Skip to content

Commit fc173b9

Browse files
erikgberikgb
committed
Initial MVP
Signed-off-by: Erik Godding Boye <[email protected]>
1 parent d3beef0 commit fc173b9

File tree

7 files changed

+610
-0
lines changed

7 files changed

+610
-0
lines changed

‎go.mod

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
module github.com/cert-manager/webhook-cert-lib
2+
3+
go 1.22.0

‎go.sum

Whitespace-only changes.

‎internal/pki/cert_pool.go

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
/*
2+
Copyright The cert-manager Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package pki
18+
19+
import (
20+
"bytes"
21+
"crypto/sha256"
22+
"crypto/x509"
23+
"encoding/pem"
24+
"fmt"
25+
"slices"
26+
"time"
27+
)
28+
29+
// CertPool is a set of certificates.
30+
type CertPool struct {
31+
certificates map[[32]byte]*x509.Certificate
32+
33+
filterExpired bool
34+
}
35+
36+
type Option func(*CertPool)
37+
38+
func WithFilteredExpiredCerts(filterExpired bool) Option {
39+
return func(cp *CertPool) {
40+
cp.filterExpired = filterExpired
41+
}
42+
}
43+
44+
// NewCertPool returns a new, empty CertPool.
45+
// It will deduplicate certificates based on their SHA256 hash.
46+
// Optionally, it can filter out expired certificates.
47+
func NewCertPool(options ...Option) *CertPool {
48+
certPool := &CertPool{
49+
certificates: make(map[[32]byte]*x509.Certificate),
50+
}
51+
52+
for _, option := range options {
53+
option(certPool)
54+
}
55+
56+
return certPool
57+
}
58+
59+
func (cp *CertPool) AddCert(cert *x509.Certificate) bool {
60+
if cert == nil {
61+
panic("adding nil Certificate to CertPool")
62+
}
63+
if cp.filterExpired && time.Now().After(cert.NotAfter) {
64+
return false
65+
}
66+
67+
hash := sha256.Sum256(cert.Raw)
68+
cp.certificates[hash] = cert
69+
return true
70+
}
71+
72+
// AddCertsFromPEM strictly validates a given input PEM bundle to confirm it contains
73+
// only valid CERTIFICATE PEM blocks. If successful, returns the validated PEM blocks with any
74+
// comments or extra data stripped.
75+
//
76+
// This validation is broadly similar to the standard library function
77+
// crypto/x509.CertPool.AppendCertsFromPEM - that is, we decode each PEM block at a time and parse
78+
// it as a certificate.
79+
//
80+
// The difference here is that we want to ensure that the bundle _only_ contains certificates, and
81+
// not just skip over things which aren't certificates.
82+
//
83+
// If, for example, someone accidentally used a combined cert + private key as an input to a trust
84+
// bundle, we wouldn't want to then distribute the private key in the target.
85+
//
86+
// In addition, the standard library AppendCertsFromPEM also silently skips PEM blocks with
87+
// non-empty Headers. We error on such PEM blocks, for the same reason as above; headers could
88+
// contain (accidental) private information. They're also non-standard according to
89+
// https://www.rfc-editor.org/rfc/rfc7468
90+
//
91+
// Additionally, if the input PEM bundle contains no non-expired certificates, an error is returned.
92+
// TODO: Reconsider what should happen if the input only contains expired certificates.
93+
func (cp *CertPool) AddCertsFromPEM(pemData []byte) error {
94+
if pemData == nil {
95+
return fmt.Errorf("certificate data can't be nil")
96+
}
97+
98+
ok := false
99+
for {
100+
var block *pem.Block
101+
block, pemData = pem.Decode(pemData)
102+
103+
if block == nil {
104+
break
105+
}
106+
107+
if block.Type != "CERTIFICATE" {
108+
// only certificates are allowed in a bundle
109+
return fmt.Errorf("invalid PEM block in bundle: only CERTIFICATE blocks are permitted but found '%s'", block.Type)
110+
}
111+
112+
if len(block.Headers) != 0 {
113+
return fmt.Errorf("invalid PEM block in bundle; blocks are not permitted to have PEM headers")
114+
}
115+
116+
certificate, err := x509.ParseCertificate(block.Bytes)
117+
if err != nil {
118+
// the presence of an invalid cert (including things which aren't certs)
119+
// should cause the bundle to be rejected
120+
return fmt.Errorf("invalid PEM block in bundle; invalid PEM certificate: %w", err)
121+
}
122+
123+
if certificate == nil {
124+
return fmt.Errorf("failed appending a certificate: certificate is nil")
125+
}
126+
127+
if cp.AddCert(certificate) {
128+
ok = true // at least one non-expired certificate was found in the input
129+
}
130+
}
131+
132+
if !ok {
133+
return fmt.Errorf("no non-expired certificates found in input bundle")
134+
}
135+
136+
return nil
137+
}
138+
139+
// Get certificates quantity in the certificates pool
140+
func (cp *CertPool) Size() int {
141+
return len(cp.certificates)
142+
}
143+
144+
func (cp *CertPool) PEM() string {
145+
if cp == nil || len(cp.certificates) == 0 {
146+
return ""
147+
}
148+
149+
buffer := bytes.Buffer{}
150+
151+
for _, cert := range cp.Certificates() {
152+
if err := pem.Encode(&buffer, &pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw}); err != nil {
153+
return ""
154+
}
155+
}
156+
157+
return string(bytes.TrimSpace(buffer.Bytes()))
158+
}
159+
160+
func (cp *CertPool) PEMSplit() []string {
161+
if cp == nil || len(cp.certificates) == 0 {
162+
return nil
163+
}
164+
165+
pems := make([]string, 0, len(cp.certificates))
166+
for _, cert := range cp.Certificates() {
167+
pems = append(pems, string(bytes.TrimSpace(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw}))))
168+
}
169+
170+
return pems
171+
}
172+
173+
// Get the list of all x509 Certificates in the certificates pool
174+
func (cp *CertPool) Certificates() []*x509.Certificate {
175+
hashes := make([][32]byte, 0, len(cp.certificates))
176+
for hash := range cp.certificates {
177+
hashes = append(hashes, hash)
178+
}
179+
180+
slices.SortFunc(hashes, func(i, j [32]byte) int {
181+
return bytes.Compare(i[:], j[:])
182+
})
183+
184+
orderedCertificates := make([]*x509.Certificate, 0, len(cp.certificates))
185+
for _, hash := range hashes {
186+
orderedCertificates = append(orderedCertificates, cp.certificates[hash])
187+
}
188+
189+
return orderedCertificates
190+
}

‎internal/pki/csr.go

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
/*
2+
Copyright The cert-manager Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package pki
18+
19+
import (
20+
"bytes"
21+
"crypto"
22+
"crypto/ecdsa"
23+
"crypto/ed25519"
24+
"crypto/elliptic"
25+
"crypto/rand"
26+
"crypto/rsa"
27+
"crypto/x509"
28+
"encoding/pem"
29+
"fmt"
30+
)
31+
32+
// SignCertificate returns a signed *x509.Certificate given a template
33+
// *x509.Certificate crt and an issuer.
34+
// publicKey is the public key of the signee, and signerKey is the private
35+
// key of the signer.
36+
// It returns a PEM encoded copy of the Certificate as well as a *x509.Certificate
37+
// which can be used for reading the encoded values.
38+
func SignCertificate(template *x509.Certificate, issuerCert *x509.Certificate, publicKey crypto.PublicKey, signerKey any) ([]byte, *x509.Certificate, error) {
39+
typedSigner, ok := signerKey.(crypto.Signer)
40+
if !ok {
41+
return nil, nil, fmt.Errorf("didn't get an expected Signer in call to SignCertificate")
42+
}
43+
44+
var pubKeyAlgo x509.PublicKeyAlgorithm
45+
var sigAlgoArg any
46+
47+
// NB: can't rely on issuerCert.Public or issuercert.PublicKeyAlgorithm being set reliably;
48+
// but we know that signerKey.Public() will work!
49+
switch pubKey := typedSigner.Public().(type) {
50+
case *rsa.PublicKey:
51+
pubKeyAlgo = x509.RSA
52+
53+
// Size is in bytes so multiply by 8 to get bits because they're more familiar
54+
// This is technically not portable but if you're using cert-manager on a platform
55+
// with bytes that don't have 8 bits, you've got bigger problems than this!
56+
sigAlgoArg = pubKey.Size() * 8
57+
58+
case *ecdsa.PublicKey:
59+
pubKeyAlgo = x509.ECDSA
60+
sigAlgoArg = pubKey.Curve
61+
62+
case ed25519.PublicKey:
63+
pubKeyAlgo = x509.Ed25519
64+
sigAlgoArg = nil // ignored by signatureAlgorithmFromPublicKey
65+
66+
default:
67+
return nil, nil, fmt.Errorf("unknown public key type on signing certificate: %T", issuerCert.PublicKey)
68+
}
69+
70+
var err error
71+
template.SignatureAlgorithm, err = signatureAlgorithmFromPublicKey(pubKeyAlgo, sigAlgoArg)
72+
if err != nil {
73+
return nil, nil, err
74+
}
75+
76+
derBytes, err := x509.CreateCertificate(rand.Reader, template, issuerCert, publicKey, signerKey)
77+
if err != nil {
78+
return nil, nil, fmt.Errorf("error creating x509 certificate: %s", err.Error())
79+
}
80+
81+
cert, err := x509.ParseCertificate(derBytes)
82+
if err != nil {
83+
return nil, nil, fmt.Errorf("error decoding DER certificate bytes: %s", err.Error())
84+
}
85+
86+
pemBytes := bytes.NewBuffer([]byte{})
87+
err = pem.Encode(pemBytes, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
88+
if err != nil {
89+
return nil, nil, fmt.Errorf("error encoding certificate PEM: %s", err.Error())
90+
}
91+
92+
return pemBytes.Bytes(), cert, err
93+
}
94+
95+
// EncodeX509 will encode a single *x509.Certificate into PEM format.
96+
func EncodeX509(cert *x509.Certificate) ([]byte, error) {
97+
caPem := bytes.NewBuffer([]byte{})
98+
err := pem.Encode(caPem, &pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw})
99+
if err != nil {
100+
return nil, err
101+
}
102+
103+
return caPem.Bytes(), nil
104+
}
105+
106+
// signatureAlgorithmFromPublicKey takes a public key type and an argument specific to that public
107+
// key, and returns an appropriate signature algorithm for that key.
108+
// If alg is x509.RSA, arg must be an integer key size in bits
109+
// If alg is x509.ECDSA, arg must be an elliptic.Curve
110+
// If alg is x509.Ed25519, arg is ignored
111+
// All other algorithms and args cause an error
112+
// The signature algorithms returned by this function are to some degree a matter of preference. The
113+
// choices here are motivated by what is common and what is required by bodies such as the US DoD.
114+
func signatureAlgorithmFromPublicKey(alg x509.PublicKeyAlgorithm, arg any) (x509.SignatureAlgorithm, error) {
115+
var signatureAlgorithm x509.SignatureAlgorithm
116+
117+
switch alg {
118+
case x509.RSA:
119+
size, ok := arg.(int)
120+
if !ok {
121+
return x509.UnknownSignatureAlgorithm, fmt.Errorf("expected to get an integer key size for RSA key but got %T", arg)
122+
}
123+
124+
switch {
125+
case size >= 4096:
126+
signatureAlgorithm = x509.SHA512WithRSA
127+
128+
case size >= 3072:
129+
signatureAlgorithm = x509.SHA384WithRSA
130+
131+
case size >= 2048:
132+
signatureAlgorithm = x509.SHA256WithRSA
133+
134+
default:
135+
return x509.UnknownSignatureAlgorithm, fmt.Errorf("invalid size %d for RSA key on signing certificate", size)
136+
}
137+
138+
case x509.ECDSA:
139+
curve, ok := arg.(elliptic.Curve)
140+
if !ok {
141+
return x509.UnknownSignatureAlgorithm, fmt.Errorf("expected to get an ECDSA curve for ECDSA key but got %T", arg)
142+
}
143+
144+
switch curve {
145+
case elliptic.P521():
146+
signatureAlgorithm = x509.ECDSAWithSHA512
147+
148+
case elliptic.P384():
149+
signatureAlgorithm = x509.ECDSAWithSHA384
150+
151+
case elliptic.P256():
152+
signatureAlgorithm = x509.ECDSAWithSHA256
153+
154+
default:
155+
return x509.UnknownSignatureAlgorithm, fmt.Errorf("unknown / unsupported curve attached to ECDSA signing certificate")
156+
}
157+
158+
case x509.Ed25519:
159+
signatureAlgorithm = x509.PureEd25519
160+
161+
default:
162+
return x509.UnknownSignatureAlgorithm, fmt.Errorf("got unsupported public key type when trying to calculate signature algorithm")
163+
}
164+
165+
return signatureAlgorithm, nil
166+
}

‎internal/pki/errors/errors.go

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/*
2+
Copyright The cert-manager Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package errors
18+
19+
import "fmt"
20+
21+
type invalidDataError struct{ error }
22+
23+
func NewInvalidData(str string, obj ...interface{}) error {
24+
return &invalidDataError{error: fmt.Errorf(str, obj...)}
25+
}

0 commit comments

Comments
 (0)