Skip to content

Commit 4943ae5

Browse files
marainomaraino
committed
Move TLSOption, TLSVersion, CipherSuites and ASN1DN to certificates.
1 parent 77624c6 commit 4943ae5

12 files changed

+384
-55
lines changed

‎api/api.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ import (
2323
"github.com/smallstep/certificates/authority/provisioner"
2424
"github.com/smallstep/certificates/errs"
2525
"github.com/smallstep/certificates/logging"
26-
"github.com/smallstep/cli/crypto/tlsutil"
2726
)
2827

2928
// Authority is the interface implemented by a CA authority.
@@ -32,7 +31,7 @@ type Authority interface {
3231
// context specifies the Authorize[Sign|Revoke|etc.] method.
3332
Authorize(ctx context.Context, ott string) ([]provisioner.SignOption, error)
3433
AuthorizeSign(ott string) ([]provisioner.SignOption, error)
35-
GetTLSOptions() *tlsutil.TLSOptions
34+
GetTLSOptions() *authority.TLSOptions
3635
Root(shasum string) (*x509.Certificate, error)
3736
Sign(cr *x509.CertificateRequest, opts provisioner.SignOptions, signOpts ...provisioner.SignOption) ([]*x509.Certificate, error)
3837
Renew(peer *x509.Certificate) ([]*x509.Certificate, error)

‎api/api_test.go

+6-7
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@ import (
3232
"github.com/smallstep/certificates/errs"
3333
"github.com/smallstep/certificates/logging"
3434
"github.com/smallstep/certificates/templates"
35-
"github.com/smallstep/cli/crypto/tlsutil"
3635
"github.com/smallstep/cli/jose"
3736
"golang.org/x/crypto/ssh"
3837
)
@@ -547,7 +546,7 @@ type mockAuthority struct {
547546
ret1, ret2 interface{}
548547
err error
549548
authorizeSign func(ott string) ([]provisioner.SignOption, error)
550-
getTLSOptions func() *tlsutil.TLSOptions
549+
getTLSOptions func() *authority.TLSOptions
551550
root func(shasum string) (*x509.Certificate, error)
552551
sign func(cr *x509.CertificateRequest, opts provisioner.SignOptions, signOpts ...provisioner.SignOption) ([]*x509.Certificate, error)
553552
renew func(cert *x509.Certificate) ([]*x509.Certificate, error)
@@ -584,11 +583,11 @@ func (m *mockAuthority) AuthorizeSign(ott string) ([]provisioner.SignOption, err
584583
return m.ret1.([]provisioner.SignOption), m.err
585584
}
586585

587-
func (m *mockAuthority) GetTLSOptions() *tlsutil.TLSOptions {
586+
func (m *mockAuthority) GetTLSOptions() *authority.TLSOptions {
588587
if m.getTLSOptions != nil {
589588
return m.getTLSOptions()
590589
}
591-
return m.ret1.(*tlsutil.TLSOptions)
590+
return m.ret1.(*authority.TLSOptions)
592591
}
593592

594593
func (m *mockAuthority) Root(shasum string) (*x509.Certificate, error) {
@@ -881,7 +880,7 @@ func Test_caHandler_Sign(t *testing.T) {
881880
authorizeSign: func(ott string) ([]provisioner.SignOption, error) {
882881
return tt.certAttrOpts, tt.autherr
883882
},
884-
getTLSOptions: func() *tlsutil.TLSOptions {
883+
getTLSOptions: func() *authority.TLSOptions {
885884
return nil
886885
},
887886
}).(*caHandler)
@@ -932,7 +931,7 @@ func Test_caHandler_Renew(t *testing.T) {
932931
t.Run(tt.name, func(t *testing.T) {
933932
h := New(&mockAuthority{
934933
ret1: tt.cert, ret2: tt.root, err: tt.err,
935-
getTLSOptions: func() *tlsutil.TLSOptions {
934+
getTLSOptions: func() *authority.TLSOptions {
936935
return nil
937936
},
938937
}).(*caHandler)
@@ -993,7 +992,7 @@ func Test_caHandler_Rekey(t *testing.T) {
993992
t.Run(tt.name, func(t *testing.T) {
994993
h := New(&mockAuthority{
995994
ret1: tt.cert, ret2: tt.root, err: tt.err,
996-
getTLSOptions: func() *tlsutil.TLSOptions {
995+
getTLSOptions: func() *authority.TLSOptions {
997996
return nil
998997
},
999998
}).(*caHandler)

‎api/sign.go

+6-6
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ import (
55
"encoding/json"
66
"net/http"
77

8+
"github.com/smallstep/certificates/authority"
89
"github.com/smallstep/certificates/authority/provisioner"
910
"github.com/smallstep/certificates/errs"
10-
"github.com/smallstep/cli/crypto/tlsutil"
1111
)
1212

1313
// SignRequest is the request body for a certificate signature request.
@@ -37,11 +37,11 @@ func (s *SignRequest) Validate() error {
3737

3838
// SignResponse is the response object of the certificate signature request.
3939
type SignResponse struct {
40-
ServerPEM Certificate `json:"crt"`
41-
CaPEM Certificate `json:"ca"`
42-
CertChainPEM []Certificate `json:"certChain"`
43-
TLSOptions *tlsutil.TLSOptions `json:"tlsOptions,omitempty"`
44-
TLS *tls.ConnectionState `json:"-"`
40+
ServerPEM Certificate `json:"crt"`
41+
CaPEM Certificate `json:"ca"`
42+
CertChainPEM []Certificate `json:"certChain"`
43+
TLSOptions *authority.TLSOptions `json:"tlsOptions,omitempty"`
44+
TLS *tls.ConnectionState `json:"-"`
4545
}
4646

4747
// Sign is an HTTP handler that reads a certificate request and an

‎authority/config.go

+17-7
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,13 @@ import (
1212
"github.com/smallstep/certificates/db"
1313
kms "github.com/smallstep/certificates/kms/apiv1"
1414
"github.com/smallstep/certificates/templates"
15-
"github.com/smallstep/cli/crypto/tlsutil"
16-
"github.com/smallstep/cli/crypto/x509util"
1715
)
1816

1917
var (
2018
// DefaultTLSOptions represents the default TLS version as well as the cipher
2119
// suites used in the TLS certificates.
22-
DefaultTLSOptions = tlsutil.TLSOptions{
23-
CipherSuites: x509util.CipherSuites{
20+
DefaultTLSOptions = TLSOptions{
21+
CipherSuites: CipherSuites{
2422
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
2523
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
2624
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
@@ -61,15 +59,27 @@ type Config struct {
6159
DB *db.Config `json:"db,omitempty"`
6260
Monitoring json.RawMessage `json:"monitoring,omitempty"`
6361
AuthorityConfig *AuthConfig `json:"authority,omitempty"`
64-
TLS *tlsutil.TLSOptions `json:"tls,omitempty"`
62+
TLS *TLSOptions `json:"tls,omitempty"`
6563
Password string `json:"password,omitempty"`
6664
Templates *templates.Templates `json:"templates,omitempty"`
6765
}
6866

67+
// ASN1DN contains ASN1.DN attributes that are used in Subject and Issuer
68+
// x509 Certificate blocks.
69+
type ASN1DN struct {
70+
Country string `json:"country,omitempty" step:"country"`
71+
Organization string `json:"organization,omitempty" step:"organization"`
72+
OrganizationalUnit string `json:"organizationalUnit,omitempty" step:"organizationalUnit"`
73+
Locality string `json:"locality,omitempty" step:"locality"`
74+
Province string `json:"province,omitempty" step:"province"`
75+
StreetAddress string `json:"streetAddress,omitempty" step:"streetAddress"`
76+
CommonName string `json:"commonName,omitempty" step:"commonName"`
77+
}
78+
6979
// AuthConfig represents the configuration options for the authority.
7080
type AuthConfig struct {
7181
Provisioners provisioner.List `json:"provisioners"`
72-
Template *x509util.ASN1DN `json:"template,omitempty"`
82+
Template *ASN1DN `json:"template,omitempty"`
7383
Claims *provisioner.Claims `json:"claims,omitempty"`
7484
DisableIssuedAtCheck bool `json:"disableIssuedAtCheck,omitempty"`
7585
Backdate *provisioner.Duration `json:"backdate,omitempty"`
@@ -82,7 +92,7 @@ func (c *AuthConfig) init() {
8292
c.Provisioners = provisioner.List{}
8393
}
8494
if c.Template == nil {
85-
c.Template = &x509util.ASN1DN{}
95+
c.Template = &ASN1DN{}
8696
}
8797
if c.Backdate == nil {
8898
c.Backdate = &provisioner.Duration{

‎authority/config_test.go

+12-14
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,6 @@ import (
77
"github.com/pkg/errors"
88
"github.com/smallstep/assert"
99
"github.com/smallstep/certificates/authority/provisioner"
10-
"github.com/smallstep/cli/crypto/tlsutil"
11-
"github.com/smallstep/cli/crypto/x509util"
1210
stepJOSE "github.com/smallstep/cli/jose"
1311
)
1412

@@ -35,7 +33,7 @@ func TestConfigValidate(t *testing.T) {
3533
type ConfigValidateTest struct {
3634
config *Config
3735
err error
38-
tls tlsutil.TLSOptions
36+
tls TLSOptions
3937
}
4038
tests := map[string]func(*testing.T) ConfigValidateTest{
4139
"empty-address": func(t *testing.T) ConfigValidateTest {
@@ -141,7 +139,7 @@ func TestConfigValidate(t *testing.T) {
141139
DNSNames: []string{"test.smallstep.com"},
142140
Password: "pass",
143141
AuthorityConfig: ac,
144-
TLS: &tlsutil.TLSOptions{},
142+
TLS: &TLSOptions{},
145143
},
146144
tls: DefaultTLSOptions,
147145
}
@@ -156,17 +154,17 @@ func TestConfigValidate(t *testing.T) {
156154
DNSNames: []string{"test.smallstep.com"},
157155
Password: "pass",
158156
AuthorityConfig: ac,
159-
TLS: &tlsutil.TLSOptions{
160-
CipherSuites: x509util.CipherSuites{
157+
TLS: &TLSOptions{
158+
CipherSuites: CipherSuites{
161159
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
162160
},
163161
MinVersion: 1.0,
164162
MaxVersion: 1.1,
165163
Renegotiation: true,
166164
},
167165
},
168-
tls: tlsutil.TLSOptions{
169-
CipherSuites: x509util.CipherSuites{
166+
tls: TLSOptions{
167+
CipherSuites: CipherSuites{
170168
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
171169
},
172170
MinVersion: 1.0,
@@ -185,8 +183,8 @@ func TestConfigValidate(t *testing.T) {
185183
DNSNames: []string{"test.smallstep.com"},
186184
Password: "pass",
187185
AuthorityConfig: ac,
188-
TLS: &tlsutil.TLSOptions{
189-
CipherSuites: x509util.CipherSuites{
186+
TLS: &TLSOptions{
187+
CipherSuites: CipherSuites{
190188
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
191189
},
192190
MinVersion: 1.2,
@@ -217,7 +215,7 @@ func TestConfigValidate(t *testing.T) {
217215
}
218216

219217
func TestAuthConfigValidate(t *testing.T) {
220-
asn1dn := x509util.ASN1DN{
218+
asn1dn := ASN1DN{
221219
Country: "Tazmania",
222220
Organization: "Acme Co",
223221
Locality: "Landscapes",
@@ -245,7 +243,7 @@ func TestAuthConfigValidate(t *testing.T) {
245243

246244
type AuthConfigValidateTest struct {
247245
ac *AuthConfig
248-
asn1dn x509util.ASN1DN
246+
asn1dn ASN1DN
249247
err error
250248
}
251249
tests := map[string]func(*testing.T) AuthConfigValidateTest{
@@ -258,15 +256,15 @@ func TestAuthConfigValidate(t *testing.T) {
258256
"ok-empty-provisioners": func(t *testing.T) AuthConfigValidateTest {
259257
return AuthConfigValidateTest{
260258
ac: &AuthConfig{},
261-
asn1dn: x509util.ASN1DN{},
259+
asn1dn: ASN1DN{},
262260
}
263261
},
264262
"ok-empty-asn1dn-template": func(t *testing.T) AuthConfigValidateTest {
265263
return AuthConfigValidateTest{
266264
ac: &AuthConfig{
267265
Provisioners: p,
268266
},
269-
asn1dn: x509util.ASN1DN{},
267+
asn1dn: ASN1DN{},
270268
}
271269
},
272270
"ok-custom-asn1dn": func(t *testing.T) AuthConfigValidateTest {

‎authority/tls.go

+2-3
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,20 @@ import (
1717
"github.com/smallstep/certificates/db"
1818
"github.com/smallstep/certificates/errs"
1919
"github.com/smallstep/cli/crypto/pemutil"
20-
"github.com/smallstep/cli/crypto/tlsutil"
2120
x509legacy "github.com/smallstep/cli/crypto/x509util"
2221
"github.com/smallstep/cli/jose"
2322
"go.step.sm/crypto/x509util"
2423
)
2524

2625
// GetTLSOptions returns the tls options configured.
27-
func (a *Authority) GetTLSOptions() *tlsutil.TLSOptions {
26+
func (a *Authority) GetTLSOptions() *TLSOptions {
2827
return a.config.TLS
2928
}
3029

3130
var oidAuthorityKeyIdentifier = asn1.ObjectIdentifier{2, 5, 29, 35}
3231
var oidSubjectKeyIdentifier = asn1.ObjectIdentifier{2, 5, 29, 14}
3332

34-
func withDefaultASN1DN(def *x509legacy.ASN1DN) provisioner.CertificateModifierFunc {
33+
func withDefaultASN1DN(def *ASN1DN) provisioner.CertificateModifierFunc {
3534
return func(crt *x509.Certificate, opts provisioner.SignOptions) error {
3635
if def == nil {
3736
return errors.New("default ASN1DN template cannot be nil")

0 commit comments

Comments
 (0)