Fix eku check for BRs

lints/base.go

@@ -18,6 +18,7 @@ import (
 	"time"
 
 	"github.com/zmap/zcrypto/x509"
+	"github.com/zmap/zlint/util"
 )
 
 var (
@@ -90,13 +91,18 @@ func (l *Lint) CheckEffective(c *x509.Certificate) bool {
 	return false
 }
 
-// Execute runs the lint against a certificate. See LintInterface for details
-// about the methods called. The ordering is as follows:
+// Execute runs the lint against a certificate. For lints that are
+// sourced from the CA/B Forum Baseline Requirements, we first determine
+// if they are within the purview of the BRs. See LintInterface for details
+// about the other methods called. The ordering is as follows:
 //
 // CheckApplies()
 // CheckEffective()
 // Execute()
 func (l *Lint) Execute(cert *x509.Certificate) *LintResult {
+	if l.Source == CABFBaselineRequirements && !util.IsServerAuthCert(cert) {
+		return &LintResult{Status: NA}
+	}
 	if !l.Lint.CheckApplies(cert) {
 		return &LintResult{Status: NA}
 	} else if !l.CheckEffective(cert) {

lints/lint_sub_ca_eku_valid_fields_test.go

@@ -16,7 +16,7 @@ func TestSubCAEKUValidFields(t *testing.T) {
 
 func TestSubCAEKUNotValidFields(t *testing.T) {
 	inputPath := "../testlint/testCerts/subCAEKUNotValidFields.pem"
-	expected := Notice
+	expected := NA
 	out := Lints["n_sub_ca_eku_not_technically_constrained"].Execute(ReadCertificate(inputPath))
 	if out.Status != expected {
 		t.Errorf("%s: expected %s, got %s", inputPath, expected, out.Status)

lints/lint_sub_cert_eku_server_auth_client_auth_missing_test.go

@@ -7,7 +7,7 @@ import (
 
 func TestEkuBothPres(t *testing.T) {
 	inputPath := "../testlint/testCerts/subExtKeyUsageCodeSign.pem"
-	expected := Error
+	expected := NA
 	out := Lints["e_sub_cert_eku_server_auth_client_auth_missing"].Execute(ReadCertificate(inputPath))
 	if out.Status != expected {
 		t.Errorf("%s: expected %s, got %s", inputPath, expected, out.Status)

util/ca.go

@@ -29,3 +29,15 @@ func IsSelfSigned(c *x509.Certificate) bool {
 func IsSubscriberCert(c *x509.Certificate) bool {
 	return !IsCACert(c) && !IsSelfSigned(c)
 }
+
+func IsServerAuthCert(cert *x509.Certificate) bool {
+	if len(cert.ExtKeyUsage) == 0 {
+		return true
+	}
+	for _, eku := range cert.ExtKeyUsage {
+		if eku == x509.ExtKeyUsageAny || eku == x509.ExtKeyUsageServerAuth {
+			return true
+		}
+	}
+	return false
+}