perfectly valid DNS name. This is caused by IdnMapping mistakenly treating such names as IDNs.

Note that Uri.CheckHostName("EC2-12-456-789-") returns Dns as the name type.

Reproduction Steps

var builder = new SubjectAlternativeNameBuilder();
s.AddDnsName("EC2-12-456-789-"); // throws ArgumentException

Expected behavior

Adds the given DNS name to the SubjectAlternateName

Actual behavior

Throws ArgumentException

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

No response

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[bartonjs]

According to RFC 1034, ending in a hyphen is invalid.

<domain> ::= <subdomain> | " "

<subdomain> ::= <label> | <subdomain> "." <label>

<label> ::= <letter> [ [ <ldh-str> ] <let-dig> ]

<ldh-str> ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str>

<let-dig-hyp> ::= <let-dig> | "-"

<let-dig> ::= <letter> | <digit>

The label production only allows ldh-str (letter-digit-or-hyphen) after the first character, and before the last.

[amaltinsky]

@bartonjs

First, this exception only happens when the ICU Globalization API is used (as I now discovered). This work fine with NLS, which means that it works fine with old versions of .NET. This shouldn't be the case regardless of whether this is a valid DNS name.

Second, hostnames seem to not have this restriction on ending with hyphen. And such hostnames can easily be accidentally created due to truncation to 15 characters. We ran into this issue in practice on a Windows EC2 machine where our code tried to generate a certificate with the hostname as an alternate name. This used to work in older versions of .NET.

Lastly, there seems to be some confusion with Uri.CheckHostName() which returns UriHostNameType.Dns for names that end with a hyphen.