TrueCloudLab/certificates
17
0
Fork 2
Code Issues 1 Pull requests 1 Releases Activity Actions

Move linkedca configuration to the main package.

Browse source
This commit is contained in:
Mariano Cano 2021-08-04 20:15:04 -07:00
parent de719eb6f0
commit 798b90c359
3 changed files with 42 additions and 34 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

70
authority/export.go
View file

@ -8,8 +8,9 @@ import (
"strings" "strings"
"github.com/pkg/errors" "github.com/pkg/errors"
step "go.step.sm/cli-utils/config" "github.com/smallstep/certificates/authority/provisioner"
"go.step.sm/linkedca/config" "go.step.sm/cli-utils/config"
"go.step.sm/linkedca"
"google.golang.org/protobuf/types/known/structpb" "google.golang.org/protobuf/types/known/structpb"
) )
@ -18,7 +19,7 @@ import (
// //
// Note that export will not export neither the pki password nor the certificate // Note that export will not export neither the pki password nor the certificate
// issuer password. // issuer password.
func (a *Authority) Export() (c *config.Configuration, err error) { func (a *Authority) Export() (c *linkedca.Configuration, err error) {
// Recover from panics // Recover from panics
defer func() { defer func() {
if r := recover(); r != nil { if r := recover(); r != nil {
@ -29,7 +30,7 @@ func (a *Authority) Export() (c *config.Configuration, err error) {
files := make(map[string][]byte) files := make(map[string][]byte)
// The exported configuration should not include the password in it. // The exported configuration should not include the password in it.
c = &config.Configuration{ c = &linkedca.Configuration{
Version: "1.0", Version: "1.0",
Root: mustReadFilesOrUris(a.config.Root, files), Root: mustReadFilesOrUris(a.config.Root, files),
FederatedRoots: mustReadFilesOrUris(a.config.FederatedRoots, files), FederatedRoots: mustReadFilesOrUris(a.config.FederatedRoots, files),
@ -41,36 +42,36 @@ func (a *Authority) Export() (c *config.Configuration, err error) {
Db: mustMarshalToStruct(a.config.DB), Db: mustMarshalToStruct(a.config.DB),
Logger: mustMarshalToStruct(a.config.Logger), Logger: mustMarshalToStruct(a.config.Logger),
Monitoring: mustMarshalToStruct(a.config.Monitoring), Monitoring: mustMarshalToStruct(a.config.Monitoring),
Authority: &config.Authority{ Authority: &linkedca.Authority{
Id: a.config.AuthorityConfig.AuthorityID, Id: a.config.AuthorityConfig.AuthorityID,
EnableAdmin: a.config.AuthorityConfig.EnableAdmin, EnableAdmin: a.config.AuthorityConfig.EnableAdmin,
DisableIssuedAtCheck: a.config.AuthorityConfig.DisableIssuedAtCheck, DisableIssuedAtCheck: a.config.AuthorityConfig.DisableIssuedAtCheck,
Backdate: a.config.AuthorityConfig.Backdate.String(), Backdate: mustDuration(a.config.AuthorityConfig.Backdate),
}, },
Files: files, Files: files,
} }
// SSH // SSH
if v := a.config.SSH; v != nil { if v := a.config.SSH; v != nil {
c.Ssh = &config.SSH{ c.Ssh = &linkedca.SSH{
HostKey: mustReadFileOrUri(v.HostKey, files), HostKey: mustReadFileOrUri(v.HostKey, files),
UserKey: mustReadFileOrUri(v.UserKey, files), UserKey: mustReadFileOrUri(v.UserKey, files),
AddUserPrincipal: v.AddUserPrincipal, AddUserPrincipal: v.AddUserPrincipal,
AddUserCommand: v.AddUserCommand, AddUserCommand: v.AddUserCommand,
} }
for _, k := range v.Keys { for _, k := range v.Keys {
typ, ok := config.SSHPublicKey_Type_value[strings.ToUpper(k.Type)] typ, ok := linkedca.SSHPublicKey_Type_value[strings.ToUpper(k.Type)]
if !ok { if !ok {
return nil, errors.Errorf("unsupported ssh key type %s", k.Type) return nil, errors.Errorf("unsupported ssh key type %s", k.Type)
} }
c.Ssh.Keys = append(c.Ssh.Keys, &config.SSHPublicKey{ c.Ssh.Keys = append(c.Ssh.Keys, &linkedca.SSHPublicKey{
Type: config.SSHPublicKey_Type(typ), Type: linkedca.SSHPublicKey_Type(typ),
Federated: k.Federated, Federated: k.Federated,
Key: mustMarshalToStruct(k), Key: mustMarshalToStruct(k),
}) })
} }
if b := v.Bastion; b != nil { if b := v.Bastion; b != nil {
c.Ssh.Bastion = &config.Bastion{ c.Ssh.Bastion = &linkedca.Bastion{
Hostname: b.Hostname, Hostname: b.Hostname,
User: b.User, User: b.User,
Port: b.Port, Port: b.Port,
@ -85,15 +86,15 @@ func (a *Authority) Export() (c *config.Configuration, err error) {
var typ int32 var typ int32
var ok bool var ok bool
if v.Type == "" { if v.Type == "" {
typ = int32(config.KMS_SOFTKMS) typ = int32(linkedca.KMS_SOFTKMS)
} else { } else {
typ, ok = config.KMS_Type_value[strings.ToUpper(v.Type)] typ, ok = linkedca.KMS_Type_value[strings.ToUpper(v.Type)]
if !ok { if !ok {
return nil, errors.Errorf("unsupported kms type %s", v.Type) return nil, errors.Errorf("unsupported kms type %s", v.Type)
} }
} }
c.Kms = &config.KMS{ c.Kms = &linkedca.KMS{
Type: config.KMS_Type(typ), Type: linkedca.KMS_Type(typ),
CredentialsFile: v.CredentialsFile, CredentialsFile: v.CredentialsFile,
Uri: v.URI, Uri: v.URI,
Pin: v.Pin, Pin: v.Pin,
@ -111,13 +112,13 @@ func (a *Authority) Export() (c *config.Configuration, err error) {
c.Authority.CertificateAuthorityFingerprint = v.CertificateAuthorityFingerprint c.Authority.CertificateAuthorityFingerprint = v.CertificateAuthorityFingerprint
c.Authority.CredentialsFile = v.CredentialsFile c.Authority.CredentialsFile = v.CredentialsFile
if iss := v.CertificateIssuer; iss != nil { if iss := v.CertificateIssuer; iss != nil {
typ, ok := config.CertificateIssuer_Type_value[strings.ToUpper(iss.Type)] typ, ok := linkedca.CertificateIssuer_Type_value[strings.ToUpper(iss.Type)]
if !ok { if !ok {
return nil, errors.Errorf("unknown certificate issuer type %s", iss.Type) return nil, errors.Errorf("unknown certificate issuer type %s", iss.Type)
} }
// The exporte certificate issuer should not include the password. // The exporte certificate issuer should not include the password.
c.Authority.CertificateIssuer = &config.CertificateIssuer{ c.Authority.CertificateIssuer = &linkedca.CertificateIssuer{
Type: config.CertificateIssuer_Type(typ), Type: linkedca.CertificateIssuer_Type(typ),
Provisioner: iss.Provisioner, Provisioner: iss.Provisioner,
Certificate: mustReadFileOrUri(iss.Certificate, files), Certificate: mustReadFileOrUri(iss.Certificate, files),
Key: mustReadFileOrUri(iss.Key, files), Key: mustReadFileOrUri(iss.Key, files),
@ -150,7 +151,7 @@ func (a *Authority) Export() (c *config.Configuration, err error) {
c.Authority.Claims = claimsToLinkedca(a.config.AuthorityConfig.Claims) c.Authority.Claims = claimsToLinkedca(a.config.AuthorityConfig.Claims)
// Distiguised names template // Distiguised names template
if v := a.config.AuthorityConfig.Template; v != nil { if v := a.config.AuthorityConfig.Template; v != nil {
c.Authority.Template = &config.DistinguishedName{ c.Authority.Template = &linkedca.DistinguishedName{
Country: v.Country, Country: v.Country,
Organization: v.Organization, Organization: v.Organization,
OrganizationalUnit: v.OrganizationalUnit, OrganizationalUnit: v.OrganizationalUnit,
@ -164,20 +165,20 @@ func (a *Authority) Export() (c *config.Configuration, err error) {
// TLS // TLS
if v := a.config.TLS; v != nil { if v := a.config.TLS; v != nil {
c.Tls = &config.TLS{ c.Tls = &linkedca.TLS{
MinVersion: v.MinVersion.String(), MinVersion: v.MinVersion.String(),
MaxVersion: v.MaxVersion.String(), MaxVersion: v.MaxVersion.String(),
Renegotiation: v.Renegotiation, Renegotiation: v.Renegotiation,
} }
for _, cs := range v.CipherSuites.Value() { for _, cs := range v.CipherSuites.Value() {
c.Tls.CipherSuites = append(c.Tls.CipherSuites, config.TLS_CiperSuite(cs)) c.Tls.CipherSuites = append(c.Tls.CipherSuites, linkedca.TLS_CiperSuite(cs))
} }
} }
// Templates // Templates
if v := a.config.Templates; v != nil { if v := a.config.Templates; v != nil {
c.Templates = &config.Templates{ c.Templates = &linkedca.ConfigTemplates{
Ssh: &config.SSHTemplate{}, Ssh: &linkedca.SSHConfigTemplate{},
Data: mustMarshalToStruct(v.Data), Data: mustMarshalToStruct(v.Data),
} }
// Remove automatically loaded vars // Remove automatically loaded vars
@ -185,12 +186,12 @@ func (a *Authority) Export() (c *config.Configuration, err error) {
delete(c.Templates.Data.Fields, "Step") delete(c.Templates.Data.Fields, "Step")
} }
for _, t := range v.SSH.Host { for _, t := range v.SSH.Host {
typ, ok := config.Template_Type_value[strings.ToUpper(string(t.Type))] typ, ok := linkedca.ConfigTemplate_Type_value[strings.ToUpper(string(t.Type))]
if !ok { if !ok {
return nil, errors.Errorf("unsupported template type %s", t.Type) return nil, errors.Errorf("unsupported template type %s", t.Type)
} }
c.Templates.Ssh.Hosts = append(c.Templates.Ssh.Hosts, &config.Template{ c.Templates.Ssh.Hosts = append(c.Templates.Ssh.Hosts, &linkedca.ConfigTemplate{
Type: config.Template_Type(typ), Type: linkedca.ConfigTemplate_Type(typ),
Name: t.Name, Name: t.Name,
Template: mustReadFileOrUri(t.TemplatePath, files), Template: mustReadFileOrUri(t.TemplatePath, files),
Path: t.Path, Path: t.Path,
@ -200,12 +201,12 @@ func (a *Authority) Export() (c *config.Configuration, err error) {
}) })
} }
for _, t := range v.SSH.User { for _, t := range v.SSH.User {
typ, ok := config.Template_Type_value[strings.ToUpper(string(t.Type))] typ, ok := linkedca.ConfigTemplate_Type_value[strings.ToUpper(string(t.Type))]
if !ok { if !ok {
return nil, errors.Errorf("unsupported template type %s", t.Type) return nil, errors.Errorf("unsupported template type %s", t.Type)
} }
c.Templates.Ssh.Users = append(c.Templates.Ssh.Users, &config.Template{ c.Templates.Ssh.Users = append(c.Templates.Ssh.Users, &linkedca.ConfigTemplate{
Type: config.Template_Type(typ), Type: linkedca.ConfigTemplate_Type(typ),
Name: t.Name, Name: t.Name,
Template: mustReadFileOrUri(t.TemplatePath, files), Template: mustReadFileOrUri(t.TemplatePath, files),
Path: t.Path, Path: t.Path,
@ -226,6 +227,13 @@ func mustPassword(s string) []byte {
return []byte(s) return []byte(s)
} }
func mustDuration(d *provisioner.Duration) string {
if d == nil || d.Duration == 0 {
return ""
}
return d.String()
}
func mustMarshalToStruct(v interface{}) *structpb.Struct { func mustMarshalToStruct(v interface{}) *structpb.Struct {
b, err := json.Marshal(v) b, err := json.Marshal(v)
if err != nil { if err != nil {
@ -243,7 +251,7 @@ func mustReadFileOrUri(fn string, m map[string][]byte) string {
return "" return ""
} }
stepPath := filepath.ToSlash(step.StepPath()) stepPath := filepath.ToSlash(config.StepPath())
if !strings.HasSuffix(stepPath, "/") { if !strings.HasSuffix(stepPath, "/") {
stepPath += "/" stepPath += "/"
} }
@ -255,7 +263,7 @@ func mustReadFileOrUri(fn string, m map[string][]byte) string {
panic(err) panic(err)
} }
if ok { if ok {
b, err := ioutil.ReadFile(step.StepAbs(fn)) b, err := ioutil.ReadFile(config.StepAbs(fn))
if err != nil { if err != nil {
panic(errors.Wrapf(err, "error reading %s", fn)) panic(errors.Wrapf(err, "error reading %s", fn))
} }

2
go.mod
View file

@ -28,7 +28,7 @@ require (
go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1 go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1
go.step.sm/cli-utils v0.4.1 go.step.sm/cli-utils v0.4.1
go.step.sm/crypto v0.9.0 go.step.sm/crypto v0.9.0
go.step.sm/linkedca v0.4.1-0.20210802195257-6104dc57167d go.step.sm/linkedca v0.4.1-0.20210805031331-a377303edb9d
golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897 golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897
golang.org/x/net v0.0.0-20210716203947-853a461950ff golang.org/x/net v0.0.0-20210716203947-853a461950ff
golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c // indirect golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c // indirect

4
go.sum
View file

@ -528,8 +528,8 @@ go.step.sm/cli-utils v0.4.1 h1:QztRUhGYjOPM1I2Nmi7V6XejQyVtcESmo+sbegxvX7Q=
go.step.sm/cli-utils v0.4.1/go.mod h1:hWYVOSlw8W9Pd+BwIbs/aftVVMRms3EG7Q2qLRwc0WA= go.step.sm/cli-utils v0.4.1/go.mod h1:hWYVOSlw8W9Pd+BwIbs/aftVVMRms3EG7Q2qLRwc0WA=
go.step.sm/crypto v0.9.0 h1:q2AllTSnVj4NRtyEPkGW2ohArLmbGbe6ZAL/VIOKDzA= go.step.sm/crypto v0.9.0 h1:q2AllTSnVj4NRtyEPkGW2ohArLmbGbe6ZAL/VIOKDzA=
go.step.sm/crypto v0.9.0/go.mod h1:+CYG05Mek1YDqi5WK0ERc6cOpKly2i/a5aZmU1sfGj0= go.step.sm/crypto v0.9.0/go.mod h1:+CYG05Mek1YDqi5WK0ERc6cOpKly2i/a5aZmU1sfGj0=
go.step.sm/linkedca v0.4.1-0.20210802195257-6104dc57167d h1:d5cE1Bgyqw4pW3M7cPD+DndyOgKf41WJIzO+Dnx3q+4= go.step.sm/linkedca v0.4.1-0.20210805031331-a377303edb9d h1:bMcTynjdYq1Xmoi0G3NPCfV/aP1/vVQ/p7W3oYhoVXU=
go.step.sm/linkedca v0.4.1-0.20210802195257-6104dc57167d/go.mod h1:5uTRjozEGSPAZal9xJqlaD38cvJcLe3o1VAFVjqcORo= go.step.sm/linkedca v0.4.1-0.20210805031331-a377303edb9d/go.mod h1:5uTRjozEGSPAZal9xJqlaD38cvJcLe3o1VAFVjqcORo=
go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE= go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ= go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0= go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=