type InvalidReason … const NotAuthorizedToSign … const Expired … const CANotAuthorizedForThisName … const TooManyIntermediates … const IncompatibleUsage … const NameMismatch … const NameConstraintsWithoutSANs … const UnconstrainedName … const TooManyConstraints … const CANotAuthorizedForExtKeyUsage … type CertificateInvalidError … func (e CertificateInvalidError) Error() string { … } type HostnameError … func (h HostnameError) Error() string { … } type UnknownAuthorityError … func (e UnknownAuthorityError) Error() string { … } type SystemRootsError … func (se SystemRootsError) Error() string { … } func (se SystemRootsError) Unwrap() error { … } var errNotParsed … type VerifyOptions … const leafCertificate … const intermediateCertificate … const rootCertificate … type rfc2821Mailbox … // parseRFC2821Mailbox parses an email address into local and domain parts, // based on the ABNF for a “Mailbox” from RFC 2821. According to RFC 5280, // Section 4.2.1.6 that's correct for an rfc822Name from a certificate: “The // format of an rfc822Name is a "Mailbox" as defined in RFC 2821, Section 4.1.2”. func parseRFC2821Mailbox(in string) (mailbox rfc2821Mailbox, ok bool) { … } // domainToReverseLabels converts a textual domain name like foo.example.com to // the list of labels in reverse order, e.g. ["com", "example", "foo"]. func domainToReverseLabels(domain string) (reverseLabels []string, ok bool) { … } func matchEmailConstraint(mailbox rfc2821Mailbox, constraint string) (bool, error) { … } func matchURIConstraint(uri *url.URL, constraint string) (bool, error) { … } func matchIPConstraint(ip net.IP, constraint *net.IPNet) (bool, error) { … } func matchDomainConstraint(domain, constraint string) (bool, error) { … } // checkNameConstraints checks that c permits a child certificate to claim the // given name, of type nameType. The argument parsedName contains the parsed // form of name, suitable for passing to the match function. The total number // of comparisons is tracked in the given count and should not exceed the given // limit. func (c *Certificate) checkNameConstraints(count *int, maxConstraintComparisons int, nameType string, name string, parsedName any, match func(parsedName, constraint any) (match bool, err error), permitted, excluded any) error { … } // isValid performs validity checks on c given that it is a candidate to append // to the chain in currentChain. func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *VerifyOptions) error { … } // Verify attempts to verify c by building one or more chains from c to a // certificate in opts.Roots, using certificates in opts.Intermediates if // needed. If successful, it returns one or more chains where the first // element of the chain is c and the last element is from opts.Roots. // // If opts.Roots is nil, the platform verifier might be used, and // verification details might differ from what is described below. If system // roots are unavailable the returned error will be of type SystemRootsError. // // Name constraints in the intermediates will be applied to all names claimed // in the chain, not just opts.DNSName. Thus it is invalid for a leaf to claim // example.com if an intermediate doesn't permit it, even if example.com is not // the name being validated. Note that DirectoryName constraints are not // supported. // // Name constraint validation follows the rules from RFC 5280, with the // addition that DNS name constraints may use the leading period format // defined for emails and URIs. When a constraint has a leading period // it indicates that at least one additional label must be prepended to // the constrained name to be considered valid. // // Extended Key Usage values are enforced nested down a chain, so an intermediate // or root that enumerates EKUs prevents a leaf from asserting an EKU not in that // list. (While this is not specified, it is common practice in order to limit // the types of certificates a CA can issue.) // // Certificates that use SHA1WithRSA and ECDSAWithSHA1 signatures are not supported, // and will not be used to build chains. // // Certificates other than c in the returned chains should not be modified. // // WARNING: this function doesn't do any revocation checking. func (c *Certificate) Verify(opts VerifyOptions) (chains [][]*Certificate, err error) { … } func appendToFreshChain(chain []*Certificate, cert *Certificate) []*Certificate { … } // alreadyInChain checks whether a candidate certificate is present in a chain. // Rather than doing a direct byte for byte equivalency check, we check if the // subject, public key, and SAN, if present, are equal. This prevents loops that // are created by mutual cross-signatures, or other cross-signature bridge // oddities. func alreadyInChain(candidate *Certificate, chain []*Certificate) bool { … } const maxChainSignatureChecks … func (c *Certificate) buildChains(currentChain []*Certificate, sigChecks *int, opts *VerifyOptions) (chains [][]*Certificate, err error) { … } func validHostnamePattern(host string) bool { … } func validHostnameInput(host string) bool { … } // validHostname reports whether host is a valid hostname that can be matched or // matched against according to RFC 6125 2.2, with some leniency to accommodate // legacy values. func validHostname(host string, isPattern bool) bool { … } func matchExactly(hostA, hostB string) bool { … } func matchHostnames(pattern, host string) bool { … } // toLowerCaseASCII returns a lower-case version of in. See RFC 6125 6.4.1. We use // an explicitly ASCII function to avoid any sharp corners resulting from // performing Unicode operations on DNS labels. func toLowerCaseASCII(in string) string { … } // VerifyHostname returns nil if c is a valid certificate for the named host. // Otherwise it returns an error describing the mismatch. // // IP addresses can be optionally enclosed in square brackets and are checked // against the IPAddresses field. Other names are checked case insensitively // against the DNSNames field. If the names are valid hostnames, the certificate // fields can have a wildcard as the complete left-most label (e.g. *.example.com). // // Note that the legacy Common Name field is ignored. func (c *Certificate) VerifyHostname(h string) error { … } func checkChainForKeyUsage(chain []*Certificate, keyUsages []ExtKeyUsage) bool { … }
Codebase Browser
go