Skip to content

Commit 53686c9

Browse files
JackDoanJackDoan
committed
prefer Nebula's public key handling functions where possible
1 parent ec15620 commit 53686c9

File tree

5 files changed

+22
-33
lines changed

5 files changed

+22
-33
lines changed

‎client_test.go‎

Lines changed: 10 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ import (
88
"crypto/rand"
99
"crypto/sha256"
1010
"encoding/json"
11-
"encoding/pem"
1211
"errors"
1312
"fmt"
1413
"io"
@@ -78,7 +77,7 @@ func TestEnroll(t *testing.T) {
7877
HostID: hostID,
7978
Counter: counter,
8079
Config: cfg,
81-
TrustedKeys: marshalCAPublicKey(ca.Curve(), ca.PublicKey()),
80+
TrustedKeys: ca.MarshalPublicKeyPEM(),
8281
Organization: message.HostOrgMetadata{
8382
ID: orgID,
8483
Name: orgName,
@@ -209,7 +208,7 @@ func TestDoUpdate(t *testing.T) {
209208
HostID: "foobar",
210209
Counter: 1,
211210
Config: cfg,
212-
TrustedKeys: marshalCAPublicKey(ca.Curve(), ca.PublicKey()),
211+
TrustedKeys: ca.MarshalPublicKeyPEM(),
213212
Organization: message.HostOrgMetadata{
214213
ID: "foobaz",
215214
Name: "foobar's foo org",
@@ -278,7 +277,7 @@ func TestDoUpdate(t *testing.T) {
278277
Config: dnapitest.NebulaCfg(caPEM),
279278
Counter: 2,
280279
Nonce: dnapitest.GetNonce(r),
281-
TrustedKeys: marshalCAPublicKey(ca.Curve(), ca.PublicKey()),
280+
TrustedKeys: ca.MarshalPublicKeyPEM(),
282281
Organization: message.HostOrgMetadata{
283282
ID: "foobaz",
284283
Name: "foobar's foo org",
@@ -333,7 +332,7 @@ func TestDoUpdate(t *testing.T) {
333332
Config: dnapitest.NebulaCfg(caPEM),
334333
Counter: 0,
335334
Nonce: dnapitest.GetNonce(r),
336-
TrustedKeys: marshalCAPublicKey(ca.Curve(), ca.PublicKey()),
335+
TrustedKeys: ca.MarshalPublicKeyPEM(),
337336
Organization: message.HostOrgMetadata{
338337
ID: "foobaz",
339338
Name: "foobar's foo org",
@@ -393,7 +392,7 @@ func TestDoUpdate(t *testing.T) {
393392
Config: dnapitest.NebulaCfg(caPEM),
394393
Counter: 3,
395394
Nonce: dnapitest.GetNonce(r),
396-
TrustedKeys: marshalCAPublicKey(ca.Curve(), ca.PublicKey()),
395+
TrustedKeys: ca.MarshalPublicKeyPEM(),
397396
Organization: message.HostOrgMetadata{
398397
ID: orgID,
399398
Name: orgName,
@@ -480,7 +479,7 @@ func TestDoUpdate_P256(t *testing.T) {
480479
HostID: "foobar",
481480
Counter: 1,
482481
Config: cfg,
483-
TrustedKeys: marshalCAPublicKey(ca.Curve(), ca.PublicKey()),
482+
TrustedKeys: ca.MarshalPublicKeyPEM(),
484483
Organization: message.HostOrgMetadata{
485484
ID: "foobaz",
486485
Name: "foobar's foo org",
@@ -638,7 +637,7 @@ func TestDoUpdate_P256(t *testing.T) {
638637
Config: dnapitest.NebulaCfg(caPEM),
639638
Counter: 3,
640639
Nonce: dnapitest.GetNonce(r),
641-
TrustedKeys: marshalCAPublicKey(ca.Curve(), ca.PublicKey()),
640+
TrustedKeys: ca.MarshalPublicKeyPEM(),
642641
Organization: message.HostOrgMetadata{
643642
ID: "foobaz",
644643
Name: "foobar's foo org",
@@ -720,7 +719,7 @@ func TestCommandResponse(t *testing.T) {
720719
HostID: "foobar",
721720
Counter: 1,
722721
Config: cfg,
723-
TrustedKeys: marshalCAPublicKey(ca.Curve(), ca.PublicKey()),
722+
TrustedKeys: ca.MarshalPublicKeyPEM(),
724723
Organization: message.HostOrgMetadata{
725724
ID: "foobaz",
726725
Name: "foobar's foo org",
@@ -825,7 +824,7 @@ func TestStreamCommandResponse(t *testing.T) {
825824
HostID: "foobar",
826825
Counter: 1,
827826
Config: cfg,
828-
TrustedKeys: marshalCAPublicKey(ca.Curve(), ca.PublicKey()),
827+
TrustedKeys: ca.MarshalPublicKeyPEM(),
829828
Organization: message.HostOrgMetadata{
830829
ID: "foobaz",
831830
Name: "foobar's foo org",
@@ -951,7 +950,7 @@ func TestReauthenticate(t *testing.T) {
951950
HostID: "foobar",
952951
Counter: 1,
953952
Config: cfg,
954-
TrustedKeys: marshalCAPublicKey(ca.Curve(), ca.PublicKey()),
953+
TrustedKeys: ca.MarshalPublicKeyPEM(),
955954
Organization: message.HostOrgMetadata{
956955
ID: "foobaz",
957956
Name: "foobar's foo org",
@@ -1062,17 +1061,6 @@ func TestOverrideTimeout(t *testing.T) {
10621061
require.ErrorIs(t, err, context.DeadlineExceeded)
10631062
}
10641063

1065-
func marshalCAPublicKey(curve cert.Curve, pubkey []byte) []byte {
1066-
switch curve {
1067-
case cert.Curve_CURVE25519:
1068-
return pem.EncodeToMemory(&pem.Block{Type: keys.NebulaEd25519PublicKeyBanner, Bytes: pubkey})
1069-
case cert.Curve_P256:
1070-
return pem.EncodeToMemory(&pem.Block{Type: keys.NebulaECDSAP256PublicKeyBanner, Bytes: pubkey})
1071-
default:
1072-
panic("unsupported curve")
1073-
}
1074-
}
1075-
10761064
func TestGetOidcPollCode(t *testing.T) {
10771065
t.Parallel()
10781066

@@ -1219,7 +1207,6 @@ func TestDownloads(t *testing.T) {
12191207
}
12201208

12211209
func TestNebulaPemBanners(t *testing.T) {
1222-
t.SkipNow() //todo this is correct for 25519 but not p256. Once this test passes, we can lean on Nebula's implementations.
12231210
const NebulaECDSAP256PublicKeyBanner = "NEBULA ECDSA P256 PUBLIC KEY"
12241211
const NebulaEd25519PublicKeyBanner = "NEBULA ED25519 PUBLIC KEY"
12251212
ca, _ := dnapitest.NebulaCACert()

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ go 1.25
44

55
require (
66
github.com/sirupsen/logrus v1.9.3
7-
github.com/slackhq/nebula v1.10.0
7+
github.com/slackhq/nebula v1.10.1-0.20251210163936-3ec527e42cec
88
github.com/stretchr/testify v1.11.1
99
golang.org/x/crypto v0.46.0
1010
gopkg.in/yaml.v2 v2.4.0

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZV
1818
github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
1919
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
2020
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
21-
github.com/slackhq/nebula v1.10.0 h1:uhu4Cpzw3pXyDJ8G1fMSppsvG7aE9XCt4UaauggHax0=
22-
github.com/slackhq/nebula v1.10.0/go.mod h1:PmYcyoGhAX4X8lCzJjGv7aLTBbFbPy7QeWbpwWvJf+Y=
21+
github.com/slackhq/nebula v1.10.1-0.20251210163936-3ec527e42cec h1:F251X4hgG3Fen49ouS7yUVcwYkvvCjb5bmRFAbMnm+c=
22+
github.com/slackhq/nebula v1.10.1-0.20251210163936-3ec527e42cec/go.mod h1:mqXWEQjg+I1r5KeCqji83gA0rZPCY9yvP25USUBFGxc=
2323
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
2424
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
2525
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=

‎keys/pem.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,15 @@ import (
77
"crypto/x509"
88
"encoding/pem"
99
"fmt"
10+
11+
"github.com/slackhq/nebula/cert"
1012
)
1113

1214
const HostEd25519PublicKeyBanner = "DEFINED HOST ED25519 PUBLIC KEY"
1315
const HostEd25519PrivateKeyBanner = "DEFINED HOST ED25519 PRIVATE KEY"
1416
const HostP256PublicKeyBanner = "DEFINED HOST P256 PUBLIC KEY"
1517
const HostP256PrivateKeyBanner = "DEFINED HOST P256 PRIVATE KEY"
1618

17-
const NebulaECDSAP256PublicKeyBanner = "NEBULA ECDSA P256 PUBLIC KEY"
18-
const NebulaEd25519PublicKeyBanner = "NEBULA ED25519 PUBLIC KEY"
19-
2019
func MarshalHostEd25519PublicKey(k ed25519.PublicKey) ([]byte, error) {
2120
b, err := x509.MarshalPKIXPublicKey(k)
2221
if err != nil {
@@ -163,8 +162,9 @@ func UnmarshalTrustedKey(b []byte) (TrustedKey, []byte, error) {
163162
return nil, r, fmt.Errorf("input did not contain a valid PEM encoded block")
164163
}
165164

165+
// we could use Nebula's implementation here, but we want to make sure we only see these specific banners.
166166
switch k.Type {
167-
case NebulaECDSAP256PublicKeyBanner:
167+
case cert.ECDSAP256PublicKeyBanner:
168168
if len(k.Bytes) != 65 {
169169
return nil, r, fmt.Errorf("key was not 65 bytes, is invalid P256 public key")
170170
}
@@ -173,7 +173,7 @@ func UnmarshalTrustedKey(b []byte) (TrustedKey, []byte, error) {
173173
return nil, r, fmt.Errorf("failed to parse public key: %s", err)
174174
}
175175
return P256TrustedKey{pk}, r, nil
176-
case NebulaEd25519PublicKeyBanner:
176+
case cert.Ed25519PublicKeyBanner:
177177
if len(k.Bytes) != ed25519.PublicKeySize {
178178
return nil, r, fmt.Errorf("key was not 32 bytes, is invalid ed25519 public key")
179179
}

‎keys/trusted_keys.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ import (
77
"crypto/sha256"
88
"encoding/pem"
99
"fmt"
10+
11+
"github.com/slackhq/nebula/cert"
1012
)
1113

1214
// TrustedKey is an interface used to generically verify signatures returned
@@ -42,7 +44,7 @@ func (key Ed25519TrustedKey) Unwrap() any {
4244
}
4345

4446
func (key Ed25519TrustedKey) MarshalPEM() ([]byte, error) {
45-
return pem.EncodeToMemory(&pem.Block{Type: NebulaEd25519PublicKeyBanner, Bytes: key.PublicKey}), nil
47+
return pem.EncodeToMemory(&pem.Block{Type: cert.Ed25519PublicKeyBanner, Bytes: key.PublicKey}), nil
4648
}
4749

4850
// P256TrustedKey is the P256 implementation of TrustedKey.
@@ -61,7 +63,7 @@ func (key P256TrustedKey) Unwrap() any {
6163

6264
func (key P256TrustedKey) MarshalPEM() ([]byte, error) {
6365
b := elliptic.Marshal(elliptic.P256(), key.X, key.Y)
64-
return pem.EncodeToMemory(&pem.Block{Type: NebulaECDSAP256PublicKeyBanner, Bytes: b}), nil
66+
return pem.EncodeToMemory(&pem.Block{Type: cert.ECDSAP256PublicKeyBanner, Bytes: b}), nil
6567
}
6668

6769
// TrustedKeysToPEM converts a slice of TrustedKey to a PEM-encoded byte slice.

0 commit comments

Comments
 (0)