further changes
parent
e9696a58c2
commit
eb0b5cafce
|
|
@ -0,0 +1,87 @@
|
|||
package routes
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/hex"
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
"golang.org/x/crypto/openpgp"
|
||||
"golang.org/x/crypto/openpgp/armor"
|
||||
"golang.org/x/crypto/openpgp/packet"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
type PGPKey struct {
|
||||
FullName, Name, Comment, Email string
|
||||
CreationTime time.Time
|
||||
PublicKeyAlgorithm packet.PublicKeyAlgorithm
|
||||
Fingerprint [20]byte
|
||||
KeyID uint16
|
||||
}
|
||||
|
||||
func GetOpenPGPInformationEncoded(c *gin.Context) {
|
||||
query := c.Copy().Request.Body
|
||||
|
||||
block, err := armor.Decode(query)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusBadRequest, gin.H{
|
||||
"status": false,
|
||||
"message": "Unable to parse body.",
|
||||
})
|
||||
return
|
||||
}
|
||||
pkt := packet.NewReader(block.Body)
|
||||
entity, err := openpgp.ReadEntity(pkt)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusBadRequest, gin.H{
|
||||
"status": false,
|
||||
"message": "Unable to parse body.",
|
||||
})
|
||||
return
|
||||
}
|
||||
if len(entity.Identities) > 1 {
|
||||
c.JSON(http.StatusBadRequest, gin.H{
|
||||
"status": false,
|
||||
"message": "No identities found in PGP key.",
|
||||
})
|
||||
return
|
||||
}
|
||||
var key *PGPKey
|
||||
for name, identity := range entity.Identities {
|
||||
key = &PGPKey{
|
||||
FullName: name,
|
||||
Name: identity.UserId.Name,
|
||||
Comment: identity.UserId.Comment,
|
||||
Email: identity.UserId.Email,
|
||||
CreationTime: entity.PrimaryKey.CreationTime,
|
||||
PublicKeyAlgorithm: entity.PrimaryKey.PubKeyAlgo,
|
||||
Fingerprint: entity.PrimaryKey.Fingerprint,
|
||||
KeyID: uint16(entity.PrimaryKey.KeyId),
|
||||
}
|
||||
break
|
||||
}
|
||||
buf := new(bytes.Buffer)
|
||||
closer, err := armor.Encode(buf, block.Type, block.Header)
|
||||
defer closer.Close()
|
||||
if err != nil {
|
||||
c.JSON(http.StatusBadRequest, gin.H{
|
||||
"status": false,
|
||||
"message": "Unable to re-encode armor..",
|
||||
})
|
||||
return
|
||||
}
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"status": true,
|
||||
"fullName": key.FullName,
|
||||
"name": key.Name,
|
||||
"comment": key.Comment,
|
||||
"email": key.Email,
|
||||
"creationTime": key.CreationTime,
|
||||
"publicKeyAlgorithm": key.PublicKeyAlgorithm,
|
||||
"fingerprint": hex.EncodeToString(key.Fingerprint[:]),
|
||||
"keyID": key.KeyID,
|
||||
"armor": buf.String(),
|
||||
})
|
||||
}
|
||||
|
|
@ -0,0 +1,366 @@
|
|||
package routes
|
||||
|
||||
import (
|
||||
"crypto/ecdsa"
|
||||
"crypto/ed25519"
|
||||
"crypto/rsa"
|
||||
"crypto/sha1"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"encoding/hex"
|
||||
"encoding/pem"
|
||||
"io/ioutil"
|
||||
"net/http"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// GetCertificateInformationEncoded handler function for providing raw data to be parsed
|
||||
func GetCertificateInformationEncoded(c *gin.Context) {
|
||||
query := c.Copy().Request.Body
|
||||
data, err := ioutil.ReadAll(query)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusBadRequest, gin.H{
|
||||
"status": false,
|
||||
"message": "Unable to parse body.",
|
||||
})
|
||||
return
|
||||
}
|
||||
block, _ := pem.Decode(data)
|
||||
if block == nil {
|
||||
c.JSON(http.StatusBadRequest, gin.H{
|
||||
"status": false,
|
||||
"message": "Unable to decode PEM.",
|
||||
})
|
||||
return
|
||||
}
|
||||
certificate, err := x509.ParseCertificate(block.Bytes)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusBadRequest, gin.H{
|
||||
"status": false,
|
||||
"message": "Unable to parse x509 data.",
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
var validationType string
|
||||
for _, value := range certificate.PolicyIdentifiers {
|
||||
if value.String() == "2.23.140.1.1" {
|
||||
validationType = "EV"
|
||||
} else if value.String() == "2.23.140.1.2.2" {
|
||||
validationType = "OV"
|
||||
} else if value.String() == "2.23.140.1.2.1" {
|
||||
validationType = "DV"
|
||||
}
|
||||
}
|
||||
|
||||
keyUsages := []int{}
|
||||
keyUsagesText := []string{}
|
||||
extendedKeyUsages := []int{}
|
||||
extendedKeyUsagesText := []string{}
|
||||
for _, value := range certificate.ExtKeyUsage {
|
||||
switch value {
|
||||
case 0:
|
||||
// All Usages
|
||||
extendedKeyUsages = append(extendedKeyUsages, 0)
|
||||
extendedKeyUsagesText = append(extendedKeyUsagesText, "Any/All Usages")
|
||||
break
|
||||
case 1:
|
||||
// TLS Web Server Authentication
|
||||
extendedKeyUsages = append(extendedKeyUsages, 1)
|
||||
extendedKeyUsagesText = append(extendedKeyUsagesText, "TLS Web Server Authentication")
|
||||
break
|
||||
case 2:
|
||||
// TLS Web Client Authentication
|
||||
extendedKeyUsages = append(extendedKeyUsages, 2)
|
||||
extendedKeyUsagesText = append(extendedKeyUsagesText, "TLS Web Client Authentication")
|
||||
break
|
||||
case 3:
|
||||
// Code Signing
|
||||
extendedKeyUsages = append(extendedKeyUsages, 3)
|
||||
extendedKeyUsagesText = append(extendedKeyUsagesText, "Code Signing")
|
||||
break
|
||||
case 4:
|
||||
// Email Protection
|
||||
extendedKeyUsages = append(extendedKeyUsages, 4)
|
||||
extendedKeyUsagesText = append(extendedKeyUsagesText, "Email Protection (S/MIME)")
|
||||
default:
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if certificate.KeyUsage&x509.KeyUsageCRLSign != 0 {
|
||||
keyUsages = append(keyUsages, 0)
|
||||
keyUsagesText = append(keyUsagesText, "CRL Signing")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageCertSign != 0 {
|
||||
keyUsages = append(keyUsages, 1)
|
||||
keyUsagesText = append(keyUsagesText, "Certificate Signing")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageContentCommitment != 0 {
|
||||
keyUsages = append(keyUsages, 2)
|
||||
keyUsagesText = append(keyUsagesText, "Content Commitment")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageDataEncipherment != 0 {
|
||||
keyUsages = append(keyUsages, 3)
|
||||
keyUsagesText = append(keyUsagesText, "Data Encipherment")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageDecipherOnly != 0 {
|
||||
keyUsages = append(keyUsages, 4)
|
||||
keyUsagesText = append(keyUsagesText, "Decipher Only")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageDigitalSignature != 0 {
|
||||
keyUsages = append(keyUsages, 5)
|
||||
keyUsagesText = append(keyUsagesText, "Digital Signature")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageEncipherOnly != 0 {
|
||||
keyUsages = append(keyUsages, 6)
|
||||
keyUsagesText = append(keyUsagesText, "Encipher Only")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageKeyAgreement != 0 {
|
||||
keyUsages = append(keyUsages, 7)
|
||||
keyUsagesText = append(keyUsagesText, "Key Agreement")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageKeyEncipherment != 0 {
|
||||
keyUsages = append(keyUsages, 8)
|
||||
keyUsagesText = append(keyUsagesText, "Key Encipherment")
|
||||
}
|
||||
|
||||
sum := sha1.Sum(certificate.Raw)
|
||||
|
||||
var bitLength int
|
||||
|
||||
switch certificate.PublicKeyAlgorithm {
|
||||
case x509.RSA:
|
||||
if rsaKey, ok := certificate.PublicKey.(*rsa.PublicKey); ok {
|
||||
bitLength = rsaKey.N.BitLen()
|
||||
} else {
|
||||
panic("expected rsa.PublicKey for type x509.RSA")
|
||||
}
|
||||
case x509.ECDSA:
|
||||
if ecdsaKey, ok := certificate.PublicKey.(*ecdsa.PublicKey); ok {
|
||||
bitLength = ecdsaKey.Params().BitSize
|
||||
} else {
|
||||
panic("expected ecdsa.PublicKey for type x509.ECDSA")
|
||||
}
|
||||
case x509.Ed25519:
|
||||
bitLength = ed25519.PublicKeySize
|
||||
}
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"status": true,
|
||||
"subject": gin.H{
|
||||
"commonName": certificate.Subject.CommonName,
|
||||
"organization": certificate.Subject.Organization,
|
||||
"organizationalUnit": certificate.Subject.OrganizationalUnit,
|
||||
"locality": certificate.Subject.Locality,
|
||||
"country": certificate.Subject.Country,
|
||||
},
|
||||
"issuer": gin.H{
|
||||
"commonName": certificate.Issuer.CommonName,
|
||||
"organization": certificate.Issuer.Organization,
|
||||
"organizationalUnit": certificate.Issuer.OrganizationalUnit,
|
||||
"locality": certificate.Issuer.Locality,
|
||||
"country": certificate.Issuer.Country,
|
||||
},
|
||||
"aia": gin.H{
|
||||
"issuingCertificateURL": certificate.IssuingCertificateURL,
|
||||
"ocspServer": certificate.OCSPServer,
|
||||
},
|
||||
"validationType": validationType,
|
||||
"signatureAlgorithm": certificate.SignatureAlgorithm.String(),
|
||||
"publicKeyAlgorithm": certificate.PublicKeyAlgorithm.String(),
|
||||
"serialNumber": certificate.SerialNumber.String(),
|
||||
"notBefore": certificate.NotBefore,
|
||||
"notAfter": certificate.NotAfter,
|
||||
"keyUsage": keyUsages,
|
||||
"keyUsageAsText": keyUsagesText,
|
||||
"extendedKeyUsage": extendedKeyUsages,
|
||||
"extendedKeyUsageAsText": extendedKeyUsagesText,
|
||||
"san": certificate.DNSNames,
|
||||
"emailAddresses": certificate.EmailAddresses,
|
||||
"fingerprint": hex.EncodeToString(sum[:]),
|
||||
"bitLength": bitLength,
|
||||
"pem": string(pem.EncodeToMemory(block)),
|
||||
})
|
||||
}
|
||||
|
||||
// GetCertificateInfo handler
|
||||
func GetCertificateInfo(c *gin.Context) {
|
||||
query := c.Query("q")
|
||||
resp, err := tls.Dial("tcp", query+":443", &tls.Config{InsecureSkipVerify: true, PreferServerCipherSuites: true})
|
||||
if err != nil {
|
||||
c.JSON(http.StatusBadRequest, gin.H{
|
||||
"status": false,
|
||||
"message": "Could not establish connection with server.",
|
||||
})
|
||||
return
|
||||
}
|
||||
cipherSuite := tls.CipherSuiteName(resp.ConnectionState().CipherSuite)
|
||||
v := resp.ConnectionState().Version
|
||||
var tlsVersion string
|
||||
if v == tls.VersionSSL30 {
|
||||
tlsVersion = "SSLv3"
|
||||
} else if v == tls.VersionTLS10 {
|
||||
tlsVersion = "TLSv1"
|
||||
} else if v == tls.VersionTLS11 {
|
||||
tlsVersion = "TLSv1.1"
|
||||
} else if v == tls.VersionTLS12 {
|
||||
tlsVersion = "TLSv1.2"
|
||||
} else if v == tls.VersionTLS13 {
|
||||
tlsVersion = "TLSv1.3"
|
||||
} else {
|
||||
tlsVersion = "unknown"
|
||||
}
|
||||
certificate := resp.ConnectionState().PeerCertificates[0]
|
||||
rootCertificate := resp.ConnectionState().PeerCertificates[len(resp.ConnectionState().PeerCertificates)-1]
|
||||
|
||||
var validationType string
|
||||
for _, value := range certificate.PolicyIdentifiers {
|
||||
if value.String() == "2.23.140.1.1" {
|
||||
validationType = "EV"
|
||||
} else if value.String() == "2.23.140.1.2.2" {
|
||||
validationType = "OV"
|
||||
} else if value.String() == "2.23.140.1.2.1" {
|
||||
validationType = "DV"
|
||||
}
|
||||
}
|
||||
|
||||
keyUsages := []int{}
|
||||
keyUsagesText := []string{}
|
||||
extendedKeyUsages := []int{}
|
||||
extendedKeyUsagesText := []string{}
|
||||
for _, value := range certificate.ExtKeyUsage {
|
||||
switch value {
|
||||
case 0:
|
||||
// All Usages
|
||||
extendedKeyUsages = append(extendedKeyUsages, 0)
|
||||
extendedKeyUsagesText = append(extendedKeyUsagesText, "Any/All Usages")
|
||||
break
|
||||
case 1:
|
||||
// TLS Web Server Authentication
|
||||
extendedKeyUsages = append(extendedKeyUsages, 1)
|
||||
extendedKeyUsagesText = append(extendedKeyUsagesText, "TLS Web Server Authentication")
|
||||
break
|
||||
case 2:
|
||||
// TLS Web Client Authentication
|
||||
extendedKeyUsages = append(extendedKeyUsages, 2)
|
||||
extendedKeyUsagesText = append(extendedKeyUsagesText, "TLS Web Client Authentication")
|
||||
break
|
||||
case 3:
|
||||
// Code Signing
|
||||
extendedKeyUsages = append(extendedKeyUsages, 3)
|
||||
extendedKeyUsagesText = append(extendedKeyUsagesText, "Code Signing")
|
||||
break
|
||||
case 4:
|
||||
// Email Protection
|
||||
extendedKeyUsages = append(extendedKeyUsages, 4)
|
||||
extendedKeyUsagesText = append(extendedKeyUsagesText, "Email Protection (S/MIME)")
|
||||
default:
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if certificate.KeyUsage&x509.KeyUsageCRLSign != 0 {
|
||||
keyUsages = append(keyUsages, 0)
|
||||
keyUsagesText = append(keyUsagesText, "CRL Signing")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageCertSign != 0 {
|
||||
keyUsages = append(keyUsages, 1)
|
||||
keyUsagesText = append(keyUsagesText, "Certificate Signing")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageContentCommitment != 0 {
|
||||
keyUsages = append(keyUsages, 2)
|
||||
keyUsagesText = append(keyUsagesText, "Content Commitment")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageDataEncipherment != 0 {
|
||||
keyUsages = append(keyUsages, 3)
|
||||
keyUsagesText = append(keyUsagesText, "Data Encipherment")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageDecipherOnly != 0 {
|
||||
keyUsages = append(keyUsages, 4)
|
||||
keyUsagesText = append(keyUsagesText, "Decipher Only")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageDigitalSignature != 0 {
|
||||
keyUsages = append(keyUsages, 5)
|
||||
keyUsagesText = append(keyUsagesText, "Digital Signature")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageEncipherOnly != 0 {
|
||||
keyUsages = append(keyUsages, 6)
|
||||
keyUsagesText = append(keyUsagesText, "Encipher Only")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageKeyAgreement != 0 {
|
||||
keyUsages = append(keyUsages, 7)
|
||||
keyUsagesText = append(keyUsagesText, "Key Agreement")
|
||||
}
|
||||
if certificate.KeyUsage&x509.KeyUsageKeyEncipherment != 0 {
|
||||
keyUsages = append(keyUsages, 8)
|
||||
keyUsagesText = append(keyUsagesText, "Key Encipherment")
|
||||
}
|
||||
|
||||
sum := sha1.Sum(certificate.Raw)
|
||||
|
||||
var bitLength int
|
||||
|
||||
switch certificate.PublicKeyAlgorithm {
|
||||
case x509.RSA:
|
||||
if rsaKey, ok := certificate.PublicKey.(*rsa.PublicKey); ok {
|
||||
bitLength = rsaKey.N.BitLen()
|
||||
} else {
|
||||
panic("expected rsa.PublicKey for type x509.RSA")
|
||||
}
|
||||
case x509.ECDSA:
|
||||
if ecdsaKey, ok := certificate.PublicKey.(*ecdsa.PublicKey); ok {
|
||||
bitLength = ecdsaKey.Params().BitSize
|
||||
} else {
|
||||
panic("expected ecdsa.PublicKey for type x509.ECDSA")
|
||||
}
|
||||
}
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"status": true,
|
||||
"subject": gin.H{
|
||||
"commonName": certificate.Subject.CommonName,
|
||||
"organization": certificate.Subject.Organization,
|
||||
"organizationalUnit": certificate.Subject.OrganizationalUnit,
|
||||
"locality": certificate.Subject.Locality,
|
||||
"country": certificate.Subject.Country,
|
||||
},
|
||||
"issuer": gin.H{
|
||||
"commonName": certificate.Issuer.CommonName,
|
||||
"organization": certificate.Issuer.Organization,
|
||||
"organizationalUnit": certificate.Issuer.OrganizationalUnit,
|
||||
"locality": certificate.Issuer.Locality,
|
||||
"country": certificate.Issuer.Country,
|
||||
},
|
||||
"root": gin.H{
|
||||
"commonName": rootCertificate.Issuer.CommonName,
|
||||
"organization": rootCertificate.Issuer.Organization,
|
||||
"organizationalUnit": rootCertificate.Issuer.OrganizationalUnit,
|
||||
"locality": rootCertificate.Issuer.Locality,
|
||||
"country": rootCertificate.Issuer.Country,
|
||||
},
|
||||
"aia": gin.H{
|
||||
"issuingCertificateURL": certificate.IssuingCertificateURL,
|
||||
"ocspServer": certificate.OCSPServer,
|
||||
},
|
||||
"validationType": validationType,
|
||||
"signatureAlgorithm": certificate.SignatureAlgorithm.String(),
|
||||
"publicKeyAlgorithm": certificate.PublicKeyAlgorithm.String(),
|
||||
"serialNumber": certificate.SerialNumber.String(),
|
||||
"notBefore": certificate.NotBefore,
|
||||
"notAfter": certificate.NotAfter,
|
||||
"keyUsage": keyUsages,
|
||||
"keyUsageAsText": keyUsagesText,
|
||||
"extendedKeyUsage": extendedKeyUsages,
|
||||
"extendedKeyUsageAsText": extendedKeyUsagesText,
|
||||
"san": certificate.DNSNames,
|
||||
"emailAddresses": certificate.EmailAddresses,
|
||||
"fingerprint": hex.EncodeToString(sum[:]),
|
||||
"bitLength": bitLength,
|
||||
"connection": gin.H{
|
||||
"tlsVersion": tlsVersion,
|
||||
"cipherSuite": cipherSuite,
|
||||
},
|
||||
})
|
||||
}
|
||||
Loading…
Reference in New Issue