Restricted CAs

[tofuproxy.git] / tls / verify.go

diff --git a/tls/verify.go b/tls/verify.go
index 7bff1c185f7c825d976d46fe9852dd4bae50c5ec..b7a317d6942eca635f08f9878c3c2ecb324650ab 100644 (file)
--- a/tls/verify.go
+++ b/tls/verify.go
@@ -24,7 +24,9 @@ import (
        "crypto/x509"
        "encoding/hex"
        "encoding/pem"
+       "errors"
        "fmt"
+       "io/fs"
        "log"
        "os"
        "os/exec"
@@ -206,6 +208,30 @@ func verifyCert(
                        fifos.LogDANE <- fmt.Sprintf("%s\tNAK", host)
                }
        }
+       if len(verifiedChains) > 0 {
+               caHashes := make(map[string]struct{})
+               for _, certs := range verifiedChains {
+                       for _, cert := range certs {
+                               caHashes[spkiHash(cert)] = struct{}{}
+                       }
+               }
+               var restrictedHosts []string
+               caches.RestrictedM.RLock()
+               for h := range caHashes {
+                       restrictedHosts = append(restrictedHosts, caches.Restricted[h]...)
+               }
+               caches.RestrictedM.RUnlock()
+               if len(restrictedHosts) > 0 {
+                       for _, h := range restrictedHosts {
+                               if host == h || strings.HasSuffix(host, "."+h) {
+                                       goto HostIsNotRestricted
+                               }
+                       }
+                       fifos.LogCert <- fmt.Sprintf("Restricted\t%s", host)
+                       return ErrRejected{host}
+               }
+       }
+HostIsNotRestricted:
        fn := filepath.Join(Certs, host)
        certsOur, _, err := ucspi.CertPoolFromFile(fn)
        if err == nil || dialErr != nil || (daneExists && !daneMatched) {
@@ -279,7 +305,7 @@ func verifyCert(
                        return ErrRejected{host}
                }
        } else {
-               if !os.IsNotExist(err) {
+               if !errors.Is(err, fs.ErrNotExist) {
                        return err
                }
                fifos.LogCert <- fmt.Sprintf("TOFU\t%s\t%s", host, certTheirHash)