SSHSecure/moduli/func.go

61 lines
1.6 KiB
Go
Raw Normal View History

2020-09-18 18:01:16 -04:00
/*
SSHSecure - a program to harden OpenSSH from defaults
Copyright (C) 2020 Brent Saner
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
package moduli
import (
"bytes"
"encoding/hex"
"errors"
"fmt"
"net/http"
"golang.org/x/crypto/sha3"
)
func getPregen() ([]byte, error) {
// get the pregenerated moduli
resp, err := http.Get(pregenURL)
if err != nil {
return nil, err
}
if resp.StatusCode != http.StatusOK {
return nil, errors.New(fmt.Sprintf("returned status code %v: %v", resp.StatusCode, resp.Status))
}
defer resp.Body.Close()
b := make([]byte, resp.ContentLength)
if _, err = resp.Body.Read(b); err != nil {
return nil, err
}
// and compare the SHA3-512 (NIST) checksum.
s := sha3.New512()
if _, err = s.Write(b); err != nil {
// TODO: return nil instead of b?
return b, err
}
goodCksum, err := hex.DecodeString(pregenCksum)
if err != nil {
return nil, err
}
// We just compare the bytestrings.
if bytes.Compare(s.Sum(nil), goodCksum) != 0 {
return nil, errors.New("checksums do not match")
}
return b, nil
}