Lint for S/MIME BR 7.1.2.3.g

[bitlux]

No description provided.

[christopher-henderson]

Thank you @bitlux!

I have some small suggestions. I believe that the code snippet below implements them. Let me know what you think.

func (l *authorityKeyIdentifierCorrect) CheckApplies(c *x509.Certificate) bool {
	return true
}

func (l *authorityKeyIdentifierCorrect) Execute(c *x509.Certificate) *lint.LintResult {
	var keyID keyIdentifier

	ext := util.GetExtFromCert(c, util.AuthkeyOID)
	if ext == nil {
		return &lint.LintResult{Status: lint.Error, Details: "missing authorityKeyIdentifier"}
	}
	if ext.Critical {
		return &lint.LintResult{Status: lint.Error}
	}
	if _, err := asn1.Unmarshal(ext.Value, &keyID); err != nil {
		return &lint.LintResult{
			Status:  lint.Fatal,
			Details: fmt.Sprintf("error unmarshalling authority key identifier extension: %v", err),
		}
	}

	hasKeyID := len(keyID.KeyIdentifier.Bytes) > 0
	hasCertIssuer := len(keyID.AuthorityCertIssuer.Bytes) > 0
	hasCertSerial := len(keyID.AuthorityCertSerialNumber.Bytes) > 0
	if !hasKeyID {
		return &lint.LintResult{Status: lint.Error, Details: "keyIdentifier not present"}
	}
	if hasCertIssuer {
		return &lint.LintResult{Status: lint.Error, Details: "authorityCertIssuer is present"}
	}
	if hasCertSerial {
		return &lint.LintResult{Status: lint.Error, Details: "authorityCertSerialNumber is present"}
	}
	return &lint.LintResult{Status: lint.Pass}
}

[christopher-henderson]

So from the language authorityKeyIdentifier SHALL be present I reckon that CheckApplies should always return true and that nil AKI here would be an error condition.

[bitlux]

Done. Thanks for the review.

[christopher-henderson]

The Details member of the lint.LintResult type is quite useful when a lint such as this has multiple error scenarios. Otherwise, operators are left guess as to which one triggered the issue.

Here is my own take on this code block.

	if !hasKeyID {
		return &lint.LintResult{Status: lint.Error, Details: "keyIdentifier not present"}
	}
	if hasCertIssuer {
		return &lint.LintResult{Status: lint.Error, Details: "authorityCertIssuer is present"}
	}
	if hasCertSerial {
		return &lint.LintResult{Status: lint.Error, Details: "authorityCertSerialNumber is present"}
	}

[bitlux]

Done.

[christopher-henderson]

Suggested change

	return util.IsExtInCert(c, util.AuthkeyOID)
	return true

[bitlux]

I think we want to at least check that it's a subscriber cert and an S/MIME cert, which was missing from the original commit.

[toddgaunt-gs]

LGTM