mirror of
https://github.com/square/certigo.git
synced 2024-04-21 12:32:40 +00:00
John WoodandGitHub
0a56dcc30e
* Use Go generate instead of a makefile * Meet the go generate specifications
96 lines
2.4 KiB
Go
96 lines
2.4 KiB
Go
package lib
|
|
|
|
import (
|
|
"crypto/x509"
|
|
"encoding/asn1"
|
|
"encoding/base64"
|
|
"time"
|
|
|
|
cttls "github.com/google/certificate-transparency-go/tls"
|
|
ctx509 "github.com/google/certificate-transparency-go/x509"
|
|
ctutil "github.com/google/certificate-transparency-go/x509util"
|
|
)
|
|
|
|
//go:generate go run github.com/square/certigo/internal/gen-known-logs --out ctlogs.go
|
|
//go:generate go fmt ctlogs.go
|
|
|
|
func parseSCTList(cert *x509.Certificate) []*simpleSCT {
|
|
// ctutil contains a fork of crypto/x509 with support for SCTs. We must re-parse the
|
|
// whole certificate to get at them, so do a quick check to see if the SCT extension
|
|
// is present before re-parsing the cert unnecessarily.
|
|
if !hasSCTs(cert) {
|
|
return nil
|
|
}
|
|
|
|
var sctList []*simpleSCT
|
|
if scts, err := ctutil.ParseSCTsFromCertificate(cert.Raw); err == nil {
|
|
for _, sct := range scts {
|
|
id := sct.LogID.KeyID[:]
|
|
ssct := &simpleSCT{
|
|
Version: uint64(sct.SCTVersion),
|
|
LogID: id,
|
|
Timestamp: time.UnixMilli(int64(sct.Timestamp)),
|
|
SignatureAlgorithm: sctSignatureAlg(sct.Signature.Algorithm),
|
|
}
|
|
if log := getLogByID(id); log != nil {
|
|
ssct.LogOperator = log.operator
|
|
ssct.LogURL = log.url
|
|
}
|
|
sctList = append(sctList, ssct)
|
|
}
|
|
}
|
|
return sctList
|
|
}
|
|
|
|
func hasSCTs(cert *x509.Certificate) bool {
|
|
for _, e := range cert.Extensions {
|
|
if e.Id.Equal(asn1.ObjectIdentifier(ctx509.OIDExtensionCTSCT)) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func getLogByID(id []byte) *ctLog {
|
|
b64 := base64.StdEncoding.EncodeToString(id)
|
|
return knownLogs[b64]
|
|
}
|
|
|
|
func sctSignatureAlg(alg cttls.SignatureAndHashAlgorithm) simpleSigAlg {
|
|
x509Alg := x509.UnknownSignatureAlgorithm
|
|
switch alg.Signature {
|
|
case cttls.RSA:
|
|
switch alg.Hash {
|
|
case cttls.MD5:
|
|
x509Alg = x509.MD5WithRSA
|
|
case cttls.SHA1:
|
|
x509Alg = x509.SHA1WithRSA
|
|
case cttls.SHA256:
|
|
x509Alg = x509.SHA256WithRSA
|
|
case cttls.SHA384:
|
|
x509Alg = x509.SHA384WithRSA
|
|
case cttls.SHA512:
|
|
x509Alg = x509.SHA512WithRSA
|
|
}
|
|
case cttls.DSA:
|
|
switch alg.Hash {
|
|
case cttls.SHA1:
|
|
x509Alg = x509.DSAWithSHA1
|
|
case cttls.SHA256:
|
|
x509Alg = x509.DSAWithSHA256
|
|
}
|
|
case cttls.ECDSA:
|
|
switch alg.Hash {
|
|
case cttls.SHA1:
|
|
x509Alg = x509.ECDSAWithSHA1
|
|
case cttls.SHA256:
|
|
x509Alg = x509.ECDSAWithSHA256
|
|
case cttls.SHA384:
|
|
x509Alg = x509.ECDSAWithSHA384
|
|
case cttls.SHA512:
|
|
x509Alg = x509.ECDSAWithSHA512
|
|
}
|
|
}
|
|
return simpleSigAlg(x509Alg)
|
|
}
|