Skip to content

Commit 84d4de1

Browse files
binbin-libinbin-li
authored
fix: fix the certs validation in trust store (#147)
Signed-off-by: Binbin Li <[email protected]>
1 parent ea9ee15 commit 84d4de1

File tree

5 files changed

+116
-47
lines changed

5 files changed

+116
-47
lines changed

‎verification/store.go

+24-8
Original file line numberDiff line numberDiff line change
@@ -52,14 +52,8 @@ func LoadX509TrustStore(path string) (*X509TrustStore, error) {
5252
return nil, fmt.Errorf("error while reading certificates from %q: %w", joinedPath, err)
5353
}
5454

55-
// to prevent any trust store misconfigurations, ensure there is at least one certificate from each file
56-
if len(certs) < 1 {
57-
return nil, fmt.Errorf("could not parse a certificate from %q, every file in a trust store must have a PEM or DER certificate in it", joinedPath)
58-
}
59-
for _, cert := range certs {
60-
if !cert.IsCA {
61-
return nil, fmt.Errorf("certificate with subject %q from file %q is not a CA certificate, only CA certificates (BasicConstraint CA=True) are allowed", cert.Subject, joinedPath)
62-
}
55+
if err := validateCerts(certs, joinedPath); err != nil {
56+
return nil, err
6357
}
6458

6559
trustStore.Certificates = append(trustStore.Certificates, certs...)
@@ -75,3 +69,25 @@ func LoadX509TrustStore(path string) (*X509TrustStore, error) {
7569

7670
return &trustStore, nil
7771
}
72+
73+
func validateCerts(certs []*x509.Certificate, path string) error {
74+
// to prevent any trust store misconfigurations, ensure there is at least
75+
// one certificate from each file.
76+
if len(certs) < 1 {
77+
return fmt.Errorf("could not parse a certificate from %q, every file in a trust store must have a PEM or DER certificate in it", path)
78+
}
79+
80+
for _, cert := range certs {
81+
if !cert.IsCA {
82+
if err := cert.CheckSignatureFrom(cert); err != nil {
83+
return fmt.Errorf(
84+
"certificate with subject %q from file %q is not a CA certificate or self-signed signing certificate",
85+
cert.Subject,
86+
path,
87+
)
88+
}
89+
}
90+
}
91+
92+
return nil
93+
}

‎verification/store_test.go

+10-1
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,16 @@ func TestLoadTrustStoreWithLeafCerts(t *testing.T) {
6868
path := filepath.FromSlash("testdata/truststore/x509/trust-store-with-leaf-certs")
6969
failurePath := filepath.FromSlash("testdata/truststore/x509/trust-store-with-leaf-certs/non-ca.crt")
7070
_, err := LoadX509TrustStore(path)
71-
if err == nil || err.Error() != fmt.Sprintf("certificate with subject \"CN=lol,OU=lol,O=lol,L=lol,ST=Some-State,C=AU,1.2.840.113549.1.9.1=#13036c6f6c\" from file %q is not a CA certificate, only CA certificates (BasicConstraint CA=True) are allowed", failurePath) {
71+
if err == nil || err.Error() != fmt.Sprintf("certificate with subject \"CN=wabbit-networks.io,O=Notary,L=Seattle,ST=WA,C=US\" from file %q is not a CA certificate or self-signed signing certificate", failurePath) {
72+
t.Fatalf("leaf cert in a trust store should return error : %q", err)
73+
}
74+
}
75+
76+
func TestLoadTrustStoreWithLeafCertsInSingleFile(t *testing.T) {
77+
path := filepath.FromSlash("testdata/truststore/x509/trust-store-with-leaf-certs-in-single-file")
78+
failurePath := filepath.FromSlash("testdata/truststore/x509/trust-store-with-leaf-certs-in-single-file/RootAndLeafCerts.crt")
79+
_, err := LoadX509TrustStore(path)
80+
if err == nil || err.Error() != fmt.Sprintf("certificate with subject \"CN=wabbit-networks.io,O=Notary,L=Seattle,ST=WA,C=US\" from file %q is not a CA certificate or self-signed signing certificate", failurePath) {
7281
t.Fatalf("leaf cert in a trust store should return error : %q", err)
7382
}
7483
}

‎verification/testdata/truststore/x509/trust-store-with-leaf-certs-in-single-file/RootAndLeafCerts.crt

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDejCCAmKgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJVUzEL
3+
MAkGA1UECBMCV0ExEDAOBgNVBAcTB1NlYXR0bGUxDzANBgNVBAoTBk5vdGFyeTEe
4+
MBwGA1UEAxMVd2FiYml0LW5ldHdvcmtzLmlvIENBMB4XDTIyMDkyMDA2MzExM1oX
5+
DTIyMDkyMTA2MzExM1owWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYD
6+
VQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZOb3RhcnkxGzAZBgNVBAMTEndhYmJpdC1u
7+
ZXR3b3Jrcy5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALiZp5O+
8+
6YtaNO5GbWaZUxvJPXktJ7k7LBX5G/Kn6eh9JkJln1agqbax9MRDB/5YCdQBKMBq
9+
NE2wYIwmCs7ArFU5DxvRhoBnCGLjcsIZ9pfaZ6lBppEvxMmUAYDmgjze0J13PwRp
10+
WAZMfBlisZnJAWokgE5sWtggUXURyFk67H0R+4sWlm8SSZOiJCA/e0bYPCHTfFA/
11+
2zg6koNRSwvI6zvftGnnJ9ny0BTuGOjZ6lDfIX5awFrgRdO8wmwejo4oJ45tUotF
12+
/Rt/yHkmjdGhONbJjcMLf9AIyVwMHg6t6mj2SYbHqzIyTcpjk90HgeiU5eS5JMqj
13+
Jkug5U9XrGGCqIcCAwEAAaNIMEYwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoG
14+
CCsGAQUFBwMDMB8GA1UdIwQYMBaAFLAy4Il5S9zOd/AMWF8hATmldAjYMA0GCSqG
15+
SIb3DQEBCwUAA4IBAQBLYBnSuMNCzzLmeqH/wBr6kKUtF10AN9VF8/3iZW8iCj4B
16+
Bx7VDq7iZR/G9UTLsWdZqkkxnOGu4QffBHz2Lc1v9D923EEPDAP5mJYvUchvdXYT
17+
lmyQr9QEjRC6IFhlBB27Bi207QJ8UxYgmbseQ3FQFE16Usdmlg9iWDn5tx/DZn9/
18+
yUd81yKKYp2uLx0x2sQDJh61QSZB6jtzjN7w4Xax2NViabLaH7raMrDbIqigkXJh
19+
iXG9fWx1Ax7S3dJVIglbZGPgYDW14Ass40gs8vcOBg8CwszrKiEuwp20d12Ky87/
20+
0pLsOWJmcNyXbd3gztX01N1frSEbvTBJNI9E/jmI
21+
-----END CERTIFICATE-----
22+
-----BEGIN CERTIFICATE-----
23+
MIIDjzCCAnegAwIBAgIBATANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJVUzEL
24+
MAkGA1UECBMCV0ExEDAOBgNVBAcTB1NlYXR0bGUxDzANBgNVBAoTBk5vdGFyeTEe
25+
MBwGA1UEAxMVd2FiYml0LW5ldHdvcmtzLmlvIENBMB4XDTIyMDkyMDA2MzExM1oX
26+
DTIyMTAyMDA2MzExM1owXTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYD
27+
VQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZOb3RhcnkxHjAcBgNVBAMTFXdhYmJpdC1u
28+
ZXR3b3Jrcy5pbyBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKNM
29+
3dUToC4TyegGMw47ax9aZt13pQgTeV7xZbVsOmZiv/8gZ9tEZWgQbvBJrWUH8y4o
30+
eQLCVQOTESNP2TSyTqizNtG1ex6YfSpWKSqUkfGX2II9xCX8hNXZqTphAjrGGf2Z
31+
EOLRIIkbhjkuiAR+7q4TF/KJhdfYD1HQBJ2PF92egV5JEZTrxIjVIi+WK19VKSwx
32+
m7oFiijve4VPaQYQnWgj0dk+Tn9cMB/OMX6cszoJbn98ogQIvWaY3dd1qba4uGJ9
33+
vmkNKDJcUd1PbkaVlikXC4UM+PxXy7/ZvSihOXurAPIChS6JgWC8Ru2vxm9SC+BN
34+
5J/hr92W2TdsrvLkrc8CAwEAAaNaMFgwDgYDVR0PAQH/BAQDAgIEMBMGA1UdJQQM
35+
MAoGCCsGAQUFBwMDMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFLAy4Il5
36+
S9zOd/AMWF8hATmldAjYMA0GCSqGSIb3DQEBCwUAA4IBAQCTf6GbT5Z0x5ciNr9i
37+
8i+QsIAg7ZHzv5RLLJuocGcKwbdi+btU6BPl/X4U5ZB6OArv4oiyPSbECoxkgGRq
38+
cj+mfzXdm/3jEyRskHDfoxcJFYmcBsEykS7DoLYEy5HxgKSaGOLl4dMWbbj/E8mR
39+
e9XC5ruvPNZX52pQMqSqUUTYlbR4YQojsp7ShcLLD/Iea90wXk44+wHAKNFpwkN1
40+
h5JMlYm+jKkol6u/Nmd3vNqhzrL91ZLPVtSWpfsBxh7l4BsDns2uPl+/fgCav9MJ
41+
jUkWJbEaDPY5bSbHDhCbxMO37VbvkkFUvz7lfKAkXj6DnkPzMj3++KTFNdw3fJ4+
42+
WzLe
43+
-----END CERTIFICATE-----

‎verification/testdata/truststore/x509/trust-store-with-leaf-certs/GlobalSignRootCA.crt

+20-19
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,22 @@
11
-----BEGIN CERTIFICATE-----
2-
MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAwTDEgMB4G
3-
A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNp
4-
Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4
5-
MTAwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEG
6-
A1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZI
7-
hvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5BngiFvXAg7aEyiie/QV2EcWtiHL8
8-
RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X17YUhhB5uzsT
9-
gHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm
10-
KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zd
11-
QQ4gOsC0p6Hpsk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZ
12-
XriX7613t2Saer9fwRPvm2L7DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAw
13-
DgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFI/wS3+o
14-
LkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBLQNvAUKr+yAzv95ZU
15-
RUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25sbwMp
16-
jjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK
17-
6fBdRoyV3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQX
18-
mcIfeg7jLQitChws/zyrVQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecs
19-
Mx86OyXShkDOOyyGeMlhLxS67ttVb9+E7gUJTb0o2HLO02JQZR7rkpeDMdmztcpH
20-
WD9f
2+
MIIDjzCCAnegAwIBAgIBATANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJVUzEL
3+
MAkGA1UECBMCV0ExEDAOBgNVBAcTB1NlYXR0bGUxDzANBgNVBAoTBk5vdGFyeTEe
4+
MBwGA1UEAxMVd2FiYml0LW5ldHdvcmtzLmlvIENBMB4XDTIyMDkyMDA2MzExM1oX
5+
DTIyMTAyMDA2MzExM1owXTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYD
6+
VQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZOb3RhcnkxHjAcBgNVBAMTFXdhYmJpdC1u
7+
ZXR3b3Jrcy5pbyBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKNM
8+
3dUToC4TyegGMw47ax9aZt13pQgTeV7xZbVsOmZiv/8gZ9tEZWgQbvBJrWUH8y4o
9+
eQLCVQOTESNP2TSyTqizNtG1ex6YfSpWKSqUkfGX2II9xCX8hNXZqTphAjrGGf2Z
10+
EOLRIIkbhjkuiAR+7q4TF/KJhdfYD1HQBJ2PF92egV5JEZTrxIjVIi+WK19VKSwx
11+
m7oFiijve4VPaQYQnWgj0dk+Tn9cMB/OMX6cszoJbn98ogQIvWaY3dd1qba4uGJ9
12+
vmkNKDJcUd1PbkaVlikXC4UM+PxXy7/ZvSihOXurAPIChS6JgWC8Ru2vxm9SC+BN
13+
5J/hr92W2TdsrvLkrc8CAwEAAaNaMFgwDgYDVR0PAQH/BAQDAgIEMBMGA1UdJQQM
14+
MAoGCCsGAQUFBwMDMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFLAy4Il5
15+
S9zOd/AMWF8hATmldAjYMA0GCSqGSIb3DQEBCwUAA4IBAQCTf6GbT5Z0x5ciNr9i
16+
8i+QsIAg7ZHzv5RLLJuocGcKwbdi+btU6BPl/X4U5ZB6OArv4oiyPSbECoxkgGRq
17+
cj+mfzXdm/3jEyRskHDfoxcJFYmcBsEykS7DoLYEy5HxgKSaGOLl4dMWbbj/E8mR
18+
e9XC5ruvPNZX52pQMqSqUUTYlbR4YQojsp7ShcLLD/Iea90wXk44+wHAKNFpwkN1
19+
h5JMlYm+jKkol6u/Nmd3vNqhzrL91ZLPVtSWpfsBxh7l4BsDns2uPl+/fgCav9MJ
20+
jUkWJbEaDPY5bSbHDhCbxMO37VbvkkFUvz7lfKAkXj6DnkPzMj3++KTFNdw3fJ4+
21+
WzLe
2122
-----END CERTIFICATE-----

‎verification/testdata/truststore/x509/trust-store-with-leaf-certs/non-ca.crt

+19-19
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
11
-----BEGIN CERTIFICATE-----
2-
MIIDZTCCAk0CFDdMWsovoK72JCA5YAxXSF+aTb50MA0GCSqGSIb3DQEBCwUAMG4x
3-
CzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMQwwCgYDVQQHDANsb2wx
4-
DDAKBgNVBAoMA2xvbDEMMAoGA1UECwwDbG9sMQwwCgYDVQQDDANsb2wxEjAQBgkq
5-
hkiG9w0BCQEWA2xvbDAgFw0yMjA1MjQxOTE2NDFaGA8yMTIyMDQzMDE5MTY0MVow
6-
bjELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxDDAKBgNVBAcMA2xv
7-
bDEMMAoGA1UECgwDbG9sMQwwCgYDVQQLDANsb2wxDDAKBgNVBAMMA2xvbDESMBAG
8-
CSqGSIb3DQEJARYDbG9sMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
9-
wre/7J4WeS0UwcOKe4qv4pcsl0mbG2riLAWv4E3ZhMdJdzCYYk6+k8NjY05AR6AQ
10-
KbRw8Ree1lsHa7hXfL5Gg8sER4Gq4vMN9VBqbljWI7KNsd9C16wTTlZEJaaery5j
11-
3GI0Co59rYjt9FcoqilkJuWnxr7+m7qdnFFa5ASoPQJPwE1LF1Aq1iTUdxeMxIO7
12-
wlu7hNfWom33JS71rnlfIx5/ja0r+LrJ8M0YfjFmBlTP6SBHtSLhV3W0eNZLEGF1
13-
iuULYrpbo51fT4f5j1T6gtAlCDMgBzg1aItargqz2SsG1j3OAt5HsJgVViF+xC02
14-
tsHRhkkLQELsTZUg/QpyIwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBVntmzsNiu
15-
QlXqwATAGVZ2MGxziXXVTqG/nbBGFJy1Ge3VEjMgu9AqJEBSlPXTDU1jQvSLlyvg
16-
+381CyeBuXrrvTjUziM398s3QqZqDrs3eyW9j4AuOicRao4Dfu/HP7cCWQemuOB4
17-
yihhGdaJMlExhV0fsi36OJZOw6fasvAsnjr+S1IkojxNRJLhpduAC6IY1s1/SRgn
18-
5u3/5erMgmVCnJSlIDkGSJZzCXhzSDgW4ui3VB//+JsO1OsP0p2kzftXOQpcEaEh
19-
DVnY2YybASxFJTXAFo3CKIoaeOW30fGCKi2hzocK0w5ky18703/lN/Bx2CPFVS8e
20-
dP9/ttZCG47o
2+
MIIDejCCAmKgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJVUzEL
3+
MAkGA1UECBMCV0ExEDAOBgNVBAcTB1NlYXR0bGUxDzANBgNVBAoTBk5vdGFyeTEe
4+
MBwGA1UEAxMVd2FiYml0LW5ldHdvcmtzLmlvIENBMB4XDTIyMDkyMDA2MzExM1oX
5+
DTIyMDkyMTA2MzExM1owWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYD
6+
VQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZOb3RhcnkxGzAZBgNVBAMTEndhYmJpdC1u
7+
ZXR3b3Jrcy5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALiZp5O+
8+
6YtaNO5GbWaZUxvJPXktJ7k7LBX5G/Kn6eh9JkJln1agqbax9MRDB/5YCdQBKMBq
9+
NE2wYIwmCs7ArFU5DxvRhoBnCGLjcsIZ9pfaZ6lBppEvxMmUAYDmgjze0J13PwRp
10+
WAZMfBlisZnJAWokgE5sWtggUXURyFk67H0R+4sWlm8SSZOiJCA/e0bYPCHTfFA/
11+
2zg6koNRSwvI6zvftGnnJ9ny0BTuGOjZ6lDfIX5awFrgRdO8wmwejo4oJ45tUotF
12+
/Rt/yHkmjdGhONbJjcMLf9AIyVwMHg6t6mj2SYbHqzIyTcpjk90HgeiU5eS5JMqj
13+
Jkug5U9XrGGCqIcCAwEAAaNIMEYwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoG
14+
CCsGAQUFBwMDMB8GA1UdIwQYMBaAFLAy4Il5S9zOd/AMWF8hATmldAjYMA0GCSqG
15+
SIb3DQEBCwUAA4IBAQBLYBnSuMNCzzLmeqH/wBr6kKUtF10AN9VF8/3iZW8iCj4B
16+
Bx7VDq7iZR/G9UTLsWdZqkkxnOGu4QffBHz2Lc1v9D923EEPDAP5mJYvUchvdXYT
17+
lmyQr9QEjRC6IFhlBB27Bi207QJ8UxYgmbseQ3FQFE16Usdmlg9iWDn5tx/DZn9/
18+
yUd81yKKYp2uLx0x2sQDJh61QSZB6jtzjN7w4Xax2NViabLaH7raMrDbIqigkXJh
19+
iXG9fWx1Ax7S3dJVIglbZGPgYDW14Ass40gs8vcOBg8CwszrKiEuwp20d12Ky87/
20+
0pLsOWJmcNyXbd3gztX01N1frSEbvTBJNI9E/jmI
2121
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)