2019-11-14 23:29:04 +00:00
|
|
|
package authority
|
|
|
|
|
|
|
|
import (
|
2019-12-10 07:14:56 +00:00
|
|
|
"context"
|
2020-01-10 02:42:26 +00:00
|
|
|
"crypto"
|
2019-11-20 20:59:48 +00:00
|
|
|
"crypto/x509"
|
2020-01-11 02:33:48 +00:00
|
|
|
"encoding/pem"
|
2022-09-30 00:16:26 +00:00
|
|
|
"net/http"
|
2019-11-20 20:59:48 +00:00
|
|
|
|
2020-01-15 02:38:29 +00:00
|
|
|
"github.com/pkg/errors"
|
2022-08-09 00:58:18 +00:00
|
|
|
"golang.org/x/crypto/ssh"
|
|
|
|
|
|
|
|
"go.step.sm/crypto/kms"
|
|
|
|
|
2021-05-03 19:48:20 +00:00
|
|
|
"github.com/smallstep/certificates/authority/admin"
|
2021-05-03 19:48:20 +00:00
|
|
|
"github.com/smallstep/certificates/authority/config"
|
2019-11-15 04:38:07 +00:00
|
|
|
"github.com/smallstep/certificates/authority/provisioner"
|
2020-09-16 20:31:26 +00:00
|
|
|
"github.com/smallstep/certificates/cas"
|
|
|
|
casapi "github.com/smallstep/certificates/cas/apiv1"
|
2019-11-14 23:29:04 +00:00
|
|
|
"github.com/smallstep/certificates/db"
|
|
|
|
)
|
|
|
|
|
|
|
|
// Option sets options to the Authority.
|
2020-01-11 02:33:48 +00:00
|
|
|
type Option func(*Authority) error
|
2019-11-14 23:29:04 +00:00
|
|
|
|
2020-05-05 01:52:18 +00:00
|
|
|
// WithConfig replaces the current config with the given one. No validation is
|
|
|
|
// performed in the given value.
|
2021-10-08 18:59:57 +00:00
|
|
|
func WithConfig(cfg *config.Config) Option {
|
2020-05-05 01:52:18 +00:00
|
|
|
return func(a *Authority) error {
|
2021-10-08 18:59:57 +00:00
|
|
|
a.config = cfg
|
2020-05-05 01:52:18 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// WithConfigFile reads the given filename as a configuration file and replaces
|
|
|
|
// the current one. No validation is performed in the given configuration.
|
|
|
|
func WithConfigFile(filename string) Option {
|
|
|
|
return func(a *Authority) (err error) {
|
2021-05-03 19:48:20 +00:00
|
|
|
a.config, err = config.LoadConfiguration(filename)
|
2020-05-05 01:52:18 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-09-16 18:55:41 +00:00
|
|
|
// WithPassword set the password to decrypt the intermediate key as well as the
|
|
|
|
// ssh host and user keys if they are not overridden by other options.
|
|
|
|
func WithPassword(password []byte) Option {
|
|
|
|
return func(a *Authority) (err error) {
|
|
|
|
a.password = password
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// WithSSHHostPassword set the password to decrypt the key used to sign SSH host
|
|
|
|
// certificates.
|
|
|
|
func WithSSHHostPassword(password []byte) Option {
|
|
|
|
return func(a *Authority) (err error) {
|
|
|
|
a.sshHostPassword = password
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// WithSSHUserPassword set the password to decrypt the key used to sign SSH user
|
|
|
|
// certificates.
|
|
|
|
func WithSSHUserPassword(password []byte) Option {
|
|
|
|
return func(a *Authority) (err error) {
|
|
|
|
a.sshUserPassword = password
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// WithIssuerPassword set the password to decrypt the certificate issuer private
|
|
|
|
// key used in RA mode.
|
|
|
|
func WithIssuerPassword(password []byte) Option {
|
|
|
|
return func(a *Authority) (err error) {
|
|
|
|
a.issuerPassword = password
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-11-14 23:29:04 +00:00
|
|
|
// WithDatabase sets an already initialized authority database to a new
|
|
|
|
// authority. This option is intended to be use on graceful reloads.
|
2021-10-08 18:59:57 +00:00
|
|
|
func WithDatabase(d db.AuthDB) Option {
|
2020-01-11 02:33:48 +00:00
|
|
|
return func(a *Authority) error {
|
2021-10-08 18:59:57 +00:00
|
|
|
a.db = d
|
2020-01-11 02:33:48 +00:00
|
|
|
return nil
|
2019-11-14 23:29:04 +00:00
|
|
|
}
|
|
|
|
}
|
2019-11-15 02:24:58 +00:00
|
|
|
|
2022-10-11 10:19:29 +00:00
|
|
|
// WithQuietInit disables log output when the authority is initialized.
|
|
|
|
func WithQuietInit() Option {
|
|
|
|
return func(a *Authority) error {
|
|
|
|
a.quietInit = true
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-09-30 00:16:26 +00:00
|
|
|
// WithWebhookClient sets the http.Client to be used for outbound requests.
|
|
|
|
func WithWebhookClient(c *http.Client) Option {
|
|
|
|
return func(a *Authority) error {
|
|
|
|
a.webhookClient = c
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-11-20 19:32:27 +00:00
|
|
|
// WithGetIdentityFunc sets a custom function to retrieve the identity from
|
|
|
|
// an external resource.
|
2020-03-11 02:01:45 +00:00
|
|
|
func WithGetIdentityFunc(fn func(ctx context.Context, p provisioner.Interface, email string) (*provisioner.Identity, error)) Option {
|
2020-01-11 02:33:48 +00:00
|
|
|
return func(a *Authority) error {
|
2019-11-20 19:32:27 +00:00
|
|
|
a.getIdentityFunc = fn
|
2020-01-11 02:33:48 +00:00
|
|
|
return nil
|
2019-11-20 19:32:27 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-03-10 21:01:08 +00:00
|
|
|
// WithAuthorizeRenewFunc sets a custom function that authorizes the renewal of
|
|
|
|
// an X.509 certificate.
|
|
|
|
func WithAuthorizeRenewFunc(fn func(ctx context.Context, p *provisioner.Controller, cert *x509.Certificate) error) Option {
|
|
|
|
return func(a *Authority) error {
|
|
|
|
a.authorizeRenewFunc = fn
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// WithAuthorizeSSHRenewFunc sets a custom function that authorizes the renewal
|
|
|
|
// of a SSH certificate.
|
|
|
|
func WithAuthorizeSSHRenewFunc(fn func(ctx context.Context, p *provisioner.Controller, cert *ssh.Certificate) error) Option {
|
|
|
|
return func(a *Authority) error {
|
|
|
|
a.authorizeSSHRenewFunc = fn
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-11-15 04:38:07 +00:00
|
|
|
// WithSSHBastionFunc sets a custom function to get the bastion for a
|
2019-11-15 02:24:58 +00:00
|
|
|
// given user-host pair.
|
2021-05-03 19:48:20 +00:00
|
|
|
func WithSSHBastionFunc(fn func(ctx context.Context, user, host string) (*config.Bastion, error)) Option {
|
2020-01-11 02:33:48 +00:00
|
|
|
return func(a *Authority) error {
|
2019-11-15 02:24:58 +00:00
|
|
|
a.sshBastionFunc = fn
|
2020-01-11 02:33:48 +00:00
|
|
|
return nil
|
2019-11-15 02:24:58 +00:00
|
|
|
}
|
|
|
|
}
|
2019-11-15 04:38:07 +00:00
|
|
|
|
2022-01-12 20:24:38 +00:00
|
|
|
// WithSSHGetHosts sets a custom function to return a list of step ssh enabled
|
|
|
|
// hosts.
|
2021-05-03 19:48:20 +00:00
|
|
|
func WithSSHGetHosts(fn func(ctx context.Context, cert *x509.Certificate) ([]config.Host, error)) Option {
|
2020-01-11 02:33:48 +00:00
|
|
|
return func(a *Authority) error {
|
2019-11-20 19:32:27 +00:00
|
|
|
a.sshGetHostsFunc = fn
|
2020-01-11 02:33:48 +00:00
|
|
|
return nil
|
2019-11-15 04:38:07 +00:00
|
|
|
}
|
|
|
|
}
|
2019-12-10 07:14:56 +00:00
|
|
|
|
|
|
|
// WithSSHCheckHost sets a custom function to check whether a given host is
|
|
|
|
// step ssh enabled. The token is used to validate the request, while the roots
|
|
|
|
// are used to validate the token.
|
|
|
|
func WithSSHCheckHost(fn func(ctx context.Context, principal string, tok string, roots []*x509.Certificate) (bool, error)) Option {
|
2020-01-11 02:33:48 +00:00
|
|
|
return func(a *Authority) error {
|
2019-12-10 07:14:56 +00:00
|
|
|
a.sshCheckHostFunc = fn
|
2020-01-11 02:33:48 +00:00
|
|
|
return nil
|
2019-12-10 07:14:56 +00:00
|
|
|
}
|
|
|
|
}
|
2020-01-10 02:42:26 +00:00
|
|
|
|
|
|
|
// WithKeyManager defines the key manager used to get and create keys, and sign
|
|
|
|
// certificates.
|
|
|
|
func WithKeyManager(k kms.KeyManager) Option {
|
2020-01-11 02:33:48 +00:00
|
|
|
return func(a *Authority) error {
|
2020-01-10 02:42:26 +00:00
|
|
|
a.keyManager = k
|
2020-01-11 02:33:48 +00:00
|
|
|
return nil
|
2020-01-10 02:42:26 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// WithX509Signer defines the signer used to sign X509 certificates.
|
|
|
|
func WithX509Signer(crt *x509.Certificate, s crypto.Signer) Option {
|
2022-09-21 01:52:47 +00:00
|
|
|
return WithX509SignerChain([]*x509.Certificate{crt}, s)
|
|
|
|
}
|
|
|
|
|
|
|
|
// WithX509SignerChain defines the signer used to sign X509 certificates. This
|
|
|
|
// option is similar to WithX509Signer but it supports a chain of intermediates.
|
|
|
|
func WithX509SignerChain(issuerChain []*x509.Certificate, s crypto.Signer) Option {
|
2020-01-11 02:33:48 +00:00
|
|
|
return func(a *Authority) error {
|
2020-09-16 20:31:26 +00:00
|
|
|
srv, err := cas.New(context.Background(), casapi.Options{
|
2020-12-24 04:41:10 +00:00
|
|
|
Type: casapi.SoftCAS,
|
|
|
|
Signer: s,
|
2022-09-21 01:52:47 +00:00
|
|
|
CertificateChain: issuerChain,
|
2020-09-16 20:31:26 +00:00
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
a.x509CAService = srv
|
2022-09-21 01:52:47 +00:00
|
|
|
a.intermediateX509Certs = append(a.intermediateX509Certs, issuerChain...)
|
2020-01-11 02:33:48 +00:00
|
|
|
return nil
|
2020-01-10 02:42:26 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-03-29 00:54:35 +00:00
|
|
|
// WithX509SignerFunc defines the function used to get the chain of certificates
|
|
|
|
// and signer used when we sign X.509 certificates.
|
|
|
|
func WithX509SignerFunc(fn func() ([]*x509.Certificate, crypto.Signer, error)) Option {
|
|
|
|
return func(a *Authority) error {
|
|
|
|
srv, err := cas.New(context.Background(), casapi.Options{
|
|
|
|
Type: casapi.SoftCAS,
|
|
|
|
CertificateSigner: fn,
|
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
a.x509CAService = srv
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-09-25 19:55:19 +00:00
|
|
|
func WithSCEPOptions(crt *x509.Certificate, s crypto.Signer, d crypto.Decrypter) Option {
|
|
|
|
return func(a *Authority) error {
|
|
|
|
a.scepCertificate = crt
|
|
|
|
a.scepSigner = s
|
|
|
|
a.scepDecrypter = d
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-01-10 02:42:26 +00:00
|
|
|
// WithSSHUserSigner defines the signer used to sign SSH user certificates.
|
2020-01-15 02:38:29 +00:00
|
|
|
func WithSSHUserSigner(s crypto.Signer) Option {
|
2020-01-11 02:33:48 +00:00
|
|
|
return func(a *Authority) error {
|
2020-01-15 02:38:29 +00:00
|
|
|
signer, err := ssh.NewSignerFromSigner(s)
|
|
|
|
if err != nil {
|
|
|
|
return errors.Wrap(err, "error creating ssh user signer")
|
|
|
|
}
|
|
|
|
a.sshCAUserCertSignKey = signer
|
|
|
|
// Append public key to list of user certs
|
|
|
|
pub := signer.PublicKey()
|
|
|
|
a.sshCAUserCerts = append(a.sshCAUserCerts, pub)
|
|
|
|
a.sshCAUserFederatedCerts = append(a.sshCAUserFederatedCerts, pub)
|
2020-01-11 02:33:48 +00:00
|
|
|
return nil
|
2020-01-10 02:42:26 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// WithSSHHostSigner defines the signer used to sign SSH host certificates.
|
2020-01-15 02:38:29 +00:00
|
|
|
func WithSSHHostSigner(s crypto.Signer) Option {
|
2020-01-11 02:33:48 +00:00
|
|
|
return func(a *Authority) error {
|
2020-01-15 02:38:29 +00:00
|
|
|
signer, err := ssh.NewSignerFromSigner(s)
|
|
|
|
if err != nil {
|
|
|
|
return errors.Wrap(err, "error creating ssh host signer")
|
|
|
|
}
|
|
|
|
a.sshCAHostCertSignKey = signer
|
|
|
|
// Append public key to list of host certs
|
|
|
|
pub := signer.PublicKey()
|
|
|
|
a.sshCAHostCerts = append(a.sshCAHostCerts, pub)
|
|
|
|
a.sshCAHostFederatedCerts = append(a.sshCAHostFederatedCerts, pub)
|
2020-01-11 02:33:48 +00:00
|
|
|
return nil
|
2020-01-10 02:42:26 +00:00
|
|
|
}
|
|
|
|
}
|
2020-01-11 02:33:48 +00:00
|
|
|
|
2020-02-12 23:36:24 +00:00
|
|
|
// WithX509RootCerts is an option that allows to define the list of root
|
|
|
|
// certificates to use. This option will replace any root certificate defined
|
|
|
|
// before.
|
|
|
|
func WithX509RootCerts(rootCerts ...*x509.Certificate) Option {
|
|
|
|
return func(a *Authority) error {
|
|
|
|
a.rootX509Certs = rootCerts
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// WithX509FederatedCerts is an option that allows to define the list of
|
|
|
|
// federated certificates. This option will replace any federated certificate
|
|
|
|
// defined before.
|
|
|
|
func WithX509FederatedCerts(certs ...*x509.Certificate) Option {
|
|
|
|
return func(a *Authority) error {
|
|
|
|
a.federatedX509Certs = certs
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-09-22 18:05:06 +00:00
|
|
|
// WithX509IntermediateCerts is an option that allows to define the list of
|
|
|
|
// intermediate certificates that the CA will be using. This option will replace
|
|
|
|
// any intermediate certificate defined before.
|
2022-09-21 01:52:47 +00:00
|
|
|
//
|
|
|
|
// Note that these certificates will not be bundled with the certificates signed
|
2022-09-22 18:07:22 +00:00
|
|
|
// by the CA, because the CAS service will take care of that. They should match,
|
2022-09-23 17:55:20 +00:00
|
|
|
// but that's not guaranteed. These certificates will be mainly used for name
|
2022-09-22 18:07:22 +00:00
|
|
|
// constraint validation before a certificate is issued.
|
2022-09-21 01:52:47 +00:00
|
|
|
//
|
2022-09-22 18:05:06 +00:00
|
|
|
// This option should only be used on specific configurations, for example when
|
2022-09-23 17:55:20 +00:00
|
|
|
// WithX509SignerFunc is used, as we don't know the list of intermediates in
|
2022-09-21 01:52:47 +00:00
|
|
|
// advance.
|
|
|
|
func WithX509IntermediateCerts(intermediateCerts ...*x509.Certificate) Option {
|
|
|
|
return func(a *Authority) error {
|
|
|
|
a.intermediateX509Certs = intermediateCerts
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-01-11 02:33:48 +00:00
|
|
|
// WithX509RootBundle is an option that allows to define the list of root
|
2020-02-12 23:36:24 +00:00
|
|
|
// certificates. This option will replace any root certificate defined before.
|
2020-01-11 02:33:48 +00:00
|
|
|
func WithX509RootBundle(pemCerts []byte) Option {
|
|
|
|
return func(a *Authority) error {
|
|
|
|
certs, err := readCertificateBundle(pemCerts)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
a.rootX509Certs = certs
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// WithX509FederatedBundle is an option that allows to define the list of
|
2020-02-12 23:36:24 +00:00
|
|
|
// federated certificates. This option will replace any federated certificate
|
|
|
|
// defined before.
|
2020-01-11 02:33:48 +00:00
|
|
|
func WithX509FederatedBundle(pemCerts []byte) Option {
|
|
|
|
return func(a *Authority) error {
|
|
|
|
certs, err := readCertificateBundle(pemCerts)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
a.federatedX509Certs = certs
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-05-20 20:01:58 +00:00
|
|
|
// WithAdminDB is an option to set the database backing the admin APIs.
|
2021-10-08 18:59:57 +00:00
|
|
|
func WithAdminDB(d admin.DB) Option {
|
2021-05-20 20:01:58 +00:00
|
|
|
return func(a *Authority) error {
|
2021-10-08 18:59:57 +00:00
|
|
|
a.adminDB = d
|
2021-05-20 20:01:58 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-05-18 16:43:32 +00:00
|
|
|
// WithProvisioners is an option to set the provisioner collection.
|
2022-05-20 05:46:25 +00:00
|
|
|
//
|
2022-05-20 05:26:20 +00:00
|
|
|
// Deprecated: provisioner collections will likely change
|
2022-05-18 16:43:32 +00:00
|
|
|
func WithProvisioners(ps *provisioner.Collection) Option {
|
|
|
|
return func(a *Authority) error {
|
|
|
|
a.provisioners = ps
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-07-20 02:28:06 +00:00
|
|
|
// WithLinkedCAToken is an option to set the authentication token used to enable
|
|
|
|
// linked ca.
|
|
|
|
func WithLinkedCAToken(token string) Option {
|
|
|
|
return func(a *Authority) error {
|
|
|
|
a.linkedCAToken = token
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-02-02 22:36:58 +00:00
|
|
|
// WithX509Enforcers is an option that allows to define custom certificate
|
|
|
|
// modifiers that will be processed just before the signing of the certificate.
|
|
|
|
func WithX509Enforcers(ces ...provisioner.CertificateEnforcer) Option {
|
|
|
|
return func(a *Authority) error {
|
|
|
|
a.x509Enforcers = ces
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-05-12 00:04:43 +00:00
|
|
|
// WithSkipInit is an option that allows the constructor to skip initializtion
|
|
|
|
// of the authority.
|
|
|
|
func WithSkipInit() Option {
|
|
|
|
return func(a *Authority) error {
|
|
|
|
a.skipInit = true
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-01-11 02:33:48 +00:00
|
|
|
func readCertificateBundle(pemCerts []byte) ([]*x509.Certificate, error) {
|
|
|
|
var block *pem.Block
|
|
|
|
var certs []*x509.Certificate
|
|
|
|
for len(pemCerts) > 0 {
|
|
|
|
block, pemCerts = pem.Decode(pemCerts)
|
|
|
|
if block == nil {
|
|
|
|
break
|
|
|
|
}
|
|
|
|
if block.Type != "CERTIFICATE" || len(block.Headers) != 0 {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
cert, err := x509.ParseCertificate(block.Bytes)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
certs = append(certs, cert)
|
|
|
|
}
|
|
|
|
return certs, nil
|
|
|
|
}
|