mbiryukova/certificates
1
0
Fork 0
forked from TrueCloudLab/certificates
Code Pull requests Activity

Remove extractable from StoreCertificate.

Browse source
This commit is contained in:
Mariano Cano 2021-10-29 12:02:24 -07:00
parent fa11e82b67
commit 614ee79489
4 changed files with 11 additions and 34 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
cmd/step-pkcs11-init/main.go
View file

@ -335,7 +335,6 @@ func createPKI(k kms.KeyManager, c Config) error {
if err := cm.StoreCertificate(&apiv1.StoreCertificateRequest{
Name: c.RootObject,
Certificate: root,
Extractable: c.Extractable,
}); err != nil {
return err
}
@ -414,7 +413,6 @@ func createPKI(k kms.KeyManager, c Config) error {
if err := cm.StoreCertificate(&apiv1.StoreCertificateRequest{
Name: c.CrtObject,
Certificate: intermediate,
Extractable: c.Extractable,
}); err != nil {
return err
}

14
kms/apiv1/requests.go
View file

@ -100,7 +100,7 @@ type GetPublicKeyRequest struct {
type CreateKeyRequest struct {
// Name represents the key name or label used to identify a key.
//
// Used by: awskms, cloudkms, pkcs11, yubikey.
// Used by: awskms, cloudkms, azurekms, pkcs11, yubikey.
Name string
// SignatureAlgorithm represents the type of key to create.
@ -110,11 +110,13 @@ type CreateKeyRequest struct {
Bits int
// ProtectionLevel specifies how cryptographic operations are performed.
// Used by: cloudkms
// Used by: cloudkms, azurekms
ProtectionLevel ProtectionLevel
// Whether the key may be exported from the HSM under a wrap key.
// Sets the CKA_EXTRACTABLE bit.
// Extractable defines if the new key may be exported from the HSM under a
// wrap key. On pkcs11 sets the CKA_EXTRACTABLE bit.
//
// Used by: pkcs11
Extractable bool
}
@ -156,8 +158,4 @@ type LoadCertificateRequest struct {
type StoreCertificateRequest struct {
Name string
Certificate *x509.Certificate
// Whether the key may be exported from the HSM under a wrap key.
// Sets the CKA_EXTRACTABLE bit.
Extractable bool
}

12
kms/pkcs11/pkcs11.go
View file

@ -32,7 +32,7 @@ const DefaultRSASize = 3072
type P11 interface {
FindKeyPair(id, label []byte) (crypto11.Signer, error)
FindCertificate(id, label []byte, serial *big.Int) (*x509.Certificate, error)
ImportCertificateWithAttributes(template crypto11.AttributeSet, certificate *x509.Certificate) error
ImportCertificateWithLabel(id, label []byte, certificate *x509.Certificate) error
DeleteCertificate(id, label []byte, serial *big.Int) error
GenerateRSAKeyPairWithAttributes(public, private crypto11.AttributeSet, bits int) (crypto11.SignerDecrypter, error)
GenerateECDSAKeyPairWithAttributes(public, private crypto11.AttributeSet, curve elliptic.Curve) (crypto11.Signer, error)
@ -201,15 +201,7 @@ func (k *PKCS11) StoreCertificate(req *apiv1.StoreCertificateRequest) error {
}, "storeCertificate failed")
}
// Import certificate with the necessary attributes.
template, err := crypto11.NewAttributeSetWithIDAndLabel(id, object)
if err != nil {
return errors.Wrap(err, "storeCertificate failed")
}
if req.Extractable {
template.Set(crypto11.CkaExtractable, true)
}
if err := k.p11.ImportCertificateWithAttributes(template, req.Certificate); err != nil {
if err := k.p11.ImportCertificateWithLabel(id, object, req.Certificate); err != nil {
return errors.Wrap(err, "storeCertificate failed")
}

17
kms/pkcs11/pkcs11_test.go
View file

@ -209,13 +209,13 @@ func TestPKCS11_CreateKey(t *testing.T) {
},
}, false},
{"default extractable", args{&apiv1.CreateKeyRequest{
Name: testObject,
Name: testObjectAlt,
Extractable: true,
}}, &apiv1.CreateKeyResponse{
Name: testObject,
Name: testObjectAlt,
PublicKey: &ecdsa.PublicKey{},
CreateSignerRequest: apiv1.CreateSignerRequest{
SigningKey: testObject,
SigningKey: testObjectAlt,
},
}, false},
{"RSA SHA256WithRSA", args{&apiv1.CreateKeyRequest{
@ -573,7 +573,6 @@ func TestPKCS11_StoreCertificate(t *testing.T) {
// Make sure to delete the created certificate
t.Cleanup(func() {
k.DeleteCertificate(testObject)
k.DeleteCertificate(testObjectAlt)
})
type args struct {
@ -588,11 +587,6 @@ func TestPKCS11_StoreCertificate(t *testing.T) {
Name: testObject,
Certificate: cert,
}}, false},
{"ok extractable", args{&apiv1.StoreCertificateRequest{
Name: testObjectAlt,
Certificate: cert,
Extractable: true,
}}, false},
{"fail already exists", args{&apiv1.StoreCertificateRequest{
Name: testObject,
Certificate: cert,
@ -620,11 +614,6 @@ func TestPKCS11_StoreCertificate(t *testing.T) {
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
if tt.args.req.Extractable {
if testModule == "SoftHSM2" {
t.Skip("Extractable certificates are not supported on SoftHSM2")
}
}
if err := k.StoreCertificate(tt.args.req); (err != nil) != tt.wantErr {
t.Errorf("PKCS11.StoreCertificate() error = %v, wantErr %v", err, tt.wantErr)
}