Update github.com/containerd/imgcrypt to v2.0.0
Signed-off-by: Kirtana Ashok <kiashok@microsoft.com>
This commit is contained in:
Kirtana Ashok
14
vendor/github.com/smallstep/pkcs7/internal/legacy/x509/debug.go
generated
vendored
Normal file
14
vendor/github.com/smallstep/pkcs7/internal/legacy/x509/debug.go
generated
vendored
Normal file
@@ -0,0 +1,14 @@
|
||||
package legacyx509
|
||||
|
||||
import "fmt"
|
||||
|
||||
// legacyGodebugSetting is a type mimicking Go's internal godebug package
|
||||
// settings, which are used to enable / disable certain functionalities at
|
||||
// build time.
|
||||
type legacyGodebugSetting int
|
||||
|
||||
func (s legacyGodebugSetting) Value() string {
|
||||
return fmt.Sprintf("%d", s)
|
||||
}
|
||||
|
||||
func (s legacyGodebugSetting) IncNonDefault() {}
|
||||
14
vendor/github.com/smallstep/pkcs7/internal/legacy/x509/doc.go
generated
vendored
Normal file
14
vendor/github.com/smallstep/pkcs7/internal/legacy/x509/doc.go
generated
vendored
Normal file
@@ -0,0 +1,14 @@
|
||||
/*
|
||||
Package legacyx509 is a copy of certain parts of Go's crypto/x509 package.
|
||||
It is based on Go 1.23, and has just the parts copied over required for
|
||||
parsing X509 certificates.
|
||||
|
||||
The primary reason this copy exists is to keep support for parsing PKCS7
|
||||
messages containing Simple Certificate Enrolment Protocol (SCEP) requests
|
||||
from Windows devices. Go 1.23 made a change marking certificates with a
|
||||
critical authority key identifier as invalid, which is mandated by RFC 5280,
|
||||
but apparently Windows marks those specific certificates as such, resulting
|
||||
in those SCEP requests failing from being parsed correctly.
|
||||
*/
|
||||
|
||||
package legacyx509
|
||||
377
vendor/github.com/smallstep/pkcs7/internal/legacy/x509/oid.go
generated
vendored
Normal file
377
vendor/github.com/smallstep/pkcs7/internal/legacy/x509/oid.go
generated
vendored
Normal file
@@ -0,0 +1,377 @@
|
||||
// Copyright 2023 The Go Authors. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package legacyx509
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/asn1"
|
||||
"errors"
|
||||
"math"
|
||||
"math/big"
|
||||
"math/bits"
|
||||
"strconv"
|
||||
"strings"
|
||||
)
|
||||
|
||||
var (
|
||||
errInvalidOID = errors.New("invalid oid")
|
||||
)
|
||||
|
||||
// An OID represents an ASN.1 OBJECT IDENTIFIER.
|
||||
type OID struct {
|
||||
der []byte
|
||||
}
|
||||
|
||||
// ParseOID parses a Object Identifier string, represented by ASCII numbers separated by dots.
|
||||
func ParseOID(oid string) (OID, error) {
|
||||
var o OID
|
||||
return o, o.unmarshalOIDText(oid)
|
||||
}
|
||||
|
||||
func newOIDFromDER(der []byte) (OID, bool) {
|
||||
if len(der) == 0 || der[len(der)-1]&0x80 != 0 {
|
||||
return OID{}, false
|
||||
}
|
||||
|
||||
start := 0
|
||||
for i, v := range der {
|
||||
// ITU-T X.690, section 8.19.2:
|
||||
// The subidentifier shall be encoded in the fewest possible octets,
|
||||
// that is, the leading octet of the subidentifier shall not have the value 0x80.
|
||||
if i == start && v == 0x80 {
|
||||
return OID{}, false
|
||||
}
|
||||
if v&0x80 == 0 {
|
||||
start = i + 1
|
||||
}
|
||||
}
|
||||
|
||||
return OID{der}, true
|
||||
}
|
||||
|
||||
// OIDFromInts creates a new OID using ints, each integer is a separate component.
|
||||
func OIDFromInts(oid []uint64) (OID, error) {
|
||||
if len(oid) < 2 || oid[0] > 2 || (oid[0] < 2 && oid[1] >= 40) {
|
||||
return OID{}, errInvalidOID
|
||||
}
|
||||
|
||||
length := base128IntLength(oid[0]*40 + oid[1])
|
||||
for _, v := range oid[2:] {
|
||||
length += base128IntLength(v)
|
||||
}
|
||||
|
||||
der := make([]byte, 0, length)
|
||||
der = appendBase128Int(der, oid[0]*40+oid[1])
|
||||
for _, v := range oid[2:] {
|
||||
der = appendBase128Int(der, v)
|
||||
}
|
||||
return OID{der}, nil
|
||||
}
|
||||
|
||||
func base128IntLength(n uint64) int {
|
||||
if n == 0 {
|
||||
return 1
|
||||
}
|
||||
return (bits.Len64(n) + 6) / 7
|
||||
}
|
||||
|
||||
func appendBase128Int(dst []byte, n uint64) []byte {
|
||||
for i := base128IntLength(n) - 1; i >= 0; i-- {
|
||||
o := byte(n >> uint(i*7))
|
||||
o &= 0x7f
|
||||
if i != 0 {
|
||||
o |= 0x80
|
||||
}
|
||||
dst = append(dst, o)
|
||||
}
|
||||
return dst
|
||||
}
|
||||
|
||||
func base128BigIntLength(n *big.Int) int {
|
||||
if n.Cmp(big.NewInt(0)) == 0 {
|
||||
return 1
|
||||
}
|
||||
return (n.BitLen() + 6) / 7
|
||||
}
|
||||
|
||||
func appendBase128BigInt(dst []byte, n *big.Int) []byte {
|
||||
if n.Cmp(big.NewInt(0)) == 0 {
|
||||
return append(dst, 0)
|
||||
}
|
||||
|
||||
for i := base128BigIntLength(n) - 1; i >= 0; i-- {
|
||||
o := byte(big.NewInt(0).Rsh(n, uint(i)*7).Bits()[0])
|
||||
o &= 0x7f
|
||||
if i != 0 {
|
||||
o |= 0x80
|
||||
}
|
||||
dst = append(dst, o)
|
||||
}
|
||||
return dst
|
||||
}
|
||||
|
||||
// AppendText implements [encoding.TextAppender]
|
||||
func (o OID) AppendText(b []byte) ([]byte, error) {
|
||||
return append(b, o.String()...), nil
|
||||
}
|
||||
|
||||
// MarshalText implements [encoding.TextMarshaler]
|
||||
func (o OID) MarshalText() ([]byte, error) {
|
||||
return o.AppendText(nil)
|
||||
}
|
||||
|
||||
// UnmarshalText implements [encoding.TextUnmarshaler]
|
||||
func (o *OID) UnmarshalText(text []byte) error {
|
||||
return o.unmarshalOIDText(string(text))
|
||||
}
|
||||
|
||||
// cutString slices s around the first instance of sep,
|
||||
// returning the text before and after sep.
|
||||
// The found result reports whether sep appears in s.
|
||||
// If sep does not appear in s, cut returns s, "", false.
|
||||
func cutString(s, sep string) (before, after string, found bool) {
|
||||
if i := strings.Index(s, sep); i >= 0 {
|
||||
return s[:i], s[i+len(sep):], true
|
||||
}
|
||||
return s, "", false
|
||||
}
|
||||
|
||||
func (o *OID) unmarshalOIDText(oid string) error {
|
||||
// (*big.Int).SetString allows +/- signs, but we don't want
|
||||
// to allow them in the string representation of Object Identifier, so
|
||||
// reject such encodings.
|
||||
for _, c := range oid {
|
||||
isDigit := c >= '0' && c <= '9'
|
||||
if !isDigit && c != '.' {
|
||||
return errInvalidOID
|
||||
}
|
||||
}
|
||||
|
||||
var (
|
||||
firstNum string
|
||||
secondNum string
|
||||
)
|
||||
|
||||
var nextComponentExists bool
|
||||
firstNum, oid, nextComponentExists = cutString(oid, ".")
|
||||
if !nextComponentExists {
|
||||
return errInvalidOID
|
||||
}
|
||||
secondNum, oid, nextComponentExists = cutString(oid, ".")
|
||||
|
||||
var (
|
||||
first = big.NewInt(0)
|
||||
second = big.NewInt(0)
|
||||
)
|
||||
|
||||
if _, ok := first.SetString(firstNum, 10); !ok {
|
||||
return errInvalidOID
|
||||
}
|
||||
if _, ok := second.SetString(secondNum, 10); !ok {
|
||||
return errInvalidOID
|
||||
}
|
||||
|
||||
if first.Cmp(big.NewInt(2)) > 0 || (first.Cmp(big.NewInt(2)) < 0 && second.Cmp(big.NewInt(40)) >= 0) {
|
||||
return errInvalidOID
|
||||
}
|
||||
|
||||
firstComponent := first.Mul(first, big.NewInt(40))
|
||||
firstComponent.Add(firstComponent, second)
|
||||
|
||||
der := appendBase128BigInt(make([]byte, 0, 32), firstComponent)
|
||||
|
||||
for nextComponentExists {
|
||||
var strNum string
|
||||
strNum, oid, nextComponentExists = cutString(oid, ".")
|
||||
b, ok := big.NewInt(0).SetString(strNum, 10)
|
||||
if !ok {
|
||||
return errInvalidOID
|
||||
}
|
||||
der = appendBase128BigInt(der, b)
|
||||
}
|
||||
|
||||
o.der = der
|
||||
return nil
|
||||
}
|
||||
|
||||
// AppendBinary implements [encoding.BinaryAppender]
|
||||
func (o OID) AppendBinary(b []byte) ([]byte, error) {
|
||||
return append(b, o.der...), nil
|
||||
}
|
||||
|
||||
// MarshalBinary implements [encoding.BinaryMarshaler]
|
||||
func (o OID) MarshalBinary() ([]byte, error) {
|
||||
return o.AppendBinary(nil)
|
||||
}
|
||||
|
||||
// cloneBytes returns a copy of b[:len(b)].
|
||||
// The result may have additional unused capacity.
|
||||
// Clone(nil) returns nil.
|
||||
func cloneBytes(b []byte) []byte {
|
||||
if b == nil {
|
||||
return nil
|
||||
}
|
||||
return append([]byte{}, b...)
|
||||
}
|
||||
|
||||
// UnmarshalBinary implements [encoding.BinaryUnmarshaler]
|
||||
func (o *OID) UnmarshalBinary(b []byte) error {
|
||||
oid, ok := newOIDFromDER(cloneBytes(b))
|
||||
if !ok {
|
||||
return errInvalidOID
|
||||
}
|
||||
*o = oid
|
||||
return nil
|
||||
}
|
||||
|
||||
// Equal returns true when oid and other represents the same Object Identifier.
|
||||
func (oid OID) Equal(other OID) bool {
|
||||
// There is only one possible DER encoding of
|
||||
// each unique Object Identifier.
|
||||
return bytes.Equal(oid.der, other.der)
|
||||
}
|
||||
|
||||
func parseBase128Int(bytes []byte, initOffset int) (ret, offset int, failed bool) {
|
||||
offset = initOffset
|
||||
var ret64 int64
|
||||
for shifted := 0; offset < len(bytes); shifted++ {
|
||||
// 5 * 7 bits per byte == 35 bits of data
|
||||
// Thus the representation is either non-minimal or too large for an int32
|
||||
if shifted == 5 {
|
||||
failed = true
|
||||
return
|
||||
}
|
||||
ret64 <<= 7
|
||||
b := bytes[offset]
|
||||
// integers should be minimally encoded, so the leading octet should
|
||||
// never be 0x80
|
||||
if shifted == 0 && b == 0x80 {
|
||||
failed = true
|
||||
return
|
||||
}
|
||||
ret64 |= int64(b & 0x7f)
|
||||
offset++
|
||||
if b&0x80 == 0 {
|
||||
ret = int(ret64)
|
||||
// Ensure that the returned value fits in an int on all platforms
|
||||
if ret64 > math.MaxInt32 {
|
||||
failed = true
|
||||
}
|
||||
return
|
||||
}
|
||||
}
|
||||
failed = true
|
||||
return
|
||||
}
|
||||
|
||||
// EqualASN1OID returns whether an OID equals an asn1.ObjectIdentifier. If
|
||||
// asn1.ObjectIdentifier cannot represent the OID specified by oid, because
|
||||
// a component of OID requires more than 31 bits, it returns false.
|
||||
func (oid OID) EqualASN1OID(other asn1.ObjectIdentifier) bool {
|
||||
if len(other) < 2 {
|
||||
return false
|
||||
}
|
||||
v, offset, failed := parseBase128Int(oid.der, 0)
|
||||
if failed {
|
||||
// This should never happen, since we've already parsed the OID,
|
||||
// but just in case.
|
||||
return false
|
||||
}
|
||||
if v < 80 {
|
||||
a, b := v/40, v%40
|
||||
if other[0] != a || other[1] != b {
|
||||
return false
|
||||
}
|
||||
} else {
|
||||
a, b := 2, v-80
|
||||
if other[0] != a || other[1] != b {
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
i := 2
|
||||
for ; offset < len(oid.der); i++ {
|
||||
v, offset, failed = parseBase128Int(oid.der, offset)
|
||||
if failed {
|
||||
// Again, shouldn't happen, since we've already parsed
|
||||
// the OID, but better safe than sorry.
|
||||
return false
|
||||
}
|
||||
if i >= len(other) || v != other[i] {
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
return i == len(other)
|
||||
}
|
||||
|
||||
// Strings returns the string representation of the Object Identifier.
|
||||
func (oid OID) String() string {
|
||||
var b strings.Builder
|
||||
b.Grow(32)
|
||||
const (
|
||||
valSize = 64 // size in bits of val.
|
||||
bitsPerByte = 7
|
||||
maxValSafeShift = (1 << (valSize - bitsPerByte)) - 1
|
||||
)
|
||||
var (
|
||||
start = 0
|
||||
val = uint64(0)
|
||||
numBuf = make([]byte, 0, 21)
|
||||
bigVal *big.Int
|
||||
overflow bool
|
||||
)
|
||||
for i, v := range oid.der {
|
||||
curVal := v & 0x7F
|
||||
valEnd := v&0x80 == 0
|
||||
if valEnd {
|
||||
if start != 0 {
|
||||
b.WriteByte('.')
|
||||
}
|
||||
}
|
||||
if !overflow && val > maxValSafeShift {
|
||||
if bigVal == nil {
|
||||
bigVal = new(big.Int)
|
||||
}
|
||||
bigVal = bigVal.SetUint64(val)
|
||||
overflow = true
|
||||
}
|
||||
if overflow {
|
||||
bigVal = bigVal.Lsh(bigVal, bitsPerByte).Or(bigVal, big.NewInt(int64(curVal)))
|
||||
if valEnd {
|
||||
if start == 0 {
|
||||
b.WriteString("2.")
|
||||
bigVal = bigVal.Sub(bigVal, big.NewInt(80))
|
||||
}
|
||||
numBuf = bigVal.Append(numBuf, 10)
|
||||
b.Write(numBuf)
|
||||
numBuf = numBuf[:0]
|
||||
val = 0
|
||||
start = i + 1
|
||||
overflow = false
|
||||
}
|
||||
continue
|
||||
}
|
||||
val <<= bitsPerByte
|
||||
val |= uint64(curVal)
|
||||
if valEnd {
|
||||
if start == 0 {
|
||||
if val < 80 {
|
||||
b.Write(strconv.AppendUint(numBuf, val/40, 10))
|
||||
b.WriteByte('.')
|
||||
b.Write(strconv.AppendUint(numBuf, val%40, 10))
|
||||
} else {
|
||||
b.WriteString("2.")
|
||||
b.Write(strconv.AppendUint(numBuf, val-80, 10))
|
||||
}
|
||||
} else {
|
||||
b.Write(strconv.AppendUint(numBuf, val, 10))
|
||||
}
|
||||
val = 0
|
||||
start = i + 1
|
||||
}
|
||||
}
|
||||
return b.String()
|
||||
}
|
||||
1027
vendor/github.com/smallstep/pkcs7/internal/legacy/x509/parser.go
generated
vendored
Normal file
1027
vendor/github.com/smallstep/pkcs7/internal/legacy/x509/parser.go
generated
vendored
Normal file
File diff suppressed because it is too large
Load Diff
15
vendor/github.com/smallstep/pkcs7/internal/legacy/x509/pkcs1.go
generated
vendored
Normal file
15
vendor/github.com/smallstep/pkcs7/internal/legacy/x509/pkcs1.go
generated
vendored
Normal file
@@ -0,0 +1,15 @@
|
||||
// Copyright 2011 The Go Authors. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package legacyx509
|
||||
|
||||
import (
|
||||
"math/big"
|
||||
)
|
||||
|
||||
// pkcs1PublicKey reflects the ASN.1 structure of a PKCS #1 public key.
|
||||
type pkcs1PublicKey struct {
|
||||
N *big.Int
|
||||
E int
|
||||
}
|
||||
193
vendor/github.com/smallstep/pkcs7/internal/legacy/x509/verify.go
generated
vendored
Normal file
193
vendor/github.com/smallstep/pkcs7/internal/legacy/x509/verify.go
generated
vendored
Normal file
@@ -0,0 +1,193 @@
|
||||
package legacyx509
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// rfc2821Mailbox represents a “mailbox” (which is an email address to most
|
||||
// people) by breaking it into the “local” (i.e. before the '@') and “domain”
|
||||
// parts.
|
||||
type rfc2821Mailbox struct {
|
||||
local, domain string
|
||||
}
|
||||
|
||||
// parseRFC2821Mailbox parses an email address into local and domain parts,
|
||||
// based on the ABNF for a “Mailbox” from RFC 2821. According to RFC 5280,
|
||||
// Section 4.2.1.6 that's correct for an rfc822Name from a certificate: “The
|
||||
// format of an rfc822Name is a "Mailbox" as defined in RFC 2821, Section 4.1.2”.
|
||||
func parseRFC2821Mailbox(in string) (mailbox rfc2821Mailbox, ok bool) {
|
||||
if len(in) == 0 {
|
||||
return mailbox, false
|
||||
}
|
||||
|
||||
localPartBytes := make([]byte, 0, len(in)/2)
|
||||
|
||||
if in[0] == '"' {
|
||||
// Quoted-string = DQUOTE *qcontent DQUOTE
|
||||
// non-whitespace-control = %d1-8 / %d11 / %d12 / %d14-31 / %d127
|
||||
// qcontent = qtext / quoted-pair
|
||||
// qtext = non-whitespace-control /
|
||||
// %d33 / %d35-91 / %d93-126
|
||||
// quoted-pair = ("\" text) / obs-qp
|
||||
// text = %d1-9 / %d11 / %d12 / %d14-127 / obs-text
|
||||
//
|
||||
// (Names beginning with “obs-” are the obsolete syntax from RFC 2822,
|
||||
// Section 4. Since it has been 16 years, we no longer accept that.)
|
||||
in = in[1:]
|
||||
QuotedString:
|
||||
for {
|
||||
if len(in) == 0 {
|
||||
return mailbox, false
|
||||
}
|
||||
c := in[0]
|
||||
in = in[1:]
|
||||
|
||||
switch {
|
||||
case c == '"':
|
||||
break QuotedString
|
||||
|
||||
case c == '\\':
|
||||
// quoted-pair
|
||||
if len(in) == 0 {
|
||||
return mailbox, false
|
||||
}
|
||||
if in[0] == 11 ||
|
||||
in[0] == 12 ||
|
||||
(1 <= in[0] && in[0] <= 9) ||
|
||||
(14 <= in[0] && in[0] <= 127) {
|
||||
localPartBytes = append(localPartBytes, in[0])
|
||||
in = in[1:]
|
||||
} else {
|
||||
return mailbox, false
|
||||
}
|
||||
|
||||
case c == 11 ||
|
||||
c == 12 ||
|
||||
// Space (char 32) is not allowed based on the
|
||||
// BNF, but RFC 3696 gives an example that
|
||||
// assumes that it is. Several “verified”
|
||||
// errata continue to argue about this point.
|
||||
// We choose to accept it.
|
||||
c == 32 ||
|
||||
c == 33 ||
|
||||
c == 127 ||
|
||||
(1 <= c && c <= 8) ||
|
||||
(14 <= c && c <= 31) ||
|
||||
(35 <= c && c <= 91) ||
|
||||
(93 <= c && c <= 126):
|
||||
// qtext
|
||||
localPartBytes = append(localPartBytes, c)
|
||||
|
||||
default:
|
||||
return mailbox, false
|
||||
}
|
||||
}
|
||||
} else {
|
||||
// Atom ("." Atom)*
|
||||
NextChar:
|
||||
for len(in) > 0 {
|
||||
// atext from RFC 2822, Section 3.2.4
|
||||
c := in[0]
|
||||
|
||||
switch {
|
||||
case c == '\\':
|
||||
// Examples given in RFC 3696 suggest that
|
||||
// escaped characters can appear outside of a
|
||||
// quoted string. Several “verified” errata
|
||||
// continue to argue the point. We choose to
|
||||
// accept it.
|
||||
in = in[1:]
|
||||
if len(in) == 0 {
|
||||
return mailbox, false
|
||||
}
|
||||
fallthrough
|
||||
|
||||
case ('0' <= c && c <= '9') ||
|
||||
('a' <= c && c <= 'z') ||
|
||||
('A' <= c && c <= 'Z') ||
|
||||
c == '!' || c == '#' || c == '$' || c == '%' ||
|
||||
c == '&' || c == '\'' || c == '*' || c == '+' ||
|
||||
c == '-' || c == '/' || c == '=' || c == '?' ||
|
||||
c == '^' || c == '_' || c == '`' || c == '{' ||
|
||||
c == '|' || c == '}' || c == '~' || c == '.':
|
||||
localPartBytes = append(localPartBytes, in[0])
|
||||
in = in[1:]
|
||||
|
||||
default:
|
||||
break NextChar
|
||||
}
|
||||
}
|
||||
|
||||
if len(localPartBytes) == 0 {
|
||||
return mailbox, false
|
||||
}
|
||||
|
||||
// From RFC 3696, Section 3:
|
||||
// “period (".") may also appear, but may not be used to start
|
||||
// or end the local part, nor may two or more consecutive
|
||||
// periods appear.”
|
||||
twoDots := []byte{'.', '.'}
|
||||
if localPartBytes[0] == '.' ||
|
||||
localPartBytes[len(localPartBytes)-1] == '.' ||
|
||||
bytes.Contains(localPartBytes, twoDots) {
|
||||
return mailbox, false
|
||||
}
|
||||
}
|
||||
|
||||
if len(in) == 0 || in[0] != '@' {
|
||||
return mailbox, false
|
||||
}
|
||||
in = in[1:]
|
||||
|
||||
// The RFC species a format for domains, but that's known to be
|
||||
// violated in practice so we accept that anything after an '@' is the
|
||||
// domain part.
|
||||
if _, ok := domainToReverseLabels(in); !ok {
|
||||
return mailbox, false
|
||||
}
|
||||
|
||||
mailbox.local = string(localPartBytes)
|
||||
mailbox.domain = in
|
||||
return mailbox, true
|
||||
}
|
||||
|
||||
// domainToReverseLabels converts a textual domain name like foo.example.com to
|
||||
// the list of labels in reverse order, e.g. ["com", "example", "foo"].
|
||||
func domainToReverseLabels(domain string) (reverseLabels []string, ok bool) {
|
||||
for len(domain) > 0 {
|
||||
if i := strings.LastIndexByte(domain, '.'); i == -1 {
|
||||
reverseLabels = append(reverseLabels, domain)
|
||||
domain = ""
|
||||
} else {
|
||||
reverseLabels = append(reverseLabels, domain[i+1:])
|
||||
domain = domain[:i]
|
||||
if i == 0 { // domain == ""
|
||||
// domain is prefixed with an empty label, append an empty
|
||||
// string to reverseLabels to indicate this.
|
||||
reverseLabels = append(reverseLabels, "")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if len(reverseLabels) > 0 && len(reverseLabels[0]) == 0 {
|
||||
// An empty label at the end indicates an absolute value.
|
||||
return nil, false
|
||||
}
|
||||
|
||||
for _, label := range reverseLabels {
|
||||
if len(label) == 0 {
|
||||
// Empty labels are otherwise invalid.
|
||||
return nil, false
|
||||
}
|
||||
|
||||
for _, c := range label {
|
||||
if c < 33 || c > 126 {
|
||||
// Invalid character.
|
||||
return nil, false
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return reverseLabels, true
|
||||
}
|
||||
488
vendor/github.com/smallstep/pkcs7/internal/legacy/x509/x509.go
generated
vendored
Normal file
488
vendor/github.com/smallstep/pkcs7/internal/legacy/x509/x509.go
generated
vendored
Normal file
@@ -0,0 +1,488 @@
|
||||
// Copyright 2009 The Go Authors. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// Package x509 implements a subset of the X.509 standard.
|
||||
//
|
||||
// It allows parsing and generating certificates, certificate signing
|
||||
// requests, certificate revocation lists, and encoded public and private keys.
|
||||
// It provides a certificate verifier, complete with a chain builder.
|
||||
//
|
||||
// The package targets the X.509 technical profile defined by the IETF (RFC
|
||||
// 2459/3280/5280), and as further restricted by the CA/Browser Forum Baseline
|
||||
// Requirements. There is minimal support for features outside of these
|
||||
// profiles, as the primary goal of the package is to provide compatibility
|
||||
// with the publicly trusted TLS certificate ecosystem and its policies and
|
||||
// constraints.
|
||||
//
|
||||
// On macOS and Windows, certificate verification is handled by system APIs, but
|
||||
// the package aims to apply consistent validation rules across operating
|
||||
// systems.
|
||||
package legacyx509
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto"
|
||||
"crypto/elliptic"
|
||||
stdx509 "crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
"encoding/asn1"
|
||||
"fmt"
|
||||
"strconv"
|
||||
"unicode"
|
||||
|
||||
// Explicitly import these for their crypto.RegisterHash init side-effects.
|
||||
// Keep these as blank imports, even if they're imported above.
|
||||
_ "crypto/sha1"
|
||||
_ "crypto/sha256"
|
||||
_ "crypto/sha512"
|
||||
)
|
||||
|
||||
type publicKeyInfo struct {
|
||||
Raw asn1.RawContent
|
||||
Algorithm pkix.AlgorithmIdentifier
|
||||
PublicKey asn1.BitString
|
||||
}
|
||||
|
||||
type SignatureAlgorithm int
|
||||
|
||||
const (
|
||||
UnknownSignatureAlgorithm SignatureAlgorithm = iota
|
||||
|
||||
MD2WithRSA // Unsupported.
|
||||
MD5WithRSA // Only supported for signing, not verification.
|
||||
SHA1WithRSA // Only supported for signing, and verification of CRLs, CSRs, and OCSP responses.
|
||||
SHA256WithRSA
|
||||
SHA384WithRSA
|
||||
SHA512WithRSA
|
||||
DSAWithSHA1 // Unsupported.
|
||||
DSAWithSHA256 // Unsupported.
|
||||
ECDSAWithSHA1 // Only supported for signing, and verification of CRLs, CSRs, and OCSP responses.
|
||||
ECDSAWithSHA256
|
||||
ECDSAWithSHA384
|
||||
ECDSAWithSHA512
|
||||
SHA256WithRSAPSS
|
||||
SHA384WithRSAPSS
|
||||
SHA512WithRSAPSS
|
||||
PureEd25519
|
||||
)
|
||||
|
||||
func (algo SignatureAlgorithm) String() string {
|
||||
for _, details := range signatureAlgorithmDetails {
|
||||
if details.algo == algo {
|
||||
return details.name
|
||||
}
|
||||
}
|
||||
return strconv.Itoa(int(algo))
|
||||
}
|
||||
|
||||
type PublicKeyAlgorithm int
|
||||
|
||||
const (
|
||||
UnknownPublicKeyAlgorithm PublicKeyAlgorithm = iota
|
||||
RSA
|
||||
DSA // Only supported for parsing.
|
||||
ECDSA
|
||||
Ed25519
|
||||
)
|
||||
|
||||
var publicKeyAlgoName = [...]string{
|
||||
RSA: "RSA",
|
||||
DSA: "DSA",
|
||||
ECDSA: "ECDSA",
|
||||
Ed25519: "Ed25519",
|
||||
}
|
||||
|
||||
func (algo PublicKeyAlgorithm) String() string {
|
||||
if 0 < algo && int(algo) < len(publicKeyAlgoName) {
|
||||
return publicKeyAlgoName[algo]
|
||||
}
|
||||
return strconv.Itoa(int(algo))
|
||||
}
|
||||
|
||||
// OIDs for signature algorithms
|
||||
//
|
||||
// pkcs-1 OBJECT IDENTIFIER ::= {
|
||||
// iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1 }
|
||||
//
|
||||
// RFC 3279 2.2.1 RSA Signature Algorithms
|
||||
//
|
||||
// md5WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 4 }
|
||||
//
|
||||
// sha-1WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 5 }
|
||||
//
|
||||
// dsaWithSha1 OBJECT IDENTIFIER ::= {
|
||||
// iso(1) member-body(2) us(840) x9-57(10040) x9cm(4) 3 }
|
||||
//
|
||||
// RFC 3279 2.2.3 ECDSA Signature Algorithm
|
||||
//
|
||||
// ecdsa-with-SHA1 OBJECT IDENTIFIER ::= {
|
||||
// iso(1) member-body(2) us(840) ansi-x962(10045)
|
||||
// signatures(4) ecdsa-with-SHA1(1)}
|
||||
//
|
||||
// RFC 4055 5 PKCS #1 Version 1.5
|
||||
//
|
||||
// sha256WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 11 }
|
||||
//
|
||||
// sha384WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 12 }
|
||||
//
|
||||
// sha512WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 13 }
|
||||
//
|
||||
// RFC 5758 3.1 DSA Signature Algorithms
|
||||
//
|
||||
// dsaWithSha256 OBJECT IDENTIFIER ::= {
|
||||
// joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101)
|
||||
// csor(3) algorithms(4) id-dsa-with-sha2(3) 2}
|
||||
//
|
||||
// RFC 5758 3.2 ECDSA Signature Algorithm
|
||||
//
|
||||
// ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
||||
// us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 2 }
|
||||
//
|
||||
// ecdsa-with-SHA384 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
||||
// us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 3 }
|
||||
//
|
||||
// ecdsa-with-SHA512 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
||||
// us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 4 }
|
||||
//
|
||||
// RFC 8410 3 Curve25519 and Curve448 Algorithm Identifiers
|
||||
//
|
||||
// id-Ed25519 OBJECT IDENTIFIER ::= { 1 3 101 112 }
|
||||
var (
|
||||
oidSignatureMD5WithRSA = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 4}
|
||||
oidSignatureSHA1WithRSA = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 5}
|
||||
oidSignatureSHA256WithRSA = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 11}
|
||||
oidSignatureSHA384WithRSA = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 12}
|
||||
oidSignatureSHA512WithRSA = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 13}
|
||||
oidSignatureRSAPSS = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 10}
|
||||
oidSignatureDSAWithSHA1 = asn1.ObjectIdentifier{1, 2, 840, 10040, 4, 3}
|
||||
oidSignatureDSAWithSHA256 = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 3, 2}
|
||||
oidSignatureECDSAWithSHA1 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 1}
|
||||
oidSignatureECDSAWithSHA256 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 2}
|
||||
oidSignatureECDSAWithSHA384 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 3}
|
||||
oidSignatureECDSAWithSHA512 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 4}
|
||||
oidSignatureEd25519 = asn1.ObjectIdentifier{1, 3, 101, 112}
|
||||
|
||||
oidSHA256 = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 2, 1}
|
||||
oidSHA384 = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 2, 2}
|
||||
oidSHA512 = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 2, 3}
|
||||
|
||||
oidMGF1 = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 8}
|
||||
|
||||
// oidISOSignatureSHA1WithRSA means the same as oidSignatureSHA1WithRSA
|
||||
// but it's specified by ISO. Microsoft's makecert.exe has been known
|
||||
// to produce certificates with this OID.
|
||||
oidISOSignatureSHA1WithRSA = asn1.ObjectIdentifier{1, 3, 14, 3, 2, 29}
|
||||
)
|
||||
|
||||
var signatureAlgorithmDetails = []struct {
|
||||
algo SignatureAlgorithm
|
||||
name string
|
||||
oid asn1.ObjectIdentifier
|
||||
params asn1.RawValue
|
||||
pubKeyAlgo PublicKeyAlgorithm
|
||||
hash crypto.Hash
|
||||
isRSAPSS bool
|
||||
}{
|
||||
{MD5WithRSA, "MD5-RSA", oidSignatureMD5WithRSA, asn1.NullRawValue, RSA, crypto.MD5, false},
|
||||
{SHA1WithRSA, "SHA1-RSA", oidSignatureSHA1WithRSA, asn1.NullRawValue, RSA, crypto.SHA1, false},
|
||||
{SHA1WithRSA, "SHA1-RSA", oidISOSignatureSHA1WithRSA, asn1.NullRawValue, RSA, crypto.SHA1, false},
|
||||
{SHA256WithRSA, "SHA256-RSA", oidSignatureSHA256WithRSA, asn1.NullRawValue, RSA, crypto.SHA256, false},
|
||||
{SHA384WithRSA, "SHA384-RSA", oidSignatureSHA384WithRSA, asn1.NullRawValue, RSA, crypto.SHA384, false},
|
||||
{SHA512WithRSA, "SHA512-RSA", oidSignatureSHA512WithRSA, asn1.NullRawValue, RSA, crypto.SHA512, false},
|
||||
{SHA256WithRSAPSS, "SHA256-RSAPSS", oidSignatureRSAPSS, pssParametersSHA256, RSA, crypto.SHA256, true},
|
||||
{SHA384WithRSAPSS, "SHA384-RSAPSS", oidSignatureRSAPSS, pssParametersSHA384, RSA, crypto.SHA384, true},
|
||||
{SHA512WithRSAPSS, "SHA512-RSAPSS", oidSignatureRSAPSS, pssParametersSHA512, RSA, crypto.SHA512, true},
|
||||
{DSAWithSHA1, "DSA-SHA1", oidSignatureDSAWithSHA1, emptyRawValue, DSA, crypto.SHA1, false},
|
||||
{DSAWithSHA256, "DSA-SHA256", oidSignatureDSAWithSHA256, emptyRawValue, DSA, crypto.SHA256, false},
|
||||
{ECDSAWithSHA1, "ECDSA-SHA1", oidSignatureECDSAWithSHA1, emptyRawValue, ECDSA, crypto.SHA1, false},
|
||||
{ECDSAWithSHA256, "ECDSA-SHA256", oidSignatureECDSAWithSHA256, emptyRawValue, ECDSA, crypto.SHA256, false},
|
||||
{ECDSAWithSHA384, "ECDSA-SHA384", oidSignatureECDSAWithSHA384, emptyRawValue, ECDSA, crypto.SHA384, false},
|
||||
{ECDSAWithSHA512, "ECDSA-SHA512", oidSignatureECDSAWithSHA512, emptyRawValue, ECDSA, crypto.SHA512, false},
|
||||
{PureEd25519, "Ed25519", oidSignatureEd25519, emptyRawValue, Ed25519, crypto.Hash(0) /* no pre-hashing */, false},
|
||||
}
|
||||
|
||||
var emptyRawValue = asn1.RawValue{}
|
||||
|
||||
// DER encoded RSA PSS parameters for the
|
||||
// SHA256, SHA384, and SHA512 hashes as defined in RFC 3447, Appendix A.2.3.
|
||||
// The parameters contain the following values:
|
||||
// - hashAlgorithm contains the associated hash identifier with NULL parameters
|
||||
// - maskGenAlgorithm always contains the default mgf1SHA1 identifier
|
||||
// - saltLength contains the length of the associated hash
|
||||
// - trailerField always contains the default trailerFieldBC value
|
||||
var (
|
||||
pssParametersSHA256 = asn1.RawValue{FullBytes: []byte{48, 52, 160, 15, 48, 13, 6, 9, 96, 134, 72, 1, 101, 3, 4, 2, 1, 5, 0, 161, 28, 48, 26, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 8, 48, 13, 6, 9, 96, 134, 72, 1, 101, 3, 4, 2, 1, 5, 0, 162, 3, 2, 1, 32}}
|
||||
pssParametersSHA384 = asn1.RawValue{FullBytes: []byte{48, 52, 160, 15, 48, 13, 6, 9, 96, 134, 72, 1, 101, 3, 4, 2, 2, 5, 0, 161, 28, 48, 26, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 8, 48, 13, 6, 9, 96, 134, 72, 1, 101, 3, 4, 2, 2, 5, 0, 162, 3, 2, 1, 48}}
|
||||
pssParametersSHA512 = asn1.RawValue{FullBytes: []byte{48, 52, 160, 15, 48, 13, 6, 9, 96, 134, 72, 1, 101, 3, 4, 2, 3, 5, 0, 161, 28, 48, 26, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 8, 48, 13, 6, 9, 96, 134, 72, 1, 101, 3, 4, 2, 3, 5, 0, 162, 3, 2, 1, 64}}
|
||||
)
|
||||
|
||||
// pssParameters reflects the parameters in an AlgorithmIdentifier that
|
||||
// specifies RSA PSS. See RFC 3447, Appendix A.2.3.
|
||||
type pssParameters struct {
|
||||
// The following three fields are not marked as
|
||||
// optional because the default values specify SHA-1,
|
||||
// which is no longer suitable for use in signatures.
|
||||
Hash pkix.AlgorithmIdentifier `asn1:"explicit,tag:0"`
|
||||
MGF pkix.AlgorithmIdentifier `asn1:"explicit,tag:1"`
|
||||
SaltLength int `asn1:"explicit,tag:2"`
|
||||
TrailerField int `asn1:"optional,explicit,tag:3,default:1"`
|
||||
}
|
||||
|
||||
func getSignatureAlgorithmFromAI(ai pkix.AlgorithmIdentifier) stdx509.SignatureAlgorithm {
|
||||
if ai.Algorithm.Equal(oidSignatureEd25519) {
|
||||
// RFC 8410, Section 3
|
||||
// > For all of the OIDs, the parameters MUST be absent.
|
||||
if len(ai.Parameters.FullBytes) != 0 {
|
||||
return stdx509.UnknownSignatureAlgorithm
|
||||
}
|
||||
}
|
||||
|
||||
if !ai.Algorithm.Equal(oidSignatureRSAPSS) {
|
||||
for _, details := range signatureAlgorithmDetails {
|
||||
if ai.Algorithm.Equal(details.oid) {
|
||||
return stdx509.SignatureAlgorithm(details.algo)
|
||||
}
|
||||
}
|
||||
return stdx509.UnknownSignatureAlgorithm
|
||||
}
|
||||
|
||||
// RSA PSS is special because it encodes important parameters
|
||||
// in the Parameters.
|
||||
|
||||
var params pssParameters
|
||||
if _, err := asn1.Unmarshal(ai.Parameters.FullBytes, ¶ms); err != nil {
|
||||
return stdx509.UnknownSignatureAlgorithm
|
||||
}
|
||||
|
||||
var mgf1HashFunc pkix.AlgorithmIdentifier
|
||||
if _, err := asn1.Unmarshal(params.MGF.Parameters.FullBytes, &mgf1HashFunc); err != nil {
|
||||
return stdx509.UnknownSignatureAlgorithm
|
||||
}
|
||||
|
||||
// PSS is greatly overburdened with options. This code forces them into
|
||||
// three buckets by requiring that the MGF1 hash function always match the
|
||||
// message hash function (as recommended in RFC 3447, Section 8.1), that the
|
||||
// salt length matches the hash length, and that the trailer field has the
|
||||
// default value.
|
||||
if (len(params.Hash.Parameters.FullBytes) != 0 && !bytes.Equal(params.Hash.Parameters.FullBytes, asn1.NullBytes)) ||
|
||||
!params.MGF.Algorithm.Equal(oidMGF1) ||
|
||||
!mgf1HashFunc.Algorithm.Equal(params.Hash.Algorithm) ||
|
||||
(len(mgf1HashFunc.Parameters.FullBytes) != 0 && !bytes.Equal(mgf1HashFunc.Parameters.FullBytes, asn1.NullBytes)) ||
|
||||
params.TrailerField != 1 {
|
||||
return stdx509.UnknownSignatureAlgorithm
|
||||
}
|
||||
|
||||
switch {
|
||||
case params.Hash.Algorithm.Equal(oidSHA256) && params.SaltLength == 32:
|
||||
return stdx509.SHA256WithRSAPSS
|
||||
case params.Hash.Algorithm.Equal(oidSHA384) && params.SaltLength == 48:
|
||||
return stdx509.SHA384WithRSAPSS
|
||||
case params.Hash.Algorithm.Equal(oidSHA512) && params.SaltLength == 64:
|
||||
return stdx509.SHA512WithRSAPSS
|
||||
}
|
||||
|
||||
return stdx509.UnknownSignatureAlgorithm
|
||||
}
|
||||
|
||||
var (
|
||||
// RFC 3279, 2.3 Public Key Algorithms
|
||||
//
|
||||
// pkcs-1 OBJECT IDENTIFIER ::== { iso(1) member-body(2) us(840)
|
||||
// rsadsi(113549) pkcs(1) 1 }
|
||||
//
|
||||
// rsaEncryption OBJECT IDENTIFIER ::== { pkcs1-1 1 }
|
||||
//
|
||||
// id-dsa OBJECT IDENTIFIER ::== { iso(1) member-body(2) us(840)
|
||||
// x9-57(10040) x9cm(4) 1 }
|
||||
oidPublicKeyRSA = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 1}
|
||||
oidPublicKeyDSA = asn1.ObjectIdentifier{1, 2, 840, 10040, 4, 1}
|
||||
// RFC 5480, 2.1.1 Unrestricted Algorithm Identifier and Parameters
|
||||
//
|
||||
// id-ecPublicKey OBJECT IDENTIFIER ::= {
|
||||
// iso(1) member-body(2) us(840) ansi-X9-62(10045) keyType(2) 1 }
|
||||
oidPublicKeyECDSA = asn1.ObjectIdentifier{1, 2, 840, 10045, 2, 1}
|
||||
// RFC 8410, Section 3
|
||||
//
|
||||
// id-X25519 OBJECT IDENTIFIER ::= { 1 3 101 110 }
|
||||
// id-Ed25519 OBJECT IDENTIFIER ::= { 1 3 101 112 }
|
||||
oidPublicKeyX25519 = asn1.ObjectIdentifier{1, 3, 101, 110}
|
||||
oidPublicKeyEd25519 = asn1.ObjectIdentifier{1, 3, 101, 112}
|
||||
)
|
||||
|
||||
// getPublicKeyAlgorithmFromOID returns the exposed PublicKeyAlgorithm
|
||||
// identifier for public key types supported in certificates and CSRs. Marshal
|
||||
// and Parse functions may support a different set of public key types.
|
||||
func getPublicKeyAlgorithmFromOID(oid asn1.ObjectIdentifier) stdx509.PublicKeyAlgorithm {
|
||||
switch {
|
||||
case oid.Equal(oidPublicKeyRSA):
|
||||
return stdx509.RSA
|
||||
case oid.Equal(oidPublicKeyDSA):
|
||||
return stdx509.DSA
|
||||
case oid.Equal(oidPublicKeyECDSA):
|
||||
return stdx509.ECDSA
|
||||
case oid.Equal(oidPublicKeyEd25519):
|
||||
return stdx509.Ed25519
|
||||
}
|
||||
return stdx509.UnknownPublicKeyAlgorithm
|
||||
}
|
||||
|
||||
// RFC 5480, 2.1.1.1. Named Curve
|
||||
//
|
||||
// secp224r1 OBJECT IDENTIFIER ::= {
|
||||
// iso(1) identified-organization(3) certicom(132) curve(0) 33 }
|
||||
//
|
||||
// secp256r1 OBJECT IDENTIFIER ::= {
|
||||
// iso(1) member-body(2) us(840) ansi-X9-62(10045) curves(3)
|
||||
// prime(1) 7 }
|
||||
//
|
||||
// secp384r1 OBJECT IDENTIFIER ::= {
|
||||
// iso(1) identified-organization(3) certicom(132) curve(0) 34 }
|
||||
//
|
||||
// secp521r1 OBJECT IDENTIFIER ::= {
|
||||
// iso(1) identified-organization(3) certicom(132) curve(0) 35 }
|
||||
//
|
||||
// NB: secp256r1 is equivalent to prime256v1
|
||||
var (
|
||||
oidNamedCurveP224 = asn1.ObjectIdentifier{1, 3, 132, 0, 33}
|
||||
oidNamedCurveP256 = asn1.ObjectIdentifier{1, 2, 840, 10045, 3, 1, 7}
|
||||
oidNamedCurveP384 = asn1.ObjectIdentifier{1, 3, 132, 0, 34}
|
||||
oidNamedCurveP521 = asn1.ObjectIdentifier{1, 3, 132, 0, 35}
|
||||
)
|
||||
|
||||
func namedCurveFromOID(oid asn1.ObjectIdentifier) elliptic.Curve {
|
||||
switch {
|
||||
case oid.Equal(oidNamedCurveP224):
|
||||
return elliptic.P224()
|
||||
case oid.Equal(oidNamedCurveP256):
|
||||
return elliptic.P256()
|
||||
case oid.Equal(oidNamedCurveP384):
|
||||
return elliptic.P384()
|
||||
case oid.Equal(oidNamedCurveP521):
|
||||
return elliptic.P521()
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// KeyUsage represents the set of actions that are valid for a given key. It's
|
||||
// a bitmap of the KeyUsage* constants.
|
||||
type KeyUsage int
|
||||
|
||||
const (
|
||||
KeyUsageDigitalSignature KeyUsage = 1 << iota
|
||||
KeyUsageContentCommitment
|
||||
KeyUsageKeyEncipherment
|
||||
KeyUsageDataEncipherment
|
||||
KeyUsageKeyAgreement
|
||||
KeyUsageCertSign
|
||||
KeyUsageCRLSign
|
||||
KeyUsageEncipherOnly
|
||||
KeyUsageDecipherOnly
|
||||
)
|
||||
|
||||
// RFC 5280, 4.2.1.12 Extended Key Usage
|
||||
//
|
||||
// anyExtendedKeyUsage OBJECT IDENTIFIER ::= { id-ce-extKeyUsage 0 }
|
||||
//
|
||||
// id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
|
||||
//
|
||||
// id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 }
|
||||
// id-kp-clientAuth OBJECT IDENTIFIER ::= { id-kp 2 }
|
||||
// id-kp-codeSigning OBJECT IDENTIFIER ::= { id-kp 3 }
|
||||
// id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 }
|
||||
// id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 }
|
||||
// id-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-kp 9 }
|
||||
var (
|
||||
oidExtKeyUsageAny = asn1.ObjectIdentifier{2, 5, 29, 37, 0}
|
||||
oidExtKeyUsageServerAuth = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 1}
|
||||
oidExtKeyUsageClientAuth = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 2}
|
||||
oidExtKeyUsageCodeSigning = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 3}
|
||||
oidExtKeyUsageEmailProtection = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 4}
|
||||
oidExtKeyUsageIPSECEndSystem = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 5}
|
||||
oidExtKeyUsageIPSECTunnel = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 6}
|
||||
oidExtKeyUsageIPSECUser = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 7}
|
||||
oidExtKeyUsageTimeStamping = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 8}
|
||||
oidExtKeyUsageOCSPSigning = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 9}
|
||||
oidExtKeyUsageMicrosoftServerGatedCrypto = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 311, 10, 3, 3}
|
||||
oidExtKeyUsageNetscapeServerGatedCrypto = asn1.ObjectIdentifier{2, 16, 840, 1, 113730, 4, 1}
|
||||
oidExtKeyUsageMicrosoftCommercialCodeSigning = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 311, 2, 1, 22}
|
||||
oidExtKeyUsageMicrosoftKernelCodeSigning = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 311, 61, 1, 1}
|
||||
)
|
||||
|
||||
// ExtKeyUsage represents an extended set of actions that are valid for a given key.
|
||||
// Each of the ExtKeyUsage* constants define a unique action.
|
||||
type ExtKeyUsage int
|
||||
|
||||
const (
|
||||
ExtKeyUsageAny ExtKeyUsage = iota
|
||||
ExtKeyUsageServerAuth
|
||||
ExtKeyUsageClientAuth
|
||||
ExtKeyUsageCodeSigning
|
||||
ExtKeyUsageEmailProtection
|
||||
ExtKeyUsageIPSECEndSystem
|
||||
ExtKeyUsageIPSECTunnel
|
||||
ExtKeyUsageIPSECUser
|
||||
ExtKeyUsageTimeStamping
|
||||
ExtKeyUsageOCSPSigning
|
||||
ExtKeyUsageMicrosoftServerGatedCrypto
|
||||
ExtKeyUsageNetscapeServerGatedCrypto
|
||||
ExtKeyUsageMicrosoftCommercialCodeSigning
|
||||
ExtKeyUsageMicrosoftKernelCodeSigning
|
||||
)
|
||||
|
||||
// extKeyUsageOIDs contains the mapping between an ExtKeyUsage and its OID.
|
||||
var extKeyUsageOIDs = []struct {
|
||||
extKeyUsage ExtKeyUsage
|
||||
oid asn1.ObjectIdentifier
|
||||
}{
|
||||
{ExtKeyUsageAny, oidExtKeyUsageAny},
|
||||
{ExtKeyUsageServerAuth, oidExtKeyUsageServerAuth},
|
||||
{ExtKeyUsageClientAuth, oidExtKeyUsageClientAuth},
|
||||
{ExtKeyUsageCodeSigning, oidExtKeyUsageCodeSigning},
|
||||
{ExtKeyUsageEmailProtection, oidExtKeyUsageEmailProtection},
|
||||
{ExtKeyUsageIPSECEndSystem, oidExtKeyUsageIPSECEndSystem},
|
||||
{ExtKeyUsageIPSECTunnel, oidExtKeyUsageIPSECTunnel},
|
||||
{ExtKeyUsageIPSECUser, oidExtKeyUsageIPSECUser},
|
||||
{ExtKeyUsageTimeStamping, oidExtKeyUsageTimeStamping},
|
||||
{ExtKeyUsageOCSPSigning, oidExtKeyUsageOCSPSigning},
|
||||
{ExtKeyUsageMicrosoftServerGatedCrypto, oidExtKeyUsageMicrosoftServerGatedCrypto},
|
||||
{ExtKeyUsageNetscapeServerGatedCrypto, oidExtKeyUsageNetscapeServerGatedCrypto},
|
||||
{ExtKeyUsageMicrosoftCommercialCodeSigning, oidExtKeyUsageMicrosoftCommercialCodeSigning},
|
||||
{ExtKeyUsageMicrosoftKernelCodeSigning, oidExtKeyUsageMicrosoftKernelCodeSigning},
|
||||
}
|
||||
|
||||
func extKeyUsageFromOID(oid asn1.ObjectIdentifier) (eku ExtKeyUsage, ok bool) {
|
||||
for _, pair := range extKeyUsageOIDs {
|
||||
if oid.Equal(pair.oid) {
|
||||
return pair.extKeyUsage, true
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
const (
|
||||
nameTypeEmail = 1
|
||||
nameTypeDNS = 2
|
||||
nameTypeURI = 6
|
||||
nameTypeIP = 7
|
||||
)
|
||||
|
||||
var (
|
||||
oidExtensionAuthorityInfoAccess = []int{1, 3, 6, 1, 5, 5, 7, 1, 1}
|
||||
)
|
||||
|
||||
var (
|
||||
oidAuthorityInfoAccessOcsp = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 48, 1}
|
||||
oidAuthorityInfoAccessIssuers = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 48, 2}
|
||||
)
|
||||
|
||||
func isIA5String(s string) error {
|
||||
for _, r := range s {
|
||||
// Per RFC5280 "IA5String is limited to the set of ASCII characters"
|
||||
if r > unicode.MaxASCII {
|
||||
return fmt.Errorf("x509: %q cannot be encoded as an IA5String", s)
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
Reference in New Issue
Block a user