1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
package stfe
import (
"fmt"
"crypto/ecdsa"
"crypto/rsa"
"crypto/x509"
"encoding/pem"
"io/ioutil"
)
// LoadTrustAnchors loads a list of PEM-encoded certificates from file
func LoadTrustAnchors(path string) ([]*x509.Certificate, *x509.CertPool, error) {
rest, err := ioutil.ReadFile(path)
if err != nil {
return nil, nil, fmt.Errorf("failed reading trust anchors: %v", err)
}
pool := x509.NewCertPool()
var anchors []*x509.Certificate
for len(rest) > 0 {
var block *pem.Block
block, rest = pem.Decode(rest)
if block == nil {
break
}
if block.Type != "CERTIFICATE" {
return nil, nil, fmt.Errorf("unexpected PEM block type: %s", block.Type)
}
certificate, err := x509.ParseCertificate(block.Bytes)
if err != nil {
return nil, nil, fmt.Errorf("invalid trust anchor before rest(%s): %v", rest, err)
}
anchors = append(anchors, certificate)
pool.AddCert(certificate)
}
if len(anchors) == 0 {
return nil, nil, fmt.Errorf("found no valid trust anchor in: %s", path)
}
return anchors, pool, nil
}
func VerifyChain(ld *LogParameters, certificate *x509.Certificate) ([]*x509.Certificate, error) {
opts := x509.VerifyOptions{
Roots: ld.AnchorPool,
KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageAny}, // TODO: move to ld
} // TODO: add intermediates
chains, err := certificate.Verify(opts)
if err != nil {
return nil, fmt.Errorf("chain verification failed: %v", err)
}
if len(chains) == 0 {
return nil, fmt.Errorf("chain verification failed: no chain")
}
return chains[0], nil // if we found multiple paths just pick the first one
}
func VerifySignature(leaf, signature []byte, certificate *x509.Certificate) error {
var algo x509.SignatureAlgorithm
switch t := certificate.PublicKey.(type) {
case *rsa.PublicKey:
algo = x509.SHA256WithRSA
case *ecdsa.PublicKey:
algo = x509.ECDSAWithSHA256
default:
return fmt.Errorf("unsupported public key algorithm: %v", t)
}
if err := certificate.CheckSignature(algo, leaf, signature); err != nil {
return fmt.Errorf("invalid signature: %v", err)
}
return nil
}
|
