Merge pull request #27 from brendandburns/creds

Remove the dependency on the openssl executable.

Author: brendandburns

.travis.yml

@@ -2,9 +2,9 @@ language: csharp
 sudo: required
 matrix:
   include:
-    - dotnet: 1.0.4
+    - dotnet: 2.0.0
       mono: none
       dist: trusty
 
 script:
-  - ./ci.sh
+  - ./ci.sh

src/DotNetUtilities.cs

@@ -0,0 +1,46 @@
+namespace k8s {
+    using System;
+    using System.Security.Cryptography;
+
+    using Org.BouncyCastle.Crypto.Parameters;
+    using Org.BouncyCastle.Math;
+
+    // This class was derived from:
+    // https://github.com/bcgit/bc-csharp/blob/master/crypto/src/security/DotNetUtilities.cs
+    // Copyright (c) 2000 - 2017 The Legion of the Bouncy Castle Inc. (https://www.bouncycastle.org)
+    //
+    // Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+    // The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+    // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+    public class DotNetUtilities
+    {
+        public static RSAParameters ToRSAParameters(RsaPrivateCrtKeyParameters privKey)
+        {
+            RSAParameters rp = new RSAParameters();
+            rp.Modulus = privKey.Modulus.ToByteArrayUnsigned();
+            rp.Exponent = privKey.PublicExponent.ToByteArrayUnsigned();
+            rp.P = privKey.P.ToByteArrayUnsigned();
+            rp.Q = privKey.Q.ToByteArrayUnsigned();
+            rp.D = ConvertRSAParametersField(privKey.Exponent, rp.Modulus.Length);
+            rp.DP = ConvertRSAParametersField(privKey.DP, rp.P.Length);
+            rp.DQ = ConvertRSAParametersField(privKey.DQ, rp.Q.Length);
+            rp.InverseQ = ConvertRSAParametersField(privKey.QInv, rp.Q.Length);
+            return rp;
+        }
+
+        private static byte[] ConvertRSAParametersField(BigInteger n, int size)
+        {
+            byte[] bs = n.ToByteArrayUnsigned();
+
+            if (bs.Length == size)
+                return bs;
+
+            if (bs.Length > size)
+                throw new ArgumentException("Specified size too small", "size");
+
+            byte[] padded = new byte[size];
+            Array.Copy(bs, 0, padded, size - bs.Length, bs.Length);
+            return padded;
+        }
+    }
+}

src/Kubernetes.Auth.cs

@@ -41,7 +41,7 @@ public Kubernetes(KubernetesClientConfiguration config)
             };
 
             // set credentails for the kubernernet client
-            this.SetCredentialsAsync(config, handler).Wait();
+            this.SetCredentials(config, handler);
             this.InitializeHttpClient(handler);
         }
 
@@ -53,7 +53,7 @@ public Kubernetes(KubernetesClientConfiguration config)
         /// <param name="config">k8s client configuration</param>
         /// <param name="handler">http client handler for the rest client</param>
         /// <returns>Task</returns>
-        private async Task SetCredentialsAsync(KubernetesClientConfiguration config, HttpClientHandler handler)
+        private void SetCredentials(KubernetesClientConfiguration config, HttpClientHandler handler)
         {
             // set the Credentails for token based auth
             if (!string.IsNullOrWhiteSpace(config.AccessToken))
@@ -70,9 +70,7 @@ private async Task SetCredentialsAsync(KubernetesClientConfiguration config, Htt
                      (!string.IsNullOrWhiteSpace(config.ClientCertificateKey) ||
                       !string.IsNullOrWhiteSpace(config.ClientKey)))
             {
-                var pfxFilePath = await Utils.GeneratePfxAsync(config).ConfigureAwait(false);
-
-                var cert = new X509Certificate2(pfxFilePath, string.Empty, X509KeyStorageFlags.PersistKeySet);
+                var cert = Utils.GeneratePfx(config);
                 handler.ClientCertificates.Add(cert);
             }
             else

src/KubernetesClient.csproj

@@ -1,15 +1,14 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
-    <TargetFramework>netstandard2.0</TargetFramework>
+    <TargetFramework>netcoreapp2.0</TargetFramework>
   </PropertyGroup>
   <ItemGroup>
     <Compile Remove="GlobalSuppressions.cs" />
   </ItemGroup>
   <ItemGroup>
-    <PackageReference Include="Microsoft.CodeAnalysis.FxCopAnalyzers" Version="1.1.0" />
+    <PackageReference Include="BouncyCastle.NetCore" Version="1.8.1.3" />
     <PackageReference Include="Microsoft.Rest.ClientRuntime" Version="3.0.3" />
     <PackageReference Include="Newtonsoft.Json" Version="10.0.2" />
-    <PackageReference Include="System.Diagnostics.Process" Version="4.3.0" />
     <PackageReference Include="YamlDotNet.NetCore" Version="1.0.0" />
   </ItemGroup>
-</Project>
+</Project>

src/Utils.cs

@@ -1,111 +1,88 @@
-namespace k8s
-{
-    using k8s.Exceptions;
-    using System;
-    using System.ComponentModel;
-    using System.Diagnostics;
-    using System.IO;
-    using System.Runtime.InteropServices;
-    using System.Text;
-    using System.Threading.Tasks;
-
-    public static class Utils
-    {
-        /// <summary>
-        /// Encode string in base64 format.
-        /// </summary>
-        /// <param name="text">string to be encoded.</param>
-        /// <returns>Encoded string.</returns>
-        public static string Base64Encode(string text)
-        {
-            return Convert.ToBase64String(Encoding.UTF8.GetBytes(text));
-        }
-
-        /// <summary>
-        /// Encode string in base64 format.
-        /// </summary>
-        /// <param name="text">string to be encoded.</param>
-        /// <returns>Encoded string.</returns>
-        public static string Base64Decode(string text)
-        {
-            return Encoding.UTF8.GetString(Convert.FromBase64String(text));
-        }
-
-        /// <summary>
-        /// Generates pfx from client configuration
-        /// </summary>
-        /// <param name="config">Kuberentes Client Configuration</param>
-        /// <returns>Generated Pfx Path</returns>
-        /// TODO: kabhishek8260 Remplace the method with X509 Certificate with private key(in dotnet 2.0)
-        public static async Task<string> GeneratePfxAsync(KubernetesClientConfiguration config)
-        {
-            var userHomeDir = RuntimeInformation.IsOSPlatform(OSPlatform.Windows) ?
-                Environment.GetEnvironmentVariable("USERPROFILE") :
-                Environment.GetEnvironmentVariable("HOME");
-
-            var certDirPath = Path.Combine(userHomeDir, ".k8scerts");
-            Directory.CreateDirectory(certDirPath);
-
-            var keyFilePath = "";
-            var certFilePath = "";
-
-            var filePrefix = config.CurrentContext;
-            var pfxFilePath = Path.Combine(certDirPath, filePrefix + "pfx");
-            if (!string.IsNullOrWhiteSpace(config.ClientCertificateKey))
-            {
-                keyFilePath = Path.Combine(certDirPath, filePrefix + "key");
-                using (FileStream fs = File.Create(keyFilePath))
-                {
-                    byte[] info = Convert.FromBase64String(config.ClientCertificateKey);
-                    await fs.WriteAsync(info, 0, info.Length).ConfigureAwait(false);
-                }
-            }
-            if (!string.IsNullOrWhiteSpace(config.ClientKey))
-            {
-                keyFilePath = config.ClientKey;
-            }
-
-            if (!string.IsNullOrWhiteSpace(config.ClientCertificateData))
-            {
-                certFilePath = Path.Combine(certDirPath, filePrefix + "cert");
-
-                using (FileStream fs = File.Create(certFilePath))
-                {
-                    byte[] info = Convert.FromBase64String(config.ClientCertificateData);
-                    await fs.WriteAsync(info, 0, info.Length).ConfigureAwait(false);
-                }
-            }
-            if (!string.IsNullOrWhiteSpace(config.ClientCertificate))
-            {
-                certFilePath = config.ClientCertificate;
-            }
-
-            var processStartInfo = new ProcessStartInfo
-            {
-                FileName = @"openssl",
-                Arguments = $"pkcs12 -export -out {pfxFilePath} -inkey {keyFilePath} -in {certFilePath} -passout pass:",
-                CreateNoWindow = true,
-                RedirectStandardError = true,
-                RedirectStandardOutput = true
-            };
-
-            try
-            {
-                using (Process process = Process.Start(processStartInfo))
-                {
-                    process.WaitForExit();
-                    if (process.ExitCode != 0)
-                    {
-                        throw new KubernetesClientException($"Failed to generate pfx file with openssl. ExitCode = {process.ExitCode}.");
-                    }
-                }
-            }
-            catch (Win32Exception e)
-            {
-                throw new KubernetesClientException("Failed to generate pfx file with openssl.", e);
-            }
-
-            return pfxFilePath;
-        }
-    }
-}
+namespace k8s
+{
+    using System;
+    using System.Diagnostics;
+    using System.Globalization;
+    using System.IO;
+    using System.Runtime.InteropServices;
+    using System.Security.Cryptography;
+    using System.Security.Cryptography.X509Certificates;
+    using System.Text;
+    using System.Threading.Tasks;
+
+    using Org.BouncyCastle.Crypto;
+    using Org.BouncyCastle.Crypto.Parameters;
+    using Org.BouncyCastle.Security;
+    using Org.BouncyCastle.OpenSsl;
+
+    public static class Utils
+    {
+        /// <summary>
+        /// Encode string in base64 format.
+        /// </summary>
+        /// <param name="text">string to be encoded.</param>
+        /// <returns>Encoded string.</returns>
+        public static string Base64Encode(string text)
+        {
+            return Convert.ToBase64String(Encoding.UTF8.GetBytes(text));
+        }
+
+        /// <summary>
+        /// Encode string in base64 format.
+        /// </summary>
+        /// <param name="text">string to be encoded.</param>
+        /// <returns>Encoded string.</returns>
+        public static string Base64Decode(string text)
+        {
+            return Encoding.UTF8.GetString(Convert.FromBase64String(text));
+        }
+
+        /// <summary>
+        /// Generates pfx from client configuration
+        /// </summary>
+        /// <param name="config">Kuberentes Client Configuration</param>
+        /// <returns>Generated Pfx Path</returns>
+        public static X509Certificate2 GeneratePfx(KubernetesClientConfiguration config)
+        {
+            var keyData = new byte[]{};
+            var certData = new byte[]{};
+
+            var filePrefix = config.CurrentContext;
+            if (!string.IsNullOrWhiteSpace(config.ClientCertificateKey))
+            {
+                keyData = Convert.FromBase64String(config.ClientCertificateKey);
+            }
+            if (!string.IsNullOrWhiteSpace(config.ClientKey))
+            {
+                keyData = File.ReadAllBytes(config.ClientKey);
+            }
+
+            if (!string.IsNullOrWhiteSpace(config.ClientCertificateData))
+            {
+                certData = Convert.FromBase64String(config.ClientCertificateData);
+            }
+            if (!string.IsNullOrWhiteSpace(config.ClientCertificate))
+            {
+                certData = File.ReadAllBytes(config.ClientCertificate);
+            }
+
+            var cert = new X509Certificate2(certData);
+            return addPrivateKey(cert, keyData);
+        }
+
+        public static X509Certificate2 addPrivateKey(X509Certificate2 cert, byte[] keyData)
+        {
+            using (var reader = new StreamReader(new MemoryStream(keyData)))
+            {
+                var obj = new PemReader(reader).ReadObject();
+                if (obj is AsymmetricCipherKeyPair) {
+                    var cipherKey = (AsymmetricCipherKeyPair)obj;
+                    obj = cipherKey.Private;
+                }
+                var rsaKeyParams = (RsaPrivateCrtKeyParameters)obj;
+                var rsaKey = RSA.Create(DotNetUtilities.ToRSAParameters(rsaKeyParams));
+                return cert.CopyWithPrivateKey(rsaKey);
+            }
+        }
+    }
+}

tests/UtilTests.cs

@@ -0,0 +1,43 @@
+using System;
+using Xunit;
+using k8s;
+using System.IO;
+
+namespace k8s.Tests
+{
+    public class UtilsTests
+    {
+        /// <summary>
+        /// This file contains a sample kubeconfig file
+        /// </summary>
+        private static readonly string kubeConfigFileName = "assets/kubeconfig.yml";
+
+        /// <summary>
+        /// Checks that a certificate can be loaded from files.
+        /// </summary>
+        [Fact]
+        public void LoadFromFiles() 
+        {
+            var fi = new FileInfo(kubeConfigFileName);
+            var cfg = new KubernetesClientConfiguration(fi, "federal-context");
+
+            // Just validate that this doesn't throw and private key is non-null
+            var cert = Utils.GeneratePfx(cfg);
+            Assert.NotNull(cert.PrivateKey);
+        }
+
+        /// <summary>
+        /// Checks that a certificate can be loaded from inline.
+        /// </summary>
+        [Fact]
+        public void LoadFromInlineData() 
+        {
+            var fi = new FileInfo(kubeConfigFileName);
+            var cfg = new KubernetesClientConfiguration(fi, "victorian-context");
+
+            // Just validate that this doesn't throw and private key is non-null
+            var cert = Utils.GeneratePfx(cfg);
+            Assert.NotNull(cert.PrivateKey);
+        }
+    }
+}

tests/assets/client-certificate-data.txt

@@ -1 +1 @@
-LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlEUkRDQ0FpeWdBd0lCQWdJSUVIVm8zVzZXcnJjd0RRWUpLb1pJaHZjTkFRRUxCUUF3RXpFUk1BOEdBMVVFQXd3SVlXTnphemh6DQpZMkV3SGhjTk1UY3dOREU1TURBd01EQXdXaGNOTVRrd05ERTVNREF3TURBd1dqQVZNUk13RVFZRFZRUUREQXByZFdKbFkyOXVabWxuDQpNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXVEZ0ttVUxsU0ZSTStCN0pNMWMxUEJqS25mWlZpL1d1DQpSUks2TE9xNHpzL1UxanUyN21TbE9HbWJxRWVYTlpCRVFCblYvVGptQXpqM0Zwd2VKbW5PdDY0TTFIeXZRUW8yTC9LS2JlOVlPbUxNDQpRWXZyeE9QeFRnZHVJeDYzTGxKSUJRZERqdVFhWUhBc0FqTllhbTB3UmQwZTNhVkUxeEJnVDA4QkVWZnVwZmUrUnpXUWhVemJXYkhDDQpydmU2b2s4aHQzRk9LYjNxRzhyR3UrYzN4bGM1MXNVa2ovMGhMK0xrZVBWOTBRYVVCRjF6czlDMVZGaVhoT1Z6WlRjQ0lWQThSTDNvDQpxRTdGUEwvczBNc0RsdkRoNkZ3ZFkvUWhwSUtRMkdKTHQ0ZGRobk5yYW5GbS9pM1RzQ3FJSWxieHl5TVRsT09YYytOUG9mZW9EUUcvDQpvQldjTVFJREFRQUJvNEdaTUlHV01FSUdBMVVkSXdRN01EbUFGSmcrY0p4ZHpaUzNabzdjajFjQXJFWjNxREh1b1Jla0ZUQVRNUkV3DQpEd1lEVlFRRERBaGhZM05yT0hOallZSUlGTjZKejlmRStOVXdIUVlEVlIwT0JCWUVGTmJxZURyeHRvbWZFYnd5bmFUaXp4WXVmeVRXDQpNQXdHQTFVZEV3RUIvd1FDTUFBd0RnWURWUjBQQVFIL0JBUURBZ1dnTUJNR0ExVWRKUVFNTUFvR0NDc0dBUVVGQndNQ01BMEdDU3FHDQpTSWIzRFFFQkN3VUFBNElCQVFCYkFKdjJDRzRnTDJtNlpiQmJKSEtqMVF5MGtmbUFJdWgyZHNISU5vUHZ4V0lqY3VXeHZlbUpRcndUDQpuUEZPeWFMY3VtNmVmcGZhWG04T2hxNWxjT3NldUtYaDVya2ZuRUp1VmNWYk9UNXY2aUU3TEY5eGMrelVlTkZDWjA1a1QwbU52eW9lDQpIVmhkYlljeG8yOXVwbGVqa3RqZXd0eGZBZjM2a25hQytOVGE3dVZyNVQ0aTd4MUNQMGkvcUY5ZVgwVHJqZ0diM09MTHVwcVhMSzd5DQpUWUllK3NCajNjOGZRNit6RUJDVFNib05DRlRldXpjOTMxclltc1VyZGtIdEp2SkI2aSthMG5iRjB4MnRYY3ZRbVJ6aUwzTGR0UG84DQptSWh0bDRRWXBQZG5Qdk1RWk1MMlZ4T0FqN3V0RnhNMW44OEpKV0NaTkNyUUdYZjBLSDFpdHhwNg0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ0K
+LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlEUkRDQ0FpeWdBd0lCQWdJSUxzVmNxZ0pmOWdZd0RRWUpLb1pJaHZjTkFRRUxCUUF3RXpFUk1BOEdBMVVFQXd3SVlXTnphemh6DQpZMkV3SGhjTk1UY3dPVEl3TURBd01EQXdXaGNOTVRrd09USXdNREF3TURBd1dqQVZNUk13RVFZRFZRUUREQXByZFdKbFkyOXVabWxuDQpNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXJQVjB0Rmp3ZkxVL0p6M3RaUXRRblNSRG5aMGpLTGtjDQpRcnJ2a2pwbEhpVkFVOVNkRG9nT0VneUVWQjJoMU0xSWNYSVZYM2lCTGFHS04rSTl2dGZQSFQ2QmViTzVKNzFaOHRGMytJU1pNRzBLDQpzSWwzQS94VEJWKzlwRHVEU3pXTGNVTVoxbnhWV1Bma0paRkVTQTNCakxFT1NGWWYySUF4V0g2cjJDRHp0SDMySzVLbUNaLzR1NFFsDQpCT204YWoxVkFUbUZvK3BJaTNmUXVKcm1TblBSRGRlSW5HVGYwaEYyQ3oybzYrNU1TSzAxbURuaERyZVF5eTJHNXZXRnlWUjNxZ3pGDQpOMHFyaUEvSFRGcklSazdtbFZtaEpPM3A5cU0wRGdJc29XdHg0Ukdqc1lycTBmOTBnREhna1YvS0E3UEhZQlhheVVnQjhLcTUwS2xHDQpxczRyYVFJREFRQUJvNEdaTUlHV01FSUdBMVVkSXdRN01EbUFGS0FXL3JnbWJ4YUtWcUZoaFl4bEl5TEhQbEkyb1Jla0ZUQVRNUkV3DQpEd1lEVlFRRERBaGhZM05yT0hOallZSUlSbWp6U3h0U2d5TXdIUVlEVlIwT0JCWUVGSk5mZDNaZlJZZnlQdGJZbE1NUDYvKzcrU3dIDQpNQXdHQTFVZEV3RUIvd1FDTUFBd0RnWURWUjBQQVFIL0JBUURBZ1dnTUJNR0ExVWRKUVFNTUFvR0NDc0dBUVVGQndNQ01BMEdDU3FHDQpTSWIzRFFFQkN3VUFBNElCQVFCRVd0U1JMU0lTODhFUWpRdWp4bitQdmQ0OVNxSkdTUmRFNnlraUkwcXZ5RmY1c1lnV2FlYTdaME43DQpuK3k3SmlQQXQ1MEFkdGdvYTF1bWV4bG9VZE02WDJQYTB4RUpDaklGOFArcjhPOU41U0N5NVRXYTd0VTFrWkdoZHJFOERMS2RJbXk4DQpqblhnUlBjUHVlVnRkam50TFdUMGpETDI5YVg3ZUhLcllTMWQ2dkUyWXE3djZVNFNKN2JLU0NGbFNjS1h0VjhxUFVteXFlbXd5WHNBDQpVdEtBelRKS0l0UGw3eG5icXduVm5tY3Q0a0Q1VHZBUEFTdmZGTkR0eEU0WTU1ZHNYTERSVEc3NU5VK044bi94ZnBzcnlBZkQrUGZ6DQpNR05OWVhLb0hwbm93R1Z4V3UxRHZNY2kxQTl4STF6VnFsS2FpVTZSNm9qWmx6Q2xsVU54QUhzZA0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ0K