/*

* ZLint Copyright 2024 Regents of the University of Michigan

*

* Licensed under the Apache License, Version 2.0 (the "License"); you may not

* use this file except in compliance with the License. You may obtain a copy

* of the License at http://www.apache.org/licenses/LICENSE-2.0

*

* Unless required by applicable law or agreed to in writing, software

* distributed under the License is distributed on an "AS IS" BASIS,

* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

* implied. See the License for the specific language governing

* permissions and limitations under the License.

*/

package main

import (

"bytes"

"encoding/base64"

"encoding/json"

"encoding/pem"

"flag"

"fmt"

"io"

"os"

"regexp"

"sort"

"strings"

log "github.com/sirupsen/logrus"

"github.com/zmap/zcrypto/x509"

"github.com/zmap/zlint/v3"

"github.com/zmap/zlint/v3/formattedoutput"

"github.com/zmap/zlint/v3/lint"

"golang.org/x/crypto/ocsp"

_ "github.com/zmap/zlint/v3/profiles"

)

var ( // flags

listLintsJSON bool

listLintSources bool

listProfiles bool

summary bool

longSummary bool

prettyprint bool

format string

nameFilter string

includeNames string

excludeNames string

includeSources string

excludeSources string

profile string

printVersion bool

config string

exampleConfig bool

// version is replaced by GoReleaser or `make` using an LDFlags option at

// build time. Here we supply a default value for folks that `go install` or

// `go build` directly from src.

version = "dev-unknown"

)

func init() {

flag.BoolVar(&listLintsJSON, "list-lints-json", false, "Prints a line delimited list of JSON. Each line prints the name, description, and source of the given lint")

flag.BoolVar(&listLintSources, "list-lints-source", false, "Prints a line-delimited list of lint sources. A lint source is a governing body, or document, such as CABF or an individual RFC.")

flag.BoolVar(&listProfiles, "list-profiles", false, "Prints a line delimited list of JSON. Each line the prints name, description, source, and a list of all lints that comprise the profile")

flag.BoolVar(&summary, "summary", false, "Prints a succinct, tabular, human-readable, summary report in place of the default JSON report. Only the counts of info/warn/error/fatal occurrences are reported")

flag.BoolVar(&longSummary, "longSummary", false, "Prints a tabular, human-readable, summary report in place of the default JSON report. This prints the same contents as '-summary', but with the additional detail of what lints produced a non-PASS code")

flag.StringVar(&format, "format", "pem", "Informs ZLint of the format of the incoming file. One of {pem, der, base64}. Default: pem")

flag.StringVar(&nameFilter, "nameFilter", "", "Only run lints with a name matching the provided regex. The regex syntax used is that used in the Golang regexp package (please see https://pkg.go.dev/regexp/syntax) (Can not be used with -includeNames/-excludeNames)")

flag.StringVar(&includeNames, "includeNames", "", "Comma-separated list of lints to include by name. The names provided must be precise. If you wish to use a pattern instead, please see -nameFilter")

flag.StringVar(&excludeNames, "excludeNames", "", "Comma-separated list of lints to exclude by name. The names provided must be precise. If you wish to use a pattern instead, please see -nameFilter")

flag.StringVar(&includeSources, "includeSources", "", "Comma-separated list of lint sources to include. For a list of sources, please see '-list-lints-source'")

flag.StringVar(&excludeSources, "excludeSources", "", "Comma-separated list of lint sources to exclude. For a list of sources, please see '-list-lints-source'")

flag.StringVar(&profile, "profile", "", "Name of the linting profile to use. Only the lints falling under this profile will be ran. For a list of lints per-profile, please see '-list-profiles'")

flag.BoolVar(&printVersion, "version", false, "Print ZLint version and exit")

flag.StringVar(&config, "config", "", "A path to valid a TOML file that is to service as the configuration for a single run of ZLint. Providing a configuration file allows for modifying the behavior of select lints. For an example configuration, please see '-exampleConfig'")

flag.BoolVar(&exampleConfig, "exampleConfig", false, "Prints a complete example of a configuration that is usable via the '-config' flag and exit. All values listed in this example will be set to their default.")

flag.BoolVar(&prettyprint, "pretty", false, "Pretty-print JSON output")

flag.Usage = func() {

fmt.Fprintf(os.Stderr, "ZLint version %s\n\n", version)

fmt.Fprintf(os.Stderr, "Usage: %s [flags] file...\n", os.Args[0])

flag.PrintDefaults()

}

flag.Parse()

log.SetLevel(log.InfoLevel)

}

//nolint:cyclop

func main() {

if printVersion {

fmt.Printf("ZLint version %s\n", version)

return

}

// Build a registry of lints using the include/exclude lint name and source

// flags.

registry, err := setLints()

if err != nil {

log.Fatalf("unable to configure included/exclude lints: %v\n", err)

}

if listLintsJSON {

registry.WriteJSON(os.Stdout)

return

}

if exampleConfig {

b, err := registry.DefaultConfiguration()

if err != nil {

log.Fatalf("a critical error occurred while generating a configuration file, %s", err)

}

fmt.Println(string(b))

return

}

if listLintSources {

sources := registry.Sources()

sort.Sort(sources)

for _, source := range sources {

fmt.Printf(" %s\n", source)

}

return

}

if listProfiles {

enc := json.NewEncoder(os.Stdout)

enc.SetEscapeHTML(false)

for _, profile := range lint.AllProfiles() {

err = enc.Encode(profile)

if err != nil {

log.Fatalf("a critical error occurred while JSON encoding a profile, %s", err)

}

}

return

}

var inform = strings.ToLower(format)

if flag.NArg() < 1 || flag.Arg(0) == "-" {

doLint(os.Stdin, inform, registry)

} else {

for _, filePath := range flag.Args() {

var inputFile *os.File

var err error

inputFile, err = os.Open(filePath)

if err != nil {

log.Fatalf("unable to open file %s: %s", filePath, err)

}

var fileInform = inform

switch {

case strings.HasSuffix(filePath, ".der"):

fileInform = "der"

case strings.HasSuffix(filePath, ".pem"):

fileInform = "pem"

}

doLint(inputFile, fileInform, registry)

inputFile.Close() //nolint:errcheck

}

}

}

//nolint:cyclop

func doLint(inputFile *os.File, inform string, registry lint.Registry) {

fileBytes, err := io.ReadAll(inputFile)

if err != nil {

log.Fatalf("unable to read file %s: %s", inputFile.Name(), err)

}

var asn1Data []byte

switch inform {

case "pem":

p, _ := pem.Decode(fileBytes)

if p == nil {

log.Fatal("unable to parse PEM")

}

if p.Type != "CERTIFICATE" && p.Type != "X509 CRL" {

log.Fatalf("unknown PEM type %s", p.Type)

}

asn1Data = p.Bytes

case "der":

asn1Data = fileBytes

case "base64":

asn1Data, err = base64.StdEncoding.DecodeString(string(fileBytes))

if err != nil {

log.Fatalf("unable to parse base64: %s", err)

}

default:

log.Fatalf("unknown input format %s", format)

}

var zlintResult *zlint.ResultSet

var errs []error

if cert, err := x509.ParseCertificate(asn1Data); err == nil {

zlintResult = zlint.LintCertificateEx(cert, registry)

} else {

errs = append(errs, fmt.Errorf("parsing as certificate: %v", err))

}

if zlintResult == nil {

if crl, err := x509.ParseRevocationList(asn1Data); err == nil {

zlintResult = zlint.LintRevocationListEx(crl, registry)

} else {

errs = append(errs, fmt.Errorf("parsing as CRL: %v", err))

}

}

if zlintResult == nil {

if resp, err := ocsp.ParseResponse(asn1Data, nil); err == nil {

zlintResult = zlint.LintOcspResponseEx(resp, registry)

} else {

errs = append(errs, fmt.Errorf("parsing as OCSP response: %v", err))

}

}

if zlintResult == nil {

log.Fatalf("unable to parse input as any known type, errors: %v", errs)

}

jsonBytes, err := json.Marshal(zlintResult.Results)

if err != nil {

log.Fatalf("unable to encode lints JSON: %s", err)

}

if prettyprint {

var out bytes.Buffer

if err := json.Indent(&out, jsonBytes, "", " "); err != nil {

log.Fatalf("can't format output: %s", err)

}

os.Stdout.Write(out.Bytes()) //nolint:errcheck

fmt.Printf("\n\n")

}

if summary {

formattedoutput.OutputSummary(zlintResult, false)

}

if longSummary {

formattedoutput.OutputSummary(zlintResult, true)

}

if !prettyprint && !summary && !longSummary {

os.Stdout.Write(jsonBytes) //nolint:errcheck

}

os.Stdout.Write([]byte{'\n'}) //nolint:errcheck

os.Stdout.Sync() //nolint:errcheck

}

// trimmedList takes a comma separated string argument in raw, splits it by

// comma, and returns a list of the separated elements after trimming spaces

// from each element.

func trimmedList(raw string) []string {

var list []string

for _, item := range strings.Split(raw, ",") {

list = append(list, strings.TrimSpace(item))

}

return list

}

// setLints returns a filtered registry to use based on the nameFilter,

// includeNames, excludeNames, includeSources, and excludeSources flag values in

// use.

//

//nolint:cyclop

func setLints() (lint.Registry, error) {

configuration, err := lint.NewConfigFromFile(config)

if err != nil {

return nil, err

}

lint.GlobalRegistry().SetConfiguration(configuration)

// If there's no filter options set, use the global registry as-is

anyFilters := func(args ...string) bool {

for _, arg := range args {

if arg != "" {

return true

}

}

return false

}

if !anyFilters(nameFilter, includeNames, excludeNames, includeSources, excludeSources, profile) {

return lint.GlobalRegistry(), nil

}

filterOpts := lint.FilterOptions{}

if nameFilter != "" {

r, err := regexp.Compile(nameFilter)

if err != nil {

return nil, fmt.Errorf("bad -nameFilter: %v", err)

}

filterOpts.NameFilter = r

}

if excludeSources != "" {

if err := filterOpts.ExcludeSources.FromString(excludeSources); err != nil {

log.Fatalf("invalid -excludeSources: %v", err)

}

}

if includeSources != "" {

if err := filterOpts.IncludeSources.FromString(includeSources); err != nil {

log.Fatalf("invalid -includeSources: %v\n", err)

}

}

if excludeNames != "" {

filterOpts.ExcludeNames = trimmedList(excludeNames)

}

if includeNames != "" {

filterOpts.IncludeNames = trimmedList(includeNames)

}

if profile != "" {

p, ok := lint.GetProfile(profile)

if !ok {

return nil, fmt.Errorf("lint profile name does not exist: %v", profile)

}

filterOpts.AddProfile(p)

}

return lint.GlobalRegistry().Filter(filterOpts)

}