2019-03-05 08:07:13 +00:00
|
|
|
package db
|
|
|
|
|
|
|
|
import (
|
2022-04-27 19:05:19 +00:00
|
|
|
"context"
|
2019-03-05 08:07:13 +00:00
|
|
|
"crypto/x509"
|
|
|
|
"encoding/json"
|
2019-10-10 20:08:57 +00:00
|
|
|
"strconv"
|
|
|
|
"strings"
|
2019-03-05 08:07:13 +00:00
|
|
|
"time"
|
|
|
|
|
|
|
|
"github.com/pkg/errors"
|
2022-04-06 01:00:01 +00:00
|
|
|
"github.com/smallstep/certificates/authority/provisioner"
|
2019-03-05 08:07:13 +00:00
|
|
|
"github.com/smallstep/nosql"
|
2019-05-27 00:41:10 +00:00
|
|
|
"github.com/smallstep/nosql/database"
|
2019-10-10 20:08:57 +00:00
|
|
|
"golang.org/x/crypto/ssh"
|
2019-03-05 08:07:13 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
var (
|
2019-10-25 20:47:49 +00:00
|
|
|
certsTable = []byte("x509_certs")
|
2022-04-06 02:24:53 +00:00
|
|
|
certsDataTable = []byte("x509_certs_data")
|
2019-10-25 20:47:49 +00:00
|
|
|
revokedCertsTable = []byte("revoked_x509_certs")
|
2021-10-30 07:52:50 +00:00
|
|
|
crlTable = []byte("x509_crl")
|
2019-10-28 18:50:43 +00:00
|
|
|
revokedSSHCertsTable = []byte("revoked_ssh_certs")
|
2019-10-25 20:47:49 +00:00
|
|
|
usedOTTTable = []byte("used_ott")
|
|
|
|
sshCertsTable = []byte("ssh_certs")
|
|
|
|
sshHostsTable = []byte("ssh_hosts")
|
|
|
|
sshUsersTable = []byte("ssh_users")
|
|
|
|
sshHostPrincipalsTable = []byte("ssh_host_principals")
|
2019-03-05 08:07:13 +00:00
|
|
|
)
|
|
|
|
|
2022-11-04 23:42:07 +00:00
|
|
|
// TODO: at the moment we store a single CRL in the database, in a dedicated table.
|
|
|
|
// is this acceptable? probably not....
|
|
|
|
var crlKey = []byte("crl")
|
2021-10-30 07:52:50 +00:00
|
|
|
|
2019-03-05 08:07:13 +00:00
|
|
|
// ErrAlreadyExists can be returned if the DB attempts to set a key that has
|
|
|
|
// been previously set.
|
|
|
|
var ErrAlreadyExists = errors.New("already exists")
|
|
|
|
|
|
|
|
// Config represents the JSON attributes used for configuring a step-ca DB.
|
|
|
|
type Config struct {
|
2019-04-25 00:42:14 +00:00
|
|
|
Type string `json:"type"`
|
|
|
|
DataSource string `json:"dataSource"`
|
2019-04-26 20:08:14 +00:00
|
|
|
ValueDir string `json:"valueDir,omitempty"`
|
|
|
|
Database string `json:"database,omitempty"`
|
2020-04-20 18:46:47 +00:00
|
|
|
|
2020-04-20 23:09:07 +00:00
|
|
|
// BadgerFileLoadingMode can be set to 'FileIO' (instead of the default
|
|
|
|
// 'MemoryMap') to avoid memory-mapping log files. This can be useful
|
2020-04-20 18:46:47 +00:00
|
|
|
// in environments with low RAM
|
2020-04-20 23:09:07 +00:00
|
|
|
BadgerFileLoadingMode string `json:"badgerFileLoadingMode"`
|
2019-03-05 08:07:13 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// AuthDB is an interface over an Authority DB client that implements a nosql.DB interface.
|
|
|
|
type AuthDB interface {
|
|
|
|
IsRevoked(sn string) (bool, error)
|
2019-10-28 18:50:43 +00:00
|
|
|
IsSSHRevoked(sn string) (bool, error)
|
2019-03-05 08:07:13 +00:00
|
|
|
Revoke(rci *RevokedCertificateInfo) error
|
2019-10-28 18:50:43 +00:00
|
|
|
RevokeSSH(rci *RevokedCertificateInfo) error
|
2020-09-16 01:14:03 +00:00
|
|
|
GetCertificate(serialNumber string) (*x509.Certificate, error)
|
2019-05-02 22:26:18 +00:00
|
|
|
UseToken(id, tok string) (bool, error)
|
2019-10-10 20:08:57 +00:00
|
|
|
IsSSHHost(name string) (bool, error)
|
2019-10-25 20:47:49 +00:00
|
|
|
GetSSHHostPrincipals() ([]string, error)
|
2019-03-05 08:07:13 +00:00
|
|
|
Shutdown() error
|
|
|
|
}
|
|
|
|
|
2022-04-27 19:05:19 +00:00
|
|
|
type dbKey struct{}
|
|
|
|
|
|
|
|
// NewContext adds the given authority database to the context.
|
|
|
|
func NewContext(ctx context.Context, db AuthDB) context.Context {
|
|
|
|
return context.WithValue(ctx, dbKey{}, db)
|
|
|
|
}
|
|
|
|
|
|
|
|
// FromContext returns the current authority database from the given context.
|
|
|
|
func FromContext(ctx context.Context) (db AuthDB, ok bool) {
|
|
|
|
db, ok = ctx.Value(dbKey{}).(AuthDB)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// MustFromContext returns the current database from the given context. It
|
|
|
|
// will panic if it's not in the context.
|
|
|
|
func MustFromContext(ctx context.Context) AuthDB {
|
2023-11-29 04:58:58 +00:00
|
|
|
var (
|
|
|
|
db AuthDB
|
|
|
|
ok bool
|
|
|
|
)
|
|
|
|
if db, ok = FromContext(ctx); !ok {
|
2022-04-27 19:05:19 +00:00
|
|
|
panic("authority database is not in the context")
|
|
|
|
}
|
2023-11-29 04:58:58 +00:00
|
|
|
return db
|
2022-04-27 19:05:19 +00:00
|
|
|
}
|
|
|
|
|
2022-05-19 01:27:37 +00:00
|
|
|
// CertificateStorer is an extension of AuthDB that allows to store
|
|
|
|
// certificates.
|
|
|
|
type CertificateStorer interface {
|
|
|
|
StoreCertificate(crt *x509.Certificate) error
|
|
|
|
StoreSSHCertificate(crt *ssh.Certificate) error
|
|
|
|
}
|
|
|
|
|
2021-11-04 06:05:07 +00:00
|
|
|
// CertificateRevocationListDB is an interface to indicate whether the DB supports CRL generation
|
|
|
|
type CertificateRevocationListDB interface {
|
|
|
|
GetRevokedCertificates() (*[]RevokedCertificateInfo, error)
|
|
|
|
GetCRL() (*CertificateRevocationListInfo, error)
|
|
|
|
StoreCRL(*CertificateRevocationListInfo) error
|
|
|
|
}
|
|
|
|
|
2019-03-05 08:07:13 +00:00
|
|
|
// DB is a wrapper over the nosql.DB interface.
|
|
|
|
type DB struct {
|
|
|
|
nosql.DB
|
2019-04-25 19:37:25 +00:00
|
|
|
isUp bool
|
2019-03-05 08:07:13 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// New returns a new database client that implements the AuthDB interface.
|
|
|
|
func New(c *Config) (AuthDB, error) {
|
|
|
|
if c == nil {
|
2019-05-07 18:38:27 +00:00
|
|
|
return newSimpleDB(c)
|
2019-03-05 08:07:13 +00:00
|
|
|
}
|
|
|
|
|
2020-04-20 18:46:47 +00:00
|
|
|
opts := []nosql.Option{nosql.WithDatabase(c.Database),
|
|
|
|
nosql.WithValueDir(c.ValueDir)}
|
2020-04-20 23:09:07 +00:00
|
|
|
if len(c.BadgerFileLoadingMode) > 0 {
|
|
|
|
opts = append(opts, nosql.WithBadgerFileLoadingMode(c.BadgerFileLoadingMode))
|
2020-04-20 18:46:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
db, err := nosql.New(c.Type, c.DataSource, opts...)
|
2019-04-25 00:42:14 +00:00
|
|
|
if err != nil {
|
2023-09-11 16:11:48 +00:00
|
|
|
return nil, errors.Wrapf(err, "Error opening database of Type %s", c.Type)
|
2019-03-05 08:07:13 +00:00
|
|
|
}
|
|
|
|
|
2019-10-10 20:08:57 +00:00
|
|
|
tables := [][]byte{
|
|
|
|
revokedCertsTable, certsTable, usedOTTTable,
|
2019-10-27 00:40:26 +00:00
|
|
|
sshCertsTable, sshHostsTable, sshHostPrincipalsTable, sshUsersTable,
|
2022-07-13 00:52:58 +00:00
|
|
|
revokedSSHCertsTable, certsDataTable, crlTable,
|
2019-10-10 20:08:57 +00:00
|
|
|
}
|
2019-03-05 08:07:13 +00:00
|
|
|
for _, b := range tables {
|
|
|
|
if err := db.CreateTable(b); err != nil {
|
|
|
|
return nil, errors.Wrapf(err, "error creating table %s",
|
|
|
|
string(b))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-04-25 19:37:25 +00:00
|
|
|
return &DB{db, true}, nil
|
2019-03-05 08:07:13 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// RevokedCertificateInfo contains information regarding the certificate
|
|
|
|
// revocation action.
|
|
|
|
type RevokedCertificateInfo struct {
|
|
|
|
Serial string
|
|
|
|
ProvisionerID string
|
|
|
|
ReasonCode int
|
|
|
|
Reason string
|
|
|
|
RevokedAt time.Time
|
2021-11-04 06:05:07 +00:00
|
|
|
ExpiresAt time.Time
|
2019-03-05 08:07:13 +00:00
|
|
|
TokenID string
|
|
|
|
MTLS bool
|
2021-12-02 16:11:36 +00:00
|
|
|
ACME bool
|
2019-03-05 08:07:13 +00:00
|
|
|
}
|
|
|
|
|
2021-11-02 05:26:07 +00:00
|
|
|
// CertificateRevocationListInfo contains a CRL in DER format and associated
|
|
|
|
// metadata to allow a decision on whether to regenerate the CRL or not easier
|
2021-10-30 07:52:50 +00:00
|
|
|
type CertificateRevocationListInfo struct {
|
|
|
|
Number int64
|
|
|
|
ExpiresAt time.Time
|
2022-10-07 02:30:00 +00:00
|
|
|
Duration time.Duration
|
2021-11-02 05:26:07 +00:00
|
|
|
DER []byte
|
2021-10-30 07:52:50 +00:00
|
|
|
}
|
|
|
|
|
2019-03-05 08:07:13 +00:00
|
|
|
// IsRevoked returns whether or not a certificate with the given identifier
|
|
|
|
// has been revoked.
|
|
|
|
// In the case of an X509 Certificate the `id` should be the Serial Number of
|
|
|
|
// the Certificate.
|
|
|
|
func (db *DB) IsRevoked(sn string) (bool, error) {
|
|
|
|
// If the DB is nil then act as pass through.
|
|
|
|
if db == nil {
|
|
|
|
return false, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// If the error is `Not Found` then the certificate has not been revoked.
|
|
|
|
// Any other error should be propagated to the caller.
|
|
|
|
if _, err := db.Get(revokedCertsTable, []byte(sn)); err != nil {
|
|
|
|
if nosql.IsErrNotFound(err) {
|
|
|
|
return false, nil
|
|
|
|
}
|
|
|
|
return false, errors.Wrap(err, "error checking revocation bucket")
|
|
|
|
}
|
|
|
|
|
|
|
|
// This certificate has been revoked.
|
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
|
2019-10-28 18:50:43 +00:00
|
|
|
// IsSSHRevoked returns whether or not a certificate with the given identifier
|
|
|
|
// has been revoked.
|
|
|
|
// In the case of an X509 Certificate the `id` should be the Serial Number of
|
|
|
|
// the Certificate.
|
|
|
|
func (db *DB) IsSSHRevoked(sn string) (bool, error) {
|
|
|
|
// If the DB is nil then act as pass through.
|
|
|
|
if db == nil {
|
|
|
|
return false, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// If the error is `Not Found` then the certificate has not been revoked.
|
|
|
|
// Any other error should be propagated to the caller.
|
|
|
|
if _, err := db.Get(revokedSSHCertsTable, []byte(sn)); err != nil {
|
|
|
|
if nosql.IsErrNotFound(err) {
|
|
|
|
return false, nil
|
|
|
|
}
|
|
|
|
return false, errors.Wrap(err, "error checking revocation bucket")
|
|
|
|
}
|
|
|
|
|
|
|
|
// This certificate has been revoked.
|
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
|
2019-03-05 08:07:13 +00:00
|
|
|
// Revoke adds a certificate to the revocation table.
|
|
|
|
func (db *DB) Revoke(rci *RevokedCertificateInfo) error {
|
|
|
|
rcib, err := json.Marshal(rci)
|
|
|
|
if err != nil {
|
|
|
|
return errors.Wrap(err, "error marshaling revoked certificate info")
|
|
|
|
}
|
|
|
|
|
2019-05-27 00:41:10 +00:00
|
|
|
_, swapped, err := db.CmpAndSwap(revokedCertsTable, []byte(rci.Serial), nil, rcib)
|
|
|
|
switch {
|
|
|
|
case err != nil:
|
2019-10-28 18:50:43 +00:00
|
|
|
return errors.Wrap(err, "error AuthDB CmpAndSwap")
|
|
|
|
case !swapped:
|
|
|
|
return ErrAlreadyExists
|
|
|
|
default:
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// RevokeSSH adds a SSH certificate to the revocation table.
|
|
|
|
func (db *DB) RevokeSSH(rci *RevokedCertificateInfo) error {
|
|
|
|
rcib, err := json.Marshal(rci)
|
|
|
|
if err != nil {
|
|
|
|
return errors.Wrap(err, "error marshaling revoked certificate info")
|
|
|
|
}
|
|
|
|
|
|
|
|
_, swapped, err := db.CmpAndSwap(revokedSSHCertsTable, []byte(rci.Serial), nil, rcib)
|
|
|
|
switch {
|
|
|
|
case err != nil:
|
2019-05-27 00:41:10 +00:00
|
|
|
return errors.Wrap(err, "error AuthDB CmpAndSwap")
|
|
|
|
case !swapped:
|
|
|
|
return ErrAlreadyExists
|
|
|
|
default:
|
|
|
|
return nil
|
2019-03-05 08:07:13 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-10-30 07:52:50 +00:00
|
|
|
// GetRevokedCertificates gets a list of all revoked certificates.
|
|
|
|
func (db *DB) GetRevokedCertificates() (*[]RevokedCertificateInfo, error) {
|
|
|
|
entries, err := db.List(revokedCertsTable)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
var revokedCerts []RevokedCertificateInfo
|
|
|
|
for _, e := range entries {
|
|
|
|
var data RevokedCertificateInfo
|
|
|
|
if err := json.Unmarshal(e.Value, &data); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2022-10-27 18:58:01 +00:00
|
|
|
revokedCerts = append(revokedCerts, data)
|
2021-10-30 07:52:50 +00:00
|
|
|
}
|
|
|
|
return &revokedCerts, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// StoreCRL stores a CRL in the DB
|
|
|
|
func (db *DB) StoreCRL(crlInfo *CertificateRevocationListInfo) error {
|
|
|
|
crlInfoBytes, err := json.Marshal(crlInfo)
|
|
|
|
if err != nil {
|
|
|
|
return errors.Wrap(err, "json Marshal error")
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := db.Set(crlTable, crlKey, crlInfoBytes); err != nil {
|
|
|
|
return errors.Wrap(err, "database Set error")
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetCRL gets the existing CRL from the database
|
|
|
|
func (db *DB) GetCRL() (*CertificateRevocationListInfo, error) {
|
|
|
|
crlInfoBytes, err := db.Get(crlTable, crlKey)
|
|
|
|
if err != nil {
|
|
|
|
return nil, errors.Wrap(err, "database Get error")
|
|
|
|
}
|
|
|
|
|
|
|
|
var crlInfo CertificateRevocationListInfo
|
|
|
|
err = json.Unmarshal(crlInfoBytes, &crlInfo)
|
|
|
|
if err != nil {
|
|
|
|
return nil, errors.Wrap(err, "json Unmarshal error")
|
|
|
|
}
|
|
|
|
return &crlInfo, err
|
|
|
|
}
|
|
|
|
|
2020-09-16 01:14:03 +00:00
|
|
|
// GetCertificate retrieves a certificate by the serial number.
|
|
|
|
func (db *DB) GetCertificate(serialNumber string) (*x509.Certificate, error) {
|
2020-10-06 00:20:22 +00:00
|
|
|
asn1Data, err := db.Get(certsTable, []byte(serialNumber))
|
2020-09-16 01:14:03 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, errors.Wrap(err, "database Get error")
|
|
|
|
}
|
2020-10-06 00:20:22 +00:00
|
|
|
cert, err := x509.ParseCertificate(asn1Data)
|
2020-09-16 01:14:03 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, errors.Wrapf(err, "error parsing certificate with serial number %s", serialNumber)
|
|
|
|
}
|
|
|
|
return cert, nil
|
|
|
|
}
|
|
|
|
|
2022-04-06 02:24:53 +00:00
|
|
|
// GetCertificateData returns the data stored for a provisioner
|
|
|
|
func (db *DB) GetCertificateData(serialNumber string) (*CertificateData, error) {
|
|
|
|
b, err := db.Get(certsDataTable, []byte(serialNumber))
|
|
|
|
if err != nil {
|
|
|
|
return nil, errors.Wrap(err, "database Get error")
|
|
|
|
}
|
|
|
|
var data CertificateData
|
|
|
|
if err := json.Unmarshal(b, &data); err != nil {
|
|
|
|
return nil, errors.Wrap(err, "error unmarshaling json")
|
|
|
|
}
|
|
|
|
return &data, nil
|
|
|
|
}
|
|
|
|
|
2019-03-05 08:07:13 +00:00
|
|
|
// StoreCertificate stores a certificate PEM.
|
|
|
|
func (db *DB) StoreCertificate(crt *x509.Certificate) error {
|
|
|
|
if err := db.Set(certsTable, []byte(crt.SerialNumber.String()), crt.Raw); err != nil {
|
|
|
|
return errors.Wrap(err, "database Set error")
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-04-06 02:24:53 +00:00
|
|
|
// CertificateData is the JSON representation of the data stored in
|
|
|
|
// x509_certs_data table.
|
|
|
|
type CertificateData struct {
|
2022-11-04 23:42:07 +00:00
|
|
|
Provisioner *ProvisionerData `json:"provisioner,omitempty"`
|
|
|
|
RaInfo *provisioner.RAInfo `json:"ra,omitempty"`
|
2022-04-06 02:24:53 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// ProvisionerData is the JSON representation of the provisioner stored in the
|
|
|
|
// x509_certs_data table.
|
|
|
|
type ProvisionerData struct {
|
2022-04-06 01:00:01 +00:00
|
|
|
ID string `json:"id"`
|
|
|
|
Name string `json:"name"`
|
|
|
|
Type string `json:"type"`
|
|
|
|
}
|
|
|
|
|
2022-11-04 23:42:07 +00:00
|
|
|
type raProvisioner interface {
|
|
|
|
RAInfo() *provisioner.RAInfo
|
|
|
|
}
|
|
|
|
|
2022-04-06 01:00:01 +00:00
|
|
|
// StoreCertificateChain stores the leaf certificate and the provisioner that
|
|
|
|
// authorized the certificate.
|
2022-04-06 02:24:53 +00:00
|
|
|
func (db *DB) StoreCertificateChain(p provisioner.Interface, chain ...*x509.Certificate) error {
|
2022-04-06 01:00:01 +00:00
|
|
|
leaf := chain[0]
|
2022-04-13 01:42:27 +00:00
|
|
|
serialNumber := []byte(leaf.SerialNumber.String())
|
2022-04-06 02:24:53 +00:00
|
|
|
data := &CertificateData{}
|
2022-04-06 01:00:01 +00:00
|
|
|
if p != nil {
|
2022-04-06 02:24:53 +00:00
|
|
|
data.Provisioner = &ProvisionerData{
|
2022-04-06 01:00:01 +00:00
|
|
|
ID: p.GetID(),
|
|
|
|
Name: p.GetName(),
|
|
|
|
Type: p.GetType().String(),
|
|
|
|
}
|
2022-11-04 23:42:07 +00:00
|
|
|
if rap, ok := p.(raProvisioner); ok {
|
|
|
|
data.RaInfo = rap.RAInfo()
|
|
|
|
}
|
2022-04-06 02:24:53 +00:00
|
|
|
}
|
|
|
|
b, err := json.Marshal(data)
|
|
|
|
if err != nil {
|
|
|
|
return errors.Wrap(err, "error marshaling json")
|
|
|
|
}
|
2022-04-13 01:42:27 +00:00
|
|
|
// Add certificate and certificate data in one transaction.
|
|
|
|
tx := new(database.Tx)
|
|
|
|
tx.Set(certsTable, serialNumber, leaf.Raw)
|
|
|
|
tx.Set(certsDataTable, serialNumber, b)
|
|
|
|
if err := db.Update(tx); err != nil {
|
|
|
|
return errors.Wrap(err, "database Update error")
|
2022-04-06 01:00:01 +00:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-11-04 23:42:07 +00:00
|
|
|
// StoreRenewedCertificate stores the leaf certificate and the provisioner that
|
|
|
|
// authorized the old certificate if available.
|
|
|
|
func (db *DB) StoreRenewedCertificate(oldCert *x509.Certificate, chain ...*x509.Certificate) error {
|
|
|
|
var certificateData []byte
|
|
|
|
if data, err := db.GetCertificateData(oldCert.SerialNumber.String()); err == nil {
|
|
|
|
if b, err := json.Marshal(data); err == nil {
|
|
|
|
certificateData = b
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
leaf := chain[0]
|
|
|
|
serialNumber := []byte(leaf.SerialNumber.String())
|
|
|
|
|
|
|
|
// Add certificate and certificate data in one transaction.
|
|
|
|
tx := new(database.Tx)
|
|
|
|
tx.Set(certsTable, serialNumber, leaf.Raw)
|
|
|
|
if certificateData != nil {
|
|
|
|
tx.Set(certsDataTable, serialNumber, certificateData)
|
|
|
|
}
|
|
|
|
if err := db.Update(tx); err != nil {
|
|
|
|
return errors.Wrap(err, "database Update error")
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2019-05-02 22:26:18 +00:00
|
|
|
// UseToken returns true if we were able to successfully store the token for
|
|
|
|
// for the first time, false otherwise.
|
|
|
|
func (db *DB) UseToken(id, tok string) (bool, error) {
|
2019-06-10 20:21:06 +00:00
|
|
|
_, swapped, err := db.CmpAndSwap(usedOTTTable, []byte(id), nil, []byte(tok))
|
2019-05-27 00:41:10 +00:00
|
|
|
if err != nil {
|
2019-06-10 20:21:06 +00:00
|
|
|
return false, errors.Wrapf(err, "error storing used token %s/%s",
|
2019-05-02 22:26:18 +00:00
|
|
|
string(usedOTTTable), id)
|
|
|
|
}
|
2019-05-27 00:41:10 +00:00
|
|
|
return swapped, nil
|
2019-05-02 22:26:18 +00:00
|
|
|
}
|
|
|
|
|
2019-10-10 20:08:57 +00:00
|
|
|
// IsSSHHost returns if a principal is present in the ssh hosts table.
|
|
|
|
func (db *DB) IsSSHHost(principal string) (bool, error) {
|
|
|
|
if _, err := db.Get(sshHostsTable, []byte(strings.ToLower(principal))); err != nil {
|
|
|
|
if database.IsErrNotFound(err) {
|
|
|
|
return false, nil
|
|
|
|
}
|
|
|
|
return false, errors.Wrap(err, "database Get error")
|
|
|
|
}
|
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
|
2019-10-25 20:47:49 +00:00
|
|
|
type sshHostPrincipalData struct {
|
|
|
|
Serial string
|
|
|
|
Expiry uint64
|
|
|
|
}
|
|
|
|
|
2019-10-10 20:08:57 +00:00
|
|
|
// StoreSSHCertificate stores an SSH certificate.
|
|
|
|
func (db *DB) StoreSSHCertificate(crt *ssh.Certificate) error {
|
|
|
|
serial := strconv.FormatUint(crt.Serial, 10)
|
|
|
|
tx := new(database.Tx)
|
|
|
|
tx.Set(sshCertsTable, []byte(serial), crt.Marshal())
|
|
|
|
if crt.CertType == ssh.HostCert {
|
2019-10-25 20:47:49 +00:00
|
|
|
for _, p := range crt.ValidPrincipals {
|
|
|
|
hostPrincipalData, err := json.Marshal(sshHostPrincipalData{
|
|
|
|
Serial: serial,
|
|
|
|
Expiry: crt.ValidBefore,
|
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
tx.Set(sshHostsTable, []byte(strings.ToLower(p)), []byte(serial))
|
|
|
|
tx.Set(sshHostPrincipalsTable, []byte(strings.ToLower(p)), hostPrincipalData)
|
|
|
|
}
|
2019-10-10 20:08:57 +00:00
|
|
|
} else {
|
2019-10-25 20:47:49 +00:00
|
|
|
for _, p := range crt.ValidPrincipals {
|
|
|
|
tx.Set(sshUsersTable, []byte(strings.ToLower(p)), []byte(serial))
|
|
|
|
}
|
2019-10-10 20:08:57 +00:00
|
|
|
}
|
|
|
|
if err := db.Update(tx); err != nil {
|
|
|
|
return errors.Wrap(err, "database Update error")
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2019-10-25 20:47:49 +00:00
|
|
|
// GetSSHHostPrincipals gets a list of all valid host principals.
|
|
|
|
func (db *DB) GetSSHHostPrincipals() ([]string, error) {
|
|
|
|
entries, err := db.List(sshHostPrincipalsTable)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
var principals []string
|
|
|
|
for _, e := range entries {
|
|
|
|
var data sshHostPrincipalData
|
|
|
|
if err := json.Unmarshal(e.Value, &data); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if time.Unix(int64(data.Expiry), 0).After(time.Now()) {
|
|
|
|
principals = append(principals, string(e.Key))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return principals, nil
|
|
|
|
}
|
|
|
|
|
2019-03-05 08:07:13 +00:00
|
|
|
// Shutdown sends a shutdown message to the database.
|
|
|
|
func (db *DB) Shutdown() error {
|
2019-04-25 19:37:25 +00:00
|
|
|
if db.isUp {
|
|
|
|
if err := db.Close(); err != nil {
|
|
|
|
return errors.Wrap(err, "database shutdown error")
|
|
|
|
}
|
|
|
|
db.isUp = false
|
2019-03-05 08:07:13 +00:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
2019-05-27 00:41:10 +00:00
|
|
|
|
2019-12-20 21:30:05 +00:00
|
|
|
// MockAuthDB mocks the AuthDB interface. //
|
|
|
|
type MockAuthDB struct {
|
2022-10-07 02:30:00 +00:00
|
|
|
Err error
|
|
|
|
Ret1 interface{}
|
|
|
|
MIsRevoked func(string) (bool, error)
|
|
|
|
MIsSSHRevoked func(string) (bool, error)
|
|
|
|
MRevoke func(rci *RevokedCertificateInfo) error
|
|
|
|
MRevokeSSH func(rci *RevokedCertificateInfo) error
|
|
|
|
MGetCertificate func(serialNumber string) (*x509.Certificate, error)
|
|
|
|
MGetCertificateData func(serialNumber string) (*CertificateData, error)
|
|
|
|
MStoreCertificate func(crt *x509.Certificate) error
|
|
|
|
MUseToken func(id, tok string) (bool, error)
|
|
|
|
MIsSSHHost func(principal string) (bool, error)
|
|
|
|
MStoreSSHCertificate func(crt *ssh.Certificate) error
|
|
|
|
MGetSSHHostPrincipals func() ([]string, error)
|
|
|
|
MShutdown func() error
|
|
|
|
MGetRevokedCertificates func() (*[]RevokedCertificateInfo, error)
|
|
|
|
MGetCRL func() (*CertificateRevocationListInfo, error)
|
|
|
|
MStoreCRL func(*CertificateRevocationListInfo) error
|
2019-12-20 21:30:05 +00:00
|
|
|
}
|
|
|
|
|
2021-11-02 05:26:07 +00:00
|
|
|
func (m *MockAuthDB) GetRevokedCertificates() (*[]RevokedCertificateInfo, error) {
|
2022-10-07 02:30:00 +00:00
|
|
|
if m.MGetRevokedCertificates != nil {
|
|
|
|
return m.MGetRevokedCertificates()
|
|
|
|
}
|
|
|
|
return m.Ret1.(*[]RevokedCertificateInfo), m.Err
|
2021-11-02 05:26:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (m *MockAuthDB) GetCRL() (*CertificateRevocationListInfo, error) {
|
2022-10-07 02:30:00 +00:00
|
|
|
if m.MGetCRL != nil {
|
|
|
|
return m.MGetCRL()
|
|
|
|
}
|
|
|
|
return m.Ret1.(*CertificateRevocationListInfo), m.Err
|
2021-11-02 05:26:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (m *MockAuthDB) StoreCRL(info *CertificateRevocationListInfo) error {
|
2022-10-07 02:30:00 +00:00
|
|
|
if m.MStoreCRL != nil {
|
|
|
|
return m.MStoreCRL(info)
|
|
|
|
}
|
|
|
|
return m.Err
|
2021-11-02 05:26:07 +00:00
|
|
|
}
|
|
|
|
|
2019-12-20 21:30:05 +00:00
|
|
|
// IsRevoked mock.
|
|
|
|
func (m *MockAuthDB) IsRevoked(sn string) (bool, error) {
|
|
|
|
if m.MIsRevoked != nil {
|
|
|
|
return m.MIsRevoked(sn)
|
|
|
|
}
|
|
|
|
return m.Ret1.(bool), m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// IsSSHRevoked mock.
|
|
|
|
func (m *MockAuthDB) IsSSHRevoked(sn string) (bool, error) {
|
|
|
|
if m.MIsSSHRevoked != nil {
|
|
|
|
return m.MIsSSHRevoked(sn)
|
|
|
|
}
|
|
|
|
return m.Ret1.(bool), m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// UseToken mock.
|
|
|
|
func (m *MockAuthDB) UseToken(id, tok string) (bool, error) {
|
|
|
|
if m.MUseToken != nil {
|
|
|
|
return m.MUseToken(id, tok)
|
|
|
|
}
|
|
|
|
if m.Ret1 == nil {
|
|
|
|
return false, m.Err
|
|
|
|
}
|
|
|
|
return m.Ret1.(bool), m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Revoke mock.
|
|
|
|
func (m *MockAuthDB) Revoke(rci *RevokedCertificateInfo) error {
|
|
|
|
if m.MRevoke != nil {
|
|
|
|
return m.MRevoke(rci)
|
|
|
|
}
|
|
|
|
return m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// RevokeSSH mock.
|
|
|
|
func (m *MockAuthDB) RevokeSSH(rci *RevokedCertificateInfo) error {
|
|
|
|
if m.MRevokeSSH != nil {
|
|
|
|
return m.MRevokeSSH(rci)
|
|
|
|
}
|
|
|
|
return m.Err
|
|
|
|
}
|
|
|
|
|
2020-09-16 01:14:03 +00:00
|
|
|
// GetCertificate mock.
|
|
|
|
func (m *MockAuthDB) GetCertificate(serialNumber string) (*x509.Certificate, error) {
|
|
|
|
if m.MGetCertificate != nil {
|
|
|
|
return m.MGetCertificate(serialNumber)
|
|
|
|
}
|
|
|
|
return m.Ret1.(*x509.Certificate), m.Err
|
|
|
|
}
|
|
|
|
|
2022-04-08 20:06:29 +00:00
|
|
|
// GetCertificateData mock.
|
|
|
|
func (m *MockAuthDB) GetCertificateData(serialNumber string) (*CertificateData, error) {
|
|
|
|
if m.MGetCertificateData != nil {
|
|
|
|
return m.MGetCertificateData(serialNumber)
|
|
|
|
}
|
|
|
|
if cd, ok := m.Ret1.(*CertificateData); ok {
|
|
|
|
return cd, m.Err
|
|
|
|
}
|
|
|
|
return nil, m.Err
|
|
|
|
}
|
|
|
|
|
2019-12-20 21:30:05 +00:00
|
|
|
// StoreCertificate mock.
|
|
|
|
func (m *MockAuthDB) StoreCertificate(crt *x509.Certificate) error {
|
|
|
|
if m.MStoreCertificate != nil {
|
|
|
|
return m.MStoreCertificate(crt)
|
|
|
|
}
|
|
|
|
return m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// IsSSHHost mock.
|
|
|
|
func (m *MockAuthDB) IsSSHHost(principal string) (bool, error) {
|
|
|
|
if m.MIsSSHHost != nil {
|
|
|
|
return m.MIsSSHHost(principal)
|
|
|
|
}
|
|
|
|
return m.Ret1.(bool), m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// StoreSSHCertificate mock.
|
|
|
|
func (m *MockAuthDB) StoreSSHCertificate(crt *ssh.Certificate) error {
|
|
|
|
if m.MStoreSSHCertificate != nil {
|
|
|
|
return m.MStoreSSHCertificate(crt)
|
|
|
|
}
|
|
|
|
return m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetSSHHostPrincipals mock.
|
|
|
|
func (m *MockAuthDB) GetSSHHostPrincipals() ([]string, error) {
|
|
|
|
if m.MGetSSHHostPrincipals != nil {
|
|
|
|
return m.MGetSSHHostPrincipals()
|
|
|
|
}
|
|
|
|
return m.Ret1.([]string), m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Shutdown mock.
|
|
|
|
func (m *MockAuthDB) Shutdown() error {
|
|
|
|
if m.MShutdown != nil {
|
|
|
|
return m.MShutdown()
|
|
|
|
}
|
|
|
|
return m.Err
|
|
|
|
}
|
|
|
|
|
2019-05-27 00:41:10 +00:00
|
|
|
// MockNoSQLDB //
|
|
|
|
type MockNoSQLDB struct {
|
|
|
|
Err error
|
|
|
|
Ret1, Ret2 interface{}
|
|
|
|
MGet func(bucket, key []byte) ([]byte, error)
|
|
|
|
MSet func(bucket, key, value []byte) error
|
|
|
|
MOpen func(dataSourceName string, opt ...database.Option) error
|
|
|
|
MClose func() error
|
|
|
|
MCreateTable func(bucket []byte) error
|
|
|
|
MDeleteTable func(bucket []byte) error
|
|
|
|
MDel func(bucket, key []byte) error
|
|
|
|
MList func(bucket []byte) ([]*database.Entry, error)
|
|
|
|
MUpdate func(tx *database.Tx) error
|
|
|
|
MCmpAndSwap func(bucket, key, old, newval []byte) ([]byte, bool, error)
|
|
|
|
}
|
|
|
|
|
|
|
|
// CmpAndSwap mock
|
|
|
|
func (m *MockNoSQLDB) CmpAndSwap(bucket, key, old, newval []byte) ([]byte, bool, error) {
|
|
|
|
if m.MCmpAndSwap != nil {
|
|
|
|
return m.MCmpAndSwap(bucket, key, old, newval)
|
|
|
|
}
|
|
|
|
if m.Ret1 == nil {
|
|
|
|
return nil, false, m.Err
|
|
|
|
}
|
|
|
|
return m.Ret1.([]byte), m.Ret2.(bool), m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Get mock
|
|
|
|
func (m *MockNoSQLDB) Get(bucket, key []byte) ([]byte, error) {
|
|
|
|
if m.MGet != nil {
|
|
|
|
return m.MGet(bucket, key)
|
|
|
|
}
|
|
|
|
if m.Ret1 == nil {
|
|
|
|
return nil, m.Err
|
|
|
|
}
|
|
|
|
return m.Ret1.([]byte), m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Set mock
|
|
|
|
func (m *MockNoSQLDB) Set(bucket, key, value []byte) error {
|
|
|
|
if m.MSet != nil {
|
|
|
|
return m.MSet(bucket, key, value)
|
|
|
|
}
|
|
|
|
return m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Open mock
|
|
|
|
func (m *MockNoSQLDB) Open(dataSourceName string, opt ...database.Option) error {
|
|
|
|
if m.MOpen != nil {
|
|
|
|
return m.MOpen(dataSourceName, opt...)
|
|
|
|
}
|
|
|
|
return m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Close mock
|
|
|
|
func (m *MockNoSQLDB) Close() error {
|
|
|
|
if m.MClose != nil {
|
|
|
|
return m.MClose()
|
|
|
|
}
|
|
|
|
return m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// CreateTable mock
|
|
|
|
func (m *MockNoSQLDB) CreateTable(bucket []byte) error {
|
|
|
|
if m.MCreateTable != nil {
|
|
|
|
return m.MCreateTable(bucket)
|
|
|
|
}
|
|
|
|
return m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// DeleteTable mock
|
|
|
|
func (m *MockNoSQLDB) DeleteTable(bucket []byte) error {
|
|
|
|
if m.MDeleteTable != nil {
|
|
|
|
return m.MDeleteTable(bucket)
|
|
|
|
}
|
|
|
|
return m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Del mock
|
|
|
|
func (m *MockNoSQLDB) Del(bucket, key []byte) error {
|
|
|
|
if m.MDel != nil {
|
|
|
|
return m.MDel(bucket, key)
|
|
|
|
}
|
|
|
|
return m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// List mock
|
|
|
|
func (m *MockNoSQLDB) List(bucket []byte) ([]*database.Entry, error) {
|
|
|
|
if m.MList != nil {
|
|
|
|
return m.MList(bucket)
|
|
|
|
}
|
|
|
|
return m.Ret1.([]*database.Entry), m.Err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Update mock
|
|
|
|
func (m *MockNoSQLDB) Update(tx *database.Tx) error {
|
|
|
|
if m.MUpdate != nil {
|
|
|
|
return m.MUpdate(tx)
|
|
|
|
}
|
|
|
|
return m.Err
|
|
|
|
}
|