From d42c1fa1c529ea0ee78eb2022b60d3f30eaada35 Mon Sep 17 00:00:00 2001 From: Kyle Isom Date: Fri, 20 Oct 2017 12:18:41 -0700 Subject: [PATCH] Add subjhash tool. Minor cleanups. --- cmd/ski/main.go | 4 ++ cmd/subjhash/main.go | 108 +++++++++++++++++++++++++++++++++ lib/lib.go | 80 +++++++++++++++++++++++++ lib/lib_test.go | 139 +++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 331 insertions(+) create mode 100644 cmd/subjhash/main.go create mode 100644 lib/lib_test.go diff --git a/cmd/ski/main.go b/cmd/ski/main.go index 3e794bf..ee7644a 100644 --- a/cmd/ski/main.go +++ b/cmd/ski/main.go @@ -49,6 +49,10 @@ func parse(path string) (public []byte, kt, ft string) { lib.Warnx("trailing data in PEM file") } + if p == nil { + die.With("no PEM data found") + } + data = p.Bytes switch p.Type { diff --git a/cmd/subjhash/main.go b/cmd/subjhash/main.go new file mode 100644 index 0000000..17d2700 --- /dev/null +++ b/cmd/subjhash/main.go @@ -0,0 +1,108 @@ +package main + +import ( + "bytes" + "crypto/sha256" + "crypto/x509" + "flag" + "fmt" + "io" + "os" + + "github.com/kisom/goutils/die" + "github.com/kisom/goutils/lib" +) + +func usage(w io.Writer) { + fmt.Fprintf(w, `Print hash of subject or issuer fields in certificates. + +Usage: subjhash [-im] certs... + +Flags: + -i Print hash of issuer field. + -m Matching mode. This expects arguments to be in the form of + pairs of certificates (e.g. previous, new) whose subjects + will be compared. For example, + + subjhash -m ca1.pem ca1-renewed.pem \ + ca2.pem ca2-renewed.pem + + will exit with a non-zero status if the subject in the + ca1-renewed.pem certificate doesn't match the subject in the + ca.pem certificate; similarly for ca2. +`) +} + +// NB: the Issuer field is *also* a subject field. Also, the returned +// hash is *not* hex encoded. +func getSubjectInfoHash(cert *x509.Certificate, issuer bool) []byte { + if cert == nil { + return nil + } + + var subject []byte + if issuer { + subject = cert.RawIssuer + } else { + subject = cert.RawSubject + } + + digest := sha256.Sum256(subject) + return digest[:] +} + +func printDigests(paths []string, issuer bool) { + for _, path := range paths { + cert, err := lib.LoadCertificate(path) + if err != nil { + lib.Warn(err, "failed to load certificate from %s", path) + continue + } + + digest := getSubjectInfoHash(cert, issuer) + fmt.Printf("%x %s\n", digest, path) + } +} + +func matchDigests(paths []string, issuer bool) { + if (len(paths) % 2) != 0 { + lib.Errx(lib.ExitFailure, "not all certificates are paired") + } + + var invalid int + for { + if len(paths) == 0 { + break + } + fst := paths[0] + snd := paths[1] + paths = paths[2:] + + fstCert, err := lib.LoadCertificate(fst) + die.If(err) + sndCert, err := lib.LoadCertificate(snd) + die.If(err) + if !bytes.Equal(getSubjectInfoHash(fstCert, issuer), getSubjectInfoHash(sndCert, issuer)) { + lib.Warnx("certificates don't match: %s and %s", fst, snd) + invalid++ + } + } + + if invalid > 0 { + os.Exit(1) + } +} + +func main() { + var issuer, match bool + flag.BoolVar(&issuer, "i", false, "print the issuer") + flag.BoolVar(&match, "m", false, "match mode") + flag.Parse() + + paths := flag.Args() + if match { + matchDigests(paths, issuer) + } else { + printDigests(paths, issuer) + } +} diff --git a/lib/lib.go b/lib/lib.go index 74eaa46..ef618b9 100644 --- a/lib/lib.go +++ b/lib/lib.go @@ -2,7 +2,11 @@ package lib import ( + "crypto/x509" + "encoding/pem" + "errors" "fmt" + "io/ioutil" "os" "path/filepath" "time" @@ -79,6 +83,7 @@ var ( yearDuration = (365 * dayDuration) + (6 * time.Hour) ) +// Duration returns a prettier string for time.Durations. func Duration(d time.Duration) string { var s string if d >= yearDuration { @@ -102,3 +107,78 @@ func Duration(d time.Duration) string { s += fmt.Sprintf("%dh%s", hours, d) return s } + +// ReadCertificate reads a DER or PEM-encoded certificate from the +// byte slice. +func ReadCertificate(in []byte) (cert *x509.Certificate, rest []byte, err error) { + if len(in) == 0 { + err = errors.New("lib: empty certificate") + return + } + + if in[0] == '-' { + p, remaining := pem.Decode(in) + if p == nil { + err = errors.New("lib: invalid PEM file") + return + } + + rest = remaining + if p.Type != "CERTIFICATE" { + err = fmt.Errorf("lib: expected a CERTIFICATE PEM file, but have %s", p.Type) + return + } + + in = p.Bytes + } + + cert, err = x509.ParseCertificate(in) + return +} + +// ReadCertificates tries to read all the certificates in a +// PEM-encoded collection. +func ReadCertificates(in []byte) (certs []*x509.Certificate, err error) { + var cert *x509.Certificate + for { + cert, in, err = ReadCertificate(in) + if err != nil { + break + } + + if cert == nil { + break + } + + certs = append(certs, cert) + if len(in) == 0 { + break + } + } + + return certs, err +} + +// LoadCertificate tries to read a single certificate from disk. If +// the file contains multiple certificates (e.g. a chain), only the +// first certificate is returned. +func LoadCertificate(path string) (*x509.Certificate, error) { + in, err := ioutil.ReadFile(path) + if err != nil { + return nil, err + } + + cert, _, err := ReadCertificate(in) + return cert, err +} + +// LoadCertificates tries to read all the certificates in a file, +// returning them in the order that it found them in the file. +func LoadCertificates(path string) ([]*x509.Certificate, error) { + in, err := ioutil.ReadFile(path) + if err != nil { + return nil, err + } + + return ReadCertificates(in) +} diff --git a/lib/lib_test.go b/lib/lib_test.go new file mode 100644 index 0000000..d522f10 --- /dev/null +++ b/lib/lib_test.go @@ -0,0 +1,139 @@ +package lib + +import ( + "fmt" + "testing" + + "github.com/kisom/goutils/assert" +) + +// some CA certs I found on my computerbox. +var testCerts = `-----BEGIN CERTIFICATE----- +MIIH0zCCBbugAwIBAgIIXsO3pkN/pOAwDQYJKoZIhvcNAQEFBQAwQjESMBAGA1UE +AwwJQUNDVlJBSVoxMRAwDgYDVQQLDAdQS0lBQ0NWMQ0wCwYDVQQKDARBQ0NWMQsw +CQYDVQQGEwJFUzAeFw0xMTA1MDUwOTM3MzdaFw0zMDEyMzEwOTM3MzdaMEIxEjAQ +BgNVBAMMCUFDQ1ZSQUlaMTEQMA4GA1UECwwHUEtJQUNDVjENMAsGA1UECgwEQUND +VjELMAkGA1UEBhMCRVMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCb +qau/YUqXry+XZpp0X9DZlv3P4uRm7x8fRzPCRKPfmt4ftVTdFXxpNRFvu8gMjmoY +HtiP2Ra8EEg2XPBjs5BaXCQ316PWywlxufEBcoSwfdtNgM3802/J+Nq2DoLSRYWo +G2ioPej0RGy9ocLLA76MPhMAhN9KSMDjIgro6TenGEyxCQ0jVn8ETdkXhBilyNpA +lHPrzg5XPAOBOp0KoVdDaaxXbXmQeOW1tDvYvEyNKKGno6e6Ak4l0Squ7a4DIrhr +IA8wKFSVf+DuzgpmndFALW4ir50awQUZ0m/A8p/4e7MCQvtQqR0tkw8jq8bBD5L/ +0KIV9VMJcRz/RROE5iZe+OCIHAr8Fraocwa48GOEAqDGWuzndN9wrqODJerWx5eH +k6fGioozl2A3ED6XPm4pFdahD9GILBKfb6qkxkLrQaLjlUPTAYVtjrs78yM2x/47 +4KElB0iryYl0/wiPgL/AlmXz7uxLaL2diMMxs0Dx6M/2OLuc5NF/1OVYm3z61PMO +m3WR5LpSLhl+0fXNWhn8ugb2+1KoS5kE3fj5tItQo05iifCHJPqDQsGH+tUtKSpa +cXpkatcnYGMN285J9Y0fkIkyF/hzQ7jSWpOGYdbhdQrqeWZ2iE9x6wQl1gpaepPl +uUsXQA+xtrn13k/c4LOsOxFwYIRKQ26ZIMApcQrAZQIDAQABo4ICyzCCAscwfQYI +KwYBBQUHAQEEcTBvMEwGCCsGAQUFBzAChkBodHRwOi8vd3d3LmFjY3YuZXMvZmls +ZWFkbWluL0FyY2hpdm9zL2NlcnRpZmljYWRvcy9yYWl6YWNjdjEuY3J0MB8GCCsG +AQUFBzABhhNodHRwOi8vb2NzcC5hY2N2LmVzMB0GA1UdDgQWBBTSh7Tj3zcnk1X2 +VuqB5TbMjB4/vTAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNKHtOPfNyeT +VfZW6oHlNsyMHj+9MIIBcwYDVR0gBIIBajCCAWYwggFiBgRVHSAAMIIBWDCCASIG +CCsGAQUFBwICMIIBFB6CARAAQQB1AHQAbwByAGkAZABhAGQAIABkAGUAIABDAGUA +cgB0AGkAZgBpAGMAYQBjAGkA8wBuACAAUgBhAO0AegAgAGQAZQAgAGwAYQAgAEEA +QwBDAFYAIAAoAEEAZwBlAG4AYwBpAGEAIABkAGUAIABUAGUAYwBuAG8AbABvAGcA +7QBhACAAeQAgAEMAZQByAHQAaQBmAGkAYwBhAGMAaQDzAG4AIABFAGwAZQBjAHQA +cgDzAG4AaQBjAGEALAAgAEMASQBGACAAUQA0ADYAMAAxADEANQA2AEUAKQAuACAA +QwBQAFMAIABlAG4AIABoAHQAdABwADoALwAvAHcAdwB3AC4AYQBjAGMAdgAuAGUA +czAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu +aHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt +aW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud +DwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXMwDQYJKoZIhvcNAQEF +BQADggIBAJcxAp/n/UNnSEQU5CmH7UwoZtCPNdpNYbdKl02125DgBS4OxnnQ8pdp +D70ER9m+27Up2pvZrqmZ1dM8MJP1jaGo/AaNRPTKFpV8M9xii6g3+CfYCS0b78gU +JyCpZET/LtZ1qmxNYEAZSUNUY9rizLpm5U9EelvZaoErQNV/+QEnWCzI7UiRfD+m +AM/EKXMRNt6GGT6d7hmKG9Ww7Y49nCrADdg9ZuM8Db3VlFzi4qc1GwQA9j9ajepD +vV+JHanBsMyZ4k0ACtrJJ1vnE5Bc5PUzolVt3OAJTS+xJlsndQAJxGJ3KQhfnlms +tn6tn1QwIgPBHnFk/vk4CpYY3QIUrCPLBhwepH2NDd4nQeit2hW3sCPdK6jT2iWH +7ehVRE2I9DZ+hJp4rPcOVkkO1jMl1oRQQmwgEh0q1b688nCBpHBgvgW1m54ERL5h +I6zppSSMEYCUWqKiuUnSwdzRp+0xESyeGabu4VXhwOrPDYTkF7eifKXeVSUG7szA +h1xA2syVP1XgNce4hL60Xc16gwFy7ofmXx2utYXGJt/mwZrpHgJHnyqobalbz+xF +d3+YJ5oyXSrjhO7FmGYvliAd3djDJ9ew+f7Zfc3Qn48LFFhRny+Lwzgt3uiP1o2H +pPVWQxaZLPSkVrQ0uGE3ycJYgBugl6H8WY3pEfbRD0tVNEYqi4Y7 +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFtTCCA52gAwIBAgIIYY3HhjsBggUwDQYJKoZIhvcNAQEFBQAwRDEWMBQGA1UE +AwwNQUNFRElDT00gUm9vdDEMMAoGA1UECwwDUEtJMQ8wDQYDVQQKDAZFRElDT00x +CzAJBgNVBAYTAkVTMB4XDTA4MDQxODE2MjQyMloXDTI4MDQxMzE2MjQyMlowRDEW +MBQGA1UEAwwNQUNFRElDT00gUm9vdDEMMAoGA1UECwwDUEtJMQ8wDQYDVQQKDAZF +RElDT00xCzAJBgNVBAYTAkVTMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC +AgEA/5KV4WgGdrQsyFhIyv2AVClVYyT/kGWbEHV7w2rbYgIB8hiGtXxaOLHkWLn7 +09gtn70yN78sFW2+tfQh0hOR2QetAQXW8713zl9CgQr5auODAKgrLlUTY4HKRxx7 +XBZXehuDYAQ6PmXDzQHe3qTWDLqO3tkE7hdWIpuPY/1NFgu3e3eM+SW10W2ZEi5P +Grjm6gSSrj0RuVFCPYewMYWveVqc/udOXpJPQ/yrOq2lEiZmueIM15jO1FillUAK +t0SdE3QrwqXrIhWYENiLxQSfHY9g5QYbm8+5eaA9oiM/Qj9r+hwDezCNzmzAv+Yb +X79nuIQZ1RXve8uQNjFiybwCq0Zfm/4aaJQ0PZCOrfbkHQl/Sog4P75n/TSW9R28 +MHTLOO7VbKvU/PQAtwBbhTIWdjPp2KOZnQUAqhbm84F9b32qhm2tFXTTxKJxqvQU +fecyuB+81fFOvW8XAjnXDpVCOscAPukmYxHqC9FK/xidstd7LzrZlvvoHpKuE1XI +2Sf23EgbsCTBheN3nZqk8wwRHQ3ItBTutYJXCb8gWH8vIiPYcMt5bMlL8qkqyPyH +K9caUPgn6C9D4zq92Fdx/c6mUlv53U3t5fZvie27k5x2IXXwkkwp9y+cAS7+UEae +ZAwUswdbxcJzbPEHXEUkFDWug/FqTYl6+rPYLWbwNof1K1MCAwEAAaOBqjCBpzAP +BgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFKaz4SsrSbbXc6GqlPUB53NlTKxQ +MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUprPhKytJttdzoaqU9QHnc2VMrFAw +RAYDVR0gBD0wOzA5BgRVHSAAMDEwLwYIKwYBBQUHAgEWI2h0dHA6Ly9hY2VkaWNv +bS5lZGljb21ncm91cC5jb20vZG9jMA0GCSqGSIb3DQEBBQUAA4ICAQDOLAtSUWIm +fQwng4/F9tqgaHtPkl7qpHMyEVNEskTLnewPeUKzEKbHDZ3Ltvo/Onzqv4hTGzz3 +gvoFNTPhNahXwOf9jU8/kzJPeGYDdwdY6ZXIfj7QeQCM8htRM5u8lOk6e25SLTKe +I6RF+7YuE7CLGLHdztUdp0J/Vb77W7tH1PwkzQSulgUV1qzOMPPKC8W64iLgpq0i +5ALudBF/TP94HTXa5gI06xgSYXcGCRZj6hitoocf8seACQl1ThCojz2GuHURwCRi +ipZ7SkXp7FnFvmuD5uHorLUwHv4FB4D54SMNUI8FmP8sX+g7tq3PgbUhh8oIKiMn +MCArz+2UW6yyetLHKKGKC5tNSixthT8Jcjxn4tncB7rrZXtaAWPWkFtPF2Y9fwsZ +o5NjEFIqnxQWWOLcpfShFosOkYuByptZ+thrkQdlVV9SH686+5DdaaVbnG0OLLb6 +zqylfDJKZ0DcMDQj3dcEI2bw/FWAp/tmGYI1Z2JwOV5vx+qQQEQIHriy1tvuWacN +GHk0vFQYXlPKNFHtRQrmjseCNj6nOGOpMCwXEGCSn1WHElkQwg9naRHMTh5+Spqt +r0CodaxWkHS4oJyleW/c6RrIaQXpuvoDs3zk4E7Czp3otkYNbn5XOmeUwssfnHdK +Z05phkOTOPu220+DkdRgfks+KzgHVZhepA== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFuzCCA6OgAwIBAgIIVwoRl0LE48wwDQYJKoZIhvcNAQELBQAwazELMAkGA1UE +BhMCSVQxDjAMBgNVBAcMBU1pbGFuMSMwIQYDVQQKDBpBY3RhbGlzIFMucC5BLi8w +MzM1ODUyMDk2NzEnMCUGA1UEAwweQWN0YWxpcyBBdXRoZW50aWNhdGlvbiBSb290 +IENBMB4XDTExMDkyMjExMjIwMloXDTMwMDkyMjExMjIwMlowazELMAkGA1UEBhMC +SVQxDjAMBgNVBAcMBU1pbGFuMSMwIQYDVQQKDBpBY3RhbGlzIFMucC5BLi8wMzM1 +ODUyMDk2NzEnMCUGA1UEAwweQWN0YWxpcyBBdXRoZW50aWNhdGlvbiBSb290IENB +MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAp8bEpSmkLO/lGMWwUKNv +UTufClrJwkg4CsIcoBh/kbWHuUA/3R1oHwiD1S0eiKD4j1aPbZkCkpAW1V8IbInX +4ay8IMKx4INRimlNAJZaby/ARH6jDuSRzVju3PvHHkVH3Se5CAGfpiEd9UEtL0z9 +KK3giq0itFZljoZUj5NDKd45RnijMCO6zfB9E1fAXdKDa0hMxKufgFpbOr3JpyI/ +gCczWw63igxdBzcIy2zSekciRDXFzMwujt0q7bd9Zg1fYVEiVRvjRuPjPdA1Yprb +rxTIW6HMiRvhMCb8oJsfgadHHwTrozmSBp+Z07/T6k9QnBn+locePGX2oxgkg4YQ +51Q+qDp2JE+BIcXjDwL4k5RHILv+1A7TaLndxHqEguNTVHnd25zS8gebLra8Pu2F +be8lEfKXGkJh90qX6IuxEAf6ZYGyojnP9zz/GPvG8VqLWeICrHuS0E4UT1lF9gxe +KF+w6D9Fz8+vm2/7hNN3WpVvrJSEnu68wEqPSpP4RCHiMUVhUE4Q2OM1fEwZtN4F +v6MGn8i1zeQf1xcGDXqVdFUNaBr8EBtiZJ1t4JWgw5QHVw0U5r0F+7if5t+L4sbn +fpb2U8WANFAoWPASUHEXMLrmeGO89LKtmyuy/uE5jF66CyCU3nuDuP/jVo23Eek7 +jPKxwV2dpAtMK9myGPW1n0sCAwEAAaNjMGEwHQYDVR0OBBYEFFLYiDrIn3hm7Ynz +ezhwlMkCAjbQMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUUtiIOsifeGbt +ifN7OHCUyQICNtAwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4ICAQAL +e3KHwGCmSUyIWOYdiPcUZEim2FgKDk8TNd81HdTtBjHIgT5q1d07GjLukD0R0i70 +jsNjLiNmsGe+b7bAEzlgqqI0JZN1Ut6nna0Oh4lScWoWPBkdg/iaKWW+9D+a2fDz +WochcYBNy+A4mz+7+uAwTc+G02UQGRjRlwKxK3JCaKygvU5a2hi/a5iB0P2avl4V +SM0RFbnAKVy06Ij3Pjaut2L9HmLecHgQHEhb2rykOLpn7VU+Xlff1ANATIGk0k9j +pwlCCRT8AKnCgHNPLsBA2RF7SOp6AsDT6ygBJlh0wcBzIm2Tlf05fbsq4/aC4yyX +X04fkZT6/iyj2HYauE2yOE+b+h1IYHkm4vP9qdCa6HCPSXrW5b0KDtst842/6+Ok +fcvHlXHo2qN8xcL4dJIEG4aspCJTQLas/kx2z/uUMsA1n3Y/buWQbqCmJqK4LL7R +K4X9p2jIugErsWx0Hbhzlefut8cl8ABMALJ+tguLHPPAUJ4lueAI3jZm/zel0btU +ZCzJJ7VLkn5l/9Mt4blOvH+kQSGQQXemOR/qnuOf0GZvBeyqdn6/axag67XH/JJU +LysRJyU3eExRarDzzFhdFPFqSBX/wge2sY0PjlxQRrM9vwGYT7JZVEc+NHt4bVaT +LnPqZih4zR0Uv6CPLy64Lo7yFIrM6bV8+2ydDKXhlg== +-----END CERTIFICATE----- +` + +func TestReadCertificate(t *testing.T) { + cert, remaining, err := ReadCertificate([]byte(testCerts)) + assert.NoErrorT(t, err) + + assert.BoolT(t, len(remaining) > 0, "lib: expected extra data from ReadCertificate") + assert.BoolT(t, cert != nil, "lib: expected an actual certificate to have been returned") +} + +func TestReadCertificates(t *testing.T) { + certs, err := ReadCertificates([]byte(testCerts)) + assert.NoErrorT(t, err) + + assert.BoolT(t, len(certs) == 3, fmt.Sprintf("lib: expected three certificates, have %d", len(certs))) + for _, cert := range certs { + assert.BoolT(t, cert != nil, "lib: expected an actual certificate to have been returned") + } +}