diff --git a/v3/integration/config.json b/v3/integration/config.json index 3da787605..148c92551 100644 --- a/v3/integration/config.json +++ b/v3/integration/config.json @@ -348,7 +348,7 @@ "ErrCount": 37 }, "e_ext_authority_key_identifier_no_key_identifier": { - "ErrCount": 65 + "ErrCount": 66 }, "e_ext_cert_policy_disallowed_any_policy_qualifier": {}, "e_ext_cert_policy_duplicate": {}, diff --git a/v3/lints/rfc/lint_ext_authority_key_identifier_missing.go b/v3/lints/rfc/lint_ext_authority_key_identifier_missing.go deleted file mode 100644 index 663c23b15..000000000 --- a/v3/lints/rfc/lint_ext_authority_key_identifier_missing.go +++ /dev/null @@ -1,65 +0,0 @@ -package rfc - -/* - * ZLint Copyright 2023 Regents of the University of Michigan - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may not - * use this file except in compliance with the License. You may obtain a copy - * of the License at http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - * implied. See the License for the specific language governing - * permissions and limitations under the License. - */ - -import ( - "github.com/zmap/zcrypto/x509" - "github.com/zmap/zlint/v3/lint" - "github.com/zmap/zlint/v3/util" -) - -type authorityKeyIdMissing struct{} - -/*********************************************************************** -RFC 5280: 4.2.1.1 -The keyIdentifier field of the authorityKeyIdentifier extension MUST - be included in all certificates generated by conforming CAs to - facilitate certification path construction. There is one exception; - where a CA distributes its public key in the form of a "self-signed" - certificate, the authority key identifier MAY be omitted. The - signature on a self-signed certificate is generated with the private - key associated with the certificate's subject public key. (This - proves that the issuer possesses both the public and private keys.) - In this case, the subject and authority key identifiers would be - identical, but only the subject key identifier is needed for - certification path building. -***********************************************************************/ - -func init() { - lint.RegisterLint(&lint.Lint{ - Name: "e_ext_authority_key_identifier_missing", - Description: "CAs must support key identifiers and include them in all certificates", - Citation: "RFC 5280: 4.2 & 4.2.1.1", - Source: lint.RFC5280, - EffectiveDate: util.RFC2459Date, - Lint: NewAuthorityKeyIdMissing, - }) -} - -func NewAuthorityKeyIdMissing() lint.LintInterface { - return &authorityKeyIdMissing{} -} - -func (l *authorityKeyIdMissing) CheckApplies(c *x509.Certificate) bool { - return !util.IsRootCA(c) -} - -func (l *authorityKeyIdMissing) Execute(c *x509.Certificate) *lint.LintResult { - if !util.IsExtInCert(c, util.AuthkeyOID) && !util.IsSelfSigned(c) { - return &lint.LintResult{Status: lint.Error} - } else { - return &lint.LintResult{Status: lint.Pass} - } -} diff --git a/v3/lints/rfc/lint_ext_authority_key_identifier_missing_test.go b/v3/lints/rfc/lint_ext_authority_key_identifier_missing_test.go deleted file mode 100644 index 0b011da96..000000000 --- a/v3/lints/rfc/lint_ext_authority_key_identifier_missing_test.go +++ /dev/null @@ -1,40 +0,0 @@ -package rfc - -/* - * ZLint Copyright 2023 Regents of the University of Michigan - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may not - * use this file except in compliance with the License. You may obtain a copy - * of the License at http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - * implied. See the License for the specific language governing - * permissions and limitations under the License. - */ - -import ( - "testing" - - "github.com/zmap/zlint/v3/lint" - "github.com/zmap/zlint/v3/test" -) - -func TestAKIMissing(t *testing.T) { - inputPath := "akiMissing.pem" - expected := lint.Error - out := test.TestLint("e_ext_authority_key_identifier_missing", inputPath) - if out.Status != expected { - t.Errorf("%s: expected %s, got %s", inputPath, expected, out.Status) - } -} - -func TestAKIPresent(t *testing.T) { - inputPath := "orgValGoodAllFields.pem" - expected := lint.Pass - out := test.TestLint("e_ext_authority_key_identifier_missing", inputPath) - if out.Status != expected { - t.Errorf("%s: expected %s, got %s", inputPath, expected, out.Status) - } -} diff --git a/v3/lints/rfc/lint_ext_authority_key_identifier_no_key_identifier.go b/v3/lints/rfc/lint_ext_authority_key_identifier_no_key_identifier.go index 115287660..5a1d05c40 100644 --- a/v3/lints/rfc/lint_ext_authority_key_identifier_no_key_identifier.go +++ b/v3/lints/rfc/lint_ext_authority_key_identifier_no_key_identifier.go @@ -57,9 +57,9 @@ func (l *authorityKeyIdNoKeyIdField) CheckApplies(c *x509.Certificate) bool { } func (l *authorityKeyIdNoKeyIdField) Execute(c *x509.Certificate) *lint.LintResult { - if c.AuthorityKeyId == nil && !util.IsSelfSigned(c) { //will be nil by default if not found in x509.parseCert - return &lint.LintResult{Status: lint.Error} - } else { + if c.AuthorityKeyId != nil || util.IsCACert(c) && util.IsSelfSigned(c) { return &lint.LintResult{Status: lint.Pass} + } else { + return &lint.LintResult{Status: lint.Error} } }