Skip to content

Commit f99dbd5

Browse files
dopeydopey
authored
Merge branch 'master' into wire_subject_test_coverage
2 parents ce05770 + 77667e7 commit f99dbd5

29 files changed

+196
-112
lines changed

‎authority/export.go

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,12 @@ import (
88
"strings"
99

1010
"github.com/pkg/errors"
11-
"github.com/smallstep/certificates/authority/provisioner"
12-
"go.step.sm/cli-utils/step"
13-
"go.step.sm/linkedca"
1411
"google.golang.org/protobuf/types/known/structpb"
12+
13+
"github.com/smallstep/cli-utils/step"
14+
"go.step.sm/linkedca"
15+
16+
"github.com/smallstep/certificates/authority/provisioner"
1517
)
1618

1719
// Export creates a linkedca configuration form the current ca.json and loaded

‎authority/provisioner/aws.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -358,7 +358,7 @@ func (p *AWS) AuthorizeSign(ctx context.Context, token string) ([]SignOption, er
358358
if p.DisableCustomSANs {
359359
dnsName := fmt.Sprintf("ip-%s.%s.compute.internal", strings.ReplaceAll(doc.PrivateIP, ".", "-"), doc.Region)
360360
so = append(so,
361-
dnsNamesValidator([]string{dnsName}),
361+
dnsNamesSubsetValidator([]string{dnsName}),
362362
ipAddressesValidator([]net.IP{
363363
net.ParseIP(doc.PrivateIP),
364364
}),

‎authority/provisioner/aws_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -698,7 +698,7 @@ func TestAWS_AuthorizeSign(t *testing.T) {
698698
case *urisValidator:
699699
assert.Equals(t, v.uris, nil)
700700
assert.Equals(t, MethodFromContext(v.ctx), SignMethod)
701-
case dnsNamesValidator:
701+
case dnsNamesSubsetValidator:
702702
assert.Equals(t, []string(v), []string{"ip-127-0-0-1.us-west-1.compute.internal"})
703703
case *x509NamePolicyValidator:
704704
assert.Equals(t, nil, v.policyEngine)

‎authority/provisioner/azure.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -379,7 +379,7 @@ func (p *Azure) AuthorizeSign(ctx context.Context, token string) ([]SignOption,
379379
// name will work only inside the virtual network
380380
so = append(so,
381381
commonNameValidator(name),
382-
dnsNamesValidator([]string{name}),
382+
dnsNamesSubsetValidator([]string{name}),
383383
ipAddressesValidator(nil),
384384
emailAddressesValidator(nil),
385385
newURIsValidator(ctx, nil),

‎authority/provisioner/azure_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -563,7 +563,7 @@ func TestAzure_AuthorizeSign(t *testing.T) {
563563
case *urisValidator:
564564
assert.Equals(t, v.uris, nil)
565565
assert.Equals(t, MethodFromContext(v.ctx), SignMethod)
566-
case dnsNamesValidator:
566+
case dnsNamesSubsetValidator:
567567
assert.Equals(t, []string(v), []string{"virtualMachine"})
568568
case *x509NamePolicyValidator:
569569
assert.Equals(t, nil, v.policyEngine)

‎authority/provisioner/gcp.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -265,7 +265,7 @@ func (p *GCP) AuthorizeSign(ctx context.Context, token string) ([]SignOption, er
265265
commonNameSliceValidator([]string{
266266
ce.InstanceName, ce.InstanceID, dnsName1, dnsName2,
267267
}),
268-
dnsNamesValidator([]string{
268+
dnsNamesSubsetValidator([]string{
269269
dnsName1, dnsName2,
270270
}),
271271
ipAddressesValidator(nil),

‎authority/provisioner/gcp_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -579,7 +579,7 @@ func TestGCP_AuthorizeSign(t *testing.T) {
579579
case *urisValidator:
580580
assert.Equals(t, v.uris, nil)
581581
assert.Equals(t, MethodFromContext(v.ctx), SignMethod)
582-
case dnsNamesValidator:
582+
case dnsNamesSubsetValidator:
583583
assert.Equals(t, []string(v), []string{"instance-name.c.project-id.internal", "instance-name.zone.c.project-id.internal"})
584584
case *x509NamePolicyValidator:
585585
assert.Equals(t, nil, v.policyEngine)

‎authority/provisioner/options.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import (
66

77
"github.com/pkg/errors"
88

9-
"go.step.sm/cli-utils/step"
9+
"github.com/smallstep/cli-utils/step"
1010
"go.step.sm/crypto/jose"
1111
"go.step.sm/crypto/x509util"
1212

‎authority/provisioner/sign_options.go

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,27 @@ func (v dnsNamesValidator) Valid(req *x509.CertificateRequest) error {
190190
return nil
191191
}
192192

193+
// dnsNamesSubsetValidator validates the DNS name SANs of a certificate request.
194+
type dnsNamesSubsetValidator []string
195+
196+
// Valid checks that all DNS name SANs in the certificate request are present in
197+
// the allowed list of DNS names.
198+
func (v dnsNamesSubsetValidator) Valid(req *x509.CertificateRequest) error {
199+
if len(req.DNSNames) == 0 {
200+
return nil
201+
}
202+
allowed := make(map[string]struct{}, len(v))
203+
for _, s := range v {
204+
allowed[s] = struct{}{}
205+
}
206+
for _, s := range req.DNSNames {
207+
if _, ok := allowed[s]; !ok {
208+
return errs.Forbidden("certificate request contains unauthorized DNS names - got %v, allowed %v", req.DNSNames, v)
209+
}
210+
}
211+
return nil
212+
}
213+
193214
// ipAddressesValidator validates the IP addresses SAN of a certificate request.
194215
type ipAddressesValidator []net.IP
195216

‎authority/provisioner/sign_options_test.go

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,39 @@ func Test_dnsNamesValidator_Valid(t *testing.T) {
186186
}
187187
}
188188

189+
func Test_dnsNamesSubsetValidator_Valid(t *testing.T) {
190+
type args struct {
191+
req *x509.CertificateRequest
192+
}
193+
tests := []struct {
194+
name string
195+
v dnsNamesSubsetValidator
196+
args args
197+
wantErr bool
198+
}{
199+
{"ok0", []string{}, args{&x509.CertificateRequest{DNSNames: []string{}}}, false},
200+
{"ok1", []string{"foo.bar.zar"}, args{&x509.CertificateRequest{DNSNames: []string{"foo.bar.zar"}}}, false},
201+
{"ok2", []string{"foo.bar.zar", "bar.zar"}, args{&x509.CertificateRequest{DNSNames: []string{"foo.bar.zar", "bar.zar"}}}, false},
202+
{"ok3", []string{"foo.bar.zar", "bar.zar"}, args{&x509.CertificateRequest{DNSNames: []string{"bar.zar", "foo.bar.zar"}}}, false},
203+
{"ok4", []string{"foo.bar.zar", "bar.zar"}, args{&x509.CertificateRequest{}}, false},
204+
{"ok5", []string{"foo.bar.zar", "bar.zar"}, args{&x509.CertificateRequest{DNSNames: []string{"bar.zar"}}}, false},
205+
{"ok6", []string{"foo", "bar", "baz", "zar", "zap"}, args{&x509.CertificateRequest{DNSNames: []string{"zap", "baz", "foo"}}}, false},
206+
{"fail1", []string{"foo.bar.zar"}, args{&x509.CertificateRequest{DNSNames: []string{"bar.zar"}}}, true},
207+
{"fail2", []string{"foo.bar.zar"}, args{&x509.CertificateRequest{DNSNames: []string{"bar.zar", "foo.bar.zar"}}}, true},
208+
{"fail3", []string{"foo.bar.zar", "bar.zar"}, args{&x509.CertificateRequest{DNSNames: []string{"foo.bar.zar", "zar.bar"}}}, true},
209+
{"fail4", []string{"foo", "bar", "baz", "zar", "zap"}, args{&x509.CertificateRequest{DNSNames: []string{"zap", "baz", "foO"}}}, true},
210+
{"fail5", []string{"foo", "bar", "baz", "zar", "zap"}, args{&x509.CertificateRequest{DNSNames: []string{"zap", "baz", "fax", "foo"}}}, true},
211+
{"fail6", []string{}, args{&x509.CertificateRequest{DNSNames: []string{"zap", "baz", "fax", "foo"}}}, true},
212+
}
213+
for _, tt := range tests {
214+
t.Run(tt.name, func(t *testing.T) {
215+
if err := tt.v.Valid(tt.args.req); (err != nil) != tt.wantErr {
216+
t.Errorf("dnsNamesSubsetValidator.Valid() error = %v, wantErr %v", err, tt.wantErr)
217+
}
218+
})
219+
}
220+
}
221+
189222
func Test_ipAddressesValidator_Valid(t *testing.T) {
190223
ip1 := net.IPv4(10, 3, 2, 1)
191224
ip2 := net.IPv4(10, 3, 2, 2)

‎authority/provisioner/ssh_options.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@ import (
55
"strings"
66

77
"github.com/pkg/errors"
8-
"go.step.sm/cli-utils/step"
8+
9+
"github.com/smallstep/cli-utils/step"
910
"go.step.sm/crypto/sshutil"
1011

1112
"github.com/smallstep/certificates/authority/policy"

‎authority/provisioners.go

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ import (
1111

1212
"github.com/pkg/errors"
1313

14-
"go.step.sm/cli-utils/step"
15-
"go.step.sm/cli-utils/ui"
14+
"github.com/smallstep/cli-utils/step"
15+
"github.com/smallstep/cli-utils/ui"
1616
"go.step.sm/crypto/jose"
1717
"go.step.sm/linkedca"
1818

@@ -955,6 +955,8 @@ func ProvisionerToCertificates(p *linkedca.Provisioner) (provisioner.Interface,
955955
ProjectIDs: cfg.ProjectIds,
956956
DisableCustomSANs: cfg.DisableCustomSans,
957957
DisableTrustOnFirstUse: cfg.DisableTrustOnFirstUse,
958+
DisableSSHCAUser: cfg.DisableSshCaUser,
959+
DisableSSHCAHost: cfg.DisableSshCaHost,
958960
InstanceAge: instanceAge,
959961
Claims: claims,
960962
Options: options,
@@ -1095,6 +1097,8 @@ func ProvisionerToLinkedca(p provisioner.Interface) (*linkedca.Provisioner, erro
10951097
ProjectIds: p.ProjectIDs,
10961098
DisableCustomSans: p.DisableCustomSANs,
10971099
DisableTrustOnFirstUse: p.DisableTrustOnFirstUse,
1100+
DisableSshCaUser: p.DisableSSHCAUser,
1101+
DisableSshCaHost: p.DisableSSHCAHost,
10981102
InstanceAge: p.InstanceAge.String(),
10991103
},
11001104
},

‎authority/provisioners_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,12 @@ import (
99
"testing"
1010
"time"
1111

12+
"github.com/stretchr/testify/require"
13+
1214
"go.step.sm/crypto/jose"
1315
"go.step.sm/crypto/keyutil"
1416
"go.step.sm/linkedca"
1517

16-
"github.com/stretchr/testify/require"
17-
1818
"github.com/smallstep/assert"
1919
"github.com/smallstep/certificates/api/render"
2020
"github.com/smallstep/certificates/authority/admin"

‎ca/adminClient.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ import (
1515
"github.com/pkg/errors"
1616
"google.golang.org/protobuf/encoding/protojson"
1717

18-
"go.step.sm/cli-utils/token"
19-
"go.step.sm/cli-utils/token/provision"
18+
"github.com/smallstep/cli-utils/token"
19+
"github.com/smallstep/cli-utils/token/provision"
2020
"go.step.sm/crypto/jose"
2121
"go.step.sm/crypto/randutil"
2222
"go.step.sm/linkedca"

‎ca/ca.go

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,11 @@ import (
1818
"github.com/go-chi/chi/v5"
1919
"github.com/go-chi/chi/v5/middleware"
2020
"github.com/pkg/errors"
21+
22+
"github.com/smallstep/cli-utils/step"
23+
"github.com/smallstep/nosql"
24+
"go.step.sm/crypto/x509util"
25+
2126
"github.com/smallstep/certificates/acme"
2227
acmeAPI "github.com/smallstep/certificates/acme/api"
2328
acmeNoSQL "github.com/smallstep/certificates/acme/db/nosql"
@@ -35,9 +40,6 @@ import (
3540
"github.com/smallstep/certificates/scep"
3641
scepAPI "github.com/smallstep/certificates/scep/api"
3742
"github.com/smallstep/certificates/server"
38-
"github.com/smallstep/nosql"
39-
"go.step.sm/cli-utils/step"
40-
"go.step.sm/crypto/x509util"
4143
)
4244

4345
type options struct {

‎ca/client.go

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,21 +24,23 @@ import (
2424
"strings"
2525

2626
"github.com/pkg/errors"
27+
"golang.org/x/net/http2"
28+
"google.golang.org/protobuf/encoding/protojson"
29+
"google.golang.org/protobuf/proto"
30+
31+
"github.com/smallstep/cli-utils/step"
32+
"go.step.sm/crypto/jose"
33+
"go.step.sm/crypto/keyutil"
34+
"go.step.sm/crypto/pemutil"
35+
"go.step.sm/crypto/randutil"
36+
"go.step.sm/crypto/x509util"
37+
2738
"github.com/smallstep/certificates/api"
2839
"github.com/smallstep/certificates/authority"
2940
"github.com/smallstep/certificates/authority/provisioner"
3041
"github.com/smallstep/certificates/ca/client"
3142
"github.com/smallstep/certificates/ca/identity"
3243
"github.com/smallstep/certificates/errs"
33-
"go.step.sm/cli-utils/step"
34-
"go.step.sm/crypto/jose"
35-
"go.step.sm/crypto/keyutil"
36-
"go.step.sm/crypto/pemutil"
37-
"go.step.sm/crypto/randutil"
38-
"go.step.sm/crypto/x509util"
39-
"golang.org/x/net/http2"
40-
"google.golang.org/protobuf/encoding/protojson"
41-
"google.golang.org/protobuf/proto"
4244
)
4345

4446
// DisableIdentity is a global variable to disable the identity.

‎ca/identity/identity.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,11 @@ import (
1414
"time"
1515

1616
"github.com/pkg/errors"
17-
"github.com/smallstep/certificates/api"
18-
"go.step.sm/cli-utils/step"
17+
18+
"github.com/smallstep/cli-utils/step"
1919
"go.step.sm/crypto/pemutil"
20+
21+
"github.com/smallstep/certificates/api"
2022
)
2123

2224
// Type represents the different types of identity files.

‎ca/provisioner.go

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,13 @@ import (
66
"time"
77

88
"github.com/pkg/errors"
9-
"github.com/smallstep/certificates/authority/provisioner"
10-
"go.step.sm/cli-utils/token"
11-
"go.step.sm/cli-utils/token/provision"
9+
10+
"github.com/smallstep/cli-utils/token"
11+
"github.com/smallstep/cli-utils/token/provision"
1212
"go.step.sm/crypto/jose"
1313
"go.step.sm/crypto/randutil"
14+
15+
"github.com/smallstep/certificates/authority/provisioner"
1416
)
1517

1618
const tokenLifetime = 5 * time.Minute

‎cas/stepcas/jwk_issuer.go

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,14 @@ import (
88
"time"
99

1010
"github.com/pkg/errors"
11+
12+
"github.com/smallstep/cli-utils/ui"
13+
"go.step.sm/crypto/jose"
14+
"go.step.sm/crypto/randutil"
15+
1116
"github.com/smallstep/certificates/authority/provisioner"
1217
"github.com/smallstep/certificates/ca"
1318
"github.com/smallstep/certificates/cas/apiv1"
14-
"go.step.sm/cli-utils/ui"
15-
"go.step.sm/crypto/jose"
16-
"go.step.sm/crypto/randutil"
1719
)
1820

1921
type jwkIssuer struct {

‎cmd/step-ca/main.go

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,15 @@ import (
1616
//nolint:gosec // profile server, if enabled runs on a different port
1717
_ "net/http/pprof"
1818

19+
"github.com/urfave/cli"
20+
1921
"github.com/smallstep/certificates/authority"
2022
"github.com/smallstep/certificates/commands"
21-
"github.com/urfave/cli"
22-
"go.step.sm/cli-utils/command"
23-
"go.step.sm/cli-utils/command/version"
24-
"go.step.sm/cli-utils/step"
25-
"go.step.sm/cli-utils/ui"
26-
"go.step.sm/cli-utils/usage"
23+
"github.com/smallstep/cli-utils/command"
24+
"github.com/smallstep/cli-utils/command/version"
25+
"github.com/smallstep/cli-utils/step"
26+
"github.com/smallstep/cli-utils/ui"
27+
"github.com/smallstep/cli-utils/usage"
2728
"go.step.sm/crypto/pemutil"
2829

2930
// Enabled kms interfaces.

‎commands/app.go

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,17 @@ import (
1313
"unicode"
1414

1515
"github.com/pkg/errors"
16+
"github.com/urfave/cli"
17+
18+
"github.com/smallstep/cli-utils/errs"
19+
"github.com/smallstep/cli-utils/step"
20+
1621
"github.com/smallstep/certificates/acme"
1722
"github.com/smallstep/certificates/authority/config"
1823
"github.com/smallstep/certificates/authority/provisioner"
1924
"github.com/smallstep/certificates/ca"
2025
"github.com/smallstep/certificates/db"
2126
"github.com/smallstep/certificates/pki"
22-
"github.com/urfave/cli"
23-
"go.step.sm/cli-utils/errs"
24-
"go.step.sm/cli-utils/step"
2527
)
2628

2729
// AppCommand is the action used as the top action.

‎commands/export.go

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,14 @@ import (
88
"unicode"
99

1010
"github.com/pkg/errors"
11-
"github.com/smallstep/certificates/authority"
12-
"github.com/smallstep/certificates/authority/config"
1311
"github.com/urfave/cli"
1412
"google.golang.org/protobuf/encoding/protojson"
1513

16-
"go.step.sm/cli-utils/command"
17-
"go.step.sm/cli-utils/errs"
14+
"github.com/smallstep/cli-utils/command"
15+
"github.com/smallstep/cli-utils/errs"
16+
17+
"github.com/smallstep/certificates/authority"
18+
"github.com/smallstep/certificates/authority/config"
1819
)
1920

2021
func init() {

0 commit comments

Comments
 (0)