forked from TrueCloudLab/certificates
Rename claim to allowRenewAfterExpiry.
This commit is contained in:
parent
6dcde8a743
commit
c903f00cd4
9 changed files with 72 additions and 64 deletions
|
@ -6,7 +6,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
|
||||||
|
|
||||||
## [Unreleased - 0.18.3] - DATE
|
## [Unreleased - 0.18.3] - DATE
|
||||||
### Added
|
### Added
|
||||||
- Added support for renew after expiry using the claim `enableRenewAfterExpiry`.
|
- Added support for renew after expiry using the claim `allowRenewAfterExpiry`.
|
||||||
### Changed
|
### Changed
|
||||||
### Deprecated
|
### Deprecated
|
||||||
### Removed
|
### Removed
|
||||||
|
|
|
@ -26,8 +26,9 @@ var (
|
||||||
DefaultBackdate = time.Minute
|
DefaultBackdate = time.Minute
|
||||||
// DefaultDisableRenewal disables renewals per provisioner.
|
// DefaultDisableRenewal disables renewals per provisioner.
|
||||||
DefaultDisableRenewal = false
|
DefaultDisableRenewal = false
|
||||||
// DefaultEnableRenewAfterExpiry enables renewals even when the certificate is expired.
|
// DefaultAllowRenewAfterExpiry allows renewals even if the certificate is
|
||||||
DefaultEnableRenewAfterExpiry = false
|
// expired.
|
||||||
|
DefaultAllowRenewAfterExpiry = false
|
||||||
// DefaultEnableSSHCA enable SSH CA features per provisioner or globally
|
// DefaultEnableSSHCA enable SSH CA features per provisioner or globally
|
||||||
// for all provisioners.
|
// for all provisioners.
|
||||||
DefaultEnableSSHCA = false
|
DefaultEnableSSHCA = false
|
||||||
|
@ -45,7 +46,7 @@ var (
|
||||||
DefaultHostSSHDur: &provisioner.Duration{Duration: 30 * 24 * time.Hour},
|
DefaultHostSSHDur: &provisioner.Duration{Duration: 30 * 24 * time.Hour},
|
||||||
EnableSSHCA: &DefaultEnableSSHCA,
|
EnableSSHCA: &DefaultEnableSSHCA,
|
||||||
DisableRenewal: &DefaultDisableRenewal,
|
DisableRenewal: &DefaultDisableRenewal,
|
||||||
EnableRenewAfterExpiry: &DefaultEnableRenewAfterExpiry,
|
AllowRenewAfterExpiry: &DefaultAllowRenewAfterExpiry,
|
||||||
}
|
}
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
|
@ -25,7 +25,7 @@ type Claims struct {
|
||||||
|
|
||||||
// Renewal properties
|
// Renewal properties
|
||||||
DisableRenewal *bool `json:"disableRenewal,omitempty"`
|
DisableRenewal *bool `json:"disableRenewal,omitempty"`
|
||||||
EnableRenewAfterExpiry *bool `json:"enableRenewAfterExpiry,omitempty"`
|
AllowRenewAfterExpiry *bool `json:"allowRenewAfterExpiry,omitempty"`
|
||||||
}
|
}
|
||||||
|
|
||||||
// Claimer is the type that controls claims. It provides an interface around the
|
// Claimer is the type that controls claims. It provides an interface around the
|
||||||
|
@ -44,7 +44,7 @@ func NewClaimer(claims *Claims, global Claims) (*Claimer, error) {
|
||||||
// Claims returns the merge of the inner and global claims.
|
// Claims returns the merge of the inner and global claims.
|
||||||
func (c *Claimer) Claims() Claims {
|
func (c *Claimer) Claims() Claims {
|
||||||
disableRenewal := c.IsDisableRenewal()
|
disableRenewal := c.IsDisableRenewal()
|
||||||
enablerenewAfterExpiry := c.IsRenewAfterExpiry()
|
allowRenewAfterExpiry := c.AllowRenewAfterExpiry()
|
||||||
enableSSHCA := c.IsSSHCAEnabled()
|
enableSSHCA := c.IsSSHCAEnabled()
|
||||||
|
|
||||||
return Claims{
|
return Claims{
|
||||||
|
@ -59,7 +59,7 @@ func (c *Claimer) Claims() Claims {
|
||||||
DefaultHostSSHDur: &Duration{c.DefaultHostSSHCertDuration()},
|
DefaultHostSSHDur: &Duration{c.DefaultHostSSHCertDuration()},
|
||||||
EnableSSHCA: &enableSSHCA,
|
EnableSSHCA: &enableSSHCA,
|
||||||
DisableRenewal: &disableRenewal,
|
DisableRenewal: &disableRenewal,
|
||||||
EnableRenewAfterExpiry: &enablerenewAfterExpiry,
|
AllowRenewAfterExpiry: &allowRenewAfterExpiry,
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -109,14 +109,14 @@ func (c *Claimer) IsDisableRenewal() bool {
|
||||||
return *c.claims.DisableRenewal
|
return *c.claims.DisableRenewal
|
||||||
}
|
}
|
||||||
|
|
||||||
// IsRenewAfterExpiry returns if the renewal flow is authorized even if the
|
// AllowRenewAfterExpiry returns if the renewal flow is authorized if the
|
||||||
// certificate is expired. If the property is not set within the provisioner
|
// certificate is expired. If the property is not set within the provisioner
|
||||||
// then the global value from the authority configuration will be used.
|
// then the global value from the authority configuration will be used.
|
||||||
func (c *Claimer) IsRenewAfterExpiry() bool {
|
func (c *Claimer) AllowRenewAfterExpiry() bool {
|
||||||
if c.claims == nil || c.claims.EnableRenewAfterExpiry == nil {
|
if c.claims == nil || c.claims.AllowRenewAfterExpiry == nil {
|
||||||
return *c.global.EnableRenewAfterExpiry
|
return *c.global.AllowRenewAfterExpiry
|
||||||
}
|
}
|
||||||
return *c.claims.EnableRenewAfterExpiry
|
return *c.claims.AllowRenewAfterExpiry
|
||||||
}
|
}
|
||||||
|
|
||||||
// DefaultSSHCertDuration returns the default SSH certificate duration for the
|
// DefaultSSHCertDuration returns the default SSH certificate duration for the
|
||||||
|
|
|
@ -124,7 +124,7 @@ func DefaultAuthorizeRenew(ctx context.Context, p *Controller, cert *x509.Certif
|
||||||
if now.Before(cert.NotBefore) {
|
if now.Before(cert.NotBefore) {
|
||||||
return errs.Unauthorized("certificate is not yet valid" + " " + now.UTC().Format(time.RFC3339Nano) + " vs " + cert.NotBefore.Format(time.RFC3339Nano))
|
return errs.Unauthorized("certificate is not yet valid" + " " + now.UTC().Format(time.RFC3339Nano) + " vs " + cert.NotBefore.Format(time.RFC3339Nano))
|
||||||
}
|
}
|
||||||
if now.After(cert.NotAfter) && !p.Claimer.IsRenewAfterExpiry() {
|
if now.After(cert.NotAfter) && !p.Claimer.AllowRenewAfterExpiry() {
|
||||||
return errs.Unauthorized("certificate has expired")
|
return errs.Unauthorized("certificate has expired")
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -144,7 +144,7 @@ func DefaultAuthorizeSSHRenew(ctx context.Context, p *Controller, cert *ssh.Cert
|
||||||
if after := int64(cert.ValidAfter); after < 0 || unixNow < int64(cert.ValidAfter) {
|
if after := int64(cert.ValidAfter); after < 0 || unixNow < int64(cert.ValidAfter) {
|
||||||
return errs.Unauthorized("certificate is not yet valid")
|
return errs.Unauthorized("certificate is not yet valid")
|
||||||
}
|
}
|
||||||
if before := int64(cert.ValidBefore); cert.ValidBefore != uint64(ssh.CertTimeInfinity) && (unixNow >= before || before < 0) && !p.Claimer.IsRenewAfterExpiry() {
|
if before := int64(cert.ValidBefore); cert.ValidBefore != uint64(ssh.CertTimeInfinity) && (unixNow >= before || before < 0) && !p.Claimer.AllowRenewAfterExpiry() {
|
||||||
return errs.Unauthorized("certificate has expired")
|
return errs.Unauthorized("certificate has expired")
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -160,13 +160,13 @@ func TestController_AuthorizeRenew(t *testing.T) {
|
||||||
NotBefore: now,
|
NotBefore: now,
|
||||||
NotAfter: now.Add(time.Hour),
|
NotAfter: now.Add(time.Hour),
|
||||||
}}, false},
|
}}, false},
|
||||||
{"ok custom disabled", fields{&JWK{}, mustClaimer(t, &Claims{EnableRenewAfterExpiry: &trueValue}, globalProvisionerClaims), func(ctx context.Context, p *Controller, cert *x509.Certificate) error {
|
{"ok custom disabled", fields{&JWK{}, mustClaimer(t, &Claims{AllowRenewAfterExpiry: &trueValue}, globalProvisionerClaims), func(ctx context.Context, p *Controller, cert *x509.Certificate) error {
|
||||||
return nil
|
return nil
|
||||||
}}, args{ctx, &x509.Certificate{
|
}}, args{ctx, &x509.Certificate{
|
||||||
NotBefore: now,
|
NotBefore: now,
|
||||||
NotAfter: now.Add(time.Hour),
|
NotAfter: now.Add(time.Hour),
|
||||||
}}, false},
|
}}, false},
|
||||||
{"ok renew after expiry", fields{&JWK{}, mustClaimer(t, &Claims{EnableRenewAfterExpiry: &trueValue}, globalProvisionerClaims), nil}, args{ctx, &x509.Certificate{
|
{"ok renew after expiry", fields{&JWK{}, mustClaimer(t, &Claims{AllowRenewAfterExpiry: &trueValue}, globalProvisionerClaims), nil}, args{ctx, &x509.Certificate{
|
||||||
NotBefore: now.Add(-time.Hour),
|
NotBefore: now.Add(-time.Hour),
|
||||||
NotAfter: now.Add(-time.Minute),
|
NotAfter: now.Add(-time.Minute),
|
||||||
}}, false},
|
}}, false},
|
||||||
|
@ -231,13 +231,13 @@ func TestController_AuthorizeSSHRenew(t *testing.T) {
|
||||||
ValidAfter: uint64(now.Unix()),
|
ValidAfter: uint64(now.Unix()),
|
||||||
ValidBefore: uint64(now.Add(time.Hour).Unix()),
|
ValidBefore: uint64(now.Add(time.Hour).Unix()),
|
||||||
}}, false},
|
}}, false},
|
||||||
{"ok custom disabled", fields{&JWK{}, mustClaimer(t, &Claims{EnableRenewAfterExpiry: &trueValue}, globalProvisionerClaims), func(ctx context.Context, p *Controller, cert *ssh.Certificate) error {
|
{"ok custom disabled", fields{&JWK{}, mustClaimer(t, &Claims{AllowRenewAfterExpiry: &trueValue}, globalProvisionerClaims), func(ctx context.Context, p *Controller, cert *ssh.Certificate) error {
|
||||||
return nil
|
return nil
|
||||||
}}, args{ctx, &ssh.Certificate{
|
}}, args{ctx, &ssh.Certificate{
|
||||||
ValidAfter: uint64(now.Unix()),
|
ValidAfter: uint64(now.Unix()),
|
||||||
ValidBefore: uint64(now.Add(time.Hour).Unix()),
|
ValidBefore: uint64(now.Add(time.Hour).Unix()),
|
||||||
}}, false},
|
}}, false},
|
||||||
{"ok renew after expiry", fields{&JWK{}, mustClaimer(t, &Claims{EnableRenewAfterExpiry: &trueValue}, globalProvisionerClaims), nil}, args{ctx, &ssh.Certificate{
|
{"ok renew after expiry", fields{&JWK{}, mustClaimer(t, &Claims{AllowRenewAfterExpiry: &trueValue}, globalProvisionerClaims), nil}, args{ctx, &ssh.Certificate{
|
||||||
ValidAfter: uint64(now.Add(-time.Hour).Unix()),
|
ValidAfter: uint64(now.Add(-time.Hour).Unix()),
|
||||||
ValidBefore: uint64(now.Add(-time.Minute).Unix()),
|
ValidBefore: uint64(now.Add(-time.Minute).Unix()),
|
||||||
}}, false},
|
}}, false},
|
||||||
|
@ -296,7 +296,7 @@ func TestDefaultAuthorizeRenew(t *testing.T) {
|
||||||
}}, false},
|
}}, false},
|
||||||
{"ok renew after expiry", args{ctx, &Controller{
|
{"ok renew after expiry", args{ctx, &Controller{
|
||||||
Interface: &JWK{},
|
Interface: &JWK{},
|
||||||
Claimer: mustClaimer(t, &Claims{EnableRenewAfterExpiry: &trueValue}, globalProvisionerClaims),
|
Claimer: mustClaimer(t, &Claims{AllowRenewAfterExpiry: &trueValue}, globalProvisionerClaims),
|
||||||
}, &x509.Certificate{
|
}, &x509.Certificate{
|
||||||
NotBefore: now.Add(-time.Hour),
|
NotBefore: now.Add(-time.Hour),
|
||||||
NotAfter: now.Add(-time.Minute),
|
NotAfter: now.Add(-time.Minute),
|
||||||
|
@ -354,7 +354,7 @@ func TestDefaultAuthorizeSSHRenew(t *testing.T) {
|
||||||
}}, false},
|
}}, false},
|
||||||
{"ok renew after expiry", args{ctx, &Controller{
|
{"ok renew after expiry", args{ctx, &Controller{
|
||||||
Interface: &JWK{},
|
Interface: &JWK{},
|
||||||
Claimer: mustClaimer(t, &Claims{EnableRenewAfterExpiry: &trueValue}, globalProvisionerClaims),
|
Claimer: mustClaimer(t, &Claims{AllowRenewAfterExpiry: &trueValue}, globalProvisionerClaims),
|
||||||
}, &ssh.Certificate{
|
}, &ssh.Certificate{
|
||||||
ValidAfter: uint64(now.Add(-time.Hour).Unix()),
|
ValidAfter: uint64(now.Add(-time.Hour).Unix()),
|
||||||
ValidBefore: uint64(now.Add(-time.Minute).Unix()),
|
ValidBefore: uint64(now.Add(-time.Minute).Unix()),
|
||||||
|
|
|
@ -25,7 +25,7 @@ import (
|
||||||
|
|
||||||
var (
|
var (
|
||||||
defaultDisableRenewal = false
|
defaultDisableRenewal = false
|
||||||
defaultEnableRenewAfterExpiry = false
|
defaultAllowRenewAfterExpiry = false
|
||||||
defaultEnableSSHCA = true
|
defaultEnableSSHCA = true
|
||||||
globalProvisionerClaims = Claims{
|
globalProvisionerClaims = Claims{
|
||||||
MinTLSDur: &Duration{5 * time.Minute},
|
MinTLSDur: &Duration{5 * time.Minute},
|
||||||
|
@ -39,7 +39,7 @@ var (
|
||||||
DefaultHostSSHDur: &Duration{Duration: 30 * 24 * time.Hour},
|
DefaultHostSSHDur: &Duration{Duration: 30 * 24 * time.Hour},
|
||||||
EnableSSHCA: &defaultEnableSSHCA,
|
EnableSSHCA: &defaultEnableSSHCA,
|
||||||
DisableRenewal: &defaultDisableRenewal,
|
DisableRenewal: &defaultDisableRenewal,
|
||||||
EnableRenewAfterExpiry: &defaultEnableRenewAfterExpiry,
|
AllowRenewAfterExpiry: &defaultAllowRenewAfterExpiry,
|
||||||
}
|
}
|
||||||
testAudiences = Audiences{
|
testAudiences = Audiences{
|
||||||
Sign: []string{"https://ca.smallstep.com/1.0/sign", "https://ca.smallstep.com/sign"},
|
Sign: []string{"https://ca.smallstep.com/1.0/sign", "https://ca.smallstep.com/sign"},
|
||||||
|
|
|
@ -438,6 +438,7 @@ func claimsToCertificates(c *linkedca.Claims) (*provisioner.Claims, error) {
|
||||||
|
|
||||||
pc := &provisioner.Claims{
|
pc := &provisioner.Claims{
|
||||||
DisableRenewal: &c.DisableRenewal,
|
DisableRenewal: &c.DisableRenewal,
|
||||||
|
AllowRenewAfterExpiry: &c.AllowRenewAfterExpiry,
|
||||||
}
|
}
|
||||||
|
|
||||||
var err error
|
var err error
|
||||||
|
@ -475,12 +476,18 @@ func claimsToLinkedca(c *provisioner.Claims) *linkedca.Claims {
|
||||||
}
|
}
|
||||||
|
|
||||||
disableRenewal := config.DefaultDisableRenewal
|
disableRenewal := config.DefaultDisableRenewal
|
||||||
|
allowRenewAfterExpiry := config.DefaultAllowRenewAfterExpiry
|
||||||
|
|
||||||
if c.DisableRenewal != nil {
|
if c.DisableRenewal != nil {
|
||||||
disableRenewal = *c.DisableRenewal
|
disableRenewal = *c.DisableRenewal
|
||||||
}
|
}
|
||||||
|
if c.AllowRenewAfterExpiry != nil {
|
||||||
|
allowRenewAfterExpiry = *c.AllowRenewAfterExpiry
|
||||||
|
}
|
||||||
|
|
||||||
lc := &linkedca.Claims{
|
lc := &linkedca.Claims{
|
||||||
DisableRenewal: disableRenewal,
|
DisableRenewal: disableRenewal,
|
||||||
|
AllowRenewAfterExpiry: allowRenewAfterExpiry,
|
||||||
}
|
}
|
||||||
|
|
||||||
if c.DefaultTLSDur != nil || c.MinTLSDur != nil || c.MaxTLSDur != nil {
|
if c.DefaultTLSDur != nil || c.MinTLSDur != nil || c.MaxTLSDur != nil {
|
||||||
|
|
2
go.mod
2
go.mod
|
@ -35,7 +35,7 @@ require (
|
||||||
go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352
|
go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352
|
||||||
go.step.sm/cli-utils v0.7.0
|
go.step.sm/cli-utils v0.7.0
|
||||||
go.step.sm/crypto v0.15.3
|
go.step.sm/crypto v0.15.3
|
||||||
go.step.sm/linkedca v0.10.0
|
go.step.sm/linkedca v0.11.0
|
||||||
golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3
|
golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3
|
||||||
golang.org/x/net v0.0.0-20220114011407-0dd24b26b47d
|
golang.org/x/net v0.0.0-20220114011407-0dd24b26b47d
|
||||||
golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 // indirect
|
golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 // indirect
|
||||||
|
|
4
go.sum
4
go.sum
|
@ -685,8 +685,8 @@ go.step.sm/cli-utils v0.7.0/go.mod h1:Ur6bqA/yl636kCUJbp30J7Unv5JJ226eW2KqXPDwF/
|
||||||
go.step.sm/crypto v0.9.0/go.mod h1:+CYG05Mek1YDqi5WK0ERc6cOpKly2i/a5aZmU1sfGj0=
|
go.step.sm/crypto v0.9.0/go.mod h1:+CYG05Mek1YDqi5WK0ERc6cOpKly2i/a5aZmU1sfGj0=
|
||||||
go.step.sm/crypto v0.15.3 h1:f3GMl+aCydt294BZRjTYwpaXRqwwndvoTY2NLN4wu10=
|
go.step.sm/crypto v0.15.3 h1:f3GMl+aCydt294BZRjTYwpaXRqwwndvoTY2NLN4wu10=
|
||||||
go.step.sm/crypto v0.15.3/go.mod h1:3G0yQr5lQqfEG0CMYz8apC/qMtjLRQlzflL2AxkcN+g=
|
go.step.sm/crypto v0.15.3/go.mod h1:3G0yQr5lQqfEG0CMYz8apC/qMtjLRQlzflL2AxkcN+g=
|
||||||
go.step.sm/linkedca v0.10.0 h1:+bqymMRulHYkVde4l16FnqFVskoS6HCWJN5Z5cxAqF8=
|
go.step.sm/linkedca v0.11.0 h1:jkG5XDQz9VSz2PH+cGjDvJTwiIziN0SWExTnicWpb8o=
|
||||||
go.step.sm/linkedca v0.10.0/go.mod h1:5uTRjozEGSPAZal9xJqlaD38cvJcLe3o1VAFVjqcORo=
|
go.step.sm/linkedca v0.11.0/go.mod h1:5uTRjozEGSPAZal9xJqlaD38cvJcLe3o1VAFVjqcORo=
|
||||||
go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
|
go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
|
||||||
go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
|
go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
|
||||||
go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
|
go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
|
||||||
|
|
Loading…
Reference in a new issue