Verify SPKI hash

[mmc.git] / common.go

diff --git a/common.go b/common.go
index 014d8f9c438849336fa7f042035d6d21b60947c7..ce84af61c5cfb6fcafc871c25a499b8ad6a21826 100644 (file)
--- a/common.go
+++ b/common.go
@@ -1,5 +1,5 @@
 // mmc -- Mattermost client
-// Copyright (C) 2023 Sergey Matveev <stargrave@stargrave.org>
+// Copyright (C) 2023-2024 Sergey Matveev <stargrave@stargrave.org>
 //
 // This program is free software: you can redistribute it and/or modify
 // it under the terms of the GNU Affero General Public License as
@@ -17,14 +17,21 @@
 package mmc
 
 import (
+       "crypto/sha256"
+       "crypto/x509"
+       "encoding/hex"
+       "errors"
+       "os"
        "strings"
        "time"
 
+       "github.com/davecgh/go-spew/spew"
        "github.com/mattermost/mattermost-server/v6/model"
        "go.cypherpunks.ru/recfile"
 )
 
 const (
+       PerPage    = 100
        OutRec     = "out.rec"
        OutRecLock = "out.rec.lock"
        Last       = "last"
@@ -74,3 +81,62 @@ func PostToRec(w *recfile.Writer, users map[string]*model.User, post Post) error
        _, err = w.WriteFieldMultiline("Text", strings.Split(post.P.Message, "\n"))
        return err
 }
+
+func GetUsers(c *model.Client4, debugFd *os.File) (map[string]*model.User, error) {
+       users := make(map[string]*model.User)
+       for n := 0; ; n++ {
+               time.Sleep(SleepTime)
+               page, resp, err := c.GetUsers(n, PerPage, "")
+               if err != nil {
+                       if debugFd != nil {
+                               spew.Fdump(debugFd, resp)
+                       }
+                       return nil, err
+               }
+               if debugFd != nil {
+                       spew.Fdump(debugFd, page)
+               }
+               for _, u := range page {
+                       users[u.Id] = u
+               }
+               if len(page) < PerPage {
+                       break
+               }
+       }
+       return users, nil
+}
+
+func GetEntrypoint() string {
+       s := os.Getenv("MMC_ENTRYPOINT")
+       if s == "" {
+               return "http://mm.invalid"
+       }
+       return s
+}
+
+func GetSPKIHash() string {
+       s := os.Getenv("MMC_SPKI")
+       if s == "" {
+               return "deadbeef"
+       }
+       return s
+}
+
+func NewVerifyPeerCertificate(hashExpected string) func(
+       rawCerts [][]byte, verifiedChains [][]*x509.Certificate,
+) error {
+       return func(
+               rawCerts [][]byte, verifiedChains [][]*x509.Certificate,
+       ) error {
+               cer, err := x509.ParseCertificate(rawCerts[0])
+               if err != nil {
+                       return err
+               }
+               spki := cer.RawSubjectPublicKeyInfo
+               hsh := sha256.Sum256(spki)
+               if hashExpected != hex.EncodeToString(hsh[:]) {
+                       return errors.New("server certificate's SPKI hash mismatch")
+               }
+               return nil
+       }
+}