2018-10-05 21:48:36 +00:00
|
|
|
package authority
|
|
|
|
|
|
|
|
import (
|
2022-01-07 19:24:59 +00:00
|
|
|
"bytes"
|
2021-05-03 19:48:20 +00:00
|
|
|
"context"
|
2019-03-05 08:07:13 +00:00
|
|
|
"crypto/x509"
|
2021-05-26 04:13:01 +00:00
|
|
|
"encoding/json"
|
2021-07-27 02:01:56 +00:00
|
|
|
"encoding/pem"
|
2021-05-26 04:13:01 +00:00
|
|
|
"fmt"
|
2021-11-12 23:46:34 +00:00
|
|
|
"os"
|
2018-10-05 21:48:36 +00:00
|
|
|
|
2021-07-27 02:01:56 +00:00
|
|
|
"github.com/pkg/errors"
|
2022-04-21 10:14:03 +00:00
|
|
|
"gopkg.in/square/go-jose.v2/jwt"
|
|
|
|
|
|
|
|
"go.step.sm/cli-utils/step"
|
|
|
|
"go.step.sm/cli-utils/ui"
|
|
|
|
"go.step.sm/crypto/jose"
|
|
|
|
"go.step.sm/linkedca"
|
|
|
|
|
2021-05-03 19:48:20 +00:00
|
|
|
"github.com/smallstep/certificates/authority/admin"
|
|
|
|
"github.com/smallstep/certificates/authority/config"
|
2022-03-15 14:51:45 +00:00
|
|
|
"github.com/smallstep/certificates/authority/policy"
|
2019-03-06 23:00:23 +00:00
|
|
|
"github.com/smallstep/certificates/authority/provisioner"
|
2022-04-06 02:25:47 +00:00
|
|
|
"github.com/smallstep/certificates/db"
|
2020-01-24 06:04:34 +00:00
|
|
|
"github.com/smallstep/certificates/errs"
|
2018-10-05 21:48:36 +00:00
|
|
|
)
|
|
|
|
|
2022-10-06 19:22:19 +00:00
|
|
|
type raProvisioner interface {
|
|
|
|
RAInfo() *provisioner.RAInfo
|
|
|
|
}
|
|
|
|
|
|
|
|
type attProvisioner interface {
|
|
|
|
AttestationData() *provisioner.AttestationData
|
|
|
|
}
|
|
|
|
|
|
|
|
// wrapProvisioner wraps the given provisioner with RA information and
|
|
|
|
// attestation data.
|
|
|
|
func wrapProvisioner(p provisioner.Interface, attData *provisioner.AttestationData) *wrappedProvisioner {
|
|
|
|
var raInfo *provisioner.RAInfo
|
|
|
|
if rap, ok := p.(raProvisioner); ok {
|
|
|
|
raInfo = rap.RAInfo()
|
|
|
|
}
|
|
|
|
|
|
|
|
return &wrappedProvisioner{
|
|
|
|
Interface: p,
|
|
|
|
attestationData: attData,
|
|
|
|
raInfo: raInfo,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-11-04 23:42:07 +00:00
|
|
|
// wrapRAProvisioner wraps the given provisioner with RA information.
|
|
|
|
func wrapRAProvisioner(p provisioner.Interface, raInfo *provisioner.RAInfo) *wrappedProvisioner {
|
|
|
|
return &wrappedProvisioner{
|
|
|
|
Interface: p,
|
|
|
|
raInfo: raInfo,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// isRAProvisioner returns if the given provisioner is an RA provisioner.
|
|
|
|
func isRAProvisioner(p provisioner.Interface) bool {
|
|
|
|
if rap, ok := p.(raProvisioner); ok {
|
|
|
|
return rap.RAInfo() != nil
|
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2022-10-06 19:22:19 +00:00
|
|
|
// wrappedProvisioner implements raProvisioner and attProvisioner.
|
|
|
|
type wrappedProvisioner struct {
|
|
|
|
provisioner.Interface
|
|
|
|
attestationData *provisioner.AttestationData
|
|
|
|
raInfo *provisioner.RAInfo
|
|
|
|
}
|
|
|
|
|
|
|
|
func (p *wrappedProvisioner) AttestationData() *provisioner.AttestationData {
|
|
|
|
return p.attestationData
|
|
|
|
}
|
|
|
|
|
|
|
|
func (p *wrappedProvisioner) RAInfo() *provisioner.RAInfo {
|
|
|
|
return p.raInfo
|
|
|
|
}
|
|
|
|
|
2018-10-05 21:48:36 +00:00
|
|
|
// GetEncryptedKey returns the JWE key corresponding to the given kid argument.
|
|
|
|
func (a *Authority) GetEncryptedKey(kid string) (string, error) {
|
2021-05-03 19:48:20 +00:00
|
|
|
a.adminMutex.RLock()
|
|
|
|
defer a.adminMutex.RUnlock()
|
2019-03-06 23:00:23 +00:00
|
|
|
key, ok := a.provisioners.LoadEncryptedKey(kid)
|
2018-10-05 21:48:36 +00:00
|
|
|
if !ok {
|
2020-01-24 06:04:34 +00:00
|
|
|
return "", errs.NotFound("encrypted key with kid %s was not found", kid)
|
2018-10-05 21:48:36 +00:00
|
|
|
}
|
|
|
|
return key, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetProvisioners returns a map listing each provisioner and the JWK Key Set
|
|
|
|
// with their public keys.
|
2019-03-07 21:07:39 +00:00
|
|
|
func (a *Authority) GetProvisioners(cursor string, limit int) (provisioner.List, string, error) {
|
2021-05-03 19:48:20 +00:00
|
|
|
a.adminMutex.RLock()
|
|
|
|
defer a.adminMutex.RUnlock()
|
2019-03-06 23:00:23 +00:00
|
|
|
provisioners, nextCursor := a.provisioners.Find(cursor, limit)
|
2018-10-26 01:53:13 +00:00
|
|
|
return provisioners, nextCursor, nil
|
2018-10-05 21:48:36 +00:00
|
|
|
}
|
2019-03-05 08:07:13 +00:00
|
|
|
|
|
|
|
// LoadProvisionerByCertificate returns an interface to the provisioner that
|
|
|
|
// provisioned the certificate.
|
|
|
|
func (a *Authority) LoadProvisionerByCertificate(crt *x509.Certificate) (provisioner.Interface, error) {
|
2021-05-03 19:48:20 +00:00
|
|
|
a.adminMutex.RLock()
|
|
|
|
defer a.adminMutex.RUnlock()
|
2022-04-08 20:06:29 +00:00
|
|
|
if p, err := a.unsafeLoadProvisionerFromDatabase(crt); err == nil {
|
2022-04-06 02:25:47 +00:00
|
|
|
return p, nil
|
|
|
|
}
|
2022-04-08 20:06:29 +00:00
|
|
|
return a.unsafeLoadProvisionerFromExtension(crt)
|
|
|
|
}
|
2022-04-06 02:25:47 +00:00
|
|
|
|
2022-04-08 20:06:29 +00:00
|
|
|
func (a *Authority) unsafeLoadProvisionerFromExtension(crt *x509.Certificate) (provisioner.Interface, error) {
|
2019-03-05 08:07:13 +00:00
|
|
|
p, ok := a.provisioners.LoadByCertificate(crt)
|
2022-04-08 20:06:29 +00:00
|
|
|
if !ok || p.GetType() == 0 {
|
2021-05-03 19:48:20 +00:00
|
|
|
return nil, admin.NewError(admin.ErrorNotFoundType, "unable to load provisioner from certificate")
|
|
|
|
}
|
|
|
|
return p, nil
|
|
|
|
}
|
|
|
|
|
2022-04-08 20:06:29 +00:00
|
|
|
func (a *Authority) unsafeLoadProvisionerFromDatabase(crt *x509.Certificate) (provisioner.Interface, error) {
|
2022-04-12 21:44:55 +00:00
|
|
|
// certificateDataGetter is an interface that can be used to retrieve the
|
2022-04-08 01:14:43 +00:00
|
|
|
// provisioner from a db or a linked ca.
|
|
|
|
type certificateDataGetter interface {
|
2022-04-06 02:25:47 +00:00
|
|
|
GetCertificateData(string) (*db.CertificateData, error)
|
2022-04-08 01:14:43 +00:00
|
|
|
}
|
2022-04-08 20:06:29 +00:00
|
|
|
|
|
|
|
var err error
|
|
|
|
var data *db.CertificateData
|
|
|
|
|
|
|
|
if cdg, ok := a.adminDB.(certificateDataGetter); ok {
|
|
|
|
data, err = cdg.GetCertificateData(crt.SerialNumber.String())
|
|
|
|
} else if cdg, ok := a.db.(certificateDataGetter); ok {
|
|
|
|
data, err = cdg.GetCertificateData(crt.SerialNumber.String())
|
2022-04-08 01:14:43 +00:00
|
|
|
}
|
2022-04-08 20:06:29 +00:00
|
|
|
if err == nil && data != nil && data.Provisioner != nil {
|
|
|
|
if p, ok := a.provisioners.Load(data.Provisioner.ID); ok {
|
2022-11-04 23:42:07 +00:00
|
|
|
if data.RaInfo != nil {
|
|
|
|
return wrapRAProvisioner(p, data.RaInfo), nil
|
|
|
|
}
|
2022-04-08 20:06:29 +00:00
|
|
|
return p, nil
|
2022-04-06 02:25:47 +00:00
|
|
|
}
|
|
|
|
}
|
2022-04-08 20:06:29 +00:00
|
|
|
return nil, admin.NewError(admin.ErrorNotFoundType, "unable to load provisioner from certificate")
|
2021-05-03 19:48:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// LoadProvisionerByToken returns an interface to the provisioner that
|
|
|
|
// provisioned the token.
|
|
|
|
func (a *Authority) LoadProvisionerByToken(token *jwt.JSONWebToken, claims *jwt.Claims) (provisioner.Interface, error) {
|
|
|
|
a.adminMutex.RLock()
|
|
|
|
defer a.adminMutex.RUnlock()
|
|
|
|
p, ok := a.provisioners.LoadByToken(token, claims)
|
|
|
|
if !ok {
|
|
|
|
return nil, admin.NewError(admin.ErrorNotFoundType, "unable to load provisioner from token")
|
2019-03-05 08:07:13 +00:00
|
|
|
}
|
|
|
|
return p, nil
|
|
|
|
}
|
2019-05-27 00:41:10 +00:00
|
|
|
|
|
|
|
// LoadProvisionerByID returns an interface to the provisioner with the given ID.
|
|
|
|
func (a *Authority) LoadProvisionerByID(id string) (provisioner.Interface, error) {
|
2021-05-03 19:48:20 +00:00
|
|
|
a.adminMutex.RLock()
|
|
|
|
defer a.adminMutex.RUnlock()
|
2019-05-27 00:41:10 +00:00
|
|
|
p, ok := a.provisioners.Load(id)
|
|
|
|
if !ok {
|
2021-05-03 19:48:20 +00:00
|
|
|
return nil, admin.NewError(admin.ErrorNotFoundType, "provisioner %s not found", id)
|
2019-05-27 00:41:10 +00:00
|
|
|
}
|
|
|
|
return p, nil
|
|
|
|
}
|
2021-05-26 04:13:01 +00:00
|
|
|
|
2021-05-03 19:48:20 +00:00
|
|
|
// LoadProvisionerByName returns an interface to the provisioner with the given Name.
|
|
|
|
func (a *Authority) LoadProvisionerByName(name string) (provisioner.Interface, error) {
|
|
|
|
a.adminMutex.RLock()
|
|
|
|
defer a.adminMutex.RUnlock()
|
|
|
|
p, ok := a.provisioners.LoadByName(name)
|
|
|
|
if !ok {
|
|
|
|
return nil, admin.NewError(admin.ErrorNotFoundType, "provisioner %s not found", name)
|
|
|
|
}
|
|
|
|
return p, nil
|
|
|
|
}
|
|
|
|
|
2022-02-28 19:04:40 +00:00
|
|
|
func (a *Authority) generateProvisionerConfig(ctx context.Context) (provisioner.Config, error) {
|
2021-05-03 19:48:20 +00:00
|
|
|
// Merge global and configuration claims
|
|
|
|
claimer, err := provisioner.NewClaimer(a.config.AuthorityConfig.Claims, config.GlobalProvisionerClaims)
|
|
|
|
if err != nil {
|
2022-02-28 19:04:40 +00:00
|
|
|
return provisioner.Config{}, err
|
2021-05-03 19:48:20 +00:00
|
|
|
}
|
|
|
|
// TODO: should we also be combining the ssh federated roots here?
|
|
|
|
// If we rotate ssh roots keys, sshpop provisioner will lose ability to
|
|
|
|
// validate old SSH certificates, unless they are added as federated certs.
|
|
|
|
sshKeys, err := a.GetSSHRoots(ctx)
|
|
|
|
if err != nil {
|
2022-02-28 19:04:40 +00:00
|
|
|
return provisioner.Config{}, err
|
2021-05-03 19:48:20 +00:00
|
|
|
}
|
2022-02-28 19:04:40 +00:00
|
|
|
return provisioner.Config{
|
2021-05-03 19:48:20 +00:00
|
|
|
Claims: claimer.Claims(),
|
|
|
|
Audiences: a.config.GetAudiences(),
|
|
|
|
SSHKeys: &provisioner.SSHKeys{
|
|
|
|
UserKeys: sshKeys.UserKeys,
|
|
|
|
HostKeys: sshKeys.HostKeys,
|
2021-05-26 04:13:01 +00:00
|
|
|
},
|
2022-03-10 21:01:08 +00:00
|
|
|
GetIdentityFunc: a.getIdentityFunc,
|
|
|
|
AuthorizeRenewFunc: a.authorizeRenewFunc,
|
|
|
|
AuthorizeSSHRenewFunc: a.authorizeSSHRenewFunc,
|
2022-09-30 00:16:26 +00:00
|
|
|
WebhookClient: a.webhookClient,
|
2021-05-03 19:48:20 +00:00
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
|
2022-04-25 17:23:07 +00:00
|
|
|
// StoreProvisioner stores a provisioner to the authority.
|
2021-05-03 19:48:20 +00:00
|
|
|
func (a *Authority) StoreProvisioner(ctx context.Context, prov *linkedca.Provisioner) error {
|
|
|
|
a.adminMutex.Lock()
|
|
|
|
defer a.adminMutex.Unlock()
|
|
|
|
|
|
|
|
certProv, err := ProvisionerToCertificates(prov)
|
|
|
|
if err != nil {
|
|
|
|
return admin.WrapErrorISE(err,
|
|
|
|
"error converting to certificates provisioner from linkedca provisioner")
|
|
|
|
}
|
|
|
|
|
|
|
|
if _, ok := a.provisioners.LoadByName(prov.GetName()); ok {
|
|
|
|
return admin.NewError(admin.ErrorBadRequestType,
|
|
|
|
"provisioner with name %s already exists", prov.GetName())
|
|
|
|
}
|
|
|
|
if _, ok := a.provisioners.LoadByTokenID(certProv.GetIDForToken()); ok {
|
|
|
|
return admin.NewError(admin.ErrorBadRequestType,
|
|
|
|
"provisioner with token ID %s already exists", certProv.GetIDForToken())
|
|
|
|
}
|
|
|
|
|
2022-02-28 18:48:01 +00:00
|
|
|
provisionerConfig, err := a.generateProvisionerConfig(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return admin.WrapErrorISE(err, "error generating provisioner config")
|
|
|
|
}
|
|
|
|
|
2022-05-12 14:33:32 +00:00
|
|
|
if err := a.checkProvisionerPolicy(ctx, prov.Name, prov.Policy); err != nil {
|
2022-04-04 11:58:16 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2022-02-28 19:04:40 +00:00
|
|
|
if err := certProv.Init(provisionerConfig); err != nil {
|
2023-06-01 10:10:54 +00:00
|
|
|
return admin.WrapError(admin.ErrorBadRequestType, err, "error validating configuration for provisioner %q", prov.Name)
|
2022-02-28 18:48:01 +00:00
|
|
|
}
|
|
|
|
|
2021-05-03 19:48:20 +00:00
|
|
|
// Store to database -- this will set the ID.
|
|
|
|
if err := a.adminDB.CreateProvisioner(ctx, prov); err != nil {
|
2022-02-28 18:48:01 +00:00
|
|
|
return admin.WrapErrorISE(err, "error creating provisioner")
|
2021-05-03 19:48:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// We need a new conversion that has the newly set ID.
|
|
|
|
certProv, err = ProvisionerToCertificates(prov)
|
|
|
|
if err != nil {
|
|
|
|
return admin.WrapErrorISE(err,
|
|
|
|
"error converting to certificates provisioner from linkedca provisioner")
|
|
|
|
}
|
|
|
|
|
2022-02-28 19:04:40 +00:00
|
|
|
if err := certProv.Init(provisionerConfig); err != nil {
|
2021-05-03 19:48:20 +00:00
|
|
|
return admin.WrapErrorISE(err, "error initializing provisioner %s", prov.Name)
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := a.provisioners.Store(certProv); err != nil {
|
2022-04-25 17:23:07 +00:00
|
|
|
if err := a.ReloadAdminResources(ctx); err != nil {
|
2021-05-03 19:48:20 +00:00
|
|
|
return admin.WrapErrorISE(err, "error reloading admin resources on failed provisioner store")
|
|
|
|
}
|
|
|
|
return admin.WrapErrorISE(err, "error storing provisioner in authority cache")
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// UpdateProvisioner stores an provisioner.Interface to the authority.
|
|
|
|
func (a *Authority) UpdateProvisioner(ctx context.Context, nu *linkedca.Provisioner) error {
|
|
|
|
a.adminMutex.Lock()
|
|
|
|
defer a.adminMutex.Unlock()
|
|
|
|
|
|
|
|
certProv, err := ProvisionerToCertificates(nu)
|
|
|
|
if err != nil {
|
|
|
|
return admin.WrapErrorISE(err,
|
|
|
|
"error converting to certificates provisioner from linkedca provisioner")
|
|
|
|
}
|
|
|
|
|
|
|
|
provisionerConfig, err := a.generateProvisionerConfig(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return admin.WrapErrorISE(err, "error generating provisioner config")
|
|
|
|
}
|
|
|
|
|
2022-05-12 14:33:32 +00:00
|
|
|
if err := a.checkProvisionerPolicy(ctx, nu.Name, nu.Policy); err != nil {
|
2022-04-04 11:58:16 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2022-02-28 19:04:40 +00:00
|
|
|
if err := certProv.Init(provisionerConfig); err != nil {
|
2021-05-03 19:48:20 +00:00
|
|
|
return admin.WrapErrorISE(err, "error initializing provisioner %s", nu.Name)
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := a.provisioners.Update(certProv); err != nil {
|
|
|
|
return admin.WrapErrorISE(err, "error updating provisioner '%s' in authority cache", nu.Name)
|
|
|
|
}
|
|
|
|
if err := a.adminDB.UpdateProvisioner(ctx, nu); err != nil {
|
2022-04-25 17:23:07 +00:00
|
|
|
if err := a.ReloadAdminResources(ctx); err != nil {
|
2021-05-03 19:48:20 +00:00
|
|
|
return admin.WrapErrorISE(err, "error reloading admin resources on failed provisioner update")
|
|
|
|
}
|
|
|
|
return admin.WrapErrorISE(err, "error updating provisioner '%s'", nu.Name)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// RemoveProvisioner removes an provisioner.Interface from the authority.
|
|
|
|
func (a *Authority) RemoveProvisioner(ctx context.Context, id string) error {
|
|
|
|
a.adminMutex.Lock()
|
|
|
|
defer a.adminMutex.Unlock()
|
|
|
|
|
|
|
|
p, ok := a.provisioners.Load(id)
|
|
|
|
if !ok {
|
|
|
|
return admin.NewError(admin.ErrorBadRequestType,
|
|
|
|
"provisioner %s not found", id)
|
|
|
|
}
|
|
|
|
|
|
|
|
provName, provID := p.GetName(), p.GetID()
|
2022-05-12 00:04:43 +00:00
|
|
|
if a.IsAdminAPIEnabled() {
|
|
|
|
// Validate
|
|
|
|
// - Check that there will be SUPER_ADMINs that remain after we
|
|
|
|
// remove this provisioner.
|
|
|
|
if a.IsAdminAPIEnabled() && a.admins.SuperCount() == a.admins.SuperCountByProvisioner(provName) {
|
|
|
|
return admin.NewError(admin.ErrorBadRequestType,
|
|
|
|
"cannot remove provisioner %s because no super admins will remain", provName)
|
|
|
|
}
|
2021-05-03 19:48:20 +00:00
|
|
|
|
2022-05-12 00:04:43 +00:00
|
|
|
// Delete all admins associated with the provisioner.
|
|
|
|
admins, ok := a.admins.LoadByProvisioner(provName)
|
|
|
|
if ok {
|
|
|
|
for _, adm := range admins {
|
|
|
|
if err := a.removeAdmin(ctx, adm.Id); err != nil {
|
|
|
|
return admin.WrapErrorISE(err, "error deleting admin %s, as part of provisioner %s deletion", adm.Subject, provName)
|
|
|
|
}
|
2021-05-03 19:48:20 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Remove provisioner from authority caches.
|
|
|
|
if err := a.provisioners.Remove(provID); err != nil {
|
2022-05-12 00:04:43 +00:00
|
|
|
return admin.WrapErrorISE(err, "error removing provisioner from authority cache")
|
2021-05-03 19:48:20 +00:00
|
|
|
}
|
|
|
|
// Remove provisioner from database.
|
|
|
|
if err := a.adminDB.DeleteProvisioner(ctx, provID); err != nil {
|
2022-04-25 17:23:07 +00:00
|
|
|
if err := a.ReloadAdminResources(ctx); err != nil {
|
2021-05-03 19:48:20 +00:00
|
|
|
return admin.WrapErrorISE(err, "error reloading admin resources on failed provisioner remove")
|
|
|
|
}
|
|
|
|
return admin.WrapErrorISE(err, "error deleting provisioner %s", provName)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-11-17 19:40:01 +00:00
|
|
|
// CreateFirstProvisioner creates and stores the first provisioner when using
|
|
|
|
// admin database provisioner storage.
|
2022-04-08 01:33:13 +00:00
|
|
|
func CreateFirstProvisioner(ctx context.Context, adminDB admin.DB, password string) (*linkedca.Provisioner, error) {
|
2021-08-11 00:30:33 +00:00
|
|
|
if password == "" {
|
|
|
|
pass, err := ui.PromptPasswordGenerate("Please enter the password to encrypt your first provisioner, leave empty and we'll generate one")
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
password = string(pass)
|
|
|
|
}
|
|
|
|
|
2021-05-03 19:48:20 +00:00
|
|
|
jwk, jwe, err := jose.GenerateDefaultKeyPair([]byte(password))
|
|
|
|
if err != nil {
|
|
|
|
return nil, admin.WrapErrorISE(err, "error generating JWK key pair")
|
|
|
|
}
|
|
|
|
|
|
|
|
jwkPubBytes, err := jwk.MarshalJSON()
|
|
|
|
if err != nil {
|
|
|
|
return nil, admin.WrapErrorISE(err, "error marshaling JWK")
|
|
|
|
}
|
|
|
|
jwePrivStr, err := jwe.CompactSerialize()
|
|
|
|
if err != nil {
|
|
|
|
return nil, admin.WrapErrorISE(err, "error serializing JWE")
|
|
|
|
}
|
|
|
|
|
|
|
|
p := &linkedca.Provisioner{
|
|
|
|
Name: "Admin JWK",
|
|
|
|
Type: linkedca.Provisioner_JWK,
|
|
|
|
Details: &linkedca.ProvisionerDetails{
|
|
|
|
Data: &linkedca.ProvisionerDetails_JWK{
|
|
|
|
JWK: &linkedca.JWKProvisioner{
|
|
|
|
PublicKey: jwkPubBytes,
|
|
|
|
EncryptedPrivateKey: []byte(jwePrivStr),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Claims: &linkedca.Claims{
|
|
|
|
X509: &linkedca.X509Claims{
|
|
|
|
Enabled: true,
|
|
|
|
Durations: &linkedca.Durations{
|
|
|
|
Default: "5m",
|
|
|
|
},
|
|
|
|
},
|
2021-05-26 04:13:01 +00:00
|
|
|
},
|
|
|
|
}
|
2022-04-08 01:33:13 +00:00
|
|
|
if err := adminDB.CreateProvisioner(ctx, p); err != nil {
|
2021-05-03 19:48:20 +00:00
|
|
|
return nil, admin.WrapErrorISE(err, "error creating provisioner")
|
|
|
|
}
|
|
|
|
return p, nil
|
|
|
|
}
|
|
|
|
|
2021-11-17 19:40:01 +00:00
|
|
|
// ValidateClaims validates the Claims type.
|
2021-05-03 19:48:20 +00:00
|
|
|
func ValidateClaims(c *linkedca.Claims) error {
|
|
|
|
if c == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
if c.X509 != nil {
|
|
|
|
if c.X509.Durations != nil {
|
|
|
|
if err := ValidateDurations(c.X509.Durations); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if c.Ssh != nil {
|
|
|
|
if c.Ssh.UserDurations != nil {
|
|
|
|
if err := ValidateDurations(c.Ssh.UserDurations); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if c.Ssh.HostDurations != nil {
|
|
|
|
if err := ValidateDurations(c.Ssh.HostDurations); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-11-17 19:40:01 +00:00
|
|
|
// ValidateDurations validates the Durations type.
|
2021-05-03 19:48:20 +00:00
|
|
|
func ValidateDurations(d *linkedca.Durations) error {
|
|
|
|
var (
|
|
|
|
err error
|
|
|
|
min, max, def *provisioner.Duration
|
|
|
|
)
|
|
|
|
|
|
|
|
if d.Min != "" {
|
|
|
|
min, err = provisioner.NewDuration(d.Min)
|
|
|
|
if err != nil {
|
|
|
|
return admin.WrapError(admin.ErrorBadRequestType, err, "min duration '%s' is invalid", d.Min)
|
|
|
|
}
|
|
|
|
if min.Value() < 0 {
|
|
|
|
return admin.WrapError(admin.ErrorBadRequestType, err, "min duration '%s' cannot be less than 0", d.Min)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if d.Max != "" {
|
|
|
|
max, err = provisioner.NewDuration(d.Max)
|
|
|
|
if err != nil {
|
|
|
|
return admin.WrapError(admin.ErrorBadRequestType, err, "max duration '%s' is invalid", d.Max)
|
|
|
|
}
|
|
|
|
if max.Value() < 0 {
|
|
|
|
return admin.WrapError(admin.ErrorBadRequestType, err, "max duration '%s' cannot be less than 0", d.Max)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if d.Default != "" {
|
|
|
|
def, err = provisioner.NewDuration(d.Default)
|
|
|
|
if err != nil {
|
|
|
|
return admin.WrapError(admin.ErrorBadRequestType, err, "default duration '%s' is invalid", d.Default)
|
|
|
|
}
|
|
|
|
if def.Value() < 0 {
|
|
|
|
return admin.WrapError(admin.ErrorBadRequestType, err, "default duration '%s' cannot be less than 0", d.Default)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if d.Min != "" && d.Max != "" && min.Value() > max.Value() {
|
|
|
|
return admin.NewError(admin.ErrorBadRequestType,
|
|
|
|
"min duration '%s' cannot be greater than max duration '%s'", d.Min, d.Max)
|
|
|
|
}
|
|
|
|
if d.Min != "" && d.Default != "" && min.Value() > def.Value() {
|
|
|
|
return admin.NewError(admin.ErrorBadRequestType,
|
|
|
|
"min duration '%s' cannot be greater than default duration '%s'", d.Min, d.Default)
|
|
|
|
}
|
|
|
|
if d.Default != "" && d.Max != "" && min.Value() > def.Value() {
|
|
|
|
return admin.NewError(admin.ErrorBadRequestType,
|
|
|
|
"default duration '%s' cannot be greater than max duration '%s'", d.Default, d.Max)
|
|
|
|
}
|
|
|
|
return nil
|
2021-05-26 04:13:01 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func provisionerListToCertificates(l []*linkedca.Provisioner) (provisioner.List, error) {
|
|
|
|
var nu provisioner.List
|
|
|
|
for _, p := range l {
|
2021-05-03 19:48:20 +00:00
|
|
|
certProv, err := ProvisionerToCertificates(p)
|
2021-05-26 04:13:01 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
nu = append(nu, certProv)
|
|
|
|
}
|
|
|
|
return nu, nil
|
|
|
|
}
|
|
|
|
|
2021-05-03 19:48:20 +00:00
|
|
|
func optionsToCertificates(p *linkedca.Provisioner) *provisioner.Options {
|
|
|
|
ops := &provisioner.Options{
|
|
|
|
X509: &provisioner.X509Options{},
|
|
|
|
SSH: &provisioner.SSHOptions{},
|
|
|
|
}
|
|
|
|
if p.X509Template != nil {
|
|
|
|
ops.X509.Template = string(p.X509Template.Template)
|
|
|
|
ops.X509.TemplateData = p.X509Template.Data
|
|
|
|
}
|
|
|
|
if p.SshTemplate != nil {
|
|
|
|
ops.SSH.Template = string(p.SshTemplate.Template)
|
|
|
|
ops.SSH.TemplateData = p.SshTemplate.Data
|
|
|
|
}
|
2022-04-21 10:14:03 +00:00
|
|
|
if pol := p.GetPolicy(); pol != nil {
|
|
|
|
if x := pol.GetX509(); x != nil {
|
|
|
|
if allow := x.GetAllow(); allow != nil {
|
2022-03-15 14:51:45 +00:00
|
|
|
ops.X509.AllowedNames = &policy.X509NameOptions{
|
2022-04-21 10:14:03 +00:00
|
|
|
DNSDomains: allow.Dns,
|
|
|
|
IPRanges: allow.Ips,
|
|
|
|
EmailAddresses: allow.Emails,
|
|
|
|
URIDomains: allow.Uris,
|
2022-03-15 14:51:45 +00:00
|
|
|
}
|
|
|
|
}
|
2022-04-21 10:14:03 +00:00
|
|
|
if deny := x.GetDeny(); deny != nil {
|
2022-03-15 14:51:45 +00:00
|
|
|
ops.X509.DeniedNames = &policy.X509NameOptions{
|
2022-04-21 10:14:03 +00:00
|
|
|
DNSDomains: deny.Dns,
|
|
|
|
IPRanges: deny.Ips,
|
|
|
|
EmailAddresses: deny.Emails,
|
|
|
|
URIDomains: deny.Uris,
|
2022-03-15 14:51:45 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2022-04-21 10:14:03 +00:00
|
|
|
if ssh := pol.GetSsh(); ssh != nil {
|
|
|
|
if host := ssh.GetHost(); host != nil {
|
2022-03-15 14:51:45 +00:00
|
|
|
ops.SSH.Host = &policy.SSHHostCertificateOptions{}
|
2022-04-21 10:14:03 +00:00
|
|
|
if allow := host.GetAllow(); allow != nil {
|
2022-03-15 14:51:45 +00:00
|
|
|
ops.SSH.Host.AllowedNames = &policy.SSHNameOptions{
|
2022-04-21 10:14:03 +00:00
|
|
|
DNSDomains: allow.Dns,
|
|
|
|
IPRanges: allow.Ips,
|
|
|
|
Principals: allow.Principals,
|
2022-03-15 14:51:45 +00:00
|
|
|
}
|
|
|
|
}
|
2022-04-21 10:14:03 +00:00
|
|
|
if deny := host.GetDeny(); deny != nil {
|
2022-03-15 14:51:45 +00:00
|
|
|
ops.SSH.Host.DeniedNames = &policy.SSHNameOptions{
|
2022-04-21 10:14:03 +00:00
|
|
|
DNSDomains: deny.Dns,
|
|
|
|
IPRanges: deny.Ips,
|
|
|
|
Principals: deny.Principals,
|
2022-03-15 14:51:45 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2022-04-21 10:14:03 +00:00
|
|
|
if user := ssh.GetUser(); user != nil {
|
2022-03-15 14:51:45 +00:00
|
|
|
ops.SSH.User = &policy.SSHUserCertificateOptions{}
|
2022-04-21 10:14:03 +00:00
|
|
|
if allow := user.GetAllow(); allow != nil {
|
2022-03-15 14:51:45 +00:00
|
|
|
ops.SSH.User.AllowedNames = &policy.SSHNameOptions{
|
2022-04-21 10:14:03 +00:00
|
|
|
EmailAddresses: allow.Emails,
|
|
|
|
Principals: allow.Principals,
|
2022-03-15 14:51:45 +00:00
|
|
|
}
|
|
|
|
}
|
2022-04-21 10:14:03 +00:00
|
|
|
if deny := user.GetDeny(); deny != nil {
|
2022-03-15 14:51:45 +00:00
|
|
|
ops.SSH.User.DeniedNames = &policy.SSHNameOptions{
|
2022-04-21 10:14:03 +00:00
|
|
|
EmailAddresses: deny.Emails,
|
|
|
|
Principals: deny.Principals,
|
2022-03-15 14:51:45 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2022-09-30 00:16:26 +00:00
|
|
|
for _, wh := range p.Webhooks {
|
|
|
|
whCert := webhookToCertificates(wh)
|
|
|
|
ops.Webhooks = append(ops.Webhooks, whCert)
|
|
|
|
}
|
2021-05-03 19:48:20 +00:00
|
|
|
return ops
|
|
|
|
}
|
|
|
|
|
2022-09-30 00:16:26 +00:00
|
|
|
func webhookToCertificates(wh *linkedca.Webhook) *provisioner.Webhook {
|
|
|
|
pwh := &provisioner.Webhook{
|
|
|
|
ID: wh.Id,
|
|
|
|
Name: wh.Name,
|
|
|
|
URL: wh.Url,
|
|
|
|
Kind: wh.Kind.String(),
|
|
|
|
Secret: wh.Secret,
|
|
|
|
DisableTLSClientAuth: wh.DisableTlsClientAuth,
|
|
|
|
CertType: wh.CertType.String(),
|
|
|
|
}
|
|
|
|
|
|
|
|
switch a := wh.GetAuth().(type) {
|
|
|
|
case *linkedca.Webhook_BearerToken:
|
|
|
|
pwh.BearerToken = a.BearerToken.BearerToken
|
|
|
|
case *linkedca.Webhook_BasicAuth:
|
|
|
|
pwh.BasicAuth.Username = a.BasicAuth.Username
|
|
|
|
pwh.BasicAuth.Password = a.BasicAuth.Password
|
|
|
|
}
|
|
|
|
|
|
|
|
return pwh
|
|
|
|
}
|
|
|
|
|
|
|
|
func provisionerWebhookToLinkedca(pwh *provisioner.Webhook) *linkedca.Webhook {
|
|
|
|
lwh := &linkedca.Webhook{
|
|
|
|
Id: pwh.ID,
|
|
|
|
Name: pwh.Name,
|
|
|
|
Url: pwh.URL,
|
|
|
|
Kind: linkedca.Webhook_Kind(linkedca.Webhook_Kind_value[pwh.Kind]),
|
|
|
|
Secret: pwh.Secret,
|
|
|
|
DisableTlsClientAuth: pwh.DisableTLSClientAuth,
|
|
|
|
CertType: linkedca.Webhook_CertType(linkedca.Webhook_CertType_value[pwh.CertType]),
|
|
|
|
}
|
|
|
|
if pwh.BearerToken != "" {
|
|
|
|
lwh.Auth = &linkedca.Webhook_BearerToken{
|
|
|
|
BearerToken: &linkedca.BearerToken{
|
|
|
|
BearerToken: pwh.BearerToken,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
} else if pwh.BasicAuth.Username != "" || pwh.BasicAuth.Password != "" {
|
|
|
|
lwh.Auth = &linkedca.Webhook_BasicAuth{
|
|
|
|
BasicAuth: &linkedca.BasicAuth{
|
|
|
|
Username: pwh.BasicAuth.Username,
|
|
|
|
Password: pwh.BasicAuth.Password,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return lwh
|
|
|
|
}
|
|
|
|
|
2021-05-03 19:48:20 +00:00
|
|
|
func durationsToCertificates(d *linkedca.Durations) (min, max, def *provisioner.Duration, err error) {
|
|
|
|
if len(d.Min) > 0 {
|
|
|
|
min, err = provisioner.NewDuration(d.Min)
|
|
|
|
if err != nil {
|
|
|
|
return nil, nil, nil, admin.WrapErrorISE(err, "error parsing minimum duration '%s'", d.Min)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if len(d.Max) > 0 {
|
|
|
|
max, err = provisioner.NewDuration(d.Max)
|
|
|
|
if err != nil {
|
|
|
|
return nil, nil, nil, admin.WrapErrorISE(err, "error parsing maximum duration '%s'", d.Max)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if len(d.Default) > 0 {
|
|
|
|
def, err = provisioner.NewDuration(d.Default)
|
|
|
|
if err != nil {
|
|
|
|
return nil, nil, nil, admin.WrapErrorISE(err, "error parsing default duration '%s'", d.Default)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2021-07-27 02:01:56 +00:00
|
|
|
func durationsToLinkedca(d *provisioner.Duration) string {
|
|
|
|
if d == nil {
|
|
|
|
return ""
|
|
|
|
}
|
|
|
|
return d.Duration.String()
|
|
|
|
}
|
|
|
|
|
2021-05-03 19:48:20 +00:00
|
|
|
// claimsToCertificates converts the linkedca provisioner claims type to the
|
|
|
|
// certifictes claims type.
|
|
|
|
func claimsToCertificates(c *linkedca.Claims) (*provisioner.Claims, error) {
|
|
|
|
if c == nil {
|
2022-09-21 04:01:55 +00:00
|
|
|
//nolint:nilnil // nil claims do not pose an issue.
|
2021-05-03 19:48:20 +00:00
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
pc := &provisioner.Claims{
|
2023-07-20 17:59:38 +00:00
|
|
|
DisableRenewal: &c.DisableRenewal,
|
|
|
|
AllowRenewalAfterExpiry: &c.AllowRenewalAfterExpiry,
|
|
|
|
DisableSmallstepExtensions: &c.DisableSmallstepExtensions,
|
2021-05-03 19:48:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
var err error
|
|
|
|
|
|
|
|
if xc := c.X509; xc != nil {
|
|
|
|
if d := xc.Durations; d != nil {
|
|
|
|
pc.MinTLSDur, pc.MaxTLSDur, pc.DefaultTLSDur, err = durationsToCertificates(d)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if sc := c.Ssh; sc != nil {
|
|
|
|
pc.EnableSSHCA = &sc.Enabled
|
|
|
|
if d := sc.UserDurations; d != nil {
|
|
|
|
pc.MinUserSSHDur, pc.MaxUserSSHDur, pc.DefaultUserSSHDur, err = durationsToCertificates(d)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if d := sc.HostDurations; d != nil {
|
|
|
|
pc.MinHostSSHDur, pc.MaxHostSSHDur, pc.DefaultHostSSHDur, err = durationsToCertificates(d)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return pc, nil
|
|
|
|
}
|
|
|
|
|
2021-07-27 02:01:56 +00:00
|
|
|
func claimsToLinkedca(c *provisioner.Claims) *linkedca.Claims {
|
|
|
|
if c == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
disableRenewal := config.DefaultDisableRenewal
|
2022-04-13 22:11:54 +00:00
|
|
|
allowRenewalAfterExpiry := config.DefaultAllowRenewalAfterExpiry
|
2023-07-20 17:59:38 +00:00
|
|
|
disableSmallstepExtensions := config.DefaultDisableSmallstepExtensions
|
2022-03-14 22:40:01 +00:00
|
|
|
|
2021-07-27 02:01:56 +00:00
|
|
|
if c.DisableRenewal != nil {
|
|
|
|
disableRenewal = *c.DisableRenewal
|
|
|
|
}
|
2022-04-13 22:11:54 +00:00
|
|
|
if c.AllowRenewalAfterExpiry != nil {
|
|
|
|
allowRenewalAfterExpiry = *c.AllowRenewalAfterExpiry
|
2022-03-14 22:40:01 +00:00
|
|
|
}
|
2023-07-20 17:59:38 +00:00
|
|
|
if c.DisableSmallstepExtensions != nil {
|
|
|
|
disableSmallstepExtensions = *c.DisableSmallstepExtensions
|
|
|
|
}
|
2021-07-27 02:01:56 +00:00
|
|
|
|
|
|
|
lc := &linkedca.Claims{
|
2023-07-20 17:59:38 +00:00
|
|
|
DisableRenewal: disableRenewal,
|
|
|
|
AllowRenewalAfterExpiry: allowRenewalAfterExpiry,
|
|
|
|
DisableSmallstepExtensions: disableSmallstepExtensions,
|
2021-07-27 02:01:56 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if c.DefaultTLSDur != nil || c.MinTLSDur != nil || c.MaxTLSDur != nil {
|
|
|
|
lc.X509 = &linkedca.X509Claims{
|
|
|
|
Enabled: true,
|
|
|
|
Durations: &linkedca.Durations{
|
|
|
|
Default: durationsToLinkedca(c.DefaultTLSDur),
|
|
|
|
Min: durationsToLinkedca(c.MinTLSDur),
|
|
|
|
Max: durationsToLinkedca(c.MaxTLSDur),
|
|
|
|
},
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if c.EnableSSHCA != nil && *c.EnableSSHCA {
|
|
|
|
lc.Ssh = &linkedca.SSHClaims{
|
|
|
|
Enabled: true,
|
|
|
|
}
|
|
|
|
if c.DefaultUserSSHDur != nil || c.MinUserSSHDur != nil || c.MaxUserSSHDur != nil {
|
|
|
|
lc.Ssh.UserDurations = &linkedca.Durations{
|
|
|
|
Default: durationsToLinkedca(c.DefaultUserSSHDur),
|
|
|
|
Min: durationsToLinkedca(c.MinUserSSHDur),
|
|
|
|
Max: durationsToLinkedca(c.MaxUserSSHDur),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if c.DefaultHostSSHDur != nil || c.MinHostSSHDur != nil || c.MaxHostSSHDur != nil {
|
|
|
|
lc.Ssh.HostDurations = &linkedca.Durations{
|
|
|
|
Default: durationsToLinkedca(c.DefaultHostSSHDur),
|
|
|
|
Min: durationsToLinkedca(c.MinHostSSHDur),
|
|
|
|
Max: durationsToLinkedca(c.MaxHostSSHDur),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return lc
|
|
|
|
}
|
|
|
|
|
2022-09-30 00:16:26 +00:00
|
|
|
func provisionerOptionsToLinkedca(p *provisioner.Options) (*linkedca.Template, *linkedca.Template, []*linkedca.Webhook, error) {
|
2021-07-27 02:01:56 +00:00
|
|
|
var err error
|
|
|
|
var x509Template, sshTemplate *linkedca.Template
|
|
|
|
|
|
|
|
if p == nil {
|
2022-09-30 00:16:26 +00:00
|
|
|
return nil, nil, nil, nil
|
2021-07-27 02:01:56 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if p.X509 != nil && p.X509.HasTemplate() {
|
|
|
|
x509Template = &linkedca.Template{
|
|
|
|
Template: nil,
|
|
|
|
Data: nil,
|
|
|
|
}
|
|
|
|
|
|
|
|
if p.X509.Template != "" {
|
2023-08-30 00:26:02 +00:00
|
|
|
x509Template.Template = []byte(p.X509.Template)
|
2021-07-27 02:01:56 +00:00
|
|
|
} else if p.X509.TemplateFile != "" {
|
2021-10-18 20:56:24 +00:00
|
|
|
filename := step.Abs(p.X509.TemplateFile)
|
2021-11-12 23:46:34 +00:00
|
|
|
if x509Template.Template, err = os.ReadFile(filename); err != nil {
|
2022-09-30 00:16:26 +00:00
|
|
|
return nil, nil, nil, errors.Wrap(err, "error reading x509 template")
|
2021-07-27 02:01:56 +00:00
|
|
|
}
|
|
|
|
}
|
2023-08-30 00:26:02 +00:00
|
|
|
|
|
|
|
if p.X509.TemplateData != nil {
|
|
|
|
x509Template.Data = p.X509.TemplateData
|
|
|
|
}
|
2021-07-27 02:01:56 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if p.SSH != nil && p.SSH.HasTemplate() {
|
|
|
|
sshTemplate = &linkedca.Template{
|
|
|
|
Template: nil,
|
|
|
|
Data: nil,
|
|
|
|
}
|
|
|
|
|
|
|
|
if p.SSH.Template != "" {
|
|
|
|
sshTemplate.Template = []byte(p.SSH.Template)
|
|
|
|
} else if p.SSH.TemplateFile != "" {
|
2021-10-18 20:56:24 +00:00
|
|
|
filename := step.Abs(p.SSH.TemplateFile)
|
2021-11-12 23:46:34 +00:00
|
|
|
if sshTemplate.Template, err = os.ReadFile(filename); err != nil {
|
2022-09-30 00:16:26 +00:00
|
|
|
return nil, nil, nil, errors.Wrap(err, "error reading ssh template")
|
2021-07-27 02:01:56 +00:00
|
|
|
}
|
|
|
|
}
|
2023-08-30 00:26:02 +00:00
|
|
|
|
|
|
|
if p.SSH.TemplateData != nil {
|
|
|
|
sshTemplate.Data = p.SSH.TemplateData
|
|
|
|
}
|
2021-07-27 02:01:56 +00:00
|
|
|
}
|
|
|
|
|
2022-09-30 00:16:26 +00:00
|
|
|
var webhooks []*linkedca.Webhook
|
|
|
|
for _, pwh := range p.Webhooks {
|
|
|
|
webhooks = append(webhooks, provisionerWebhookToLinkedca(pwh))
|
|
|
|
}
|
|
|
|
|
|
|
|
return x509Template, sshTemplate, webhooks, nil
|
2021-07-27 02:01:56 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func provisionerPEMToLinkedca(b []byte) [][]byte {
|
|
|
|
var roots [][]byte
|
|
|
|
var block *pem.Block
|
|
|
|
for {
|
|
|
|
if block, b = pem.Decode(b); block == nil {
|
|
|
|
break
|
|
|
|
}
|
|
|
|
roots = append(roots, pem.EncodeToMemory(block))
|
|
|
|
}
|
|
|
|
return roots
|
|
|
|
}
|
|
|
|
|
2022-09-29 23:12:55 +00:00
|
|
|
func provisionerPEMToCertificates(bs [][]byte) []byte {
|
|
|
|
var roots []byte
|
|
|
|
for i, root := range bs {
|
|
|
|
if i > 0 && !bytes.HasSuffix(root, []byte{'\n'}) {
|
|
|
|
roots = append(roots, '\n')
|
|
|
|
}
|
|
|
|
roots = append(roots, root...)
|
|
|
|
}
|
|
|
|
return roots
|
|
|
|
}
|
|
|
|
|
2021-05-03 19:48:20 +00:00
|
|
|
// ProvisionerToCertificates converts the linkedca provisioner type to the certificates provisioner
|
|
|
|
// interface.
|
|
|
|
func ProvisionerToCertificates(p *linkedca.Provisioner) (provisioner.Interface, error) {
|
2021-05-26 04:13:01 +00:00
|
|
|
claims, err := claimsToCertificates(p.Claims)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
details := p.Details.GetData()
|
|
|
|
if details == nil {
|
2021-08-06 21:55:17 +00:00
|
|
|
return nil, errors.New("provisioner does not have any details")
|
2021-05-26 04:13:01 +00:00
|
|
|
}
|
|
|
|
|
2021-05-03 19:48:20 +00:00
|
|
|
options := optionsToCertificates(p)
|
|
|
|
|
2021-05-26 04:13:01 +00:00
|
|
|
switch d := details.(type) {
|
|
|
|
case *linkedca.ProvisionerDetails_JWK:
|
|
|
|
jwk := new(jose.JSONWebKey)
|
|
|
|
if err := json.Unmarshal(d.JWK.PublicKey, &jwk); err != nil {
|
2021-08-06 21:55:17 +00:00
|
|
|
return nil, errors.Wrap(err, "error unmarshaling public key")
|
2021-05-26 04:13:01 +00:00
|
|
|
}
|
|
|
|
return &provisioner.JWK{
|
|
|
|
ID: p.Id,
|
|
|
|
Type: p.Type.String(),
|
|
|
|
Name: p.Name,
|
|
|
|
Key: jwk,
|
|
|
|
EncryptedKey: string(d.JWK.EncryptedPrivateKey),
|
|
|
|
Claims: claims,
|
2021-05-03 19:48:20 +00:00
|
|
|
Options: options,
|
|
|
|
}, nil
|
|
|
|
case *linkedca.ProvisionerDetails_X5C:
|
|
|
|
var roots []byte
|
|
|
|
for i, root := range d.X5C.GetRoots() {
|
|
|
|
if i > 0 {
|
|
|
|
roots = append(roots, '\n')
|
|
|
|
}
|
|
|
|
roots = append(roots, root...)
|
|
|
|
}
|
|
|
|
return &provisioner.X5C{
|
|
|
|
ID: p.Id,
|
|
|
|
Type: p.Type.String(),
|
|
|
|
Name: p.Name,
|
|
|
|
Roots: roots,
|
|
|
|
Claims: claims,
|
|
|
|
Options: options,
|
|
|
|
}, nil
|
|
|
|
case *linkedca.ProvisionerDetails_K8SSA:
|
|
|
|
var publicKeys []byte
|
|
|
|
for i, k := range d.K8SSA.GetPublicKeys() {
|
|
|
|
if i > 0 {
|
|
|
|
publicKeys = append(publicKeys, '\n')
|
|
|
|
}
|
|
|
|
publicKeys = append(publicKeys, k...)
|
|
|
|
}
|
|
|
|
return &provisioner.K8sSA{
|
|
|
|
ID: p.Id,
|
|
|
|
Type: p.Type.String(),
|
|
|
|
Name: p.Name,
|
|
|
|
PubKeys: publicKeys,
|
|
|
|
Claims: claims,
|
|
|
|
Options: options,
|
|
|
|
}, nil
|
|
|
|
case *linkedca.ProvisionerDetails_SSHPOP:
|
|
|
|
return &provisioner.SSHPOP{
|
|
|
|
ID: p.Id,
|
|
|
|
Type: p.Type.String(),
|
|
|
|
Name: p.Name,
|
|
|
|
Claims: claims,
|
|
|
|
}, nil
|
|
|
|
case *linkedca.ProvisionerDetails_ACME:
|
|
|
|
cfg := d.ACME
|
|
|
|
return &provisioner.ACME{
|
2022-09-09 00:49:24 +00:00
|
|
|
ID: p.Id,
|
|
|
|
Type: p.Type.String(),
|
|
|
|
Name: p.Name,
|
|
|
|
ForceCN: cfg.ForceCn,
|
2022-11-07 21:34:21 +00:00
|
|
|
TermsOfService: cfg.TermsOfService,
|
|
|
|
Website: cfg.Website,
|
|
|
|
CaaIdentities: cfg.CaaIdentities,
|
2022-09-09 00:49:24 +00:00
|
|
|
RequireEAB: cfg.RequireEab,
|
|
|
|
Challenges: challengesToCertificates(cfg.Challenges),
|
|
|
|
AttestationFormats: attestationFormatsToCertificates(cfg.AttestationFormats),
|
2022-09-29 23:12:55 +00:00
|
|
|
AttestationRoots: provisionerPEMToCertificates(cfg.AttestationRoots),
|
2022-09-09 00:49:24 +00:00
|
|
|
Claims: claims,
|
|
|
|
Options: options,
|
2021-05-03 19:48:20 +00:00
|
|
|
}, nil
|
|
|
|
case *linkedca.ProvisionerDetails_OIDC:
|
|
|
|
cfg := d.OIDC
|
|
|
|
return &provisioner.OIDC{
|
|
|
|
ID: p.Id,
|
|
|
|
Type: p.Type.String(),
|
|
|
|
Name: p.Name,
|
|
|
|
TenantID: cfg.TenantId,
|
|
|
|
ClientID: cfg.ClientId,
|
|
|
|
ClientSecret: cfg.ClientSecret,
|
|
|
|
ConfigurationEndpoint: cfg.ConfigurationEndpoint,
|
|
|
|
Admins: cfg.Admins,
|
|
|
|
Domains: cfg.Domains,
|
|
|
|
Groups: cfg.Groups,
|
|
|
|
ListenAddress: cfg.ListenAddress,
|
|
|
|
Claims: claims,
|
|
|
|
Options: options,
|
|
|
|
}, nil
|
|
|
|
case *linkedca.ProvisionerDetails_AWS:
|
|
|
|
cfg := d.AWS
|
|
|
|
instanceAge, err := parseInstanceAge(cfg.InstanceAge)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return &provisioner.AWS{
|
|
|
|
ID: p.Id,
|
|
|
|
Type: p.Type.String(),
|
|
|
|
Name: p.Name,
|
|
|
|
Accounts: cfg.Accounts,
|
|
|
|
DisableCustomSANs: cfg.DisableCustomSans,
|
|
|
|
DisableTrustOnFirstUse: cfg.DisableTrustOnFirstUse,
|
|
|
|
InstanceAge: instanceAge,
|
|
|
|
Claims: claims,
|
|
|
|
Options: options,
|
|
|
|
}, nil
|
|
|
|
case *linkedca.ProvisionerDetails_GCP:
|
|
|
|
cfg := d.GCP
|
|
|
|
instanceAge, err := parseInstanceAge(cfg.InstanceAge)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return &provisioner.GCP{
|
|
|
|
ID: p.Id,
|
|
|
|
Type: p.Type.String(),
|
|
|
|
Name: p.Name,
|
|
|
|
ServiceAccounts: cfg.ServiceAccounts,
|
|
|
|
ProjectIDs: cfg.ProjectIds,
|
|
|
|
DisableCustomSANs: cfg.DisableCustomSans,
|
|
|
|
DisableTrustOnFirstUse: cfg.DisableTrustOnFirstUse,
|
|
|
|
InstanceAge: instanceAge,
|
|
|
|
Claims: claims,
|
|
|
|
Options: options,
|
|
|
|
}, nil
|
|
|
|
case *linkedca.ProvisionerDetails_Azure:
|
|
|
|
cfg := d.Azure
|
|
|
|
return &provisioner.Azure{
|
|
|
|
ID: p.Id,
|
|
|
|
Type: p.Type.String(),
|
|
|
|
Name: p.Name,
|
|
|
|
TenantID: cfg.TenantId,
|
|
|
|
ResourceGroups: cfg.ResourceGroups,
|
2022-02-25 11:06:48 +00:00
|
|
|
SubscriptionIDs: cfg.SubscriptionIds,
|
|
|
|
ObjectIDs: cfg.ObjectIds,
|
2021-05-03 19:48:20 +00:00
|
|
|
Audience: cfg.Audience,
|
|
|
|
DisableCustomSANs: cfg.DisableCustomSans,
|
|
|
|
DisableTrustOnFirstUse: cfg.DisableTrustOnFirstUse,
|
|
|
|
Claims: claims,
|
|
|
|
Options: options,
|
2021-05-26 04:13:01 +00:00
|
|
|
}, nil
|
2022-01-21 15:07:31 +00:00
|
|
|
case *linkedca.ProvisionerDetails_SCEP:
|
|
|
|
cfg := d.SCEP
|
2023-06-01 10:10:54 +00:00
|
|
|
s := &provisioner.SCEP{
|
2022-01-21 15:07:31 +00:00
|
|
|
ID: p.Id,
|
|
|
|
Type: p.Type.String(),
|
|
|
|
Name: p.Name,
|
|
|
|
ForceCN: cfg.ForceCn,
|
|
|
|
ChallengePassword: cfg.Challenge,
|
|
|
|
Capabilities: cfg.Capabilities,
|
|
|
|
IncludeRoot: cfg.IncludeRoot,
|
2023-09-04 12:55:27 +00:00
|
|
|
ExcludeIntermediate: cfg.ExcludeIntermediate,
|
2022-01-21 15:07:31 +00:00
|
|
|
MinimumPublicKeyLength: int(cfg.MinimumPublicKeyLength),
|
|
|
|
EncryptionAlgorithmIdentifier: int(cfg.EncryptionAlgorithmIdentifier),
|
|
|
|
Claims: claims,
|
|
|
|
Options: options,
|
2023-06-01 10:10:54 +00:00
|
|
|
}
|
|
|
|
if decrypter := cfg.GetDecrypter(); decrypter != nil {
|
2023-09-22 09:44:49 +00:00
|
|
|
s.DecrypterCertificate = decrypter.Certificate
|
|
|
|
s.DecrypterKeyPEM = decrypter.Key
|
|
|
|
s.DecrypterKeyURI = decrypter.KeyUri
|
|
|
|
s.DecrypterKeyPassword = decrypter.KeyPassword
|
2023-06-01 10:10:54 +00:00
|
|
|
}
|
|
|
|
return s, nil
|
2022-01-05 02:42:57 +00:00
|
|
|
case *linkedca.ProvisionerDetails_Nebula:
|
|
|
|
var roots []byte
|
|
|
|
for i, root := range d.Nebula.GetRoots() {
|
2022-01-07 19:24:59 +00:00
|
|
|
if i > 0 && !bytes.HasSuffix(root, []byte{'\n'}) {
|
2022-01-05 02:42:57 +00:00
|
|
|
roots = append(roots, '\n')
|
|
|
|
}
|
|
|
|
roots = append(roots, root...)
|
|
|
|
}
|
|
|
|
return &provisioner.Nebula{
|
|
|
|
ID: p.Id,
|
|
|
|
Type: p.Type.String(),
|
|
|
|
Name: p.Name,
|
|
|
|
Roots: roots,
|
|
|
|
Claims: claims,
|
|
|
|
Options: options,
|
|
|
|
}, nil
|
2021-05-26 04:13:01 +00:00
|
|
|
default:
|
|
|
|
return nil, fmt.Errorf("provisioner %s not implemented", p.Type)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-07-27 02:01:56 +00:00
|
|
|
// ProvisionerToLinkedca converts a provisioner.Interface to a
|
|
|
|
// linkedca.Provisioner type.
|
|
|
|
func ProvisionerToLinkedca(p provisioner.Interface) (*linkedca.Provisioner, error) {
|
|
|
|
switch p := p.(type) {
|
|
|
|
case *provisioner.JWK:
|
2022-09-30 00:16:26 +00:00
|
|
|
x509Template, sshTemplate, webhooks, err := provisionerOptionsToLinkedca(p.Options)
|
2021-07-27 02:01:56 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
publicKey, err := json.Marshal(p.Key)
|
|
|
|
if err != nil {
|
|
|
|
return nil, errors.Wrap(err, "error marshaling key")
|
|
|
|
}
|
|
|
|
return &linkedca.Provisioner{
|
2021-07-29 01:05:57 +00:00
|
|
|
Id: p.ID,
|
2021-07-27 02:01:56 +00:00
|
|
|
Type: linkedca.Provisioner_JWK,
|
|
|
|
Name: p.GetName(),
|
|
|
|
Details: &linkedca.ProvisionerDetails{
|
|
|
|
Data: &linkedca.ProvisionerDetails_JWK{
|
|
|
|
JWK: &linkedca.JWKProvisioner{
|
|
|
|
PublicKey: publicKey,
|
|
|
|
EncryptedPrivateKey: []byte(p.EncryptedKey),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Claims: claimsToLinkedca(p.Claims),
|
|
|
|
X509Template: x509Template,
|
|
|
|
SshTemplate: sshTemplate,
|
2022-09-30 00:16:26 +00:00
|
|
|
Webhooks: webhooks,
|
2021-07-27 02:01:56 +00:00
|
|
|
}, nil
|
|
|
|
case *provisioner.OIDC:
|
2022-09-30 00:16:26 +00:00
|
|
|
x509Template, sshTemplate, webhooks, err := provisionerOptionsToLinkedca(p.Options)
|
2021-07-27 02:01:56 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return &linkedca.Provisioner{
|
2021-07-29 01:05:57 +00:00
|
|
|
Id: p.ID,
|
2021-07-27 02:01:56 +00:00
|
|
|
Type: linkedca.Provisioner_OIDC,
|
|
|
|
Name: p.GetName(),
|
|
|
|
Details: &linkedca.ProvisionerDetails{
|
|
|
|
Data: &linkedca.ProvisionerDetails_OIDC{
|
|
|
|
OIDC: &linkedca.OIDCProvisioner{
|
|
|
|
ClientId: p.ClientID,
|
|
|
|
ClientSecret: p.ClientSecret,
|
|
|
|
ConfigurationEndpoint: p.ConfigurationEndpoint,
|
|
|
|
Admins: p.Admins,
|
|
|
|
Domains: p.Domains,
|
|
|
|
Groups: p.Groups,
|
|
|
|
ListenAddress: p.ListenAddress,
|
|
|
|
TenantId: p.TenantID,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Claims: claimsToLinkedca(p.Claims),
|
|
|
|
X509Template: x509Template,
|
|
|
|
SshTemplate: sshTemplate,
|
2022-09-30 00:16:26 +00:00
|
|
|
Webhooks: webhooks,
|
2021-07-27 02:01:56 +00:00
|
|
|
}, nil
|
|
|
|
case *provisioner.GCP:
|
2022-09-30 00:16:26 +00:00
|
|
|
x509Template, sshTemplate, webhooks, err := provisionerOptionsToLinkedca(p.Options)
|
2021-07-27 02:01:56 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return &linkedca.Provisioner{
|
2021-07-29 01:05:57 +00:00
|
|
|
Id: p.ID,
|
2021-07-27 02:01:56 +00:00
|
|
|
Type: linkedca.Provisioner_GCP,
|
|
|
|
Name: p.GetName(),
|
|
|
|
Details: &linkedca.ProvisionerDetails{
|
|
|
|
Data: &linkedca.ProvisionerDetails_GCP{
|
|
|
|
GCP: &linkedca.GCPProvisioner{
|
|
|
|
ServiceAccounts: p.ServiceAccounts,
|
|
|
|
ProjectIds: p.ProjectIDs,
|
|
|
|
DisableCustomSans: p.DisableCustomSANs,
|
|
|
|
DisableTrustOnFirstUse: p.DisableTrustOnFirstUse,
|
|
|
|
InstanceAge: p.InstanceAge.String(),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Claims: claimsToLinkedca(p.Claims),
|
|
|
|
X509Template: x509Template,
|
|
|
|
SshTemplate: sshTemplate,
|
2022-09-30 00:16:26 +00:00
|
|
|
Webhooks: webhooks,
|
2021-07-27 02:01:56 +00:00
|
|
|
}, nil
|
|
|
|
case *provisioner.AWS:
|
2022-09-30 00:16:26 +00:00
|
|
|
x509Template, sshTemplate, webhooks, err := provisionerOptionsToLinkedca(p.Options)
|
2021-07-27 02:01:56 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return &linkedca.Provisioner{
|
2021-07-29 01:05:57 +00:00
|
|
|
Id: p.ID,
|
2021-07-27 02:01:56 +00:00
|
|
|
Type: linkedca.Provisioner_AWS,
|
|
|
|
Name: p.GetName(),
|
|
|
|
Details: &linkedca.ProvisionerDetails{
|
|
|
|
Data: &linkedca.ProvisionerDetails_AWS{
|
|
|
|
AWS: &linkedca.AWSProvisioner{
|
|
|
|
Accounts: p.Accounts,
|
|
|
|
DisableCustomSans: p.DisableCustomSANs,
|
|
|
|
DisableTrustOnFirstUse: p.DisableTrustOnFirstUse,
|
|
|
|
InstanceAge: p.InstanceAge.String(),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Claims: claimsToLinkedca(p.Claims),
|
|
|
|
X509Template: x509Template,
|
|
|
|
SshTemplate: sshTemplate,
|
2022-09-30 00:16:26 +00:00
|
|
|
Webhooks: webhooks,
|
2021-07-27 02:01:56 +00:00
|
|
|
}, nil
|
|
|
|
case *provisioner.Azure:
|
2022-09-30 00:16:26 +00:00
|
|
|
x509Template, sshTemplate, webhooks, err := provisionerOptionsToLinkedca(p.Options)
|
2021-07-27 02:01:56 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return &linkedca.Provisioner{
|
2021-07-29 01:05:57 +00:00
|
|
|
Id: p.ID,
|
2021-07-27 02:01:56 +00:00
|
|
|
Type: linkedca.Provisioner_AZURE,
|
|
|
|
Name: p.GetName(),
|
|
|
|
Details: &linkedca.ProvisionerDetails{
|
|
|
|
Data: &linkedca.ProvisionerDetails_Azure{
|
|
|
|
Azure: &linkedca.AzureProvisioner{
|
|
|
|
TenantId: p.TenantID,
|
|
|
|
ResourceGroups: p.ResourceGroups,
|
2022-02-25 11:06:48 +00:00
|
|
|
SubscriptionIds: p.SubscriptionIDs,
|
|
|
|
ObjectIds: p.ObjectIDs,
|
2021-07-27 02:01:56 +00:00
|
|
|
Audience: p.Audience,
|
|
|
|
DisableCustomSans: p.DisableCustomSANs,
|
|
|
|
DisableTrustOnFirstUse: p.DisableTrustOnFirstUse,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Claims: claimsToLinkedca(p.Claims),
|
|
|
|
X509Template: x509Template,
|
|
|
|
SshTemplate: sshTemplate,
|
2022-09-30 00:16:26 +00:00
|
|
|
Webhooks: webhooks,
|
2021-07-27 02:01:56 +00:00
|
|
|
}, nil
|
|
|
|
case *provisioner.ACME:
|
2022-09-30 00:16:26 +00:00
|
|
|
x509Template, sshTemplate, webhooks, err := provisionerOptionsToLinkedca(p.Options)
|
2021-07-27 02:01:56 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return &linkedca.Provisioner{
|
2021-07-29 01:05:57 +00:00
|
|
|
Id: p.ID,
|
2021-07-27 02:01:56 +00:00
|
|
|
Type: linkedca.Provisioner_ACME,
|
|
|
|
Name: p.GetName(),
|
|
|
|
Details: &linkedca.ProvisionerDetails{
|
|
|
|
Data: &linkedca.ProvisionerDetails_ACME{
|
|
|
|
ACME: &linkedca.ACMEProvisioner{
|
2022-09-09 00:49:24 +00:00
|
|
|
ForceCn: p.ForceCN,
|
2022-11-07 21:34:21 +00:00
|
|
|
TermsOfService: p.TermsOfService,
|
|
|
|
Website: p.Website,
|
|
|
|
CaaIdentities: p.CaaIdentities,
|
|
|
|
RequireEab: p.RequireEAB,
|
2022-09-09 00:49:24 +00:00
|
|
|
Challenges: challengesToLinkedca(p.Challenges),
|
|
|
|
AttestationFormats: attestationFormatsToLinkedca(p.AttestationFormats),
|
2022-09-29 23:12:55 +00:00
|
|
|
AttestationRoots: provisionerPEMToLinkedca(p.AttestationRoots),
|
2021-07-27 02:01:56 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Claims: claimsToLinkedca(p.Claims),
|
|
|
|
X509Template: x509Template,
|
|
|
|
SshTemplate: sshTemplate,
|
2022-09-30 00:16:26 +00:00
|
|
|
Webhooks: webhooks,
|
2021-07-27 02:01:56 +00:00
|
|
|
}, nil
|
|
|
|
case *provisioner.X5C:
|
2022-09-30 00:16:26 +00:00
|
|
|
x509Template, sshTemplate, webhooks, err := provisionerOptionsToLinkedca(p.Options)
|
2021-07-27 02:01:56 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return &linkedca.Provisioner{
|
2021-07-29 01:05:57 +00:00
|
|
|
Id: p.ID,
|
2021-07-27 02:01:56 +00:00
|
|
|
Type: linkedca.Provisioner_X5C,
|
|
|
|
Name: p.GetName(),
|
|
|
|
Details: &linkedca.ProvisionerDetails{
|
|
|
|
Data: &linkedca.ProvisionerDetails_X5C{
|
|
|
|
X5C: &linkedca.X5CProvisioner{
|
|
|
|
Roots: provisionerPEMToLinkedca(p.Roots),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Claims: claimsToLinkedca(p.Claims),
|
|
|
|
X509Template: x509Template,
|
|
|
|
SshTemplate: sshTemplate,
|
2022-09-30 00:16:26 +00:00
|
|
|
Webhooks: webhooks,
|
2021-07-27 02:01:56 +00:00
|
|
|
}, nil
|
|
|
|
case *provisioner.K8sSA:
|
2022-09-30 00:16:26 +00:00
|
|
|
x509Template, sshTemplate, webhooks, err := provisionerOptionsToLinkedca(p.Options)
|
2021-07-27 02:01:56 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return &linkedca.Provisioner{
|
2021-07-29 01:05:57 +00:00
|
|
|
Id: p.ID,
|
2021-07-27 02:01:56 +00:00
|
|
|
Type: linkedca.Provisioner_K8SSA,
|
|
|
|
Name: p.GetName(),
|
|
|
|
Details: &linkedca.ProvisionerDetails{
|
|
|
|
Data: &linkedca.ProvisionerDetails_K8SSA{
|
|
|
|
K8SSA: &linkedca.K8SSAProvisioner{
|
|
|
|
PublicKeys: provisionerPEMToLinkedca(p.PubKeys),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Claims: claimsToLinkedca(p.Claims),
|
|
|
|
X509Template: x509Template,
|
|
|
|
SshTemplate: sshTemplate,
|
2022-09-30 00:16:26 +00:00
|
|
|
Webhooks: webhooks,
|
2021-07-27 02:01:56 +00:00
|
|
|
}, nil
|
|
|
|
case *provisioner.SSHPOP:
|
|
|
|
return &linkedca.Provisioner{
|
2021-07-29 01:05:57 +00:00
|
|
|
Id: p.ID,
|
2021-07-27 02:01:56 +00:00
|
|
|
Type: linkedca.Provisioner_SSHPOP,
|
|
|
|
Name: p.GetName(),
|
|
|
|
Details: &linkedca.ProvisionerDetails{
|
|
|
|
Data: &linkedca.ProvisionerDetails_SSHPOP{
|
|
|
|
SSHPOP: &linkedca.SSHPOPProvisioner{},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Claims: claimsToLinkedca(p.Claims),
|
|
|
|
}, nil
|
|
|
|
case *provisioner.SCEP:
|
2022-09-30 00:16:26 +00:00
|
|
|
x509Template, sshTemplate, webhooks, err := provisionerOptionsToLinkedca(p.Options)
|
2021-07-27 02:01:56 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return &linkedca.Provisioner{
|
2021-07-29 01:05:57 +00:00
|
|
|
Id: p.ID,
|
2021-07-27 02:01:56 +00:00
|
|
|
Type: linkedca.Provisioner_SCEP,
|
|
|
|
Name: p.GetName(),
|
|
|
|
Details: &linkedca.ProvisionerDetails{
|
|
|
|
Data: &linkedca.ProvisionerDetails_SCEP{
|
|
|
|
SCEP: &linkedca.SCEPProvisioner{
|
2022-01-21 15:07:31 +00:00
|
|
|
ForceCn: p.ForceCN,
|
2023-05-04 09:43:57 +00:00
|
|
|
Challenge: p.ChallengePassword,
|
2022-01-21 15:07:31 +00:00
|
|
|
Capabilities: p.Capabilities,
|
|
|
|
MinimumPublicKeyLength: int32(p.MinimumPublicKeyLength),
|
|
|
|
IncludeRoot: p.IncludeRoot,
|
2023-09-04 12:55:27 +00:00
|
|
|
ExcludeIntermediate: p.ExcludeIntermediate,
|
2022-01-21 15:07:31 +00:00
|
|
|
EncryptionAlgorithmIdentifier: int32(p.EncryptionAlgorithmIdentifier),
|
2023-09-22 09:38:03 +00:00
|
|
|
Decrypter: &linkedca.SCEPDecrypter{
|
2023-09-22 09:44:49 +00:00
|
|
|
Certificate: p.DecrypterCertificate,
|
|
|
|
Key: p.DecrypterKeyPEM,
|
|
|
|
KeyUri: p.DecrypterKeyURI,
|
|
|
|
KeyPassword: p.DecrypterKeyPassword,
|
2023-09-22 09:38:03 +00:00
|
|
|
},
|
2021-07-27 02:01:56 +00:00
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Claims: claimsToLinkedca(p.Claims),
|
|
|
|
X509Template: x509Template,
|
|
|
|
SshTemplate: sshTemplate,
|
2022-09-30 00:16:26 +00:00
|
|
|
Webhooks: webhooks,
|
2021-07-27 02:01:56 +00:00
|
|
|
}, nil
|
2022-01-05 02:42:57 +00:00
|
|
|
case *provisioner.Nebula:
|
2022-09-30 00:16:26 +00:00
|
|
|
x509Template, sshTemplate, webhooks, err := provisionerOptionsToLinkedca(p.Options)
|
2022-01-05 02:42:57 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return &linkedca.Provisioner{
|
|
|
|
Id: p.ID,
|
|
|
|
Type: linkedca.Provisioner_NEBULA,
|
|
|
|
Name: p.GetName(),
|
|
|
|
Details: &linkedca.ProvisionerDetails{
|
|
|
|
Data: &linkedca.ProvisionerDetails_Nebula{
|
|
|
|
Nebula: &linkedca.NebulaProvisioner{
|
|
|
|
Roots: provisionerPEMToLinkedca(p.Roots),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
Claims: claimsToLinkedca(p.Claims),
|
|
|
|
X509Template: x509Template,
|
|
|
|
SshTemplate: sshTemplate,
|
2022-09-30 00:16:26 +00:00
|
|
|
Webhooks: webhooks,
|
2022-01-05 02:42:57 +00:00
|
|
|
}, nil
|
2021-07-27 02:01:56 +00:00
|
|
|
default:
|
|
|
|
return nil, fmt.Errorf("provisioner %s not implemented", p.GetType())
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-05-03 19:48:20 +00:00
|
|
|
func parseInstanceAge(age string) (provisioner.Duration, error) {
|
|
|
|
var instanceAge provisioner.Duration
|
|
|
|
if age != "" {
|
|
|
|
iap, err := provisioner.NewDuration(age)
|
2021-05-26 04:13:01 +00:00
|
|
|
if err != nil {
|
2021-05-03 19:48:20 +00:00
|
|
|
return instanceAge, err
|
|
|
|
}
|
|
|
|
instanceAge = *iap
|
|
|
|
}
|
|
|
|
return instanceAge, nil
|
2021-05-26 04:13:01 +00:00
|
|
|
}
|
2022-08-24 00:11:40 +00:00
|
|
|
|
2022-09-08 19:34:06 +00:00
|
|
|
// challengesToCertificates converts linkedca challenges to provisioner ones
|
|
|
|
// skipping the unknown ones.
|
|
|
|
func challengesToCertificates(challenges []linkedca.ACMEProvisioner_ChallengeType) []provisioner.ACMEChallenge {
|
|
|
|
ret := make([]provisioner.ACMEChallenge, 0, len(challenges))
|
|
|
|
for _, ch := range challenges {
|
2022-08-24 00:11:40 +00:00
|
|
|
switch ch {
|
|
|
|
case linkedca.ACMEProvisioner_HTTP_01:
|
2022-09-08 19:34:06 +00:00
|
|
|
ret = append(ret, provisioner.HTTP_01)
|
2022-08-24 00:11:40 +00:00
|
|
|
case linkedca.ACMEProvisioner_DNS_01:
|
2022-09-08 19:34:06 +00:00
|
|
|
ret = append(ret, provisioner.DNS_01)
|
2022-09-09 21:34:32 +00:00
|
|
|
case linkedca.ACMEProvisioner_TLS_ALPN_01:
|
2022-09-08 19:34:06 +00:00
|
|
|
ret = append(ret, provisioner.TLS_ALPN_01)
|
2022-08-24 00:11:40 +00:00
|
|
|
case linkedca.ACMEProvisioner_DEVICE_ATTEST_01:
|
2022-09-08 19:34:06 +00:00
|
|
|
ret = append(ret, provisioner.DEVICE_ATTEST_01)
|
2022-08-24 00:11:40 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return ret
|
|
|
|
}
|
|
|
|
|
2022-09-08 19:34:06 +00:00
|
|
|
// challengesToLinkedca converts provisioner challenges to linkedca ones
|
|
|
|
// skipping the unknown ones.
|
|
|
|
func challengesToLinkedca(challenges []provisioner.ACMEChallenge) []linkedca.ACMEProvisioner_ChallengeType {
|
|
|
|
ret := make([]linkedca.ACMEProvisioner_ChallengeType, 0, len(challenges))
|
|
|
|
for _, ch := range challenges {
|
|
|
|
switch provisioner.ACMEChallenge(ch.String()) {
|
|
|
|
case provisioner.HTTP_01:
|
|
|
|
ret = append(ret, linkedca.ACMEProvisioner_HTTP_01)
|
|
|
|
case provisioner.DNS_01:
|
|
|
|
ret = append(ret, linkedca.ACMEProvisioner_DNS_01)
|
|
|
|
case provisioner.TLS_ALPN_01:
|
2022-09-09 21:34:32 +00:00
|
|
|
ret = append(ret, linkedca.ACMEProvisioner_TLS_ALPN_01)
|
2022-09-08 19:34:06 +00:00
|
|
|
case provisioner.DEVICE_ATTEST_01:
|
|
|
|
ret = append(ret, linkedca.ACMEProvisioner_DEVICE_ATTEST_01)
|
2022-08-24 00:11:40 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return ret
|
|
|
|
}
|
2022-09-09 00:49:24 +00:00
|
|
|
|
|
|
|
// attestationFormatsToCertificates converts linkedca attestation formats to
|
|
|
|
// provisioner ones skipping the unknown ones.
|
|
|
|
func attestationFormatsToCertificates(formats []linkedca.ACMEProvisioner_AttestationFormatType) []provisioner.ACMEAttestationFormat {
|
|
|
|
ret := make([]provisioner.ACMEAttestationFormat, 0, len(formats))
|
|
|
|
for _, f := range formats {
|
|
|
|
switch f {
|
|
|
|
case linkedca.ACMEProvisioner_APPLE:
|
|
|
|
ret = append(ret, provisioner.APPLE)
|
|
|
|
case linkedca.ACMEProvisioner_STEP:
|
|
|
|
ret = append(ret, provisioner.STEP)
|
|
|
|
case linkedca.ACMEProvisioner_TPM:
|
|
|
|
ret = append(ret, provisioner.TPM)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return ret
|
|
|
|
}
|
|
|
|
|
|
|
|
// attestationFormatsToLinkedca converts provisioner attestation formats to
|
|
|
|
// linkedca ones skipping the unknown ones.
|
|
|
|
func attestationFormatsToLinkedca(formats []provisioner.ACMEAttestationFormat) []linkedca.ACMEProvisioner_AttestationFormatType {
|
|
|
|
ret := make([]linkedca.ACMEProvisioner_AttestationFormatType, 0, len(formats))
|
|
|
|
for _, f := range formats {
|
|
|
|
switch provisioner.ACMEAttestationFormat(f.String()) {
|
|
|
|
case provisioner.APPLE:
|
|
|
|
ret = append(ret, linkedca.ACMEProvisioner_APPLE)
|
|
|
|
case provisioner.STEP:
|
|
|
|
ret = append(ret, linkedca.ACMEProvisioner_STEP)
|
|
|
|
case provisioner.TPM:
|
|
|
|
ret = append(ret, linkedca.ACMEProvisioner_TPM)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return ret
|
|
|
|
}
|