Skip to content

Commit 23b8f45

Browse files
marainomaraino
committed
Address gosec warnings
Most if not all false positives
1 parent 713dfad commit 23b8f45

34 files changed

+93
-30
lines changed

‎acme/challenge.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ func tlsalpn01Validate(ctx context.Context, ch *Challenge, db DB, jwk *jose.JSON
149149
// [RFC5246] or higher when connecting to clients for validation.
150150
MinVersion: tls.VersionTLS12,
151151
ServerName: serverName(ch),
152-
InsecureSkipVerify: true, // we expect a self-signed challenge certificate
152+
InsecureSkipVerify: true, // nolint:gosec // we expect a self-signed challenge certificate
153153
}
154154

155155
hostPort := net.JoinHostPort(ch.Value, "443")

‎acme/client.go

+1
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ func NewClient() Client {
5656
Timeout: 30 * time.Second,
5757
Transport: &http.Transport{
5858
TLSClientConfig: &tls.Config{
59+
// nolint:gosec // used on tls-alpn-01 challenge
5960
InsecureSkipVerify: true, // lgtm[go/disabled-certificate-check]
6061
},
6162
},

‎api/api_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -1437,7 +1437,7 @@ func Test_fmtPublicKey(t *testing.T) {
14371437
if err != nil {
14381438
t.Fatal(err)
14391439
}
1440-
rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
1440+
rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
14411441
if err != nil {
14421442
t.Fatal(err)
14431443
}
@@ -1463,7 +1463,7 @@ func Test_fmtPublicKey(t *testing.T) {
14631463
want string
14641464
}{
14651465
{"p256", args{p256.Public(), p256, nil}, "ECDSA P-256"},
1466-
{"rsa1024", args{rsa1024.Public(), rsa1024, nil}, "RSA 1024"},
1466+
{"rsa2048", args{rsa2048.Public(), rsa2048, nil}, "RSA 2048"},
14671467
{"ed25519", args{edPub, edPriv, nil}, "Ed25519"},
14681468
{"dsa2048", args{cert: &x509.Certificate{PublicKeyAlgorithm: x509.DSA, PublicKey: &dsa2048.PublicKey}}, "DSA 2048"},
14691469
{"unknown", args{cert: &x509.Certificate{PublicKeyAlgorithm: x509.ECDSA, PublicKey: []byte("12345678")}}, "ECDSA unknown"},

‎authority/config/tls_options.go

+1
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,7 @@ func (t *TLSOptions) TLSConfig() *tls.Config {
169169
rs = tls.RenegotiateNever
170170
}
171171

172+
// nolint:gosec // default MinVersion 1.2, if defined but empty 1.3 is used
172173
return &tls.Config{
173174
CipherSuites: t.CipherSuites.Value(),
174175
MinVersion: t.MinVersion.Value(),

‎authority/linkedca.go

+5-2
Original file line numberDiff line numberDiff line change
@@ -461,6 +461,7 @@ func getRootCertificate(endpoint, fingerprint string) (*x509.Certificate, error)
461461
defer cancel()
462462

463463
conn, err := grpc.DialContext(ctx, endpoint, grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{
464+
// nolint:gosec // used in bootstrap protocol
464465
InsecureSkipVerify: true, // lgtm[go/disabled-certificate-check]
465466
})))
466467
if err != nil {
@@ -514,7 +515,8 @@ func login(authority, token string, csr *x509.CertificateRequest, signer crypto.
514515
defer cancel()
515516

516517
conn, err := grpc.DialContext(ctx, endpoint, grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{
517-
RootCAs: rootCAs,
518+
MinVersion: tls.VersionTLS12,
519+
RootCAs: rootCAs,
518520
})))
519521
if err != nil {
520522
return nil, nil, errors.Wrapf(err, "error connecting %s", endpoint)
@@ -590,6 +592,7 @@ func login(authority, token string, csr *x509.CertificateRequest, signer crypto.
590592
rootCAs.AddCert(bundle[last])
591593

592594
return cert, &tls.Config{
593-
RootCAs: rootCAs,
595+
MinVersion: tls.VersionTLS12,
596+
RootCAs: rootCAs,
594597
}, nil
595598
}

‎authority/provisioner/aws.go

+3
Original file line numberDiff line numberDiff line change
@@ -35,16 +35,19 @@ const awsIdentityURL = "http://169.254.169.254/latest/dynamic/instance-identity/
3535
const awsSignatureURL = "http://169.254.169.254/latest/dynamic/instance-identity/signature"
3636

3737
// awsAPITokenURL is the url used to get the IMDSv2 API token
38+
// nolint:gosec // no credentials here
3839
const awsAPITokenURL = "http://169.254.169.254/latest/api/token"
3940

4041
// awsAPITokenTTL is the default TTL to use when requesting IMDSv2 API tokens
4142
// -- we keep this short-lived since we get a new token with every call to readURL()
4243
const awsAPITokenTTL = "30"
4344

4445
// awsMetadataTokenHeader is the header that must be passed with every IMDSv2 request
46+
// nolint:gosec // no credentials here
4547
const awsMetadataTokenHeader = "X-aws-ec2-metadata-token"
4648

4749
// awsMetadataTokenTTLHeader is the header used to indicate the token TTL requested
50+
// nolint:gosec // no credentials here
4851
const awsMetadataTokenTTLHeader = "X-aws-ec2-metadata-token-ttl-seconds"
4952

5053
// awsCertificate is the certificate used to validate the instance identity

‎authority/provisioner/aws_test.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -316,7 +316,7 @@ func TestAWS_authorizeToken(t *testing.T) {
316316
}
317317
key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
318318
assert.FatalError(t, err)
319-
badKey, err := rsa.GenerateKey(rand.Reader, 1024)
319+
badKey, err := rsa.GenerateKey(rand.Reader, 2048)
320320
assert.FatalError(t, err)
321321

322322
type test struct {
@@ -579,7 +579,7 @@ func TestAWS_AuthorizeSign(t *testing.T) {
579579
key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
580580
assert.FatalError(t, err)
581581

582-
badKey, err := rsa.GenerateKey(rand.Reader, 1024)
582+
badKey, err := rsa.GenerateKey(rand.Reader, 2048)
583583
assert.FatalError(t, err)
584584

585585
t4, err := generateAWSToken(
@@ -748,6 +748,7 @@ func TestAWS_AuthorizeSSHSign(t *testing.T) {
748748
pub := key.Public().Key
749749
rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
750750
assert.FatalError(t, err)
751+
// nolint:gosec // tests minimum size of the key
751752
rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
752753
assert.FatalError(t, err)
753754

‎authority/provisioner/azure.go

+1
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
const azureOIDCBaseURL = "https://login.microsoftonline.com"
2626

2727
// azureIdentityTokenURL is the URL to get the identity token for an instance.
28+
// nolint:gosec // no credentials here
2829
const azureIdentityTokenURL = "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F"
2930

3031
// azureDefaultAudience is the default audience used.

‎authority/provisioner/azure_test.go

+1
Original file line numberDiff line numberDiff line change
@@ -624,6 +624,7 @@ func TestAzure_AuthorizeSSHSign(t *testing.T) {
624624
pub := key.Public().Key
625625
rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
626626
assert.FatalError(t, err)
627+
// nolint:gosec // tests minimum size of the key
627628
rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
628629
assert.FatalError(t, err)
629630

‎authority/provisioner/collection.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
package provisioner
22

33
import (
4-
"crypto/sha1"
4+
"crypto/sha1" // nolint:gosec // not used for cryptographic security
55
"crypto/x509"
66
"encoding/asn1"
77
"encoding/binary"
@@ -319,6 +319,7 @@ func loadProvisioner(m *sync.Map, key string) (Interface, bool) {
319319
// provisionerSum returns the SHA1 of the provisioners ID. From this we will
320320
// create the unique and sorted id.
321321
func provisionerSum(p Interface) []byte {
322+
// nolint:gosec // not used for cryptographic security
322323
sum := sha1.Sum([]byte(p.GetID()))
323324
return sum[:]
324325
}

‎authority/provisioner/gcp_test.go

+1
Original file line numberDiff line numberDiff line change
@@ -623,6 +623,7 @@ func TestGCP_AuthorizeSSHSign(t *testing.T) {
623623
pub := key.Public().Key
624624
rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
625625
assert.FatalError(t, err)
626+
// nolint:gosec // tests minimum size of the key
626627
rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
627628
assert.FatalError(t, err)
628629

‎authority/provisioner/jwk_test.go

+1
Original file line numberDiff line numberDiff line change
@@ -411,6 +411,7 @@ func TestJWK_AuthorizeSSHSign(t *testing.T) {
411411
pub := key.Public().Key
412412
rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
413413
assert.FatalError(t, err)
414+
// nolint:gosec // tests minimum size of the key
414415
rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
415416
assert.FatalError(t, err)
416417

‎authority/provisioner/keystore.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -85,14 +85,14 @@ func (ks *keyStore) reload() {
8585
// 0 it will randomly rotate between 0-12 hours, but every time we call to Get
8686
// it will automatically rotate.
8787
func (ks *keyStore) nextReloadDuration(age time.Duration) time.Duration {
88-
n := rand.Int63n(int64(ks.jitter))
88+
n := rand.Int63n(int64(ks.jitter)) // nolint:gosec // not used for cryptographic security
8989
age -= time.Duration(n)
9090
return abs(age)
9191
}
9292

9393
func getKeysFromJWKsURI(uri string) (jose.JSONWebKeySet, time.Duration, error) {
9494
var keys jose.JSONWebKeySet
95-
resp, err := http.Get(uri)
95+
resp, err := http.Get(uri) // nolint:gosec // openid-configuration jwks_uri
9696
if err != nil {
9797
return keys, 0, errors.Wrapf(err, "failed to connect to %s", uri)
9898
}

‎authority/provisioner/oidc.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -464,7 +464,7 @@ func (o *OIDC) AuthorizeSSHRevoke(ctx context.Context, token string) error {
464464
}
465465

466466
func getAndDecode(uri string, v interface{}) error {
467-
resp, err := http.Get(uri)
467+
resp, err := http.Get(uri) // nolint:gosec // openid-configuration uri
468468
if err != nil {
469469
return errors.Wrapf(err, "failed to connect to %s", uri)
470470
}

‎authority/provisioner/oidc_test.go

+1
Original file line numberDiff line numberDiff line change
@@ -535,6 +535,7 @@ func TestOIDC_AuthorizeSSHSign(t *testing.T) {
535535
pub := key.Public().Key
536536
rsa2048, err := rsa.GenerateKey(rand.Reader, 2048)
537537
assert.FatalError(t, err)
538+
// nolint:gosec // tests minimum size of the key
538539
rsa1024, err := rsa.GenerateKey(rand.Reader, 1024)
539540
assert.FatalError(t, err)
540541

‎authority/provisioner/options_test.go

+1
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,7 @@ func TestCustomTemplateOptions(t *testing.T) {
254254
}
255255

256256
func Test_unsafeParseSigned(t *testing.T) {
257+
// nolint:gosec // no credentials here
257258
okToken := "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJqYW5lQGRvZS5jb20iLCJpc3MiOiJodHRwczovL2RvZS5jb20iLCJqdGkiOiI4ZmYzMjQ4MS1mZDVmLTRlMmUtOTZkZi05MDhjMTI3Yzg1ZjciLCJpYXQiOjE1OTUzNjAwMjgsImV4cCI6MTU5NTM2MzYyOH0.aid8UuhFucJOFHXaob9zpNtVvhul9ulTGsA52mU6XIw"
258259
type args struct {
259260
s string

‎authority/provisioner/utils_test.go

+1
Original file line numberDiff line numberDiff line change
@@ -449,6 +449,7 @@ func generateAWSWithServer() (*AWS, *httptest.Server, error) {
449449
if err != nil {
450450
return nil, nil, errors.Wrap(err, "error signing document")
451451
}
452+
// nolint:gosec // tests minimum size of the key
452453
token := "AQAEAEEO9-7Z88ewKFpboZuDlFYWz9A3AN-wMOVzjEhfAyXW31BvVw=="
453454
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
454455
switch r.URL.Path {

‎authority/tls_test.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import (
66
"crypto/ecdsa"
77
"crypto/elliptic"
88
"crypto/rand"
9-
"crypto/sha1"
9+
"crypto/sha1" // nolint:gosec // used to create the Subject Key Identifier by RFC 5280
1010
"crypto/x509"
1111
"crypto/x509/pkix"
1212
"encoding/asn1"
@@ -199,6 +199,7 @@ func generateSubjectKeyID(pub crypto.PublicKey) ([]byte, error) {
199199
if _, err = asn1.Unmarshal(b, &info); err != nil {
200200
return nil, fmt.Errorf("error unmarshaling public key: %w", err)
201201
}
202+
// nolint:gosec // used to create the Subject Key Identifier by RFC 5280
202203
hash := sha1.Sum(info.SubjectPublicKey.Bytes)
203204
return hash[:], nil
204205
}

‎ca/bootstrap_test.go

+4
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,7 @@ func TestBootstrap(t *testing.T) {
200200
}
201201
}
202202

203+
// nolint:gosec // insecure test servers
203204
func TestBootstrapServerWithoutMTLS(t *testing.T) {
204205
srv := startCABootstrapServer()
205206
defer srv.Close()
@@ -256,6 +257,7 @@ func TestBootstrapServerWithoutMTLS(t *testing.T) {
256257
}
257258
}
258259

260+
// nolint:gosec // insecure test servers
259261
func TestBootstrapServerWithMTLS(t *testing.T) {
260262
srv := startCABootstrapServer()
261263
defer srv.Close()
@@ -405,6 +407,7 @@ func TestBootstrapClientServerRotation(t *testing.T) {
405407

406408
// Create bootstrap server
407409
token := generateBootstrapToken(caURL, "127.0.0.1", "ef742f95dc0d8aa82d3cca4017af6dac3fce84290344159891952d18c53eefe7")
410+
// nolint:gosec // insecure test server
408411
server, err := BootstrapServer(context.Background(), token, &http.Server{
409412
Addr: ":0",
410413
Handler: http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
@@ -523,6 +526,7 @@ func TestBootstrapClientServerFederation(t *testing.T) {
523526

524527
// Create bootstrap server
525528
token := generateBootstrapToken(caURL1, "127.0.0.1", "ef742f95dc0d8aa82d3cca4017af6dac3fce84290344159891952d18c53eefe7")
529+
// nolint:gosec // insecure test server
526530
server, err := BootstrapServer(context.Background(), token, &http.Server{
527531
Addr: ":0",
528532
Handler: http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {

‎ca/ca_test.go

+3-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import (
55
"context"
66
"crypto"
77
"crypto/rand"
8-
"crypto/sha1"
8+
"crypto/sha1" // nolint:gosec // used to create the Subject Key Identifier by RFC 5280
99
"crypto/tls"
1010
"crypto/x509"
1111
"crypto/x509/pkix"
@@ -65,6 +65,8 @@ func generateSubjectKeyID(pub crypto.PublicKey) ([]byte, error) {
6565
if _, err = asn1.Unmarshal(b, &info); err != nil {
6666
return nil, errors.Wrap(err, "error unmarshaling public key")
6767
}
68+
69+
// nolint:gosec // used to create the Subject Key Identifier by RFC 5280
6870
hash := sha1.Sum(info.SubjectPublicKey.Bytes)
6971
return hash[:], nil
7072
}

‎ca/client.go

+13-4
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ func newClient(transport http.RoundTripper) *uaClient {
5656
}
5757
}
5858

59+
// nolint:gosec // used in bootstrap protocol
5960
func newInsecureClient() *uaClient {
6061
return &uaClient{
6162
Client: &http.Client{
@@ -201,15 +202,19 @@ func (o *clientOptions) getTransport(endpoint string) (tr http.RoundTripper, err
201202
switch tr := tr.(type) {
202203
case *http.Transport:
203204
if tr.TLSClientConfig == nil {
204-
tr.TLSClientConfig = &tls.Config{}
205+
tr.TLSClientConfig = &tls.Config{
206+
MinVersion: tls.VersionTLS12,
207+
}
205208
}
206209
if len(tr.TLSClientConfig.Certificates) == 0 && tr.TLSClientConfig.GetClientCertificate == nil {
207210
tr.TLSClientConfig.Certificates = []tls.Certificate{o.certificate}
208211
tr.TLSClientConfig.GetClientCertificate = o.getClientCertificate
209212
}
210213
case *http2.Transport:
211214
if tr.TLSClientConfig == nil {
212-
tr.TLSClientConfig = &tls.Config{}
215+
tr.TLSClientConfig = &tls.Config{
216+
MinVersion: tls.VersionTLS12,
217+
}
213218
}
214219
if len(tr.TLSClientConfig.Certificates) == 0 && tr.TLSClientConfig.GetClientCertificate == nil {
215220
tr.TLSClientConfig.Certificates = []tls.Certificate{o.certificate}
@@ -236,11 +241,15 @@ func WithTransport(tr http.RoundTripper) ClientOption {
236241
}
237242

238243
// WithInsecure adds a insecure transport that bypasses TLS verification.
244+
// nolint:gosec // insecure option
239245
func WithInsecure() ClientOption {
240246
return func(o *clientOptions) error {
241247
o.transport = &http.Transport{
242-
Proxy: http.ProxyFromEnvironment,
243-
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
248+
Proxy: http.ProxyFromEnvironment,
249+
TLSClientConfig: &tls.Config{
250+
MinVersion: tls.VersionTLS12,
251+
InsecureSkipVerify: true,
252+
},
244253
}
245254
return nil
246255
}

‎ca/identity/client.go

+1
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ func LoadClient() (*Client, error) {
6262
// Prepare transport with information in defaults.json and identity.json
6363
tr := http.DefaultTransport.(*http.Transport).Clone()
6464
tr.TLSClientConfig = &tls.Config{
65+
MinVersion: tls.VersionTLS12,
6566
GetClientCertificate: identity.GetClientCertificateFunc(),
6667
}
6768

‎ca/identity/client_test.go

+2
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ func TestClient(t *testing.T) {
5858
Certificates: []tls.Certificate{crt},
5959
ClientCAs: pool,
6060
ClientAuth: tls.VerifyClientCertIfGiven,
61+
MinVersion: tls.VersionTLS12,
6162
}
6263
okServer.StartTLS()
6364

@@ -132,6 +133,7 @@ func TestLoadClient(t *testing.T) {
132133
tr.TLSClientConfig = &tls.Config{
133134
Certificates: []tls.Certificate{crt},
134135
RootCAs: pool,
136+
MinVersion: tls.VersionTLS12,
135137
}
136138
expected := &Client{
137139
CaURL: &url.URL{Scheme: "https", Host: "127.0.0.1"},

‎ca/identity/identity.go

+1
Original file line numberDiff line numberDiff line change
@@ -296,6 +296,7 @@ func (i *Identity) Renew(client Renewer) error {
296296
tr.TLSClientConfig = &tls.Config{
297297
Certificates: []tls.Certificate{cert},
298298
RootCAs: client.GetRootCAs(),
299+
MinVersion: tls.VersionTLS12,
299300
PreferServerCipherSuites: true,
300301
}
301302

‎ca/renew.go

+7-2
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ func (r *TLSRenewer) renewCertificate() {
173173
cert, err := r.RenewCertificate()
174174
if err != nil {
175175
next = r.renewJitter / 2
176-
next += time.Duration(rand.Int63n(int64(next)))
176+
next += time.Duration(mathRandInt63n(int64(next)))
177177
} else {
178178
r.setCertificate(cert)
179179
next = r.nextRenewDuration(cert.Leaf.NotAfter)
@@ -185,10 +185,15 @@ func (r *TLSRenewer) renewCertificate() {
185185

186186
func (r *TLSRenewer) nextRenewDuration(notAfter time.Time) time.Duration {
187187
d := time.Until(notAfter).Truncate(time.Second) - r.renewBefore
188-
n := rand.Int63n(int64(r.renewJitter))
188+
n := mathRandInt63n(int64(r.renewJitter))
189189
d -= time.Duration(n)
190190
if d < 0 {
191191
d = 0
192192
}
193193
return d
194194
}
195+
196+
// nolint:gosec // not used for cryptographic security
197+
func mathRandInt63n(n int64) int64 {
198+
return rand.Int63n(n)
199+
}

‎ca/tls.go

+1
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ func init() {
6060
d := &tls.Dialer{
6161
NetDialer: getDefaultDialer(),
6262
Config: &tls.Config{
63+
MinVersion: tls.VersionTLS12,
6364
RootCAs: pool,
6465
GetClientCertificate: id.GetClientCertificateFunc(),
6566
},

0 commit comments

Comments
 (0)