forked from TrueCloudLab/certificates
126 lines
3.6 KiB
Go
126 lines
3.6 KiB
Go
package acme
|
|
|
|
import (
|
|
"crypto"
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"time"
|
|
|
|
"go.step.sm/crypto/jose"
|
|
|
|
"github.com/smallstep/certificates/authority/policy"
|
|
)
|
|
|
|
// Account is a subset of the internal account type containing only those
|
|
// attributes required for responses in the ACME protocol.
|
|
type Account struct {
|
|
ID string `json:"-"`
|
|
Key *jose.JSONWebKey `json:"-"`
|
|
Contact []string `json:"contact,omitempty"`
|
|
Status Status `json:"status"`
|
|
OrdersURL string `json:"orders"`
|
|
ExternalAccountBinding interface{} `json:"externalAccountBinding,omitempty"`
|
|
}
|
|
|
|
// ToLog enables response logging.
|
|
func (a *Account) ToLog() (interface{}, error) {
|
|
b, err := json.Marshal(a)
|
|
if err != nil {
|
|
return nil, WrapErrorISE(err, "error marshaling account for logging")
|
|
}
|
|
return string(b), nil
|
|
}
|
|
|
|
// IsValid returns true if the Account is valid.
|
|
func (a *Account) IsValid() bool {
|
|
return Status(a.Status) == StatusValid
|
|
}
|
|
|
|
// KeyToID converts a JWK to a thumbprint.
|
|
func KeyToID(jwk *jose.JSONWebKey) (string, error) {
|
|
kid, err := jwk.Thumbprint(crypto.SHA256)
|
|
if err != nil {
|
|
return "", WrapErrorISE(err, "error generating jwk thumbprint")
|
|
}
|
|
return base64.RawURLEncoding.EncodeToString(kid), nil
|
|
}
|
|
|
|
// PolicyNames contains ACME account level policy names
|
|
type PolicyNames struct {
|
|
DNSNames []string `json:"dns"`
|
|
IPRanges []string `json:"ips"`
|
|
}
|
|
|
|
// X509Policy contains ACME account level X.509 policy
|
|
type X509Policy struct {
|
|
Allowed PolicyNames `json:"allow"`
|
|
Denied PolicyNames `json:"deny"`
|
|
}
|
|
|
|
// Policy is an ACME Account level policy
|
|
type Policy struct {
|
|
X509 X509Policy `json:"x509"`
|
|
}
|
|
|
|
func (p *Policy) GetAllowedNameOptions() *policy.X509NameOptions {
|
|
if p == nil {
|
|
return nil
|
|
}
|
|
return &policy.X509NameOptions{
|
|
DNSDomains: p.X509.Allowed.DNSNames,
|
|
IPRanges: p.X509.Allowed.IPRanges,
|
|
}
|
|
}
|
|
func (p *Policy) GetDeniedNameOptions() *policy.X509NameOptions {
|
|
if p == nil {
|
|
return nil
|
|
}
|
|
return &policy.X509NameOptions{
|
|
DNSDomains: p.X509.Denied.DNSNames,
|
|
IPRanges: p.X509.Denied.IPRanges,
|
|
}
|
|
}
|
|
|
|
// IsWildcardLiteralAllowed returns true by default for
|
|
// ACME account policies, as authorization is performed on DNS
|
|
// level.
|
|
func (p *Policy) IsWildcardLiteralAllowed() bool {
|
|
return true
|
|
}
|
|
|
|
// ShouldVerifySubjectCommonName returns true by default
|
|
// for ACME account policies, as this is embedded in the
|
|
// protocol.
|
|
func (p *Policy) ShouldVerifyCommonName() bool {
|
|
return true
|
|
}
|
|
|
|
// ExternalAccountKey is an ACME External Account Binding key.
|
|
type ExternalAccountKey struct {
|
|
ID string `json:"id"`
|
|
ProvisionerID string `json:"provisionerID"`
|
|
Reference string `json:"reference"`
|
|
AccountID string `json:"-"`
|
|
HmacKey []byte `json:"-"`
|
|
CreatedAt time.Time `json:"createdAt"`
|
|
BoundAt time.Time `json:"boundAt,omitempty"`
|
|
Policy *Policy `json:"policy,omitempty"`
|
|
}
|
|
|
|
// AlreadyBound returns whether this EAK is already bound to
|
|
// an ACME Account or not.
|
|
func (eak *ExternalAccountKey) AlreadyBound() bool {
|
|
return !eak.BoundAt.IsZero()
|
|
}
|
|
|
|
// BindTo binds the EAK to an Account.
|
|
// It returns an error if it's already bound.
|
|
func (eak *ExternalAccountKey) BindTo(account *Account) error {
|
|
if eak.AlreadyBound() {
|
|
return NewError(ErrorUnauthorizedType, "external account binding key with id '%s' was already bound to account '%s' on %s", eak.ID, eak.AccountID, eak.BoundAt)
|
|
}
|
|
eak.AccountID = account.ID
|
|
eak.BoundAt = time.Now()
|
|
eak.HmacKey = []byte{} // clearing the key bytes; can only be used once
|
|
return nil
|
|
}
|