Skip to content

Commit e83e47a

Browse files
marainomaraino
committed
Use sshutil and randutil from go.step.sm/crypto.
1 parent ce1eb0a commit e83e47a

28 files changed

+72
-59
lines changed

‎acme/common.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ import (
88

99
"github.com/pkg/errors"
1010
"github.com/smallstep/certificates/authority/provisioner"
11-
"github.com/smallstep/cli/crypto/randutil"
1211
"github.com/smallstep/cli/jose"
12+
"go.step.sm/crypto/randutil"
1313
)
1414

1515
// Provisioner is an interface that implements a subset of the provisioner.Interface --

‎api/api_test.go

+3-4
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ import (
3131
"github.com/smallstep/certificates/authority/provisioner"
3232
"github.com/smallstep/certificates/errs"
3333
"github.com/smallstep/certificates/logging"
34-
"github.com/smallstep/certificates/sshutil"
3534
"github.com/smallstep/certificates/templates"
3635
"github.com/smallstep/cli/crypto/tlsutil"
3736
"github.com/smallstep/cli/jose"
@@ -564,7 +563,7 @@ type mockAuthority struct {
564563
signSSHAddUser func(ctx context.Context, key ssh.PublicKey, cert *ssh.Certificate) (*ssh.Certificate, error)
565564
renewSSH func(ctx context.Context, cert *ssh.Certificate) (*ssh.Certificate, error)
566565
rekeySSH func(ctx context.Context, cert *ssh.Certificate, key ssh.PublicKey, signOpts ...provisioner.SignOption) (*ssh.Certificate, error)
567-
getSSHHosts func(ctx context.Context, cert *x509.Certificate) ([]sshutil.Host, error)
566+
getSSHHosts func(ctx context.Context, cert *x509.Certificate) ([]authority.Host, error)
568567
getSSHRoots func(ctx context.Context) (*authority.SSHKeys, error)
569568
getSSHFederation func(ctx context.Context) (*authority.SSHKeys, error)
570569
getSSHConfig func(ctx context.Context, typ string, data map[string]string) ([]templates.Output, error)
@@ -697,11 +696,11 @@ func (m *mockAuthority) RekeySSH(ctx context.Context, cert *ssh.Certificate, key
697696
return m.ret1.(*ssh.Certificate), m.err
698697
}
699698

700-
func (m *mockAuthority) GetSSHHosts(ctx context.Context, cert *x509.Certificate) ([]sshutil.Host, error) {
699+
func (m *mockAuthority) GetSSHHosts(ctx context.Context, cert *x509.Certificate) ([]authority.Host, error) {
701700
if m.getSSHHosts != nil {
702701
return m.getSSHHosts(ctx, cert)
703702
}
704-
return m.ret1.([]sshutil.Host), m.err
703+
return m.ret1.([]authority.Host), m.err
705704
}
706705

707706
func (m *mockAuthority) GetSSHRoots(ctx context.Context) (*authority.SSHKeys, error) {

‎api/ssh.go

+2-3
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ import (
1212
"github.com/smallstep/certificates/authority"
1313
"github.com/smallstep/certificates/authority/provisioner"
1414
"github.com/smallstep/certificates/errs"
15-
"github.com/smallstep/certificates/sshutil"
1615
"github.com/smallstep/certificates/templates"
1716
"golang.org/x/crypto/ssh"
1817
)
@@ -27,7 +26,7 @@ type SSHAuthority interface {
2726
GetSSHFederation(ctx context.Context) (*authority.SSHKeys, error)
2827
GetSSHConfig(ctx context.Context, typ string, data map[string]string) ([]templates.Output, error)
2928
CheckSSHHost(ctx context.Context, principal string, token string) (bool, error)
30-
GetSSHHosts(ctx context.Context, cert *x509.Certificate) ([]sshutil.Host, error)
29+
GetSSHHosts(ctx context.Context, cert *x509.Certificate) ([]authority.Host, error)
3130
GetSSHBastion(ctx context.Context, user string, hostname string) (*authority.Bastion, error)
3231
}
3332

@@ -87,7 +86,7 @@ type SSHCertificate struct {
8786
// SSHGetHostsResponse is the response object that returns the list of valid
8887
// hosts for SSH.
8988
type SSHGetHostsResponse struct {
90-
Hosts []sshutil.Host `json:"hosts"`
89+
Hosts []authority.Host `json:"hosts"`
9190
}
9291

9392
// MarshalJSON implements the json.Marshaler interface. Returns a quoted,

‎api/ssh_test.go

+6-7
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ import (
2222
"github.com/smallstep/certificates/authority"
2323
"github.com/smallstep/certificates/authority/provisioner"
2424
"github.com/smallstep/certificates/logging"
25-
"github.com/smallstep/certificates/sshutil"
2625
"github.com/smallstep/certificates/templates"
2726
"golang.org/x/crypto/ssh"
2827
)
@@ -569,29 +568,29 @@ func Test_caHandler_SSHCheckHost(t *testing.T) {
569568
}
570569

571570
func Test_caHandler_SSHGetHosts(t *testing.T) {
572-
hosts := []sshutil.Host{
573-
{HostID: "1", HostTags: []sshutil.HostTag{{ID: "1", Name: "group", Value: "1"}}, Hostname: "host1"},
574-
{HostID: "2", HostTags: []sshutil.HostTag{{ID: "1", Name: "group", Value: "1"}, {ID: "2", Name: "group", Value: "2"}}, Hostname: "host2"},
571+
hosts := []authority.Host{
572+
{HostID: "1", HostTags: []authority.HostTag{{ID: "1", Name: "group", Value: "1"}}, Hostname: "host1"},
573+
{HostID: "2", HostTags: []authority.HostTag{{ID: "1", Name: "group", Value: "1"}, {ID: "2", Name: "group", Value: "2"}}, Hostname: "host2"},
575574
}
576575
hostsJSON, err := json.Marshal(hosts)
577576
assert.FatalError(t, err)
578577

579578
tests := []struct {
580579
name string
581-
hosts []sshutil.Host
580+
hosts []authority.Host
582581
err error
583582
body []byte
584583
statusCode int
585584
}{
586585
{"ok", hosts, nil, []byte(fmt.Sprintf(`{"hosts":%s}`, hostsJSON)), http.StatusOK},
587-
{"empty (array)", []sshutil.Host{}, nil, []byte(`{"hosts":[]}`), http.StatusOK},
586+
{"empty (array)", []authority.Host{}, nil, []byte(`{"hosts":[]}`), http.StatusOK},
588587
{"empty (nil)", nil, nil, []byte(`{"hosts":null}`), http.StatusOK},
589588
{"error", nil, fmt.Errorf("an error"), nil, http.StatusInternalServerError},
590589
}
591590
for _, tt := range tests {
592591
t.Run(tt.name, func(t *testing.T) {
593592
h := New(&mockAuthority{
594-
getSSHHosts: func(context.Context, *x509.Certificate) ([]sshutil.Host, error) {
593+
getSSHHosts: func(context.Context, *x509.Certificate) ([]authority.Host, error) {
595594
return tt.hosts, tt.err
596595
},
597596
}).(*caHandler)

‎authority/authority.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@ import (
1515
"github.com/smallstep/certificates/db"
1616
"github.com/smallstep/certificates/kms"
1717
kmsapi "github.com/smallstep/certificates/kms/apiv1"
18-
"github.com/smallstep/certificates/sshutil"
1918
"github.com/smallstep/certificates/templates"
2019
"github.com/smallstep/cli/crypto/pemutil"
2120
"golang.org/x/crypto/ssh"
@@ -55,7 +54,7 @@ type Authority struct {
5554
// Custom functions
5655
sshBastionFunc func(ctx context.Context, user, hostname string) (*Bastion, error)
5756
sshCheckHostFunc func(ctx context.Context, principal string, tok string, roots []*x509.Certificate) (bool, error)
58-
sshGetHostsFunc func(ctx context.Context, cert *x509.Certificate) ([]sshutil.Host, error)
57+
sshGetHostsFunc func(ctx context.Context, cert *x509.Certificate) ([]Host, error)
5958
getIdentityFunc provisioner.GetIdentityFunc
6059
}
6160

‎authority/authorize_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ import (
1818
"github.com/smallstep/certificates/db"
1919
"github.com/smallstep/certificates/errs"
2020
"github.com/smallstep/cli/crypto/pemutil"
21-
"github.com/smallstep/cli/crypto/randutil"
2221
"github.com/smallstep/cli/jose"
22+
"go.step.sm/crypto/randutil"
2323
"golang.org/x/crypto/ssh"
2424
"gopkg.in/square/go-jose.v2/jwt"
2525
)

‎authority/options.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ import (
1010
"github.com/smallstep/certificates/authority/provisioner"
1111
"github.com/smallstep/certificates/db"
1212
"github.com/smallstep/certificates/kms"
13-
"github.com/smallstep/certificates/sshutil"
1413
"golang.org/x/crypto/ssh"
1514
)
1615

@@ -64,7 +63,7 @@ func WithSSHBastionFunc(fn func(ctx context.Context, user, host string) (*Bastio
6463

6564
// WithSSHGetHosts sets a custom function to get the bastion for a
6665
// given user-host pair.
67-
func WithSSHGetHosts(fn func(ctx context.Context, cert *x509.Certificate) ([]sshutil.Host, error)) Option {
66+
func WithSSHGetHosts(fn func(ctx context.Context, cert *x509.Certificate) ([]Host, error)) Option {
6867
return func(a *Authority) error {
6968
a.sshGetHostsFunc = fn
7069
return nil

‎authority/provisioner/aws.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@ import (
1717

1818
"github.com/pkg/errors"
1919
"github.com/smallstep/certificates/errs"
20-
"github.com/smallstep/certificates/sshutil"
2120
"github.com/smallstep/cli/jose"
21+
"go.step.sm/crypto/sshutil"
2222
"go.step.sm/crypto/x509util"
2323
)
2424

@@ -497,7 +497,7 @@ func (p *AWS) AuthorizeSSHSign(ctx context.Context, token string) ([]SignOption,
497497
data.SetToken(v)
498498
}
499499

500-
templateOptions, err := CustomSSHTemplateOptions(p.Options, data, sshutil.DefaultIIDCertificate)
500+
templateOptions, err := CustomSSHTemplateOptions(p.Options, data, sshutil.DefaultIIDTemplate)
501501
if err != nil {
502502
return nil, errs.Wrap(http.StatusInternalServerError, err, "aws.AuthorizeSSHSign")
503503
}

‎authority/provisioner/azure.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@ import (
1414

1515
"github.com/pkg/errors"
1616
"github.com/smallstep/certificates/errs"
17-
"github.com/smallstep/certificates/sshutil"
1817
"github.com/smallstep/cli/jose"
18+
"go.step.sm/crypto/sshutil"
1919
"go.step.sm/crypto/x509util"
2020
)
2121

@@ -366,7 +366,7 @@ func (p *Azure) AuthorizeSSHSign(ctx context.Context, token string) ([]SignOptio
366366
data.SetToken(v)
367367
}
368368

369-
templateOptions, err := CustomSSHTemplateOptions(p.Options, data, sshutil.DefaultIIDCertificate)
369+
templateOptions, err := CustomSSHTemplateOptions(p.Options, data, sshutil.DefaultIIDTemplate)
370370
if err != nil {
371371
return nil, errs.Wrap(http.StatusInternalServerError, err, "azure.AuthorizeSSHSign")
372372
}

‎authority/provisioner/gcp.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ import (
1515

1616
"github.com/pkg/errors"
1717
"github.com/smallstep/certificates/errs"
18-
"github.com/smallstep/certificates/sshutil"
1918
"github.com/smallstep/cli/jose"
19+
"go.step.sm/crypto/sshutil"
2020
"go.step.sm/crypto/x509util"
2121
)
2222

@@ -408,7 +408,7 @@ func (p *GCP) AuthorizeSSHSign(ctx context.Context, token string) ([]SignOption,
408408
data.SetToken(v)
409409
}
410410

411-
templateOptions, err := CustomSSHTemplateOptions(p.Options, data, sshutil.DefaultIIDCertificate)
411+
templateOptions, err := CustomSSHTemplateOptions(p.Options, data, sshutil.DefaultIIDTemplate)
412412
if err != nil {
413413
return nil, errs.Wrap(http.StatusInternalServerError, err, "gcp.AuthorizeSSHSign")
414414
}

‎authority/provisioner/jwk.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ import (
88

99
"github.com/pkg/errors"
1010
"github.com/smallstep/certificates/errs"
11-
"github.com/smallstep/certificates/sshutil"
1211
"github.com/smallstep/cli/jose"
12+
"go.step.sm/crypto/sshutil"
1313
"go.step.sm/crypto/x509util"
1414
)
1515

‎authority/provisioner/k8sSA.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@ import (
1111

1212
"github.com/pkg/errors"
1313
"github.com/smallstep/certificates/errs"
14-
"github.com/smallstep/certificates/sshutil"
1514
"github.com/smallstep/cli/crypto/pemutil"
1615
"github.com/smallstep/cli/jose"
16+
"go.step.sm/crypto/sshutil"
1717
"go.step.sm/crypto/x509util"
1818
)
1919

‎authority/provisioner/oidc.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ import (
1313

1414
"github.com/pkg/errors"
1515
"github.com/smallstep/certificates/errs"
16-
"github.com/smallstep/certificates/sshutil"
1716
"github.com/smallstep/cli/jose"
17+
"go.step.sm/crypto/sshutil"
1818
"go.step.sm/crypto/x509util"
1919
)
2020

@@ -395,9 +395,9 @@ func (o *OIDC) AuthorizeSSHSign(ctx context.Context, token string) ([]SignOption
395395
// Use the default template unless no-templates are configured and email is
396396
// an admin, in that case we will use the parameters in the request.
397397
isAdmin := o.IsAdmin(claims.Email)
398-
defaultTemplate := sshutil.DefaultCertificate
398+
defaultTemplate := sshutil.DefaultTemplate
399399
if isAdmin && !o.Options.GetSSHOptions().HasTemplate() {
400-
defaultTemplate = sshutil.DefaultAdminCertificate
400+
defaultTemplate = sshutil.DefaultAdminTemplate
401401
}
402402

403403
templateOptions, err := CustomSSHTemplateOptions(o.Options, data, defaultTemplate)

‎authority/provisioner/ssh_options.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@ import (
55
"strings"
66

77
"github.com/pkg/errors"
8-
"github.com/smallstep/certificates/sshutil"
8+
"go.step.sm/crypto/sshutil"
99
)
1010

11-
// CertificateOptions is an interface that returns a list of options passed when
11+
// SSHCertificateOptions is an interface that returns a list of options passed when
1212
// creating a new certificate.
1313
type SSHCertificateOptions interface {
1414
Options(SignSSHOptions) []sshutil.Option
@@ -45,7 +45,7 @@ func (o *SSHOptions) HasTemplate() bool {
4545
// user data provided in the request. If no template has been provided,
4646
// x509util.DefaultLeafTemplate will be used.
4747
func TemplateSSHOptions(o *Options, data sshutil.TemplateData) (SSHCertificateOptions, error) {
48-
return CustomSSHTemplateOptions(o, data, sshutil.DefaultCertificate)
48+
return CustomSSHTemplateOptions(o, data, sshutil.DefaultTemplate)
4949
}
5050

5151
// CustomTemplateOptions generates a CertificateOptions with the template, data

‎authority/provisioner/ssh_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import (
88
"time"
99

1010
"github.com/smallstep/certificates/errs"
11-
"github.com/smallstep/certificates/sshutil"
11+
"go.step.sm/crypto/sshutil"
1212
"golang.org/x/crypto/ssh"
1313
)
1414

‎authority/provisioner/utils_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@ import (
1717

1818
"github.com/pkg/errors"
1919
"github.com/smallstep/cli/crypto/pemutil"
20-
"github.com/smallstep/cli/crypto/randutil"
2120
"github.com/smallstep/cli/jose"
21+
"go.step.sm/crypto/randutil"
2222
"golang.org/x/crypto/ssh"
2323
)
2424

‎authority/provisioner/x5c.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ import (
99

1010
"github.com/pkg/errors"
1111
"github.com/smallstep/certificates/errs"
12-
"github.com/smallstep/certificates/sshutil"
1312
"github.com/smallstep/cli/jose"
13+
"go.step.sm/crypto/sshutil"
1414
"go.step.sm/crypto/x509util"
1515
)
1616

‎authority/provisioner/x5c_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ import (
1010
"github.com/smallstep/assert"
1111
"github.com/smallstep/certificates/errs"
1212
"github.com/smallstep/cli/crypto/pemutil"
13-
"github.com/smallstep/cli/crypto/randutil"
1413
"github.com/smallstep/cli/jose"
14+
"go.step.sm/crypto/randutil"
1515
)
1616

1717
func TestX5C_Getters(t *testing.T) {

‎authority/ssh.go

+20-5
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ import (
1313
"github.com/smallstep/certificates/authority/provisioner"
1414
"github.com/smallstep/certificates/db"
1515
"github.com/smallstep/certificates/errs"
16-
"github.com/smallstep/certificates/sshutil"
1716
"github.com/smallstep/certificates/templates"
18-
"github.com/smallstep/cli/crypto/randutil"
1917
"github.com/smallstep/cli/jose"
18+
"go.step.sm/crypto/randutil"
19+
"go.step.sm/crypto/sshutil"
2020
"golang.org/x/crypto/ssh"
2121
)
2222

@@ -51,6 +51,21 @@ type Bastion struct {
5151
Flags string `json:"flags,omitempty"`
5252
}
5353

54+
// HostTag are tagged with k,v pairs. These tags are how a user is ultimately
55+
// associated with a host.
56+
type HostTag struct {
57+
ID string
58+
Name string
59+
Value string
60+
}
61+
62+
// Host defines expected attributes for an ssh host.
63+
type Host struct {
64+
HostID string `json:"hid"`
65+
HostTags []HostTag `json:"host_tags"`
66+
Hostname string `json:"hostname"`
67+
}
68+
5469
// Validate checks the fields in SSHConfig.
5570
func (c *SSHConfig) Validate() error {
5671
if c == nil {
@@ -554,7 +569,7 @@ func (a *Authority) CheckSSHHost(ctx context.Context, principal string, token st
554569
}
555570

556571
// GetSSHHosts returns a list of valid host principals.
557-
func (a *Authority) GetSSHHosts(ctx context.Context, cert *x509.Certificate) ([]sshutil.Host, error) {
572+
func (a *Authority) GetSSHHosts(ctx context.Context, cert *x509.Certificate) ([]Host, error) {
558573
if a.sshGetHostsFunc != nil {
559574
hosts, err := a.sshGetHostsFunc(ctx, cert)
560575
return hosts, errs.Wrap(http.StatusInternalServerError, err, "getSSHHosts")
@@ -564,9 +579,9 @@ func (a *Authority) GetSSHHosts(ctx context.Context, cert *x509.Certificate) ([]
564579
return nil, errs.Wrap(http.StatusInternalServerError, err, "getSSHHosts")
565580
}
566581

567-
hosts := make([]sshutil.Host, len(hostnames))
582+
hosts := make([]Host, len(hostnames))
568583
for i, hn := range hostnames {
569-
hosts[i] = sshutil.Host{Hostname: hn}
584+
hosts[i] = Host{Hostname: hn}
570585
}
571586
return hosts, nil
572587
}

0 commit comments

Comments
 (0)