Support AIA

.cirrus.yml

@@ -17,7 +17,7 @@ task:
     - go get -tags "$GOX_TAGS" -d -v -t github.com/$CIRRUS_REPO_FULL_NAME/...
   lint_script:
     - cd $(go env GOPATH)/src/github.com/$CIRRUS_REPO_FULL_NAME/
-    - golangci-lint run --no-config --enable-all --disable gochecknoglobals,gocritic,gocyclo,gomnd $GOLANGCI_ARGS -v --timeout 5m --out-format json > $CIRRUS_WORKING_DIR/lint-report.json
+    - golangci-lint run --no-config --enable-all --disable funlen,gci,gochecknoglobals,gocritic,gocyclo,godot,gofmt,gofumpt,gomnd,lll,wsl $GOLANGCI_ARGS -v --timeout 5m --out-format json > $CIRRUS_WORKING_DIR/lint-report.json
   matrix:
     - name: Go Lint $GOOS New
       env:

aiaparent.go

@@ -0,0 +1,210 @@
+// nolint: gofmt, goimports
+
+// Copyright 2009 The Go Authors. All rights reserved.
+// Dehydrated certificate modifications Copyright 2015-2017 Jeremy Rand. All
+// rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+
+// Generate a self-signed X.509 certificate for a TLS server. Outputs to
+// 'cert.pem' and 'key.pem' and will overwrite existing files.
+
+// This code has been modified from the stock Go code to generate
+// "dehydrated certificates", suitable for inclusion in a Namecoin name.
+
+// Last rebased against Go 1.14.
+// Future rebases need to rebase all of the main, parent, aiaparent, and
+// falseHost flows.
+
+package main
+
+import (
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
+	"crypto/rand"
+	//"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	//"flag"
+	"io/ioutil"
+	"log"
+	"math/big"
+	//"net"
+	"os"
+	//"strings"
+	"time"
+)
+
+//var (
+//	host       = flag.String("host", "", "Comma-separated hostnames and IPs to generate a certificate for")
+//	validFrom  = flag.String("start-date", "", "Creation date formatted as Jan 1 15:04:05 2011")
+//	validFor   = flag.Duration("duration", 365*24*time.Hour, "Duration that certificate is valid for")
+//	isCA       = flag.Bool("ca", false, "whether this cert should be its own Certificate Authority")
+//	rsaBits    = flag.Int("rsa-bits", 2048, "Size of RSA key to generate. Ignored if --ecdsa-curve is set")
+//	ecdsaCurve = flag.String("ecdsa-curve", "", "ECDSA curve to use to generate a key. Valid values are P224, P256 (recommended), P384, P521")
+//	ed25519Key = flag.Bool("ed25519", false, "Generate an Ed25519 key")
+//)
+
+//func publicKey(priv interface{}) interface{} {
+//	switch k := priv.(type) {
+//	case *rsa.PrivateKey:
+//		return &k.PublicKey
+//	case *ecdsa.PrivateKey:
+//		return &k.PublicKey
+//	case ed25519.PrivateKey:
+//		return k.Public().(ed25519.PublicKey)
+//	default:
+//		return nil
+//	}
+//}
+
+//func main() {
+func getAIAParent() (parentCert x509.Certificate, parentPriv interface{}) {
+//	flag.Parse()
+
+//	if len(*host) == 0 {
+//		log.Fatalf("Missing required --host parameter")
+//	}
+
+	var priv interface{}
+	var err error
+	switch *ecdsaCurve {
+	case "":
+		if *ed25519Key {
+			_, priv, err = ed25519.GenerateKey(rand.Reader)
+		} else {
+			//priv, err = rsa.GenerateKey(rand.Reader, *rsaBits)
+			log.Fatalf("Missing required --ecdsa-curve or --ed25519 parameter")
+		}
+	case "P224": // nolint: goconst
+		priv, err = ecdsa.GenerateKey(elliptic.P224(), rand.Reader)
+	case "P256": // nolint: goconst
+		priv, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	case "P384": // nolint: goconst
+		priv, err = ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
+	case "P521": // nolint: goconst
+		priv, err = ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+	default:
+		log.Fatalf("Unrecognized elliptic curve: %q", *ecdsaCurve)
+	}
+	if err != nil {
+		log.Fatalf("Failed to generate private key: %v", err)
+	}
+
+	var privPEM []byte
+	if *parentKey != "" {
+		log.Print("Using existing CA private key")
+		privPEM, err = ioutil.ReadFile(*parentKey)
+		if err != nil {
+			log.Fatalf("failed to read private key: %v", err)
+		}
+		privBlock, _ := pem.Decode(privPEM)
+		priv, err = x509.ParseECPrivateKey(privBlock.Bytes)
+		if err != nil {
+			log.Fatalf("failed to parse private key: %v", err)
+		}
+	}
+
+	var notBefore time.Time
+	if len(*validFrom) == 0 {
+		notBefore = time.Now()
+	} else {
+		notBefore, err = time.Parse("Jan 2 15:04:05 2006", *validFrom)
+		if err != nil {
+			log.Fatalf("Failed to parse creation date: %v", err)
+		}
+	}
+
+	notAfter := notBefore.Add(*validFor)
+
+	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
+	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
+	if err != nil {
+		log.Fatalf("Failed to generate serial number: %v", err)
+	}
+
+	template := x509.Certificate{
+		SerialNumber: serialNumber,
+		Subject: pkix.Name{
+			//Organization: []string{"Acme Co"},
+			CommonName:   *host + " Domain AIA Parent CA",
+			SerialNumber: "Namecoin TLS Certificate",
+		},
+		NotBefore: notBefore,
+		NotAfter:  notAfter,
+
+		IsCA: true,
+		//KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
+		KeyUsage:              x509.KeyUsageCertSign,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+
+		PermittedDNSDomainsCritical: true,
+		PermittedDNSDomains:         []string{*host},
+	}
+
+	//hosts := strings.Split(*host, ",")
+	//for _, h := range hosts {
+	//	if ip := net.ParseIP(h); ip != nil {
+	//		template.IPAddresses = append(template.IPAddresses, ip)
+	//	} else {
+	//		template.DNSNames = append(template.DNSNames, h)
+	//template.DNSNames = append(template.DNSNames, *falseHost)
+	//	}
+	//}
+
+	//if *isCA {
+	//	template.IsCA = true
+	//	template.KeyUsage |= x509.KeyUsageCertSign
+	//}
+
+	//derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, publicKey(priv), priv)
+	//if err != nil {
+	//	log.Fatalf("Failed to create certificate: %v", err)
+	//}
+
+	//certOut, err := os.Create("cert.pem")
+	//if err != nil {
+		//log.Fatalf("Failed to open cert.pem for writing: %v", err)
+	//}
+	//if err := pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {
+	//	log.Fatalf("Failed to write data to cert.pem: %v", err)
+	//}
+	//if err := certOut.Close(); err != nil {
+	//	log.Fatalf("Error closing cert.pem: %v", err)
+	//}
+	//log.Print("wrote cert.pem\n")
+
+	writeJSONTLSA(priv)
+
+	if *parentKey != "" {
+		return template, priv
+	}
+
+	//keyOut, err := os.OpenFile("key.pem", os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	keyOut, err := os.OpenFile("caAIAKey.pem", os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	if err != nil {
+		//log.Fatalf("Failed to open key.pem for writing: %v", err)
+		log.Fatalf("Failed to open caAIAKey.pem for writing: %v", err)
+		return
+	}
+	privBytes, err := x509.MarshalPKCS8PrivateKey(priv)
+	if err != nil {
+		log.Fatalf("Unable to marshal private key: %v", err)
+	}
+	if err := pem.Encode(keyOut, &pem.Block{Type: "PRIVATE KEY", Bytes: privBytes}); err != nil {
+		//log.Fatalf("Failed to write data to key.pem: %v", err)
+		log.Fatalf("Failed to write data to caAIAKey.pem: %v", err)
+	}
+	if err := keyOut.Close(); err != nil {
+		//log.Fatalf("Error closing key.pem: %v", err)
+		log.Fatalf("Error closing caAIAKey.pem: %v", err)
+	}
+	//log.Print("wrote key.pem\n")
+	log.Print("wrote caAIAKey.pem\n")
+
+	return template, priv
+}

falsehost.go

@@ -14,7 +14,8 @@
 // "dehydrated certificates", suitable for inclusion in a Namecoin name.
 
 // Last rebased against Go 1.14.
-// Future rebases need to rebase all of the main, parent, and falseHost flows.
+// Future rebases need to rebase all of the main, parent, aiaparent, and
+// falseHost flows.
 
 package main
 

json.go

@@ -0,0 +1,41 @@
+// nolint: gofmt, goimports
+
+// Copyright 2015-2021 Jeremy Rand. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package main
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"log"
+
+	x509_compressed "github.com/namecoin/x509-compressed/x509"
+)
+
+func writeJSONTLSA(priv interface{}) {
+	pubBytes, err := x509_compressed.MarshalPKIXPublicKey(publicKey(priv))
+	if err != nil {
+		log.Fatalf("Failed to marshal CA public key: %v", err)
+	}
+
+	// See the IANA DANE Parameters registry.
+	tlsa := make([]interface{}, 4)
+	tlsa[0] = 2 // DANE-TA
+	tlsa[1] = 1 // SPKI
+	tlsa[2] = 0 // Full
+	tlsa[3] = pubBytes
+
+	tlsaBytes, err := json.Marshal(tlsa)
+	if err != nil {
+		log.Fatalf("Failed to marshal Namecoin record: %v", err)
+	}
+
+	err = ioutil.WriteFile("namecoin.json", tlsaBytes, 0666)
+	if err != nil {
+		log.Fatalf("Failed to write data to namecoin.json: %v", err)
+	}
+
+	log.Print("wrote namecoin.json")
+}

main.go

@@ -14,7 +14,8 @@
 // "dehydrated certificates", suitable for inclusion in a Namecoin name.
 
 // Last rebased against Go 1.14.
-// Future rebases need to rebase all of the main, parent, and falseHost flows.
+// Future rebases need to rebase all of the main, parent, aiaparent, and
+// falseHost flows.
 
 package main
 
@@ -53,6 +54,7 @@ var (
 	falseHost  = flag.String("false-host", "", "(Optional) Generate a false cert for this host; used to test x.509 implementations for safety regarding handling of the CA flag and KeyUsage")
 	useCA      = flag.Bool("use-ca", false, "Use a CA instead of self-signing")
 	parentKey  = flag.String("parent-key", "", "(Optional) Path to existing CA private key to sign with")
+	useAIA     = flag.Bool("use-aia", false, "Use AIA to chase the CA")
 )
 
 func publicKey(priv interface{}) interface{} {
@@ -226,7 +228,7 @@ func main() {
 	log.Print("wrote key.pem\n")
 
 	if *useCA {
-		log.Print("SUCCESS.  Place cert.pem and key.pem in your HTTPS server, and place the above JSON in the \"tls\" field for your Namecoin name.")
+		log.Print("SUCCESS.  Place cert.pem and key.pem in your HTTPS server, and place the contents of \"namecoin.json\" in the \"tls\" field for \"*." + *host + "\".")
 		return
 	}