sneak/dnswatcher
1
0
Fork 0
Code Issues 6 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

feat: implement TLS certificate inspector (closes #4) #7

Merged
sneak merged 4 commits from feature/tlscheck-implementation into main 2026-02-20 19:36:40 +01:00
Conversation 9 Commits 4 Files Changed 3 +16 -6
1 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 54b00f3b2a - Show all commits

22
internal/tlscheck/tlscheck.go
View File

@ -27,6 +27,12 @@ var ErrUnexpectedConnType = errors.New(
"unexpected connection type", "unexpected connection type",
) )
// ErrNoPeerCertificates indicates the TLS connection had no peer
// certificates.
var ErrNoPeerCertificates = errors.New(
"no peer certificates",
)
// CertificateInfo holds information about a TLS certificate. // CertificateInfo holds information about a TLS certificate.
type CertificateInfo struct { type CertificateInfo struct {
CommonName string CommonName string
@ -144,7 +150,7 @@ func (c *Checker) CheckCertificate(
) )
} }
return c.extractCertInfo(tlsConn), nil return c.extractCertInfo(tlsConn)
} }
clawbot commented 2026-02-19 22:50:02 +01:00
Outdated
Review
Copy Link

Returning an empty CertificateInfo{} when len(state.PeerCertificates) == 0 could mask unexpected situations. Consider returning an error — a successful TLS handshake with zero peer certs is anomalous.

Returning an empty `CertificateInfo{}` when `len(state.PeerCertificates) == 0` could mask unexpected situations. Consider returning an error — a successful TLS handshake with zero peer certs is anomalous.
func (c *Checker) buildTLSConfig( func (c *Checker) buildTLSConfig(
@ -165,16 +171,20 @@ func (c *Checker) buildTLSConfig(
func (c *Checker) extractCertInfo( func (c *Checker) extractCertInfo(
conn *tls.Conn, conn *tls.Conn,
) *CertificateInfo { ) (*CertificateInfo, error) {
state := conn.ConnectionState() state := conn.ConnectionState()
if len(state.PeerCertificates) == 0 { if len(state.PeerCertificates) == 0 {
return &CertificateInfo{} return nil, ErrNoPeerCertificates
} }
cert := state.PeerCertificates[0] cert := state.PeerCertificates[0]
sans := make([]string, len(cert.DNSNames)) sans := make([]string, 0, len(cert.DNSNames)+len(cert.IPAddresses))
copy(sans, cert.DNSNames) sans = append(sans, cert.DNSNames...)
for _, ip := range cert.IPAddresses {
sans = append(sans, ip.String())
}
return &CertificateInfo{ return &CertificateInfo{
CommonName: cert.Subject.CommonName, CommonName: cert.Subject.CommonName,
@ -182,5 +192,5 @@ func (c *Checker) extractCertInfo(
NotAfter: cert.NotAfter, NotAfter: cert.NotAfter,
SubjectAlternativeNames: sans, SubjectAlternativeNames: sans,
SerialNumber: cert.SerialNumber.String(), SerialNumber: cert.SerialNumber.String(),
} }, nil
} }