diff --git a/.travis.yml b/.travis.yml index e375f43..5607dee 100644 --- a/.travis.yml +++ b/.travis.yml @@ -3,7 +3,7 @@ language: go go: - - 1.9 + - '1.10.x' install: - go get github.com/Masterminds/glide @@ -33,4 +33,3 @@ deploy: on: repo: square/certigo tags: true - go: 1.9 diff --git a/lib/display.go b/lib/display.go index c012bce..c3ef114 100644 --- a/lib/display.go +++ b/lib/display.go @@ -56,15 +56,39 @@ Authority Key ID: {{.Issuer.KeyID | hexify}} {{- if .BasicConstraints}} Basic Constraints: CA:{{.BasicConstraints.IsCA}}{{if .BasicConstraints.MaxPathLen}}, pathlen:{{.BasicConstraints.MaxPathLen}}{{end}}{{end}} {{- if .NameConstraints}} -DNS Name Constraints{{if .NameConstraints.Critical}} (critical){{end}}: +Name Constraints{{if .NameConstraints.Critical}} (critical){{end}}: {{- if .NameConstraints.PermittedDNSDomains}} -Permitted: +Permitted DNS domains: {{wrapWith .Width "\n\t" (join ", " .NameConstraints.PermittedDNSDomains)}} +{{- end -}} +{{- if .NameConstraints.PermittedEmailAddresses}} +Permitted email addresses: + {{wrapWith .Width "\n\t" (join ", " .NameConstraints.PermittedEmailAddresses)}} +{{- end -}} +{{- if .NameConstraints.PermittedIPRanges}} +Permitted IP ranges: + {{wrapWith .Width "\n\t" (join ", " .NameConstraints.PermittedIPRanges)}} +{{- end -}} +{{- if .NameConstraints.PermittedURIDomains}} +Permitted URI domains: + {{wrapWith .Width "\n\t" (join ", " .NameConstraints.PermittedURIDomains)}} {{- end}} {{- if .NameConstraints.ExcludedDNSDomains}} -Excluded: +Excluded DNS domains: {{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedDNSDomains)}} {{- end}} +{{- if .NameConstraints.ExcludedEmailAddresses}} +Excluded email addresses: + {{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedEmailAddresses)}} +{{- end}} +{{- if .NameConstraints.ExcludedIPRanges}} +Excluded IP ranges: + {{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedIPRanges)}} +{{- end}} +{{- if .NameConstraints.ExcludedURIDomains}} +Excluded URI domains: + {{wrapWith .Width "\n\t" (join ", " .NameConstraints.ExcludedURIDomains)}} +{{- end}} {{- end}} {{- if .OCSPServer}} OCSP Server(s): @@ -114,9 +138,6 @@ var layout = ` Valid: {{.NotBefore | certStart}} to {{.NotAfter | certEnd}} Subject: {{.Subject.Name | printShortName }} Issuer: {{.Issuer.Name | printShortName }} -{{- if .NameConstraints}} -Name Constraints{{if .NameConstraints.Critical}} (critical){{end}}: {{range .NameConstraints.PermittedDNSDomains}} - {{.}}{{end}}{{end}} {{- if .AltDNSNames}} DNS Names: {{wrapWith .Width "\n\t" (join ", " .AltDNSNames)}}{{end}} diff --git a/lib/encoder.go b/lib/encoder.go index 0d39a8a..94b36a1 100644 --- a/lib/encoder.go +++ b/lib/encoder.go @@ -171,9 +171,15 @@ type basicConstraints struct { } type nameConstraints struct { - Critical bool `json:"critical,omitempty"` - PermittedDNSDomains []string `json:"permitted_dns_domains,omitempty"` - ExcludedDNSDomains []string `json:"excluded_dns_domains,omitempty"` + Critical bool `json:"critical,omitempty"` + PermittedDNSDomains []string `json:"permitted_dns_domains,omitempty"` + ExcludedDNSDomains []string `json:"excluded_dns_domains,omitempty"` + PermittedIPRanges []*net.IPNet `json:"permitted_ip_ranges,omitempty"` + ExcludedIPRanges []*net.IPNet `json:"excluded_ip_ranges,omitempty"` + PermittedEmailAddresses []string `json:"permitted_email_addresses,omitempty"` + ExcludedEmailAddresses []string `json:"excluded_email_addresses,omitempty"` + PermittedURIDomains []string `json:"permitted_uri_domains,omitempty"` + ExcludedURIDomains []string `json:"excluded_uri_domains,omitempty"` } // simpleCertificate is a JSON-representable certificate metadata holder. @@ -254,11 +260,21 @@ func createSimpleCertificate(name string, cert *x509.Certificate) simpleCertific } } - if len(cert.PermittedDNSDomains) > 0 || len(cert.ExcludedDNSDomains) > 0 { + if len(cert.PermittedDNSDomains) > 0 || len(cert.ExcludedDNSDomains) > 0 || + len(cert.PermittedIPRanges) > 0 || len(cert.ExcludedIPRanges) > 0 || + len(cert.PermittedEmailAddresses) > 0 || len(cert.ExcludedEmailAddresses) > 0 || + len(cert.PermittedURIDomains) > 0 || len(cert.ExcludedURIDomains) > 0 { + out.NameConstraints = &nameConstraints{ - Critical: cert.PermittedDNSDomainsCritical, - PermittedDNSDomains: cert.PermittedDNSDomains, - ExcludedDNSDomains: cert.ExcludedDNSDomains, + Critical: cert.PermittedDNSDomainsCritical, + PermittedDNSDomains: cert.PermittedDNSDomains, + ExcludedDNSDomains: cert.ExcludedDNSDomains, + PermittedIPRanges: cert.PermittedIPRanges, + ExcludedIPRanges: cert.ExcludedIPRanges, + PermittedEmailAddresses: cert.PermittedEmailAddresses, + ExcludedEmailAddresses: cert.ExcludedEmailAddresses, + PermittedURIDomains: cert.PermittedURIDomains, + ExcludedURIDomains: cert.ExcludedURIDomains, } } diff --git a/tests/dump-mozilla-cacert-bundle.t b/tests/dump-mozilla-cacert-bundle.t index 73e9873..a272997 100644 --- a/tests/dump-mozilla-cacert-bundle.t +++ b/tests/dump-mozilla-cacert-bundle.t @@ -3736,3 +3736,9 @@ Dump trust store and make sure there are no errors. $ certigo dump cacert.pem >/dev/null; echo $? 0 + $ certigo dump --verbose cacert.pem >/dev/null; echo $? + 0 + $ certigo dump --json cacert.pem >/dev/null; echo $? + 0 + $ certigo dump --pem cacert.pem >/dev/null; echo $? + 0 diff --git a/tests/dump-name-constraints-to-text.t b/tests/dump-name-constraints-to-text.t index 2741971..171a1a7 100644 --- a/tests/dump-name-constraints-to-text.t +++ b/tests/dump-name-constraints-to-text.t @@ -24,6 +24,31 @@ Set up test data. > tFmaBKzI+2uQwt6DHQuPmOSEmI7NcrVS2WhPVPa7fIY/ExUy7jqIr2qM59eSl7OC > AhzgLtgqfwLgbj5PWZENYlNRXmZGi4GD > -----END CERTIFICATE----- + > -----BEGIN CERTIFICATE----- + > MIIEMTCCAxmgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBlTELMAkGA1UEBhMCR1Ix + > RDBCBgNVBAoTO0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1 + > dGlvbnMgQ2VydC4gQXV0aG9yaXR5MUAwPgYDVQQDEzdIZWxsZW5pYyBBY2FkZW1p + > YyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIFJvb3RDQSAyMDExMB4XDTExMTIw + > NjEzNDk1MloXDTMxMTIwMTEzNDk1MlowgZUxCzAJBgNVBAYTAkdSMUQwQgYDVQQK + > EztIZWxsZW5pYyBBY2FkZW1pYyBhbmQgUmVzZWFyY2ggSW5zdGl0dXRpb25zIENl + > cnQuIEF1dGhvcml0eTFAMD4GA1UEAxM3SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl + > c2VhcmNoIEluc3RpdHV0aW9ucyBSb290Q0EgMjAxMTCCASIwDQYJKoZIhvcNAQEB + > BQADggEPADCCAQoCggEBAKlTAOMupvaO+mDYLZU++CwqVE7NuYRhlFhPjz2L5EPz + > dYmNUeTDN9KKiE15HrcS3UN4SoqS5tdI1Q+kOilENbgH9mgdVc04UfCMJDGFr4PJ + > fel3r+0ae50X+bOdOFAPplp5kYCvN66m0zH7tSYJnTxa71HFK9+WXesyHgLacEns + > bgzImjeN9/E2YEsmLIKe0HjzDQ9jpFEw4fkrJxIH2Oq9GGKYsFk3fb7u8yBRQlqD + > 75O6aRXxYp2fmTmCobd0LovUxQt7L/DICto9eQqakxylKHJzkUOap9FNhYS5qXSP + > FEDH3N6sQWRstBmbAmNtJGSPRLIl6s5ddAxjMlyNh+UCAwEAAaOBiTCBhjAPBgNV + > HRMBAf8EBTADAQH/MAsGA1UdDwQEAwIBBjAdBgNVHQ4EFgQUppFC/RNhSiOeCKQp + > 5dgTBCPuQSUwRwYDVR0eBEAwPqA8MAWCAy5ncjAFggMuZXUwBoIELmVkdTAGggQu + > b3JnMAWBAy5ncjAFgQMuZXUwBoEELmVkdTAGgQQub3JnMA0GCSqGSIb3DQEBBQUA + > A4IBAQAf73lB4XtuP7KMhjdCSk4cNx6NZrokgclPEg8hwAOXhiVtXdMiKahsog2p + > 6z0GW5k6x8zDmjR/qw7IThzh+uTczQ2+vyT+bOdrwg3IBp5OjWEopmr95fZi6hg8 + > TqBTnbI6nOulnJEWtk2C4AwFSKls9cz4y51JtPACpf1wA+2KIaWuE4ZJwzNzvoc7 + > dIsXRSZMFpGD/md9zU1jZ/rzAxKWeAaNsWftjj++n08C9bMJL/NMh98qy5V8Acys + > Nnq/onN694/BtZqhFLKPM58N7yLcZnuEvUUXBj08yrl3NI/K6s8/MT7jiOOASSXI + > l7WdmplNsDz4SgCbZN2fOUvRJ9e4 + > -----END CERTIFICATE----- > EOF Dump an example certificate with name constraints (example-name-constraints.crt) @@ -46,11 +71,45 @@ Dump an example certificate with name constraints (example-name-constraints.crt) \tOrganizational Unit: example (esc) \tCommonName: example-name-constraints (esc) Basic Constraints: CA:true, pathlen:0 - DNS Name Constraints: - Permitted: + Name Constraints: + Permitted DNS domains: \t.example.com (esc) - Excluded: + Permitted email addresses: + \t.example.com (esc) + Permitted IP ranges: + \t192.168.0.0/16 (esc) + Excluded DNS domains: \t.example.org (esc) + Excluded email addresses: + \t.example.org (esc) + Excluded IP ranges: + \t10.10.0.0/16 (esc) Key Usage: \tCert Sign (esc) + ** CERTIFICATE 2 ** + Serial: 0 + Valid: 2011-12-06 13:49 UTC to 2031-12-01 13:49 UTC + Signature: SHA1-RSA (self-signed) + Subject Info: + \tCountry: GR (esc) + \tOrganization: Hellenic Academic and Research Institutions Cert. Authority (esc) + \tCommonName: Hellenic Academic and Research Institutions RootCA 2011 (esc) + Issuer Info: + \tCountry: GR (esc) + \tOrganization: Hellenic Academic and Research Institutions Cert. Authority (esc) + \tCommonName: Hellenic Academic and Research Institutions RootCA 2011 (esc) + Subject Key ID: A6:91:42:FD:13:61:4A:23:9E:08:A4:29:E5:D8:13:04:23:EE:41:25 + Basic Constraints: CA:true + Name Constraints: + Permitted DNS domains: + \t.gr, .eu, .edu, .org (esc) + Permitted email addresses: + \t.gr, .eu, .edu, .org (esc) + Key Usage: + \tCert Sign (esc) + \tCRL Sign (esc) + Warnings: + \tSerial number in cert appears to be zero/negative (esc) + \tSigned with SHA1-RSA, which is an outdated signature algorithm (esc) +