github.com/zmap/zlint@v1.1.0/lints/lint_distribution_point_incomplete.go (about)

     1  package lints
     2  
     3  /*
     4   * ZLint Copyright 2018 Regents of the University of Michigan
     5   *
     6   * Licensed under the Apache License, Version 2.0 (the "License"); you may not
     7   * use this file except in compliance with the License. You may obtain a copy
     8   * of the License at http://www.apache.org/licenses/LICENSE-2.0
     9   *
    10   * Unless required by applicable law or agreed to in writing, software
    11   * distributed under the License is distributed on an "AS IS" BASIS,
    12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
    13   * implied. See the License for the specific language governing
    14   * permissions and limitations under the License.
    15   */
    16  
    17  /********************************************************************
    18  The cRLDistributionPoints extension is a SEQUENCE of
    19  DistributionPoint.  A DistributionPoint consists of three fields,
    20  each of which is optional: distributionPoint, reasons, and cRLIssuer.
    21  While each of these fields is optional, a DistributionPoint MUST NOT
    22  consist of only the reasons field; either distributionPoint or
    23  cRLIssuer MUST be present.  If the certificate issuer is not the CRL
    24  issuer, then the cRLIssuer field MUST be present and contain the Name
    25  of the CRL issuer.  If the certificate issuer is also the CRL issuer,
    26  then conforming CAs MUST omit the cRLIssuer field and MUST include
    27  the distributionPoint field.
    28  ********************************************************************/
    29  
    30  import (
    31  	"encoding/asn1"
    32  
    33  	"github.com/zmap/zcrypto/x509"
    34  	"github.com/zmap/zcrypto/x509/pkix"
    35  	"github.com/zmap/zlint/util"
    36  )
    37  
    38  type distributionPoint struct {
    39  	DistributionPoint distributionPointName `asn1:"optional,tag:0"`
    40  	Reason            asn1.BitString        `asn1:"optional,tag:1"`
    41  	CRLIssuer         asn1.RawValue         `asn1:"optional,tag:2"`
    42  }
    43  
    44  type distributionPointName struct {
    45  	FullName     asn1.RawValue    `asn1:"optional,tag:0"`
    46  	RelativeName pkix.RDNSequence `asn1:"optional,tag:1"`
    47  }
    48  
    49  type dpIncomplete struct{}
    50  
    51  func (l *dpIncomplete) Initialize() error {
    52  	return nil
    53  }
    54  
    55  func (l *dpIncomplete) CheckApplies(c *x509.Certificate) bool {
    56  	return util.IsExtInCert(c, util.CrlDistOID)
    57  }
    58  
    59  func (l *dpIncomplete) Execute(c *x509.Certificate) *LintResult {
    60  	dp := util.GetExtFromCert(c, util.CrlDistOID)
    61  	var cdp []distributionPoint
    62  	_, err := asn1.Unmarshal(dp.Value, &cdp)
    63  	if err != nil {
    64  		return &LintResult{Status: Fatal}
    65  	}
    66  	for _, dp := range cdp {
    67  		if dp.Reason.BitLength != 0 && len(dp.DistributionPoint.FullName.Bytes) == 0 &&
    68  			dp.DistributionPoint.RelativeName == nil && len(dp.CRLIssuer.Bytes) == 0 {
    69  			return &LintResult{Status: Error}
    70  		}
    71  	}
    72  	return &LintResult{Status: Pass}
    73  }
    74  
    75  func init() {
    76  	RegisterLint(&Lint{
    77  		Name:          "e_distribution_point_incomplete",
    78  		Description:   "A DistributionPoint from the CRLDistributionPoints extension MUST NOT consist of only the reasons field; either distributionPoint or CRLIssuer must be present",
    79  		Citation:      "RFC 5280: 4.2.1.13",
    80  		Source:        RFC5280,
    81  		EffectiveDate: util.RFC3280Date,
    82  		Lint:          &dpIncomplete{},
    83  	})
    84  }