github/certigo
4
0
Fork 0
mirror of https://github.com/square/certigo.git synced 2024-04-21 12:32:40 +00:00
Code Issues Releases Wiki Activity

Move ocsp.go and verify.go into lib

Browse Source 
This reduces a bunch of copy-paste code.
This commit is contained in:
Matthew McPherrin
2018-04-04 21:21:46 -07:00
parent c079619f11
commit c58011aee0
3 changed files with 20 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ocsp.go → lib/ocsp.go
+1 -1
View File
@@ -14,7 +14,7 @@
* limitations under the License.
*/
package main
package lib
import (
"bytes"
verify.go → lib/verify.go
+14 -52
View File
@@ -14,7 +14,7 @@
* limitations under the License.
*/
package main
package lib
import (
"crypto/x509"
@@ -24,45 +24,14 @@ import (
"io"
"io/ioutil"
"os"
"strconv"
"time"
"crypto/tls"
"github.com/fatih/color"
"github.com/square/certigo/lib"
"golang.org/x/crypto/ocsp"
)
var (
green = color.New(color.Bold, color.FgGreen)
yellow = color.New(color.Bold, color.FgYellow)
red = color.New(color.Bold, color.FgRed)
)
var algoName = [...]string{
x509.MD2WithRSA: "MD2-RSA",
x509.MD5WithRSA: "MD5-RSA",
x509.SHA1WithRSA: "SHA1-RSA",
x509.SHA256WithRSA: "SHA256-RSA",
x509.SHA384WithRSA: "SHA384-RSA",
x509.SHA512WithRSA: "SHA512-RSA",
x509.DSAWithSHA1: "DSA-SHA1",
x509.DSAWithSHA256: "DSA-SHA256",
x509.ECDSAWithSHA1: "ECDSA-SHA1",
x509.ECDSAWithSHA256: "ECDSA-SHA256",
x509.ECDSAWithSHA384: "ECDSA-SHA384",
x509.ECDSAWithSHA512: "ECDSA-SHA512",
}
var badSignatureAlgorithms = [...]x509.SignatureAlgorithm{
x509.MD2WithRSA,
x509.MD5WithRSA,
x509.SHA1WithRSA,
x509.DSAWithSHA1,
x509.ECDSAWithSHA1,
}
type simpleVerifyCert struct {
Name string `json:"name"`
IsSelfSigned bool `json:"is_self_signed"`
@@ -70,24 +39,24 @@ type simpleVerifyCert struct {
signatureAlgorithm x509.SignatureAlgorithm
}
type simpleVerification struct {
type SimpleVerification struct {
Error string `json:"error,omitempty"`
OCSPStatus *ocsp.Response `json:"ocsp_response,omitempty"`
OCSPError string `json:"ocsp_error,omitempty"`
Chains [][]simpleVerifyCert `json:"chains"`
}
type simpleResult struct {
type SimpleResult struct {
Certificates []*x509.Certificate `json:"certificates"`
VerifyResult *simpleVerification `json:"verify_result,omitempty"`
VerifyResult *SimpleVerification `json:"verify_result,omitempty"`
TLSConnectionState *tls.ConnectionState
CertificateRequestInfo *tls.CertificateRequestInfo
}
func (s simpleResult) MarshalJSON() ([]byte, error) {
func (s SimpleResult) MarshalJSON() ([]byte, error) {
certs := make([]interface{}, len(s.Certificates))
for i, c := range s.Certificates {
certs[i] = lib.EncodeX509ToObject(c)
certs[i] = EncodeX509ToObject(c)
}
out := map[string]interface{}{}
@@ -96,10 +65,10 @@ func (s simpleResult) MarshalJSON() ([]byte, error) {
out["verify_result"] = s.VerifyResult
}
if s.TLSConnectionState != nil {
out["tls_connection"] = lib.EncodeTLSToObject(s.TLSConnectionState)
out["tls_connection"] = EncodeTLSToObject(s.TLSConnectionState)
}
if s.CertificateRequestInfo != nil {
encoded, err := lib.EncodeCRIToObject(s.CertificateRequestInfo)
encoded, err := EncodeCRIToObject(s.CertificateRequestInfo)
if err != nil {
return nil, err
}
@@ -124,8 +93,8 @@ func caBundle(caPath string) *x509.CertPool {
return bundle
}
func verifyChain(certs []*x509.Certificate, ocspStaple []byte, dnsName, caPath string) simpleVerification {
result := simpleVerification{
func VerifyChain(certs []*x509.Certificate, ocspStaple []byte, dnsName, caPath string) SimpleVerification {
result := SimpleVerification{
Chains: [][]simpleVerifyCert{},
}
@@ -158,12 +127,12 @@ func verifyChain(certs []*x509.Certificate, ocspStaple []byte, dnsName, caPath s
aChain := []simpleVerifyCert{}
for _, cert := range chain {
aCert := simpleVerifyCert{
IsSelfSigned: lib.IsSelfSigned(cert),
IsSelfSigned: IsSelfSigned(cert),
signatureAlgorithm: cert.SignatureAlgorithm,
PEM: string(pem.EncodeToMemory(lib.EncodeX509ToPEM(cert, nil))),
PEM: string(pem.EncodeToMemory(EncodeX509ToPEM(cert, nil))),
}
aCert.Name = lib.PrintCommonName(cert.Subject)
aCert.Name = PrintCommonName(cert.Subject)
aChain = append(aChain, aCert)
}
result.Chains = append(result.Chains, aChain)
@@ -185,14 +154,7 @@ func fmtCert(cert simpleVerifyCert) string {
return name
}
func algString(algo x509.SignatureAlgorithm) string {
if 0 < algo && int(algo) < len(algoName) {
return algoName[algo]
}
return strconv.Itoa(int(algo))
}
func printVerifyResult(out io.Writer, result simpleVerification) {
func PrintVerifyResult(out io.Writer, result SimpleVerification) {
if result.Error != "" {
fmt.Fprintf(out, red.SprintfFunc()("Failed to verify certificate chain:\n"))
fmt.Fprintf(out, "\t%s\n", result.Error)
main.go
+5 -5
View File
@@ -79,7 +79,7 @@ func main() {
app.UsageTemplate(kingpin.LongHelpTemplate)
stdout := colorable.NewColorableStdout()
result := simpleResult{}
result := lib.SimpleResult{}
switch kingpin.MustParse(app.Parse(os.Args[1:])) {
case dump.FullCommand(): // Dump certificate
files := inputFiles(*dumpFiles)
@@ -150,7 +150,7 @@ func main() {
} else {
hostname = strings.Split(*connectTo, ":")[0]
}
verifyResult := verifyChain(connState.PeerCertificates, connState.OCSPResponse, hostname, *connectCaPath)
verifyResult := lib.VerifyChain(connState.PeerCertificates, connState.OCSPResponse, hostname, *connectCaPath)
result.VerifyResult = &verifyResult
}
@@ -166,7 +166,7 @@ func main() {
fmt.Fprintf(stdout, "** CERTIFICATE %d **\n", i+1)
fmt.Fprintf(stdout, "%s\n\n", lib.EncodeX509ToText(cert, terminalWidth, *verbose))
}
printVerifyResult(stdout, *result.VerifyResult)
lib.PrintVerifyResult(stdout, *result.VerifyResult)
}
case verify.FullCommand():
file := inputFile(*verifyFile)
@@ -181,12 +181,12 @@ func main() {
}
})
verifyResult := verifyChain(chain, nil, *verifyName, *verifyCaPath)
verifyResult := lib.VerifyChain(chain, nil, *verifyName, *verifyCaPath)
if *verifyJSON {
blob, _ := json.Marshal(verifyResult)
fmt.Println(string(blob))
} else {
printVerifyResult(stdout, verifyResult)
lib.PrintVerifyResult(stdout, verifyResult)
}
if verifyResult.Error != "" {
os.Exit(1)