DANE check utility

diff --git a/cmd/danechk/main.go b/cmd/danechk/main.go
new file mode 100644 (file)
index 0000000..1e837d1
--- /dev/null
+++ b/cmd/danechk/main.go
@@ -0,0 +1,44 @@
+/*
+tofuproxy -- flexible HTTP/HTTPS proxy, TLS terminator, X.509 TOFU
+             manager, WARC/geminispace browser
+Copyright (C) 2021-2022 Sergey Matveev <stargrave@stargrave.org>
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, version 3 of the License.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+package main
+
+import (
+       "flag"
+       "fmt"
+       "log"
+
+       "go.cypherpunks.ru/ucspi"
+       ttls "go.stargrave.org/tofuproxy/tls"
+)
+
+func main() {
+       dnsSrv := flag.String("dns", "[::1]:53", "DNS server")
+       crtPath := flag.String("cert", "cert.pem", "Path to X.509 certificate")
+       addr := flag.String("addr", "", "Domain name")
+       flag.Parse()
+       log.SetFlags(log.Lshortfile)
+       _, cert, err := ucspi.CertificateFromFile(*crtPath)
+       if err != nil {
+               log.Fatalln(err)
+       }
+       ttls.DNSSrv = *dnsSrv
+       exists, valid := ttls.DANE(*addr, cert)
+       fmt.Println("Exists:", exists)
+       fmt.Println("Valid:", valid)
+}

diff --git a/tls/dane.go b/tls/dane.go
index 5d017ec0790aff169d21b5e09e52e9cc3e35abcb..ba6e7d059422718af4c74e934df409940c9afc43 100644 (file)
--- a/tls/dane.go
+++ b/tls/dane.go
@@ -32,7 +32,7 @@ import (
 
 var DNSSrv string
 
-func dane(addr string, cert *x509.Certificate) (bool, bool) {
+func DANE(addr string, cert *x509.Certificate) (bool, bool) {
        if DNSSrv == "" {
                return false, false
        }

diff --git a/tls/verify.go b/tls/verify.go
index 0f21ce93bc369ce30dd2b520124c9543f641189c..a63fb4a2441082ac0c63dcd09ceb8ffb27bf0f75 100644 (file)
--- a/tls/verify.go
+++ b/tls/verify.go
@@ -198,7 +198,7 @@ func verifyCert(
        if certTheirHash == certOurHash {
                return ErrRejected{host}
        }
-       daneExists, daneMatched := dane(host, certTheir)
+       daneExists, daneMatched := DANE(host, certTheir)
        if daneExists {
                if daneMatched {
                        fifos.LogDANE <- fmt.Sprintf("%s\tACK", host)