Codebase list golang-github-go-piv-piv-go / 9e7225c
*: clean up actions and address all staticcheck findings Eric Chiang authored 1 year, 8 months ago Eric Chiang committed 1 year, 8 months ago
6 changed file(s) with 25 addition(s) and 70 deletion(s). Raw diff Collapse all Expand all
+14
-8
.github/workflows/test.yaml less more
88
99 jobs:
1010 build:
11 strategy:
12 matrix:
13 go-version: [1.18.x, 1.19.x]
1114 name: Linux
1215 runs-on: ubuntu-latest
1316 steps:
14 - name: Set up Go 1.16
17 - name: Set up Go
1518 uses: actions/setup-go@v2
1619 with:
17 go-version: '^1.16.6'
20 go-version: ${{ matrix.go-version }}
1821 id: go
1922 - name: Check out code into the Go module directory
2023 uses: actions/checkout@v2
21 - name: Install golint
22 run: go get -u golang.org/x/lint/golint
24 - name: Install staticcheck
25 run: go install honnef.co/go/tools/cmd/staticcheck@v0.3.3
2326 - name: Install libpcsc
2427 run: sudo apt-get install -y libpcsclite-dev pcscd pcsc-tools
2528 - name: Test
2629 run: "make test"
2730 build-windows:
31 strategy:
32 matrix:
33 go-version: [1.18.x, 1.19.x]
2834 name: Windows
2935 runs-on: windows-latest
3036 steps:
31 - name: Set up Go 1.16
37 - name: Set up Go
3238 uses: actions/setup-go@v2
3339 with:
34 go-version: '^1.16.6'
40 go-version: ${{ matrix.go-version }}
3541 id: go
3642 - name: Check out code into the Go module directory
3743 uses: actions/checkout@v2
38 - name: Install golint
39 run: go get -u golang.org/x/lint/golint
44 - name: Install staticcheck
45 run: go install honnef.co/go/tools/cmd/staticcheck@v0.3.3
4046 - name: Test
4147 run: "make build"
4248 env:
+1
-1
Makefile less more
33
44 .PHONY: lint
55 lint:
6 golint -set_exit_status ./...
6 staticcheck ./...
77
88 .PHONY: build
99 build: lint
+1
-13
piv/key.go less more
198198 return nil
199199 }
200200
201 func verifySignature(parent, c *x509.Certificate) error {
202 return parent.CheckSignature(c.SignatureAlgorithm, c.RawTBSCertificate, c.Signature)
203 }
204
205201 // Verify proves that a key was generated on a YubiKey. It ensures the slot and
206202 // YubiKey certificate chains up to the Yubico CA, parsing additional information
207203 // out of the slot certificate, such as the touch and PIN policies of a key.
231227 // This isn't valid as per https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.9
232228 // (fourth paragraph) and thus makes x509.go validation fail.
233229 // Work around this by setting this constraint here.
234 if attestationCert.BasicConstraintsValid == false {
230 if !attestationCert.BasicConstraintsValid {
235231 attestationCert.BasicConstraintsValid = true
236232 attestationCert.IsCA = true
237233 }
746742 PINPolicy PINPolicy
747743 }
748744
749 func isAuthErr(err error) bool {
750 var e *apduErr
751 if !errors.As(err, &e) {
752 return false
753 }
754 return e.sw1 == 0x69 && e.sw2 == 0x82 // "security status not satisfied"
755 }
756
757745 func (k KeyAuth) authTx(yk *YubiKey, pp PINPolicy) error {
758746 // PINPolicyNever shouldn't require a PIN.
759747 if pp == PINPolicyNever {
+1
-1
piv/key_test.go less more
766766 t.Fatalf("decrypting data: %v", err)
767767 }
768768
769 if bytes.Compare(data, decrypted) != 0 {
769 if !bytes.Equal(data, decrypted) {
770770 t.Fatalf("decrypted data is different to the source data")
771771 }
772772 })
+5
-1
piv/pcsc_windows.go less more
126126 handle syscall.Handle
127127 activeProtocol uint16
128128 )
129 readerPtr, err := syscall.UTF16PtrFromString(reader)
130 if err != nil {
131 return nil, fmt.Errorf("invalid reader string: %v", err)
132 }
129133 r0, _, _ := procSCardConnectW.Call(
130134 uintptr(c.ctx),
131 uintptr(unsafe.Pointer(syscall.StringToUTF16Ptr(reader))),
135 uintptr(unsafe.Pointer(readerPtr)),
132136 scardShareExclusive,
133137 scardProtocolT1,
134138 uintptr(unsafe.Pointer(&handle)),
+3
-46
piv/piv.go less more
401401 response := make([]byte, 8)
402402 block.Encrypt(response, challenge)
403403
404 data := append([]byte{
404 data := []byte{
405405 0x7c, // Dynamic Authentication Template tag
406406 20, // 2+8+2+8
407407 0x80, // 'Witness'
408408 0x08, // Tag length
409 })
409 }
410410 data = append(data, cardResponse...)
411411 data = append(data,
412412 0x81, // 'Challenge'
631631 return binary.BigEndian.Uint32(resp), nil
632632 }
633633
634 // ykChangeManagementKey sets the Management Key to the new key provided. The
635 // user must have authenticated with the existing key first.
636 func ykChangeManagementKey(tx *scTx, key [24]byte) error {
637 cmd := apdu{
638 instruction: insSetMGMKey,
639 param1: 0xff,
640 param2: 0xff, // TODO: support touch policy
641 data: append([]byte{
642 alg3DES, keyCardManagement, 24,
643 }, key[:]...),
644 }
645 if _, err := tx.Transmit(cmd); err != nil {
646 return fmt.Errorf("command failed: %w", err)
647 }
648 return nil
649 }
650
651 func unmarshalDERField(b []byte, tag uint64) (obj []byte, err error) {
652 var prefix []byte
653 for tag > 0 {
654 prefix = append(prefix, byte(tag))
655 tag = tag >> 8
656 }
657 for i, j := 0, len(prefix)-1; i < j; i, j = i+1, j-1 {
658 prefix[i], prefix[j] = prefix[j], prefix[i]
659 }
660
661 hasPrefix := bytes.HasPrefix(b, prefix)
662 for len(b) > 0 {
663 var v asn1.RawValue
664 b, err = asn1.Unmarshal(b, &v)
665 if err != nil {
666 return nil, err
667 }
668 if hasPrefix {
669 return v.Bytes, nil
670 }
671 }
672 return nil, fmt.Errorf("no der value with tag 0x%x", prefix)
673 }
674
675634 // Metadata returns protected data stored on the card. This can be used to
676635 // retrieve PIN protected management keys.
677636 func (yk *YubiKey) Metadata(pin string) (*Metadata, error) {
779738 return fmt.Errorf("invalid management key length: %d", len(v.Bytes))
780739 }
781740 var key [24]byte
782 for i := 0; i < len(v.Bytes); i++ {
783 key[i] = v.Bytes[i]
784 }
741 copy(key[:], v.Bytes)
785742 m.ManagementKey = &key
786743 }
787744 return nil