snowflake-sdk
Version:
Node.js driver for Snowflake
88 lines • 4.12 kB
JavaScript
;
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.getCertificateCrlUrls = void 0;
exports.getCertificateDebugName = getCertificateDebugName;
exports.isShortLivedCertificate = isShortLivedCertificate;
exports.isCertificateRevoked = isCertificateRevoked;
exports.isIssuingDistributionPointExtensionValid = isIssuingDistributionPointExtensionValid;
const logger_1 = __importDefault(require("../../logger"));
function getCertificateDebugName(certificate) {
return [
`O:${certificate.subject.O}`,
`CN:${certificate.subject.CN}`,
`SN:${certificate.serialNumber}`,
].join(',');
}
const getCertificateCrlUrls = (certificateName, decodedCertificate) => {
const logDebug = (msg, ...msgArgs) => (0, logger_1.default)().debug(`getCertificateCrlUrls[${certificateName}]: ${msg}`, ...msgArgs);
const crlExtension = decodedCertificate.tbsCertificate.extensions?.find((ext) => ext.extnID === 'cRLDistributionPoints');
if (!crlExtension) {
logDebug('certificate doesnt have cRLDistributionPoints extension');
return null;
}
const result = [];
for (const entry of crlExtension.extnValue) {
if (!entry.distributionPoint) {
logDebug('skipping entry without distributionPoint %j', entry);
continue;
}
for (const fullNameEntry of entry.distributionPoint.value) {
if (fullNameEntry.type !== 'uniformResourceIdentifier') {
logDebug('skipping non-uniformResourceIdentifier entry %j', fullNameEntry);
continue;
}
if (fullNameEntry.value.startsWith('http')) {
// Even though the spec allows multiple http urls, we only pick first one and don't handle redundancy
result.push(fullNameEntry.value);
break;
}
else {
logDebug('skipping non-http value %j', fullNameEntry);
}
}
}
logDebug(`found URLs: ${result.join(',')}`);
return result.length > 0 ? result : null;
};
exports.getCertificateCrlUrls = getCertificateCrlUrls;
/**
* See Short-lived Subscriber Certificate section\
* https://cabforum.org/working-groups/server/baseline-requirements/requirements/
*/
function isShortLivedCertificate(decodedCertificate) {
const notBefore = new Date(decodedCertificate.tbsCertificate.validity.notBefore.value);
const notAfter = new Date(decodedCertificate.tbsCertificate.validity.notAfter.value);
let maximumValidityPeriod = 7 * 24 * 60 * 60 * 1000; // 7 days in milliseconds
if (notBefore < new Date('2026-03-15T00:00:00.000Z')) {
maximumValidityPeriod = 10 * 24 * 60 * 60 * 1000; // 10 days in milliseconds
}
maximumValidityPeriod += 60 * 1000; // Fix inclusion start and end time (1 minute)
const certValidityPeriod = notAfter.getTime() - notBefore.getTime();
return maximumValidityPeriod > certValidityPeriod;
}
function isCertificateRevoked(decodedCertificate, crl) {
for (const revokedCert of crl.tbsCertList.revokedCertificates ?? []) {
if (revokedCert.userCertificate.eq(decodedCertificate.tbsCertificate.serialNumber)) {
return true;
}
}
return false;
}
function isIssuingDistributionPointExtensionValid(crl, expectedCrlUrl) {
const issuingDistributionPointExtension = crl.tbsCertList.crlExtensions?.find((ext) => ext.extnID === 'issuingDistributionPoint');
if (!issuingDistributionPointExtension) {
(0, logger_1.default)().debug(`CRL ${expectedCrlUrl} doesnt have issuingDistributionPoint extension, ignoring`);
return true;
}
for (const fullNameEntry of issuingDistributionPointExtension.extnValue.distributionPoint.value) {
if (fullNameEntry.type === 'uniformResourceIdentifier' &&
fullNameEntry.value === expectedCrlUrl) {
return true;
}
}
return false;
}
//# sourceMappingURL=certificate_utils.js.map