From 0b9ce0c5e42e7818febddb7bd8c6b0cb7c07b012 Mon Sep 17 00:00:00 2001
From: Rasmus Dahlberg <rasmus.dahlberg@kau.se>
Date: Thu, 5 Nov 2020 12:31:34 +0100
Subject: moved publlic x509 helpers into a separate package

---
 x509.go | 130 ++--------------------------------------------------------------
 1 file changed, 3 insertions(+), 127 deletions(-)

(limited to 'x509.go')

diff --git a/x509.go b/x509.go
index 7f74e93..c65043b 100644
--- a/x509.go
+++ b/x509.go
@@ -5,139 +5,15 @@ import (
 	"time"
 
 	"crypto"
-	"crypto/ed25519"
 	"crypto/rand"
 	"crypto/tls"
 	"crypto/x509"
-	"encoding/pem"
-	"io/ioutil"
-)
-
-// LoadTrustAnchors loads a list of PEM-encoded certificates from file
-func LoadTrustAnchors(path string) ([]*x509.Certificate, *x509.CertPool, error) {
-	rest, err := ioutil.ReadFile(path)
-	if err != nil {
-		return nil, nil, fmt.Errorf("failed reading trust anchors: %v", err)
-	}
-
-	pool := x509.NewCertPool()
-	var anchors []*x509.Certificate
-	for len(rest) > 0 {
-		var block *pem.Block
-		block, rest = pem.Decode(rest)
-		if block == nil {
-			break
-		}
-		if block.Type != "CERTIFICATE" {
-			return nil, nil, fmt.Errorf("unexpected PEM block type: %s", block.Type)
-		}
-
-		certificate, err := x509.ParseCertificate(block.Bytes)
-		if err != nil {
-			return nil, nil, fmt.Errorf("invalid trust anchor before rest(%s): %v", rest, err)
-		}
 
-		anchors = append(anchors, certificate)
-		pool.AddCert(certificate)
-	}
-
-	if len(anchors) == 0 {
-		return nil, nil, fmt.Errorf("found no valid trust anchor in: %s", path)
-	}
-	return anchors, pool, nil
-}
-
-// LoadEd25519SigningKey loads an Ed25519 private key from a given path
-func LoadEd25519SigningKey(path string) (ed25519.PrivateKey, error) {
-	data, err := ioutil.ReadFile(path)
-	if err != nil {
-		return nil, fmt.Errorf("failed reading private key: %v", err)
-	}
-	return ParseEd25519PrivateKey(data)
-}
-
-// ParseEd25519PrivateKey parses a PEM-encoded private key block
-func ParseEd25519PrivateKey(data []byte) (ed25519.PrivateKey, error) {
-	block, rest := pem.Decode(data)
-	if block == nil {
-		return nil, fmt.Errorf("pem block: is empty")
-	}
-	if block.Type != "PRIVATE KEY" {
-		return nil, fmt.Errorf("bad pem block type: %v", block.Type)
-	}
-	if len(rest) != 0 {
-		return nil, fmt.Errorf("pem block: trailing data")
-	}
-
-	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
-	if err != nil {
-		fmt.Errorf("x509 parser failed: %v", err)
-	}
-	switch t := key.(type) {
-	case ed25519.PrivateKey:
-		return key.(ed25519.PrivateKey), nil
-	default:
-		return nil, fmt.Errorf("unexpected signing key type: %v", t)
-	}
-}
-
-// LoadChain loads a PEM-encoded certificate chain from a given path
-func LoadChain(path string) ([]*x509.Certificate, error) {
-	blob, err := ioutil.ReadFile(path)
-	if err != nil {
-		return nil, fmt.Errorf("failed reading certificate chain: %v", err)
-	}
-	return ParseChain(blob)
-}
-
-// ParseChain parses a PEM-encoded certificate chain
-func ParseChain(rest []byte) ([]*x509.Certificate, error) {
-	var chain []*x509.Certificate
-	for len(rest) > 0 {
-		var block *pem.Block
-		block, rest = pem.Decode(rest)
-		if block == nil {
-			break
-		}
-		if block.Type != "CERTIFICATE" {
-			return nil, fmt.Errorf("unexpected pem block type: %v", block.Type)
-		}
-
-		certificate, err := x509.ParseCertificate(block.Bytes)
-		if err != nil {
-			return nil, fmt.Errorf("failed parsing x509 certificate: %v", err)
-		}
-		chain = append(chain, certificate)
-	}
-	return chain, nil
-}
-
-// ParseDerChain parses a list of base64 DER-encoded X.509 certificates, such
-// that the first (zero-index) string is interpretted as an end-entity
-// certificate and the remaining ones as the an intermediate CertPool.
-func ParseDerChain(chain [][]byte) (*x509.Certificate, *x509.CertPool, error) {
-	var certificate *x509.Certificate
-	intermediatePool := x509.NewCertPool()
-	for index, der := range chain {
-		c, err := x509.ParseCertificate(der)
-		if err != nil {
-			return nil, nil, fmt.Errorf("certificate decoding failed: %v", err)
-		}
-
-		if index == 0 {
-			certificate = c
-		} else {
-			intermediatePool.AddCert(c)
-		}
-	}
-	if certificate == nil {
-		return nil, nil, fmt.Errorf("certificate chain is empty")
-	}
-	return certificate, intermediatePool, nil
-}
+	"github.com/system-transparency/stfe/x509util"
+)
 
 func (lp *LogParameters) buildChainFromDerList(derChain [][]byte) ([]*x509.Certificate, error) {
-	certificate, intermediatePool, err := ParseDerChain(derChain)
+	certificate, intermediatePool, err := x509util.ParseDerChain(derChain)
 	if err != nil {
 		return nil, err
 	}
-- 
cgit v1.2.3