Merge pull request #154 from square/cs/go1.10

Support new name constraint fields in crypto/x509
2024-04-21 12:32:40 +00:00 · 2018-02-27 17:01:57 -08:00
parent ba63b127cd 7c6b521735
commit 4902e7daf5
5 changed files with 119 additions and 18 deletions
@@ -3,7 +3,7 @@
 language: go

 go:
-  - 1.9
+  - '1.10.x'

 install:
  - go get github.com/Masterminds/glide
@@ -33,4 +33,3 @@ deploy:
  on:
    repo: square/certigo
    tags: true
-    go: 1.9
@@ -56,15 +56,39 @@ Authority Key ID: {{.Issuer.KeyID | hexify}}
 {{- if .BasicConstraints}}
 Basic Constraints: CA:{{.BasicConstraints.IsCA}}{{if .BasicConstraints.MaxPathLen}}, pathlen:{{.BasicConstraints.MaxPathLen}}{{end}}{{end}}
 {{- if .NameConstraints}}
-DNS Name Constraints{{if .NameConstraints.Critical}} (critical){{end}}: 
+Name Constraints{{if .NameConstraints.Critical}} (critical){{end}}: 
 {{- if .NameConstraints.PermittedDNSDomains}}
-Permitted:
+Permitted DNS domains:
 	{{wrapWith .Width "\n\t" (join ", " .NameConstraints.PermittedDNSDomains)}}
+{{- end -}}
+{{- if .NameConstraints.PermittedEmailAddresses}}
+Permitted email addresses:
+	{{wrapWith .Width "\n\t" (join ", " .NameConstraints.PermittedEmailAddresses)}}
+{{- end -}}
+{{- if .NameConstraints.PermittedIPRanges}}
+Permitted IP ranges:
+	{{wrapWith .Width "\n\t" (join ", " .NameConstraints.PermittedIPRanges)}}
+{{- end -}}
+{{- if .NameConstraints.PermittedURIDomains}}
+Permitted URI domains:
+	{{wrapWith .Width "\n\t" (join ", " .NameConstraints.PermittedURIDomains)}}
 {{- end}}
 {{- if .NameConstraints.ExcludedDNSDomains}}
-Excluded:
+Excluded DNS domains:
 	{{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedDNSDomains)}}
 {{- end}}
+{{- if .NameConstraints.ExcludedEmailAddresses}}
+Excluded email addresses:
+	{{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedEmailAddresses)}}
+{{- end}}
+{{- if .NameConstraints.ExcludedIPRanges}}
+Excluded IP ranges:
+	{{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedIPRanges)}}
+{{- end}}
+{{- if .NameConstraints.ExcludedURIDomains}}
+Excluded URI domains:
+	{{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedURIDomains)}}
+{{- end}}
 {{- end}}
 {{- if .OCSPServer}}
 OCSP Server(s):
@@ -114,9 +138,6 @@ var layout = `
 Valid: {{.NotBefore | certStart}} to {{.NotAfter | certEnd}}
 Subject: {{.Subject.Name | printShortName }}
 Issuer: {{.Issuer.Name | printShortName }}
-{{- if .NameConstraints}}
-Name Constraints{{if .NameConstraints.Critical}} (critical){{end}}: {{range .NameConstraints.PermittedDNSDomains}}
-	{{.}}{{end}}{{end}}
 {{- if .AltDNSNames}}
 DNS Names:
 	{{wrapWith .Width "\n\t" (join ", " .AltDNSNames)}}{{end}}
@@ -171,9 +171,15 @@ type basicConstraints struct {
 }

 type nameConstraints struct {
-	Critical            bool     `json:"critical,omitempty"`
-	PermittedDNSDomains []string `json:"permitted_dns_domains,omitempty"`
-	ExcludedDNSDomains  []string `json:"excluded_dns_domains,omitempty"`
+	Critical                bool         `json:"critical,omitempty"`
+	PermittedDNSDomains     []string     `json:"permitted_dns_domains,omitempty"`
+	ExcludedDNSDomains      []string     `json:"excluded_dns_domains,omitempty"`
+	PermittedIPRanges       []*net.IPNet `json:"permitted_ip_ranges,omitempty"`
+	ExcludedIPRanges        []*net.IPNet `json:"excluded_ip_ranges,omitempty"`
+	PermittedEmailAddresses []string     `json:"permitted_email_addresses,omitempty"`
+	ExcludedEmailAddresses  []string     `json:"excluded_email_addresses,omitempty"`
+	PermittedURIDomains     []string     `json:"permitted_uri_domains,omitempty"`
+	ExcludedURIDomains      []string     `json:"excluded_uri_domains,omitempty"`
 }

 // simpleCertificate is a JSON-representable certificate metadata holder.
@@ -254,11 +260,21 @@ func createSimpleCertificate(name string, cert *x509.Certificate) simpleCertific
 		}
 	}

-	if len(cert.PermittedDNSDomains) > 0 || len(cert.ExcludedDNSDomains) > 0 {
+	if len(cert.PermittedDNSDomains) > 0 || len(cert.ExcludedDNSDomains) > 0 ||
+		len(cert.PermittedIPRanges) > 0 || len(cert.ExcludedIPRanges) > 0 ||
+		len(cert.PermittedEmailAddresses) > 0 || len(cert.ExcludedEmailAddresses) > 0 ||
+		len(cert.PermittedURIDomains) > 0 || len(cert.ExcludedURIDomains) > 0 {
+
 		out.NameConstraints = &nameConstraints{
-			Critical:            cert.PermittedDNSDomainsCritical,
-			PermittedDNSDomains: cert.PermittedDNSDomains,
-			ExcludedDNSDomains:  cert.ExcludedDNSDomains,
+			Critical:                cert.PermittedDNSDomainsCritical,
+			PermittedDNSDomains:     cert.PermittedDNSDomains,
+			ExcludedDNSDomains:      cert.ExcludedDNSDomains,
+			PermittedIPRanges:       cert.PermittedIPRanges,
+			ExcludedIPRanges:        cert.ExcludedIPRanges,
+			PermittedEmailAddresses: cert.PermittedEmailAddresses,
+			ExcludedEmailAddresses:  cert.ExcludedEmailAddresses,
+			PermittedURIDomains:     cert.PermittedURIDomains,
+			ExcludedURIDomains:      cert.ExcludedURIDomains,
 		}
 	}

@@ -3736,3 +3736,9 @@ Dump trust store and make sure there are no errors.

  $ certigo dump cacert.pem >/dev/null; echo $?
  0
+  $ certigo dump --verbose cacert.pem >/dev/null; echo $?
+  0
+  $ certigo dump --json cacert.pem >/dev/null; echo $?
+  0
+  $ certigo dump --pem cacert.pem >/dev/null; echo $?
+  0
@@ -24,6 +24,31 @@ Set up test data.
  > tFmaBKzI+2uQwt6DHQuPmOSEmI7NcrVS2WhPVPa7fIY/ExUy7jqIr2qM59eSl7OC
  > AhzgLtgqfwLgbj5PWZENYlNRXmZGi4GD
  > -----END CERTIFICATE-----
+  > -----BEGIN CERTIFICATE-----
+  > MIIEMTCCAxmgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBlTELMAkGA1UEBhMCR1Ix
+  > RDBCBgNVBAoTO0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1
+  > dGlvbnMgQ2VydC4gQXV0aG9yaXR5MUAwPgYDVQQDEzdIZWxsZW5pYyBBY2FkZW1p
+  > YyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIFJvb3RDQSAyMDExMB4XDTExMTIw
+  > NjEzNDk1MloXDTMxMTIwMTEzNDk1MlowgZUxCzAJBgNVBAYTAkdSMUQwQgYDVQQK
+  > EztIZWxsZW5pYyBBY2FkZW1pYyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIENl
+  > cnQuIEF1dGhvcml0eTFAMD4GA1UEAxM3SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+  > c2VhcmNoIEluc3RpdHV0aW9ucyBSb290Q0EgMjAxMTCCASIwDQYJKoZIhvcNAQEB
+  > BQADggEPADCCAQoCggEBAKlTAOMupvaO+mDYLZU++CwqVE7NuYRhlFhPjz2L5EPz
+  > dYmNUeTDN9KKiE15HrcS3UN4SoqS5tdI1Q+kOilENbgH9mgdVc04UfCMJDGFr4PJ
+  > fel3r+0ae50X+bOdOFAPplp5kYCvN66m0zH7tSYJnTxa71HFK9+WXesyHgLacEns
+  > bgzImjeN9/E2YEsmLIKe0HjzDQ9jpFEw4fkrJxIH2Oq9GGKYsFk3fb7u8yBRQlqD
+  > 75O6aRXxYp2fmTmCobd0LovUxQt7L/DICto9eQqakxylKHJzkUOap9FNhYS5qXSP
+  > FEDH3N6sQWRstBmbAmNtJGSPRLIl6s5ddAxjMlyNh+UCAwEAAaOBiTCBhjAPBgNV
+  > HRMBAf8EBTADAQH/MAsGA1UdDwQEAwIBBjAdBgNVHQ4EFgQUppFC/RNhSiOeCKQp
+  > 5dgTBCPuQSUwRwYDVR0eBEAwPqA8MAWCAy5ncjAFggMuZXUwBoIELmVkdTAGggQu
+  > b3JnMAWBAy5ncjAFgQMuZXUwBoEELmVkdTAGgQQub3JnMA0GCSqGSIb3DQEBBQUA
+  > A4IBAQAf73lB4XtuP7KMhjdCSk4cNx6NZrokgclPEg8hwAOXhiVtXdMiKahsog2p
+  > 6z0GW5k6x8zDmjR/qw7IThzh+uTczQ2+vyT+bOdrwg3IBp5OjWEopmr95fZi6hg8
+  > TqBTnbI6nOulnJEWtk2C4AwFSKls9cz4y51JtPACpf1wA+2KIaWuE4ZJwzNzvoc7
+  > dIsXRSZMFpGD/md9zU1jZ/rzAxKWeAaNsWftjj++n08C9bMJL/NMh98qy5V8Acys
+  > Nnq/onN694/BtZqhFLKPM58N7yLcZnuEvUUXBj08yrl3NI/K6s8/MT7jiOOASSXI
+  > l7WdmplNsDz4SgCbZN2fOUvRJ9e4
+  > -----END CERTIFICATE-----
  > EOF

 Dump an example certificate with name constraints (example-name-constraints.crt)
@@ -46,11 +71,45 @@ Dump an example certificate with name constraints (example-name-constraints.crt)
  \tOrganizational Unit: example (esc)
  \tCommonName: example-name-constraints (esc)
  Basic Constraints: CA:true, pathlen:0
-  DNS Name Constraints:
-  Permitted:
+  Name Constraints:
+  Permitted DNS domains:
  \t.example.com (esc)
-  Excluded:
+  Permitted email addresses:
+  \t.example.com (esc)
+  Permitted IP ranges:
+  \t192.168.0.0/16 (esc)
+  Excluded DNS domains:
  \t.example.org (esc)
+  Excluded email addresses:
+  \t.example.org (esc)
+  Excluded IP ranges:
+  \t10.10.0.0/16 (esc)
  Key Usage:
  \tCert Sign (esc)
  
+  ** CERTIFICATE 2 **
+  Serial: 0
+  Valid: 2011-12-06 13:49 UTC to 2031-12-01 13:49 UTC
+  Signature: SHA1-RSA (self-signed)
+  Subject Info:
+  \tCountry: GR (esc)
+  \tOrganization: Hellenic Academic and Research Institutions Cert. Authority (esc)
+  \tCommonName: Hellenic Academic and Research Institutions RootCA 2011 (esc)
+  Issuer Info:
+  \tCountry: GR (esc)
+  \tOrganization: Hellenic Academic and Research Institutions Cert. Authority (esc)
+  \tCommonName: Hellenic Academic and Research Institutions RootCA 2011 (esc)
+  Subject Key ID: A6:91:42:FD:13:61:4A:23:9E:08:A4:29:E5:D8:13:04:23:EE:41:25
+  Basic Constraints: CA:true
+  Name Constraints:
+  Permitted DNS domains:
+  \t.gr, .eu, .edu, .org (esc)
+  Permitted email addresses:
+  \t.gr, .eu, .edu, .org (esc)
+  Key Usage:
+  \tCert Sign (esc)
+  \tCRL Sign (esc)
+  Warnings:
+  \tSerial number in cert appears to be zero/negative (esc)
+  \tSigned with SHA1-RSA, which is an outdated signature algorithm (esc)
+