This commit modifies the psql fork to accept a `*tls.Config` when
dumping TLS info. This allows us to pass the same broad
cipher suite configuration that we use for other connection types,
which preserves compatibility with older Go defaults. It also has
the side effect of hooking up the client certificate request info
callback, which means that Certigo now reports details about the
expected client certificate for Postgres connections.
In the future, we should eliminate our need for this fork by
switching to the `pgx` package and extracting the certificates via
new hooks in the `*tls.Config` struct, rather than patching this
outdated fork.
`github.com/go-ldap/ldap/v3` now supports the two features that we
previously added to a local fork: extracting the TLS connection
state, and defining a connection timeout. This commit deletes the
fork and uses the upstream dependency.
This commit also adjusts the `certigo connect` TLS configuration to
support every cipher suite supported by `crypto/tls`, including
insecure ones. This improves the ability to extract certificates
from servers with poor cipher suite support. This limitation was
uncovered while testing LDAP connectivity.
This commit adds an explicit `golangci-lint` configuration that
simply matches the default linters previously in use, and then
fixes all current linter findings.
Aside from tweaking error message strings, this commit introduces
one externally visible behavior change: PEM data generated from
PKCS#12 files now correctly identifies private key blocks as
`RSA PRIVATE KEY` or `EC PRIVATE KEY`, whereas previously it
generated invalid `PRIVATE KEY` blocks with non-PKCS#8 data.
This commit lays the groundwork for more aggressive linting in the
future, and identifies some additional issues via TODOs.
This splits the logic into a cli, which handles parsing command line args and
reading files, and a terminal abstraction for handling user input and ouput.
All uses of os.Exit are removed in favor of returning errors.
Overall this enables better testing and reuse of code. Previously we had to
rely on external unit testing for CLI tests, which are harder to write tests.
Unfortunately kingpin doesn't support natively support aliased flag names, so
you can supply both --start-tls and --starttls without an error, but that's
just "holding it wrong".
I found some servers don't always return a space after the three-digit code
for example,
certigo connect --start-tls ftp ftp.mirrorservice.org:21
error connecting: FTP server responded with status 220-----------------------------------------------------------------------------
, was expecting 220
Instead, we always take the first three digits and parse them as an integer, rather than
relying on the space. Makes the code look a little cleaner too, by returning it as an int.
If otherwise unspecified, default to port 443.
If a starttls protocol is given, use a protocol-specific default.
So now "certigo connect squareup.com" works.
This moves two functions out of main.go.
The only change to the functions was to make them take arguments, instead of using global variables in main.
The mysql and psql imports are moved here too.
Nik Unger