Skip to content

Commit 1c630f2

Browse files
paepckehhpaepckehh
committed
disable some linter that fail for legacy DSA crypto (needed to anlyse old/broken certs here!)
1 parent e432b7e commit 1c630f2

File tree

6 files changed

+47
-22
lines changed

6 files changed

+47
-22
lines changed

‎Makefile‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,14 @@ PROJECT=$(shell basename $(CURDIR))
33
all:
44
make -C cmd/$(PROJECT) all
55

6-
clean:
7-
make -C cmd/$(PROJECT) clean
8-
9-
examples:
10-
make -C cmd/$(PROJECT) examples
11-
126
deps:
137
rm go.mod go.sum
148
go mod init paepcke.de/$(PROJECT)
159
go mod tidy -v
1610

1711
check:
18-
echo "expect some legacy crypto DSA support complains, need for analysis of bad certs/actors"
1912
gofmt -w -s .
20-
staticcheck
13+
# expect some legacy crypto DSA support complains, need for analysis of bad and old legacy certs
14+
# staticcheck
15+
# golangci-lint run
2116
make -C cmd/$(PROJECT) check

‎cmd/certinfo/Makefile‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,9 @@ all:
33

44
check:
55
gofmt -w -s .
6+
go vet .
67
staticcheck
7-
8-
clean:
8+
golangci-lint run
99

1010
examples:
11-
1211
go run main.go example.txt

‎cmd/certinfo/main.go‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package main
22

33
import (
44
"io"
5+
"log"
56
"os"
67
"syscall"
78

@@ -51,7 +52,7 @@ func main() {
5152
out(certinfo.Decode(readFile(os.Args[i]), report))
5253
}
5354
default:
54-
errExit("no pipe or input parameter found, example: certinfo file.txt")
55+
log.Fatal(_app + _err + "no pipe or input parameter found, example: certinfo file.txt")
5556
}
5657
}
5758

@@ -64,12 +65,6 @@ func out(msg string) {
6465
os.Stdout.Write([]byte(msg))
6566
}
6667

67-
// errExit
68-
func errExit(msg string) {
69-
out(_app + _err + msg + _linefeed)
70-
os.Exit(1)
71-
}
72-
7368
// isPipe ...
7469
func isPipe() bool {
7570
out, _ := os.Stdin.Stat()
@@ -80,7 +75,7 @@ func isPipe() bool {
8075
func getPipe() string {
8176
pipe, err := io.ReadAll(os.Stdin)
8277
if err != nil {
83-
errExit("reading data from pipe")
78+
log.Fatal(_app + _err + "reading data from pipe")
8479
}
8580
return string(pipe)
8681
}
@@ -102,7 +97,7 @@ func isEnv(in string) bool {
10297
func readFile(filename string) string {
10398
file, err := os.ReadFile(filename)
10499
if err != nil {
105-
errExit("unable to read file: " + err.Error())
100+
log.Fatal(_app + _err + "unable to read file: " + err.Error())
106101
}
107102
return string(file)
108103
}

‎generic.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ const (
4040
// GENERIC ASCII INPUT HANDLER
4141
//
4242

43+
// decodeBlock ...
4344
func decodeBlock(asciiBlock string, r *Report) string {
4445
var err error
4546
var eval string
@@ -62,6 +63,7 @@ func decodeBlock(asciiBlock string, r *Report) string {
6263
return "[certinfo] [unable to decode] [pem:failed] [ssh:failed]"
6364
}
6465

66+
// multipartDecodeParallel ...
6567
func multipartDecodeParallel(asciiBlock string, r *Report) string {
6668
var (
6769
bg sync.WaitGroup
@@ -93,6 +95,7 @@ func multipartDecodeParallel(asciiBlock string, r *Report) string {
9395
return s.String()
9496
}
9597

98+
// sanitizer ...
9699
func sanitizer(in string) (full, cut string, err error) {
97100
var s strings.Builder
98101
scanner := bufio.NewScanner(strings.NewReader(in))
@@ -122,6 +125,7 @@ func sanitizer(in string) (full, cut string, err error) {
122125
// GENERIC OUTPUT FORMAT HELPER
123126
//
124127

128+
// errString ...
125129
func errString(err error) string {
126130
var s strings.Builder
127131
s.WriteString(_app)
@@ -130,13 +134,15 @@ func errString(err error) string {
130134
return s.String()
131135
}
132136

137+
// short ...
133138
func short(in string) string {
134139
if len(in) > 80 {
135140
return in[:80]
136141
}
137142
return in
138143
}
139144

145+
// shortMsg ...
140146
func shortMsg(in string) string {
141147
var s strings.Builder
142148
s.WriteString(_openbracket)
@@ -150,6 +156,7 @@ func shortMsg(in string) string {
150156
return s.String()
151157
}
152158

159+
// shortMsgArray ...
153160
func shortMsgArray(in []string) string {
154161
if len(in) < 1 {
155162
return _empty
@@ -161,6 +168,7 @@ func shortMsgArray(in []string) string {
161168
return short(s.String())
162169
}
163170

171+
// shortMsgArrayIP ...
164172
func shortMsgArrayIP(in []net.IP) string {
165173
if len(in) < 1 {
166174
return _empty
@@ -172,6 +180,7 @@ func shortMsgArrayIP(in []net.IP) string {
172180
return short(s.String())
173181
}
174182

183+
// shortMsgArrayURL ...
175184
func shortMsgArrayURL(in []*url.URL) string {
176185
if len(in) > 0 {
177186
return _empty

‎ssh.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
package certinfo
22

33
import (
4-
//nolint:all yes, we must detect/analyze legecy
4+
//lint:ignore SA41019 we need to analyse old and broken certs as well
55
"crypto/dsa"
66
"crypto/ecdsa"
77
"crypto/ed25519"
@@ -12,6 +12,7 @@ import (
1212
"strconv"
1313
)
1414

15+
// parseRawPrivateKey ...
1516
func parseRawPrivateKey(in *pem.Block) string {
1617
if encryptedBlock(in) {
1718
return "Encrypted KEY [PEM BLOCK]"
@@ -31,6 +32,7 @@ func parseRawPrivateKey(in *pem.Block) string {
3132
return errString(errors.New("unsupported keytype"))
3233
}
3334

35+
// getKey ...
3436
func getKey(pub any) string {
3537
switch pub := pub.(type) {
3638
case *rsa.PublicKey:
@@ -49,8 +51,10 @@ func getKey(pub any) string {
4951
// SSH KEY ASCII REP
5052
//
5153

54+
// dbapo ...
5255
type dbapo struct{ Y, X int }
5356

57+
// getDBAA ...
5458
func getDBAA(in string) (out string) {
5559
const sep = "+-----------------+\n"
5660
var bp []string

‎x509.go‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
package certinfo
22

33
import (
4-
//nolint:all yes, we must detect/analyze legecy
4+
//lint:ignore SA41019 we need to analyse old and broken certs as well
55
"crypto/dsa"
66
"crypto/ecdsa"
77
"crypto/ed25519"
@@ -27,6 +27,7 @@ import (
2727
// INTERNAL LEGACY BACKEND
2828
//
2929

30+
// certSummary ...
3031
func certSummary(cert *x509.Certificate, e *reportstyle.Style) string {
3132
var s strings.Builder
3233
s.WriteString(e.L1 + "X509 Cert Subject " + e.L2 + shortMsg(cert.Subject.String()) + e.LE)
@@ -73,6 +74,7 @@ func certSummary(cert *x509.Certificate, e *reportstyle.Style) string {
7374
return s.String()
7475
}
7576

77+
// certOpenSSL ...
7678
func certOpenSSL(cert *x509.Certificate, e *reportstyle.Style) string {
7779
ossl := x509UT.CertificateToString(cert2CT(cert))
7880
if e.SaniFunc != nil {
@@ -85,23 +87,27 @@ func certOpenSSL(cert *x509.Certificate, e *reportstyle.Style) string {
8587
return s.String()
8688
}
8789

90+
// certPem ...
8891
func certPem(cert *x509.Certificate, e *reportstyle.Style) string {
8992
if e.SaniFunc != nil {
9093
return e.PS + e.SaniFunc(string(cert2pem(cert))) + e.PE
9194
}
9295
return string(cert2pem(cert))
9396
}
9497

98+
// cert2pem ...
9599
func cert2pem(cert *x509.Certificate) []byte {
96100
return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw})
97101
}
98102

103+
// cert2CT ...
99104
func cert2CT(cert *x509.Certificate) *x509CT.Certificate {
100105
pct, _ := pem.Decode(cert2pem(cert))
101106
crt, _ := x509CT.ParseCertificate(pct.Bytes)
102107
return crt
103108
}
104109

110+
// decodePemBlock ...
105111
func decodePemBlock(block *pem.Block, r *Report) string {
106112
defer func() {
107113
if err := recover(); err != nil {
@@ -138,6 +144,7 @@ func decodePemBlock(block *pem.Block, r *Report) string {
138144
return errString(errors.New("no decoder for pem type: " + block.Type))
139145
}
140146

147+
// sigAlgo ...
141148
func sigAlgo(in string, e *reportstyle.Style) string {
142149
switch in {
143150
case "MD2-RSA", "MD5-RSA", "SHA1-RSA", "DSA-SHA1", "ECDSA-SHA1", "DSA-SHA256":
@@ -150,6 +157,7 @@ func sigAlgo(in string, e *reportstyle.Style) string {
150157
return e.Fail + _unknown + shortMsg(in)
151158
}
152159

160+
// pubKey ...
153161
func pubKey(pub any, e *reportstyle.Style) string {
154162
switch pub := pub.(type) {
155163
case *rsa.PublicKey:
@@ -172,11 +180,13 @@ func pubKey(pub any, e *reportstyle.Style) string {
172180
return e.Fail + "[UNKNOWN]"
173181
}
174182

183+
// keyPin ...
175184
func keyPin(cert *x509.Certificate) []byte {
176185
digest := sha256.Sum256(cert.RawSubjectPublicKeyInfo)
177186
return digest[:]
178187
}
179188

189+
// isSelfSigned ...
180190
func isSelfSigned(cert *x509.Certificate, e *reportstyle.Style) (string, bool) {
181191
selfsigned, status := _no, false
182192
if cert.IsCA && cert.Issuer.String() == cert.Subject.String() {
@@ -188,6 +198,7 @@ func isSelfSigned(cert *x509.Certificate, e *reportstyle.Style) (string, bool) {
188198
return selfsigned, status
189199
}
190200

201+
// subCA ..
191202
func subCA(cert *x509.Certificate, e *reportstyle.Style) string {
192203
if cert.IsCA {
193204
if cert.MaxPathLen > 0 {
@@ -201,6 +212,7 @@ func subCA(cert *x509.Certificate, e *reportstyle.Style) string {
201212
return _no
202213
}
203214

215+
// isCA ...
204216
func isCA(cert *x509.Certificate, e *reportstyle.Style) string {
205217
state, alert := "", ""
206218
if cert.IsCA {
@@ -217,6 +229,7 @@ func isCA(cert *x509.Certificate, e *reportstyle.Style) string {
217229
return state + alert
218230
}
219231

232+
// signatureState ...
220233
func signatureState(cert *x509.Certificate, e *reportstyle.Style) string {
221234
_, err := cert.Verify(x509.VerifyOptions{})
222235
if err != nil {
@@ -225,6 +238,7 @@ func signatureState(cert *x509.Certificate, e *reportstyle.Style) string {
225238
return e.Valid + " [trusted via system trust store]"
226239
}
227240

241+
// validFor ...
228242
func validFor(cert *x509.Certificate, e *reportstyle.Style) string {
229243
// result, t := e.Fail, cert.NotAfter.Sub(time.Now())
230244
t := time.Until(cert.NotAfter)
@@ -252,10 +266,12 @@ func validFor(cert *x509.Certificate, e *reportstyle.Style) string {
252266
return result
253267
}
254268

269+
// encryptedBlock ...
255270
func encryptedBlock(block *pem.Block) bool {
256271
return strings.Contains(block.Headers["Proc-Type"], "ENCRYPTED")
257272
}
258273

274+
// certRequestSummary ...
259275
func certRequestSummary(csr *x509.CertificateRequest, e *reportstyle.Style) string {
260276
err := csr.CheckSignature()
261277
if err != nil {
@@ -264,6 +280,7 @@ func certRequestSummary(csr *x509.CertificateRequest, e *reportstyle.Style) stri
264280
return e.Valid
265281
}
266282

283+
// keyUsage ...
267284
func keyUsage(cert *x509.Certificate, e *reportstyle.Style) string {
268285
var s strings.Builder
269286
caAlert := false
@@ -285,6 +302,7 @@ func keyUsage(cert *x509.Certificate, e *reportstyle.Style) string {
285302
return s.String()
286303
}
287304

305+
// exgtendedKeyUsage ...
288306
func extendedKeyUsage(cert *x509.Certificate, e *reportstyle.Style) string {
289307
var s strings.Builder
290308
count, critical := oidInExtensions(oidExtensionExtendedKeyUsage, cert.Extensions)
@@ -303,6 +321,7 @@ func extendedKeyUsage(cert *x509.Certificate, e *reportstyle.Style) string {
303321
return s.String()
304322
}
305323

324+
// sct ...
306325
func sct(cert *x509.Certificate, _ *reportstyle.Style) string {
307326
var s strings.Builder
308327
count, critical := oidInExtensions(oidExtensionCTPoison, cert.Extensions)
@@ -354,6 +373,7 @@ var (
354373
oidExtensionCTSCT = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 11129, 2, 4, 2}
355374
)
356375

376+
// oidInExtensions ...
357377
func oidInExtensions(oid asn1.ObjectIdentifier, extensions []pkix.Extension) (int, bool) {
358378
count := 0
359379
critical := false
@@ -368,6 +388,7 @@ func oidInExtensions(oid asn1.ObjectIdentifier, extensions []pkix.Extension) (in
368388
return count, critical
369389
}
370390

391+
// keyUsageToString ...
371392
func keyUsageToString(k x509.KeyUsage) (string, bool) {
372393
var s strings.Builder
373394
caAlert := false
@@ -402,6 +423,7 @@ func keyUsageToString(k x509.KeyUsage) (string, bool) {
402423
return s.String(), caAlert
403424
}
404425

426+
// extKeyUsageToString ...
405427
func extKeyUsageToString(u x509.ExtKeyUsage, e *reportstyle.Style) string {
406428
var s strings.Builder
407429
switch u {
@@ -442,6 +464,7 @@ func extKeyUsageToString(u x509.ExtKeyUsage, e *reportstyle.Style) string {
442464
return s.String()
443465
}
444466

467+
// isCurveValid ...
445468
func isCurveValid(curve elliptic.Curve) (string, bool) {
446469
switch curve {
447470
case elliptic.P256():

0 commit comments

Comments
 (0)