Delete identifiers.go
This commit is contained in:
removedporn
GitHub
parent
54f34077d3
commit
407d069c87
316
identifiers.go
316
identifiers.go
|
|
@ -1,316 +0,0 @@
|
|||
// Copyright (C) 2016 Opsmate, Inc.
|
||||
//
|
||||
// This Source Code Form is subject to the terms of the Mozilla
|
||||
// Public License, v. 2.0. If a copy of the MPL was not distributed
|
||||
// with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
//
|
||||
// This software is distributed WITHOUT A WARRANTY OF ANY KIND.
|
||||
// See the Mozilla Public License for details.
|
||||
|
||||
package certspotter
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"golang.org/x/net/idna"
|
||||
"net"
|
||||
"strings"
|
||||
"unicode/utf8"
|
||||
)
|
||||
|
||||
const UnparsableDNSLabelPlaceholder = "<unparsable>"
|
||||
|
||||
/*
|
||||
const (
|
||||
IdentifierSourceSubjectCN = iota
|
||||
IdentifierSourceDNSName
|
||||
IdentifierSourceIPAddr
|
||||
)
|
||||
type IdentifierSource int
|
||||
|
||||
type UnknownIdentifier struct {
|
||||
Source IdentifierSource
|
||||
Value []byte
|
||||
}
|
||||
*/
|
||||
|
||||
type Identifiers struct {
|
||||
DNSNames []string // stored as ASCII, with IDNs in Punycode
|
||||
IPAddrs []net.IP
|
||||
//Unknowns []UnknownIdentifier
|
||||
}
|
||||
|
||||
func NewIdentifiers() *Identifiers {
|
||||
return &Identifiers{
|
||||
DNSNames: []string{},
|
||||
IPAddrs: []net.IP{},
|
||||
//Unknowns: []UnknownIdentifier{},
|
||||
}
|
||||
}
|
||||
|
||||
func parseIPAddrString(str string) net.IP {
|
||||
return net.ParseIP(str)
|
||||
}
|
||||
|
||||
func isASCIIString(value []byte) bool {
|
||||
for _, b := range value {
|
||||
if b > 127 {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
func isUTF8String(value []byte) bool {
|
||||
return utf8.Valid(value)
|
||||
}
|
||||
func latin1ToUTF8(value []byte) string {
|
||||
runes := make([]rune, len(value))
|
||||
for i, b := range value {
|
||||
runes[i] = rune(b)
|
||||
}
|
||||
return string(runes)
|
||||
}
|
||||
|
||||
// Make sure the DNS label doesn't have any weird characters that
|
||||
// could cause trouble during later processing.
|
||||
func isSaneDNSLabelChar(ch rune) bool {
|
||||
return ch == '\t' || (ch >= 32 && ch <= 126)
|
||||
}
|
||||
func isSaneDNSLabel(label string) bool {
|
||||
for _, ch := range label {
|
||||
if !isSaneDNSLabelChar(ch) {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
func trimHttpPrefixString(value string) string {
|
||||
if strings.HasPrefix(value, "http://") {
|
||||
return value[7:]
|
||||
} else if strings.HasPrefix(value, "https://") {
|
||||
return value[8:]
|
||||
} else {
|
||||
return value
|
||||
}
|
||||
}
|
||||
|
||||
func trimHttpPrefixBytes(value []byte) []byte {
|
||||
if bytes.HasPrefix(value, []byte("http://")) {
|
||||
return value[7:]
|
||||
} else if bytes.HasPrefix(value, []byte("https://")) {
|
||||
return value[8:]
|
||||
} else {
|
||||
return value
|
||||
}
|
||||
}
|
||||
|
||||
func trimTrailingDots(value string) string {
|
||||
length := len(value)
|
||||
for length > 0 && value[length-1] == '.' {
|
||||
length--
|
||||
}
|
||||
return value[0:length]
|
||||
}
|
||||
|
||||
// Try to canonicalize/sanitize the DNS name:
|
||||
// 1. Trim leading and trailing whitespace
|
||||
// 2. Trim trailing dots
|
||||
// 3. Convert to lower case
|
||||
// 4. Replace totally nonsensical labels (e.g. having non-printable characters) with a placeholder
|
||||
func sanitizeDNSName(value string) string {
|
||||
value = strings.ToLower(trimTrailingDots(strings.TrimSpace(value)))
|
||||
labels := strings.Split(value, ".")
|
||||
for i, label := range labels {
|
||||
if !isSaneDNSLabel(label) {
|
||||
labels[i] = UnparsableDNSLabelPlaceholder
|
||||
}
|
||||
}
|
||||
return strings.Join(labels, ".")
|
||||
}
|
||||
|
||||
// Like sanitizeDNSName, but labels that are Unicode are converted to Punycode.
|
||||
func sanitizeUnicodeDNSName(value string) string {
|
||||
value = strings.ToLower(trimTrailingDots(strings.TrimSpace(value)))
|
||||
labels := strings.Split(value, ".")
|
||||
for i, label := range labels {
|
||||
if asciiLabel, err := idna.ToASCII(label); err == nil && isSaneDNSLabel(asciiLabel) {
|
||||
labels[i] = asciiLabel
|
||||
} else {
|
||||
labels[i] = UnparsableDNSLabelPlaceholder
|
||||
}
|
||||
}
|
||||
return strings.Join(labels, ".")
|
||||
}
|
||||
|
||||
func (ids *Identifiers) appendDNSName(dnsName string) {
|
||||
if dnsName != "" && !ids.hasDNSName(dnsName) {
|
||||
ids.DNSNames = append(ids.DNSNames, dnsName)
|
||||
}
|
||||
}
|
||||
func (ids *Identifiers) appendIPAddress(ipaddr net.IP) {
|
||||
if !ids.hasIPAddress(ipaddr) {
|
||||
ids.IPAddrs = append(ids.IPAddrs, ipaddr)
|
||||
}
|
||||
}
|
||||
|
||||
func (ids *Identifiers) hasDNSName(target string) bool {
|
||||
for _, value := range ids.DNSNames {
|
||||
if value == target {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
func (ids *Identifiers) hasIPAddress(target net.IP) bool {
|
||||
for _, value := range ids.IPAddrs {
|
||||
if value.Equal(target) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func (ids *Identifiers) addDnsSANfinal(value []byte) {
|
||||
if ipaddr := parseIPAddrString(string(value)); ipaddr != nil {
|
||||
// Stupid CAs put IP addresses in DNS SANs because stupid Microsoft
|
||||
// used to not support IP address SANs. Since there's no way for an IP
|
||||
// address to also be a valid DNS name, just treat it like an IP address
|
||||
// and not try to process it as a DNS name.
|
||||
ids.appendIPAddress(ipaddr)
|
||||
} else if isASCIIString(value) {
|
||||
ids.appendDNSName(sanitizeDNSName(string(value)))
|
||||
} else {
|
||||
// DNS SANs are supposed to be IA5Strings (i.e. ASCII) but CAs can't follow
|
||||
// simple rules. Unfortunately, we have no idea what the encoding really is
|
||||
// in this case, so interpret it as both UTF-8 (if it's valid UTF-8)
|
||||
// and Latin-1.
|
||||
if isUTF8String(value) {
|
||||
ids.appendDNSName(sanitizeUnicodeDNSName(string(value)))
|
||||
}
|
||||
ids.appendDNSName(sanitizeUnicodeDNSName(latin1ToUTF8(value)))
|
||||
}
|
||||
}
|
||||
|
||||
func (ids *Identifiers) addDnsSANnonull(value []byte) {
|
||||
if slashIndex := bytes.IndexByte(value, '/'); slashIndex != -1 {
|
||||
// If the value contains a slash, then this might be a URL,
|
||||
// so process the part of the value up to the first slash,
|
||||
// which should be the domain. Even though no client should
|
||||
// ever successfully validate such a DNS name, the domain owner
|
||||
// might still want to know about it.
|
||||
ids.addDnsSANfinal(value[0:slashIndex])
|
||||
}
|
||||
ids.addDnsSANfinal(value)
|
||||
}
|
||||
|
||||
func (ids *Identifiers) AddDnsSAN(value []byte) {
|
||||
// Trim http:// and https:// prefixes, which are all too common in the wild,
|
||||
// so http://example.com becomes just example.com. Even though clients
|
||||
// should never successfully validate a DNS name like http://example.com,
|
||||
// the owner of example.com might still want to know about it.
|
||||
value = trimHttpPrefixBytes(value)
|
||||
|
||||
if nullIndex := bytes.IndexByte(value, 0); nullIndex != -1 {
|
||||
// If the value contains a null byte, process the part of
|
||||
// the value up to the first null byte in addition to the
|
||||
// complete value, in case this certificate is an attempt to
|
||||
// fake out validators that only compare up to the first null.
|
||||
ids.addDnsSANnonull(value[0:nullIndex])
|
||||
}
|
||||
ids.addDnsSANnonull(value)
|
||||
}
|
||||
|
||||
func (ids *Identifiers) addCNfinal(value string) {
|
||||
if ipaddr := parseIPAddrString(value); ipaddr != nil {
|
||||
ids.appendIPAddress(ipaddr)
|
||||
} else if !strings.ContainsRune(value, ' ') {
|
||||
// If the CN contains a space it's clearly not a DNS name, so ignore it.
|
||||
ids.appendDNSName(sanitizeUnicodeDNSName(value))
|
||||
}
|
||||
}
|
||||
|
||||
func (ids *Identifiers) addCNnonull(value string) {
|
||||
if slashIndex := strings.IndexRune(value, '/'); slashIndex != -1 {
|
||||
// If the value contains a slash, then this might be a URL,
|
||||
// so process the part of the value up to the first slash,
|
||||
// which should be the domain. Even though no client should
|
||||
// ever successfully validate such a DNS name, the domain owner
|
||||
// might still want to know about it.
|
||||
ids.addCNfinal(value[0:slashIndex])
|
||||
}
|
||||
ids.addCNfinal(value)
|
||||
}
|
||||
|
||||
func (ids *Identifiers) AddCN(value string) {
|
||||
// Trim http:// and https:// prefixes, which are all too common in the wild,
|
||||
// so http://example.com becomes just example.com. Even though clients
|
||||
// should never successfully validate a DNS name like http://example.com,
|
||||
// the owner of example.com might still want to know about it.
|
||||
value = trimHttpPrefixString(value)
|
||||
|
||||
if nullIndex := strings.IndexRune(value, 0); nullIndex != -1 {
|
||||
// If the value contains a null byte, process the part of
|
||||
// the value up to the first null byte in addition to the
|
||||
// complete value, in case this certificate is an attempt to
|
||||
// fake out validators that only compare up to the first null.
|
||||
ids.addCNnonull(value[0:nullIndex])
|
||||
}
|
||||
ids.addCNnonull(value)
|
||||
}
|
||||
|
||||
func (ids *Identifiers) AddIPAddress(value net.IP) {
|
||||
ids.appendIPAddress(value)
|
||||
}
|
||||
|
||||
func (ids *Identifiers) dnsNamesString(sep string) string {
|
||||
return strings.Join(ids.DNSNames, sep)
|
||||
}
|
||||
|
||||
func (ids *Identifiers) ipAddrsString(sep string) string {
|
||||
str := ""
|
||||
for _, ipAddr := range ids.IPAddrs {
|
||||
if str != "" {
|
||||
str += sep
|
||||
}
|
||||
str += ipAddr.String()
|
||||
}
|
||||
return str
|
||||
}
|
||||
|
||||
func (cert *CertInfo) ParseIdentifiers() (*Identifiers, error) {
|
||||
ids := NewIdentifiers()
|
||||
|
||||
if cert.SubjectParseError != nil {
|
||||
return nil, cert.SubjectParseError
|
||||
}
|
||||
cns, err := cert.Subject.ParseCNs()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
for _, cn := range cns {
|
||||
ids.AddCN(cn)
|
||||
}
|
||||
|
||||
if cert.SANsParseError != nil {
|
||||
return nil, cert.SANsParseError
|
||||
}
|
||||
for _, san := range cert.SANs {
|
||||
switch san.Type {
|
||||
case sanDNSName:
|
||||
ids.AddDnsSAN(san.Value)
|
||||
case sanIPAddress:
|
||||
if len(san.Value) == 4 || len(san.Value) == 16 {
|
||||
ids.AddIPAddress(net.IP(san.Value))
|
||||
}
|
||||
// TODO: decide what to do with IP addresses with an invalid length.
|
||||
// The two encoding errors I've observed in CT logs are:
|
||||
// 1. encoding the IP address as a string
|
||||
// 2. a value of 0x00000000FFFFFF00 (WTF?)
|
||||
// IP addresses aren't a high priority so just ignore invalid ones for now.
|
||||
// Hopefully no clients out there are dumb enough to process IP address
|
||||
// SANs encoded as strings...
|
||||
}
|
||||
}
|
||||
|
||||
return ids, nil
|
||||
}
|
||||
Loading…
Reference in New Issue