Skip to content

Commit a97ea87

Browse files
marainomaraino
committed
Move options to provisioner so we can set the duration of the cert.
1 parent aa8385b commit a97ea87

File tree

6 files changed

+35
-44
lines changed

6 files changed

+35
-44
lines changed

‎api/api.go

+5-6
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ import (
1818

1919
"github.com/go-chi/chi"
2020
"github.com/pkg/errors"
21-
"github.com/smallstep/certificates/authority"
2221
"github.com/smallstep/certificates/authority/provisioner"
2322
"github.com/smallstep/certificates/logging"
2423
"github.com/smallstep/cli/crypto/tlsutil"
@@ -29,7 +28,7 @@ type Authority interface {
2928
Authorize(ott string) ([]provisioner.SignOption, error)
3029
GetTLSOptions() *tlsutil.TLSOptions
3130
Root(shasum string) (*x509.Certificate, error)
32-
Sign(cr *x509.CertificateRequest, signOpts authority.SignOptions, extraOpts ...provisioner.SignOption) (*x509.Certificate, *x509.Certificate, error)
31+
Sign(cr *x509.CertificateRequest, opts provisioner.Options, signOpts ...provisioner.SignOption) (*x509.Certificate, *x509.Certificate, error)
3332
Renew(peer *x509.Certificate) (*x509.Certificate, *x509.Certificate, error)
3433
GetProvisioners(cursor string, limit int) (provisioner.List, string, error)
3534
GetEncryptedKey(kid string) (string, error)
@@ -166,7 +165,7 @@ type ProvisionersResponse struct {
166165
NextCursor string `json:"nextCursor"`
167166
}
168167

169-
// ProvisionerKeyResponse is the response object that returns the encryptoed key
168+
// ProvisionerKeyResponse is the response object that returns the encrypted key
170169
// of a provisioner.
171170
type ProvisionerKeyResponse struct {
172171
Key string `json:"key"`
@@ -267,18 +266,18 @@ func (h *caHandler) Sign(w http.ResponseWriter, r *http.Request) {
267266
return
268267
}
269268

270-
signOpts := authority.SignOptions{
269+
opts := provisioner.Options{
271270
NotBefore: body.NotBefore,
272271
NotAfter: body.NotAfter,
273272
}
274273

275-
extraOpts, err := h.Authority.Authorize(body.OTT)
274+
signOpts, err := h.Authority.Authorize(body.OTT)
276275
if err != nil {
277276
WriteError(w, Unauthorized(err))
278277
return
279278
}
280279

281-
cert, root, err := h.Authority.Sign(body.CsrPEM.CertificateRequest, signOpts, extraOpts...)
280+
cert, root, err := h.Authority.Sign(body.CsrPEM.CertificateRequest, opts, signOpts...)
282281
if err != nil {
283282
WriteError(w, Forbidden(err))
284283
return

‎api/api_test.go

+3-4
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ import (
2424
"time"
2525

2626
"github.com/go-chi/chi"
27-
"github.com/smallstep/certificates/authority"
2827
"github.com/smallstep/certificates/authority/provisioner"
2928
"github.com/smallstep/certificates/logging"
3029
"github.com/smallstep/cli/crypto/tlsutil"
@@ -414,7 +413,7 @@ type mockAuthority struct {
414413
authorize func(ott string) ([]provisioner.SignOption, error)
415414
getTLSOptions func() *tlsutil.TLSOptions
416415
root func(shasum string) (*x509.Certificate, error)
417-
sign func(cr *x509.CertificateRequest, signOpts authority.SignOptions, extraOpts ...provisioner.SignOption) (*x509.Certificate, *x509.Certificate, error)
416+
sign func(cr *x509.CertificateRequest, opts provisioner.Options, signOpts ...provisioner.SignOption) (*x509.Certificate, *x509.Certificate, error)
418417
renew func(cert *x509.Certificate) (*x509.Certificate, *x509.Certificate, error)
419418
getProvisioners func(nextCursor string, limit int) (provisioner.List, string, error)
420419
getEncryptedKey func(kid string) (string, error)
@@ -443,9 +442,9 @@ func (m *mockAuthority) Root(shasum string) (*x509.Certificate, error) {
443442
return m.ret1.(*x509.Certificate), m.err
444443
}
445444

446-
func (m *mockAuthority) Sign(cr *x509.CertificateRequest, signOpts authority.SignOptions, extraOpts ...provisioner.SignOption) (*x509.Certificate, *x509.Certificate, error) {
445+
func (m *mockAuthority) Sign(cr *x509.CertificateRequest, opts provisioner.Options, signOpts ...provisioner.SignOption) (*x509.Certificate, *x509.Certificate, error) {
447446
if m.sign != nil {
448-
return m.sign(cr, signOpts, extraOpts...)
447+
return m.sign(cr, opts, signOpts...)
449448
}
450449
return m.ret1.(*x509.Certificate), m.ret2.(*x509.Certificate), m.err
451450
}

‎authority/provisioner/jwk.go

+3-20
Original file line numberDiff line numberDiff line change
@@ -105,16 +105,14 @@ func (p *JWK) Authorize(token string) ([]SignOption, error) {
105105
return nil, err
106106
}
107107

108-
signOps := []SignOption{
108+
return []SignOption{
109109
commonNameValidator(claims.Subject),
110110
dnsNamesValidator(dnsNames),
111111
ipAddressesValidator(ips),
112-
// profileWithOption(x509util.WithNotBeforeAfterDuration(so.NotBefore, so.NotAfter, p.Claims.DefaultTLSCertDuration())),
112+
profileDefaultDuration(p.Claims.DefaultTLSCertDuration()),
113113
newProvisionerExtensionOption(TypeJWK, p.Name, p.Key.KeyID),
114114
newValidityValidator(p.Claims.MinTLSCertDuration(), p.Claims.MaxTLSCertDuration()),
115-
}
116-
117-
return signOps, nil
115+
}, nil
118116
}
119117

120118
// AuthorizeRenewal returns an error if the renewal is disabled.
@@ -130,18 +128,3 @@ func (p *JWK) AuthorizeRenewal(cert *x509.Certificate) error {
130128
func (p *JWK) AuthorizeRevoke(token string) error {
131129
return errors.New("not implemented")
132130
}
133-
134-
// // getTLSApps returns a list of modifiers and validators that will be applied to
135-
// // the certificate.
136-
// func (p *JWT) getTLSApps(so SignOptions) ([]x509util.WithOption, []certClaim, error) {
137-
// c := p.Claims
138-
// return []x509util.WithOption{
139-
// x509util.WithNotBeforeAfterDuration(so.NotBefore, so.NotAfter, c.DefaultTLSCertDuration()),
140-
// withProvisionerOID(p.Name, p.Key.KeyID),
141-
// }, []certClaim{
142-
// &certTemporalClaim{
143-
// min: c.MinTLSCertDuration(),
144-
// max: c.MaxTLSCertDuration(),
145-
// },
146-
// }, nil
147-
// }

‎authority/provisioner/oidc.go

+1
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,7 @@ func (o *OIDC) Authorize(token string) ([]SignOption, error) {
156156

157157
return []SignOption{
158158
emailOnlyIdentity(claims.Email),
159+
profileDefaultDuration(o.Claims.DefaultTLSCertDuration()),
159160
newProvisionerExtensionOption(TypeOIDC, o.Name, o.ClientID),
160161
newValidityValidator(o.Claims.MinTLSCertDuration(), o.Claims.MaxTLSCertDuration()),
161162
}, nil

‎authority/provisioner/sign_options.go

+20-4
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,12 @@ import (
1212
"github.com/smallstep/cli/crypto/x509util"
1313
)
1414

15+
// Options contains the options that can be passed to the Sign method.
16+
type Options struct {
17+
NotAfter time.Time `json:"notAfter"`
18+
NotBefore time.Time `json:"notBefore"`
19+
}
20+
1521
// SignOption is the interface used to collect all extra options used in the
1622
// Sign method.
1723
type SignOption interface{}
@@ -29,19 +35,29 @@ type CertificateRequestValidator interface {
2935
Valid(req *x509.CertificateRequest) error
3036
}
3137

32-
// ProfileWithOption is the interface used to add custom options to the profile
38+
// ProfileModifier is the interface used to add custom options to the profile
3339
// constructor. The options are used to modify the final certificate.
34-
type ProfileWithOption interface {
40+
type ProfileModifier interface {
3541
SignOption
36-
Option() x509util.WithOption
42+
Option(so SignOption) x509util.WithOption
3743
}
3844

45+
// profileWithOption is a wrapper against x509util.WithOption to conform the
46+
// interface.
3947
type profileWithOption x509util.WithOption
4048

41-
func (v profileWithOption) Option() x509util.WithOption {
49+
func (v profileWithOption) Option(Options) x509util.WithOption {
4250
return x509util.WithOption(v)
4351
}
4452

53+
// profileDefaultDuration is a wrapper against x509util.WithOption to conform the
54+
// interface.
55+
type profileDefaultDuration time.Duration
56+
57+
func (v profileDefaultDuration) Option(so Options) x509util.WithOption {
58+
return x509util.WithNotBeforeAfterDuration(so.NotBefore, so.NotAfter, time.Duration(v))
59+
}
60+
4561
// emailOnlyIdentity is a CertificateRequestValidator that checks that the only
4662
// SAN provided is the given email address.
4763
type emailOnlyIdentity string

‎authority/tls.go

+3-10
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,6 @@ func (a *Authority) GetTLSOptions() *tlsutil.TLSOptions {
2323
return a.config.TLS
2424
}
2525

26-
// SignOptions contains the options that can be passed to the Authority.Sign
27-
// method.
28-
type SignOptions struct {
29-
NotAfter time.Time `json:"notAfter"`
30-
NotBefore time.Time `json:"notBefore"`
31-
}
32-
3326
var (
3427
stepOIDRoot = asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 37476, 9000, 64}
3528
stepOIDProvisioner = append(asn1.ObjectIdentifier(nil), append(stepOIDRoot, 1)...)
@@ -97,7 +90,7 @@ func withDefaultASN1DN(def *x509util.ASN1DN) x509util.WithOption {
9790
}
9891

9992
// Sign creates a signed certificate from a certificate signing request.
100-
func (a *Authority) Sign(csr *x509.CertificateRequest, signOpts SignOptions, extraOpts ...provisioner.SignOption) (*x509.Certificate, *x509.Certificate, error) {
93+
func (a *Authority) Sign(csr *x509.CertificateRequest, signOpts provisioner.Options, extraOpts ...provisioner.SignOption) (*x509.Certificate, *x509.Certificate, error) {
10194
var (
10295
errContext = context{"csr": csr, "signOptions": signOpts}
10396
mods = []x509util.WithOption{}
@@ -111,8 +104,8 @@ func (a *Authority) Sign(csr *x509.CertificateRequest, signOpts SignOptions, ext
111104
if err := k.Valid(csr); err != nil {
112105
return nil, nil, err
113106
}
114-
case provisioner.ProfileWithOption:
115-
mods = append(mods, k.Option())
107+
case provisioner.ProfileModifier:
108+
mods = append(mods, k.Option(signOpts))
116109
default:
117110
return nil, nil, &apiError{errors.Errorf("sign: invalid extra option type %T", k),
118111
http.StatusInternalServerError, errContext}

0 commit comments

Comments
 (0)