From 70012cd865b3dcdab376dba0c0e0abc88c48f508 Mon Sep 17 00:00:00 2001
From: Steven Clark <steven@sclark.me>
Date: Mon, 4 Oct 2021 14:02:47 -0400
Subject: [PATCH] Fix 1.8 regression preventing email addresses being used as
 common name within pki certificates (#12336) (#12716)

* Fix 1.8 regression preventing email addresses being used as common name within pki certs (#12336)

* Add changelog
---
 builtin/logical/pki/cert_util.go      |  4 +-
 builtin/logical/pki/cert_util_test.go | 71 ++++++++++++++++++++++-----
 changelog/12716.txt                   |  3 ++
 3 files changed, 65 insertions(+), 13 deletions(-)
 create mode 100644 changelog/12716.txt

diff --git a/builtin/logical/pki/cert_util.go b/builtin/logical/pki/cert_util.go
index 52f0a33e0c81..b129fc2834cb 100644
--- a/builtin/logical/pki/cert_util.go
+++ b/builtin/logical/pki/cert_util.go
@@ -330,7 +330,9 @@ func validateNames(b *backend, data *inputBundle, names []string) string {
 				// is enabled
 				if data.role.AllowBareDomains &&
 					(strings.EqualFold(sanitizedName, currDomain) ||
-						(isEmail && strings.EqualFold(emailDomain, currDomain))) {
+						(isEmail && strings.EqualFold(emailDomain, currDomain)) ||
+							// Handle the use case of AllowedDomain being an email address
+							(isEmail && strings.EqualFold(name, currDomain))) {
 					valid = true
 					break
 				}
diff --git a/builtin/logical/pki/cert_util_test.go b/builtin/logical/pki/cert_util_test.go
index b1f815d1a11c..d27cb7d6d27a 100644
--- a/builtin/logical/pki/cert_util_test.go
+++ b/builtin/logical/pki/cert_util_test.go
@@ -164,7 +164,8 @@ func TestPki_PermitFQDNs(t *testing.T) {
 
 	cases := map[string]struct {
 		input    *inputBundle
-		expected []string
+		expectedDnsNames []string
+		expectedEmails []string
 	}{
 		"base valid case": {
 			input: &inputBundle{
@@ -181,7 +182,8 @@ func TestPki_PermitFQDNs(t *testing.T) {
 					EnforceHostnames: true,
 				},
 			},
-			expected: []string{"example.com."},
+			expectedDnsNames: []string{"example.com."},
+			expectedEmails: []string{},
 		},
 		"case insensitivity validation": {
 			input: &inputBundle{
@@ -199,20 +201,65 @@ func TestPki_PermitFQDNs(t *testing.T) {
 					MaxTTL:           3600,
 				},
 			},
-			expected: []string{"Example.Net", "eXaMPLe.COM"},
+			expectedDnsNames: []string{"Example.Net", "eXaMPLe.COM"},
+			expectedEmails: []string{},
+		},
+		"case email as AllowedDomain with bare domains": {
+			input: &inputBundle{
+				apiData: &framework.FieldData{
+					Schema: fields,
+					Raw: map[string]interface{}{
+						"common_name": "test@testemail.com",
+						"ttl":         3600,
+					},
+				},
+				role: &roleEntry{
+					AllowedDomains:   []string{"test@testemail.com"},
+					AllowBareDomains: true,
+					MaxTTL:           3600,
+				},
+			},
+			expectedDnsNames: []string{},
+			expectedEmails: []string{"test@testemail.com"},
+		},
+		"case email common name with bare domains": {
+			input: &inputBundle{
+				apiData: &framework.FieldData{
+					Schema: fields,
+					Raw: map[string]interface{}{
+						"common_name": "test@testemail.com",
+						"ttl":         3600,
+					},
+				},
+				role: &roleEntry{
+					AllowedDomains:   []string{"testemail.com"},
+					AllowBareDomains: true,
+					MaxTTL:           3600,
+				},
+			},
+			expectedDnsNames: []string{},
+			expectedEmails: []string{"test@testemail.com"},
 		},
 	}
 
-	for _, testCase := range cases {
-		cb, err := generateCreationBundle(&b, testCase.input, nil, nil)
-		if err != nil {
-			t.Fatalf("Error: %v", err)
-		}
+	for name, testCase := range cases {
+		t.Run(name, func(t *testing.T) {
+			cb, err := generateCreationBundle(&b, testCase.input, nil, nil)
+			if err != nil {
+				t.Fatalf("Error: %v", err)
+			}
 
-		actual := cb.Params.DNSNames
+			actualDnsNames := cb.Params.DNSNames
 
-		if !reflect.DeepEqual(testCase.expected, actual) {
-			t.Fatalf("Expected %v, got %v", testCase.expected, actual)
-		}
+			if !reflect.DeepEqual(testCase.expectedDnsNames, actualDnsNames) {
+				t.Fatalf("Expected dns names %v, got %v", testCase.expectedDnsNames, actualDnsNames)
+			}
+
+			actualEmails := cb.Params.EmailAddresses
+
+			if !reflect.DeepEqual(testCase.expectedEmails, actualEmails) {
+				t.Fatalf("Expected email addresses %v, got %v", testCase.expectedEmails, actualEmails)
+			}
+		})
 	}
 }
diff --git a/changelog/12716.txt b/changelog/12716.txt
new file mode 100644
index 000000000000..9a41d313ce3f
--- /dev/null
+++ b/changelog/12716.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+pki: Fix regression preventing email addresses being used as a common name within certificates
+```