6f2b4d3042
Add ACME permanent-identifier identifier type
2 years ago
ab0d2503ae
Standardize linting file and fix or ignore lots of linting errors
2 years ago
7dc2067cb2
Update acme/errors.go
...
Co-authored-by: Max <mx.furman@gmail.com>
2 years ago
226d36f66f
Fix unit tests
2 years ago
8cf6675ce4
Return the internal error instead of the ACME error
...
For ACME errors, return the internal error string instead of the
ACME one on the "Error() string" function. This way the logs will
have more information about the cause of an error.
Fixes #1057
2 years ago
34c6c65671
Pass attestation information to the Sign method
...
Attestation information might be useful in authorizing webhooks
2 years ago
498549c95c
Extract common function used in tests
2 years ago
829530ae90
Fix linter errors
2 years ago
6b73a020e3
Add unit tests for apple and step attestations
2 years ago
0f651799d0
Reject not enabled attestation formats
2 years ago
fd4e96d1f4
Rename method to IsChallengeEnabled
2 years ago
c77b4ff9c5
Fix linter errors
2 years ago
59c5219a07
Use a type for acme challenges
2 years ago
a89bea701d
Format comment
2 years ago
5df9434286
Fix old comment, device-attest-01 uses the acme payload
2 years ago
c5d3714a63
Fix acme error map
2 years ago
08815c5e90
Reneame attestation statement error
2 years ago
3cd72ac72a
Remove debug statements
2 years ago
e75e7e7cd6
Fix linter warnings
2 years ago
54d92095ac
Validate proof of possession signature
...
On the step format, validate proof of possession of the private
key validating the signature in the attestation statement.
2 years ago
59b7603d1e
Use a clientAuth only cert for device-attest-01
2 years ago
ca412e77cc
Return error on attestation validation
...
The method storeError returns a nil error
2 years ago
ab5f916bd3
Define ErrorBadAttestationStatement
2 years ago
735c9d49b0
Add support for yubikey attestation
2 years ago
df96b126dc
Add AuthorizeChallenge unit tests
2 years ago
bca311b05e
Add acme property to enable challenges
...
Fixes #1027
2 years ago
ae8d4d8757
Fix unit test
2 years ago
693dc39481
Merge branch 'master' into device-attestation
2 years ago
23b8f45b37
Address gosec warnings
...
Most if not all false positives
2 years ago
c040e4b459
Add unit tests
2 years ago
b7c2f6c482
Check for DNS name validity
2 years ago
b62f4d1000
Add lgtm comments on some security warnings
2 years ago
2f7cb9225f
Use go.step.sm/crypto to set the permanent identifier
2 years ago
2ab1e6658e
Fix nonce validation
...
The attestation certificate contains the nonce as raw bytes in the
extension 1.2.840.113635.100.8.11.1
2 years ago
66356cff43
Add attestation certificate validation for Apple devices
2 years ago
274f6ccb41
iOS 16 beta 2 support
2 years ago
7e1b0bebd9
iOS 16 beta 1 support
2 years ago
77c6d10fd6
Verify key authorization is contained within the TPM quote extraData field
2 years ago
e1ec31c0ed
Implement TPM attestation statement verification
2 years ago
2ac8b69da2
Add ACME permanent-identifier identifier type
2 years ago
aacd6f4cc6
Add device-attest-01 challenge type
2 years ago
860baeb1c5
Verbose debug logging
2 years ago
fe04f93d7f
all: reformat all go files with the next gofmt (Go 1.19)
...
There are some changes that manually edited, for example using '-' as
default list and grouping imports.
2 years ago
abfbbc8d49
Merge pull request #946 from smallstep/herman/acme-csr-padding
...
Strip base64-url padding from ACME CSR
2 years ago
fd546287ac
Strip base64-url padding from ACME CSR
...
This commit strips the padding from a base64-url encoded CSR
submitted by a client that doesn't use raw base64-url encoding.
2 years ago
e7f4eaf6c4
Remove explicit deprecation notice
...
This will avoid linter errors on other projects for now.
2 years ago
d461918eb0
Merge branch 'master' into context-authority
2 years ago
2ea0c70344
Move acme context middleware to deprecated handler
2 years ago
9147356d8a
Fix linter errors
2 years ago
2ab7dc6f9d
Fix acme tests.
2 years ago
ba499eeb2a
Fix acme/api tests.
2 years ago
6f9d847bc6
Fix panic in acme/api tests.
2 years ago
d82e51b748
Update AllowWildcardNames configuration name
2 years ago
d1f75f1720
Refactor ACME api.
2 years ago
fddd6f7d95
Move linker to the acme package.
2 years ago
55b0f72821
Add context methods for the acme linker.
2 years ago
bb8d85a201
Fix unit tests - work in progress
2 years ago
42435ace64
Use scep authority from context
...
This commit also converts all the methods from the handler to
functions.
2 years ago
d13537d426
Use context in the acme handlers.
2 years ago
bd412c9f42
Add context methods for the acme database
2 years ago
6e1f8dd7ab
Refactor policy engines into container
2 years ago
2a7620641f
Fix more PR comments
2 years ago
fb81407d6f
Fix ACME policy comments
2 years ago
7f9034d22a
Add additional policy options
2 years ago
a9f033ece5
Fix JSON property name for ACME policy
2 years ago
256fe113f7
Improve tests for ACME account policy
2 years ago
034b7943fe
Merge branch 'master' into herman/allow-deny
2 years ago
7df52dbb76
Add ACME EAB policy
2 years ago
479c6d2bf5
Fix ACME IPv6 HTTP-01 challenges
...
Fixes #890
2 years ago
2fbdf7d5b0
Merge branch 'master' into herman/allow-deny
2 years ago
00634fb648
api/render, api/log: initial implementation of the packages ( #860 )
...
* api/render: initial implementation of the package
* acme/api: refactored to support api/render
* authority/admin: refactored to support api/render
* ca: refactored to support api/render
* api: refactored to support api/render
* api/render: implemented Error
* api: refactored to support api/render.Error
* acme/api: refactored to support api/render.Error
* authority/admin: refactored to support api/render.Error
* ca: refactored to support api/render.Error
* ca: fixed broken tests
* api/render, api/log: moved error logging to this package
* acme: refactored Error so that it implements render.RenderableError
* authority/admin: refactored Error so that it implements render.RenderableError
* api/render: implemented RenderableError
* api/render: added test coverage for Error
* api/render: implemented statusCodeFromError
* api: refactored RootsPEM to work with render.Error
* acme, authority/admin: fixed pointer receiver name for consistency
* api/render, errs: moved StatusCoder & StackTracer to the render package
2 years ago
b49307f326
Fix ACME order tests with mock ACME CA
2 years ago
9e0edc7b50
Add early authority policy evaluation to ACME order API
2 years ago
101ca6a2d3
Check admin subjects before changing policy
2 years ago
3ec9a7310c
Fix ACME order identifier allow/deny check
2 years ago
af53a17bb4
Merge branch 'master' into herman/allow-deny
2 years ago
b6f6bd879c
Fix PR comment and add tests for ACME prerequisites checker
2 years ago
e47dd0a666
Add ACME configuration prerequisites check
2 years ago
c3c6f3da72
Merge branch 'master' into herman/allow-deny
2 years ago
bfa2245abb
Merge branch 'master' into herman/normalize-ipv6-dns-names
2 years ago
1fe7362bee
Normalize IPv6 addresses in ACME linker
2 years ago
c1424036bf
Merge branch 'master' into herman/allow-deny
2 years ago
bf21319e76
Fix PR comments and issue with empty string slices
2 years ago
fd9845e9c7
Add cursor and limit to ACME EAB DB interface
2 years ago
c3f2fd8ef0
Add RW locks to prevent concurrent updates to the DB
...
Although this may slow certain API calls down and may not be, strictly
necessary, I think it's best to put all the ACME EAB operations behind
RW locks to prevent concurrent updates to the DB and guarantee
consistent result sets.
2 years ago
868cc4ad7f
Increase test coverage for additional indexes
2 years ago
c0eb420806
Remove special case for empty slices
2 years ago
6440870a80
Clean up, improve test cases and coverage
2 years ago
ef16febf40
Refactor ACME EAB queries
...
The ACME EAB keys are now also indexed by the provisioner. This
solves part of the issue in which too many EAB keys may be in
memory at a given time.
3 years ago
30859d3c83
Remove server-side paging logic for ExternalAccountKeys
3 years ago
9539729bd9
Add initial implementation of x509 and SSH allow/deny policy engine
3 years ago
11a7f01177
Simplify lookup cursor logic for ExternalAccountKeys
3 years ago
22ff90f655
Merge branch 'master' into hs/acme-eab
3 years ago
a5f2f004e3
Change name of IP Common Name test for clarity
3 years ago
f9ae875f9d
Use short if-style statements
3 years ago
80bebda69c
Fix code style issue
3 years ago
bc0875bd7b
Disallow email address and URLs in the CSR
...
Before this commit `step` would allow email addresses and URLs
in the CSR. This doesn't fit nicely with the rest of ACME, in which
identifiers need to be authorized before a certificate is issued.
3 years ago
13a31fd862
Merge branch 'master' into herman/ip-sans-improvements
3 years ago
ca707cbe05
Fix linting
3 years ago
a5d33512fe
Fix test
3 years ago
Brandon Weeks
max furman
Mariano Cano
Mariano Cano
Shulhan
Herman Slatman
Herman Slatman
Panagiotis Siatras