Add test for C RDN

[microshine]

Create a test to check that if the root is on US calist the C RDN must always refer to the US country code

[rmhrisk]

This has been made more testable in CP 1.4; it must be present and must be C=US. We can now easily implement this check.

[microshine]

Current implementation uses ATIS rule for DN validation.

var subject_details = "The DN shall contain a Country (C=) attribute, a Common Name (CN=) attribute and an Organization (O=) attribute. Other DN attributes are optional"

func init() {
	lint.RegisterLint(&lint.Lint{
		Name:          "e_atis_subject",
		Description:   subject_details,
		Citation:      ATIS1000080v003_STI_Citation,
		Source:        lint.ATIS1000080,
		EffectiveDate: util.ATIS1000080_v003_Leaf_Date,
		Lint:          NewSubject,
	})
}

Would it be better to add a SHAKEN rule for DN validation and use validations depending on CP version?

CP v1.1-v1.3
3.1 Naming
3.1.1 Types of Names
The STI-CA shall assign an X.501 Distinguished Name (DN) [X.501] to each Subscriber. The distinguished name for every STI-CA and end-entity consists of a single Common Name (CN) attribute with a value generated by the issuer of the certificate. The ‘serialNumber’ attribute shall be included along with the CN (to form a terminal relative distinguished name set), to distinguish among successive instances of certificates associated with the same entity.

CP v1.4
3.1 Naming
3.1.1 Types of Names
The STI-CA shall assign an X.501 Distinguished Name (DN) [X.501] to each Subscriber. Issuer and subject DNs, shall include single country name (C) which shall be “US” for all certificates produced under this policy, single organization name (O), and single common name (CN) naming attributes. See [ATIS-100080.v005] and [ATIS100092.v002] for additional restrictions on the values placed in the organization name and common name naming attributes. To distinguish among successive instances of certificates associated with the same entity, the ‘serialNumber’ naming attribute may also be included in the DN.

Something like

var cp_v1_1_to_v1_3_dn_details = "The distinguished name for every STI-CA and end-entity consists of a single Common Name (CN) attribute with a value generated by the issuer of the certificate. The ‘serialNumber’ attribute shall be included along with the CN."
var cp_v1_4_dn_details = "Issuer and subject DNs shall include single country name (C) which shall be “US” for all certificates produced under this policy, single organization name (O), and single common name (CN) naming attributes."

func init() {
	lint.RegisterLint(&lint.Lint{
		Name:          "e_shaken_subject_dn",
		Description:   "Validates the DN based on SHAKEN CP versions.",
		Citation:      "SHAKEN CP Section 3.1 for v1.1 through v1.4",
		Source:        lint.UnitedStatesSHAKENCP,
		EffectiveDate: util.SpecificDate(2020, 4, 7), // Assuming an arbitrary earliest date for the SHAKEN CP versions
		Lint:          NewShakenSubjectDN,
	})
}

type shakenSubjectDN struct{}

func NewShakenSubjectDN() lint.LintInterface {
	return &shakenSubjectDN{}
}

func (l *shakenSubjectDN) CheckApplies(c *x509.Certificate) bool {
	return util.HasPolicyIdentifierOID(c, util.ShakenCPv1_1OID) ||
		util.HasPolicyIdentifierOID(c, util.ShakenCPv1_2OID) ||
		util.HasPolicyIdentifierOID(c, util.ShakenCPv1_3OID) ||
		util.HasPolicyIdentifierOID(c, util.ShakenCPv1_4OID)
}

func (l *shakenSubjectDN) Execute(c *x509.Certificate) *lint.LintResult {
	if util.HasPolicyIdentifierOID(c, util.ShakenCPv1_1OID) || 
	   util.HasPolicyIdentifierOID(c, util.ShakenCPv1_2OID) ||
	   util.HasPolicyIdentifierOID(c, util.ShakenCPv1_3OID) {
		// Implement the DN validation logic for CP v1.1 to v1.3
	} else if util.HasPolicyIdentifierOID(c, util.ShakenCPv1_4OID) {
		// Implement the DN validation logic for CP v1.4
	}

	// Return appropriate lint results
}