improve cert parsing and formatting (#19)

Author: botsman

app/cert/parse.go

@@ -1,15 +1,13 @@
 package cert
 
 import (
-	"bytes"
 	"crypto/sha256"
 	"crypto/x509"
 	"encoding/asn1"
 	"encoding/hex"
 	"encoding/pem"
 	"errors"
 	"log"
-	"strings"
 	"time"
 
 	"go.mongodb.org/mongo-driver/bson"
@@ -52,8 +50,12 @@ func (c *ParsedCert) ToBson() (bson.M, error) {
 	if c.Cert == nil {
 		return nil, errors.New("certificate is nil")
 	}
+	rawCertPem := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: c.Cert.Raw})
+	if rawCertPem == nil {
+		return nil, errors.New("error encoding certificate to PEM format")
+	}
 	res := bson.M{
-		"pem":           c.Cert.Raw,
+		"pem":           rawCertPem,
 		"serial_number": c.Cert.SerialNumber.String(),
 		"sha256":        c.Sha256(),
 		"registers":     c.Registers,
@@ -98,7 +100,8 @@ func (c *ParsedCert) UnmarshalBSON(data []byte) error {
 	c.Position = raw["position"].(models.Position)
 
 	pemData := raw["pem"].([]byte)
-	p, _ := pem.Decode(pemData) // ignore rest for now, maybe use it later
+	// ignore rest as we expect only PEM data in the DB
+	p, _ := pem.Decode(pemData)
 	if p == nil {
 		return errors.New("error parsing certificate")
 	}
@@ -113,44 +116,29 @@ func (c *ParsedCert) CompanyId() string {
 	return c.Cert.Subject.SerialNumber
 }
 
-func ParseCert(data []byte) (*ParsedCert, error) {
-	data, err := FormatCertContent(data)
-	if err != nil {
-		return nil, err
-	}
-	p, _ := pem.Decode(data) // ignore rest for now, maybe use it later
-	if p == nil {
-		return nil, errors.New("error parsing certificate")
-	}
-	x509Cert, err := x509.ParseCertificate(p.Bytes)
-	if err != nil {
-		return nil, err
+func ParseCerts(data []byte) ([]*ParsedCert, error) {
+	if len(data) == 0 {
+		return nil, errors.New("no data provided")
 	}
-	var cert ParsedCert
-	cert.Cert = x509Cert
-	return &cert, nil
-}
-
-func FormatCertContent(content []byte) ([]byte, error) {
-	certPrefix := "-----BEGIN CERTIFICATE-----"
-	certSuffix := "-----END CERTIFICATE-----"
-	pemLineLength := 64
-	contentString := string(content)
-	contentString = strings.Replace(contentString, certPrefix, "", 1)
-	contentString = strings.Replace(contentString, certSuffix, "", 1)
-	contentString = strings.ReplaceAll(contentString, "\n", "")
-	contentString = strings.ReplaceAll(contentString, " ", "")
-	contentString = strings.ReplaceAll(contentString, "\r", "")
-	var buffer bytes.Buffer
-	buffer.WriteString(certPrefix)
-	buffer.WriteString("\n")
-	for i := 0; i < len(contentString); i += pemLineLength {
-		end := min(i+pemLineLength, len(contentString))
-		buffer.WriteString(contentString[i:end])
-		buffer.WriteString("\n")
+	certs := []*ParsedCert{}
+	for {
+		p, rest := pem.Decode(data)
+		if p == nil {
+			return nil, errors.New("error parsing certificate")
+		}
+		x509Cert, err := x509.ParseCertificate(p.Bytes)
+		if err != nil {
+			return nil, err
+		}
+		var cert ParsedCert
+		cert.Cert = x509Cert
+		certs = append(certs, &cert)
+		if len(rest) == 0 {
+			break
+		}
+		data = rest
 	}
-	buffer.WriteString(certSuffix)
-	return buffer.Bytes(), nil
+	return certs, nil
 }
 
 func (c *ParsedCert) OBScopes() ([]models.Scope, error) {

app/verify/verify.go

@@ -119,13 +119,20 @@ func (s *VerifySvc) Verify(c *gin.Context) {
 		return
 	}
 	result := VerifyResult{}
-	cert, err := cert.ParseCert(req.Cert)
+	certs, err := cert.ParseCerts(req.Cert)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{
 			"error": err.Error(),
 		})
 		return
 	}
+	if len(certs) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"error": "No valid certificate found",
+		})
+		return
+	}
+	cert := certs[0]
 	result.Certificate = cert
 	tpp, err := s.getTpp(c, cert.CompanyId())
 	if err != nil {
@@ -369,12 +376,12 @@ func (s *VerifySvc) loadCerts(c *gin.Context, body io.ReadCloser) ([]*cert.Parse
 		log.Printf("Error reading response body: %s", err)
 		return nil, err
 	}
-	crt, err := cert.ParseCert(bodyBytes)
+	certs, err := cert.ParseCerts(bodyBytes)
 	if err != nil {
 		log.Printf("Error parsing certificate: %s", err)
 		return nil, err
 	}
-	return []*cert.ParsedCert{crt}, nil
+	return certs, nil
 }
 
 func (s *VerifySvc) getScopes(c *gin.Context, crt *cert.ParsedCert, tpp *models.TPP) map[string][]string {

app/verify/verify_test.go

@@ -257,10 +257,11 @@ func TestParseCert(t *testing.T) {
 	if svc == nil {
 		t.Fatal("Expected non-nil VerifySvc")
 	}
-	cert, err := cert.ParseCert([]byte(certContent))
+	certs, err := cert.ParseCerts([]byte(certContent))
 	if err != nil {
 		t.Fatalf("Expected no error, got %v", err)
 	}
+	cert := certs[0]
 	t.Logf("Parsed certificate: %+v", cert)
 	if cert.CompanyId() != "12345678" {
 		t.Errorf("Expected CompanyId '12345678', got '%s'", cert.CompanyId())
@@ -394,10 +395,14 @@ func TestVerifyCert(t *testing.T) {
 			return
 		}
 		svc.AddRoot(caCert)
-		cert, err := cert.ParseCert([]byte(certContent))
+		certs, err := cert.ParseCerts([]byte(certContent))
 		if err != nil {
 			t.Fatalf("Expected no error, got %v", err)
 		}
+		if len(certs) == 0 {
+			t.Fatal("Expected non-empty certificate slice")
+		}
+		cert := certs[0]
 		t.Logf("Parsed certificate: %+v", cert)
 		// Simulate a successful verification
 
@@ -430,10 +435,14 @@ func TestGetScopes(t *testing.T) {
 	if tpp == nil {
 		t.Fatal("Expected non-nil TPP")
 	}
-	cert, err := cert.ParseCert([]byte(certContent))
+	certs, err := cert.ParseCerts([]byte(certContent))
 	if err != nil {
 		t.Fatalf("Expected no error, got %v", err)
 	}
+	if len(certs) == 0 {
+		t.Fatal("Expected non-empty certificate slice")
+	}
+	cert := certs[0]
 	scopes := svc.getScopes(&ctx, cert, tpp)
 	if len(scopes) == 0 {
 		t.Fatal("Expected non-empty scopes")

server/db/mongo.go

@@ -64,8 +64,11 @@ func (r *TppMongoRepository) GetTpp(ctx context.Context, id string) (*models.TPP
 }
 
 func (r *TppMongoRepository) GetRootCertificates(ctx context.Context) ([]string, error) {
-	// Get all certificates from the "certs" collection for now
-	cursor, err := r.db.Collection("certs").Find(ctx, bson.M{})
+	filter := bson.M{
+		"is_active": true,
+		"position":  models.Root,
+	}
+	cursor, err := r.db.Collection("certs").Find(ctx, filter)
 	if err != nil {
 		return nil, err
 	}

tools/eba_certs/main.go

@@ -15,8 +15,8 @@ import (
 	"go.mongodb.org/mongo-driver/mongo"
 	"go.mongodb.org/mongo-driver/mongo/options"
 
-	"github.com/botsman/tppVerifier/app/models"
 	"github.com/botsman/tppVerifier/app/cert"
+	"github.com/botsman/tppVerifier/app/models"
 )
 
 // Load XML files from EBA
@@ -153,18 +153,20 @@ func parseCerts(certChan <-chan RawCert, now time.Time) <-chan *cert.ParsedCert
 	go func() {
 		defer close(parsedCertChan)
 		for crt := range certChan {
-			parsedCert, err := cert.ParseCert([]byte(crt.Pem))
+			parsedCerts, err := cert.ParseCerts([]byte(crt.Pem))
 			if err != nil {
 				fmt.Println(err)
 				continue
 			}
-			parsedCert.UpdatedAt = now
-			parsedCert.IsActive = true
-			parsedCert.Position = models.Root
-			parsedCert.Registers = []models.Register{
-				models.EBA,
+			for _, parsedCert := range parsedCerts {
+				parsedCert.UpdatedAt = now
+				parsedCert.IsActive = true
+				parsedCert.Position = models.Root
+				parsedCert.Registers = []models.Register{
+					models.EBA,
+				}
+				parsedCertChan <- parsedCert
 			}
-			parsedCertChan <- parsedCert
 		}
 	}()
 	return parsedCertChan
@@ -230,16 +232,16 @@ func main() {
 			fmt.Println("Error updating certificate:", err)
 			continue
 		}
-		
+
 	}
 
 	// Clean up all certificates that are not active
 	// We check their `updated_at` field to see if they were not updated in the
 	// current run
 	cleanupRes, err := certsCollection.UpdateMany(ctx,
 		bson.M{
-			"is_active": true,
-			"position": bson.M{"$eq": models.Root},
+			"is_active":  true,
+			"position":   bson.M{"$eq": models.Root},
 			"updated_at": bson.M{"$ne": now},
 		},
 		bson.M{