ctl

Documentation

Index

• Constants
• type AppleCTL
  • func NewAppleCTL() *AppleCTL
  • func (ctl *AppleCTL) Fetch() error
  • func (ctl *AppleCTL) Verify(certs []*Cert, allowedCerts Entrys) *VerifyResult
• type CTL
  • func NewCTL() *CTL
• type Cert
• type CertStore
  • func LoadSystemRoots() (*CertStore, error)
  • func NewCertStore() *CertStore
  • func (s *CertStore) AddCert(cert *x509.Certificate)
  • func (s *CertStore) AppendCertsFromPEM(pemCerts []byte) (ok bool)
• type Entrys
• type MicrosoftCTL
  • func NewMicrosoftCTL() *MicrosoftCTL
  • func (ctl *MicrosoftCTL) Fetch() error
  • func (ctl *MicrosoftCTL) Verify(certs []*Cert, allowedCerts Entrys) *VerifyResult
• type MozillaCTL
  • func NewMozillaCTL() *MozillaCTL
  • func (ctl *MozillaCTL) Fetch() error
  • func (ctl *MozillaCTL) Verify(certs []*Cert, allowedCerts Entrys) *VerifyResult
• type VerifyResult
  • func (result *VerifyResult) ConsoleReport() (output string)

Constants

const (
	MICROSOFT   = "microsoft"
	MOZILLA_NSS = "mozilla_nss"
	OPENJDK     = "openjdk"
)

const (
	MicrosoftCACertificateReportCSV = "https://ccadb-public.secure.force.com/microsoft/IncludedCACertificateReportForMSFTCSV"
	MicrosoftAuthrootStl            = "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authroot.stl"
)

const (
	MozillaIncludedCACertificateReportCSV = "https://ccadb-public.secure.force.com/mozilla/IncludedCACertificateReportCSVFormat"
	MozillaRemovedCACertificateReportCSV  = "https://ccadb-public.secure.force.com/mozilla/RemovedCACertificateReportCSVFormat"
)

const AppleKBURL = "https://support.apple.com/en-us/HT209143"

Types

type AppleCTL

type AppleCTL struct {
	*CTL          `yaml:",inline"`
	PublishURL    string `yaml:"publish_url,omitempty"`
	PublishedDate string `yaml:"published_date,omitempty"`
}

func NewAppleCTL

func NewAppleCTL() *AppleCTL

func (*AppleCTL) Fetch

func (ctl *AppleCTL) Fetch() error

func (*AppleCTL) Verify

func (ctl *AppleCTL) Verify(certs []*Cert, allowedCerts Entrys) *VerifyResult

Verify that the specified certificate is included in the CTL or has been removed

type CTL

type CTL struct {
	UpdatedAt time.Time `yaml:"updated_at,omitempty"`
	Trusted   Entrys    `yaml:"trusted"`
	Removed   Entrys    `yaml:"removed,omitempty"`
}

func NewCTL

func NewCTL() *CTL

type Cert

type Cert struct {
	*x509.Certificate `json:"_"`
	Checksum          string `json:"checksum,omitempty"`
}

Cert adds Checksum field to x509.Cerificate to store SHA256

type CertStore

type CertStore struct {
	Certs []*Cert
	// contains filtered or unexported fields
}

CertStore is a set of certificates.

func LoadSystemRoots

func LoadSystemRoots() (*CertStore, error)

func NewCertStore

func NewCertStore() *CertStore

NewCertStore returns a new, empty CertStore.

func (*CertStore) AddCert

func (s *CertStore) AddCert(cert *x509.Certificate)

AddCert adds a certificate to CertStore.

func (*CertStore) AppendCertsFromPEM

func (s *CertStore) AppendCertsFromPEM(pemCerts []byte) (ok bool)

AppendCertsFromPEM attempts to parse a series of PEM encoded certificates. It appends any certificates found to s and reports whether any certificates were successfully parsed.

On many Linux systems, /etc/ssl/cert.pem will contain the system wide set of root CAs in a format suitable for this function.

type Entrys

type Entrys map[string]string

Entrys maps from sum256(cert.Raw) to subject name.

type MicrosoftCTL

type MicrosoftCTL struct {
	*CTL          `yaml:",inline"`
	CCADBUrl      string `yaml:"ccadb_url"`
	CCADBChecksum string `yaml:"ccadb_checksum,omitempty"`
}

func NewMicrosoftCTL

func NewMicrosoftCTL() *MicrosoftCTL

func (*MicrosoftCTL) Fetch

func (ctl *MicrosoftCTL) Fetch() error

Fetch Microsoft's CTL from two sources, ccadb and authroot.stl

func (*MicrosoftCTL) Verify

func (ctl *MicrosoftCTL) Verify(certs []*Cert, allowedCerts Entrys) *VerifyResult

Verify that the specified certificate is included in the CTL or has been removed

type MozillaCTL

type MozillaCTL struct {
	*CTL             `yaml:",inline"`
	URLIncluded      string `yaml:"url_included,omitempty"`
	ChecksumIncluded string `yaml:"checksum_included,omitempty"`
	URLRemoved       string `yaml:"url_removed,omitempty"`
	ChecksumRemoved  string `yaml:"checksum_removed,omitempty"`
}

func NewMozillaCTL

func NewMozillaCTL() *MozillaCTL

func (*MozillaCTL) Fetch

func (ctl *MozillaCTL) Fetch() error

Fetch Mozilla's CA certificate report from https://www.ccadb.org

func (*MozillaCTL) Verify

func (ctl *MozillaCTL) Verify(certs []*Cert, allowedCerts Entrys) *VerifyResult

Verify that the specified certificate is included in the CTL or has been removed

type VerifyResult

type VerifyResult struct {
	Total        int
	TrustedCerts []*Cert `json:"_"`
	AllowedCerts []*Cert `json:"allowed_certs,omitempty"`

	RemovedCerts []*Cert `json:"removed_certs,omitempty"`

	UnknownCerts []*Cert `json:"unknown_certs,omitempty"`
	// contains filtered or unexported fields
}

func (*VerifyResult) ConsoleReport

func (result *VerifyResult) ConsoleReport() (output string)