435c0d9fc8
This PR switches the Nomad repository from using govendor to Go modules for managing dependencies. Aspects of the Nomad workflow remain pretty much the same. The usual Makefile targets should continue to work as they always did. The API submodule simply defers to the parent Nomad version on the repository, keeping the semantics of API versioning that currently exists.
132 lines
3.4 KiB
Go
132 lines
3.4 KiB
Go
//
|
|
// Copyright (c) 2018, Joyent, Inc. All rights reserved.
|
|
//
|
|
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
//
|
|
|
|
package authentication
|
|
|
|
import (
|
|
"crypto"
|
|
"crypto/rand"
|
|
"crypto/rsa"
|
|
"crypto/x509"
|
|
"encoding/base64"
|
|
"encoding/pem"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/pkg/errors"
|
|
"golang.org/x/crypto/ssh"
|
|
)
|
|
|
|
type PrivateKeySigner struct {
|
|
formattedKeyFingerprint string
|
|
keyFingerprint string
|
|
algorithm string
|
|
accountName string
|
|
userName string
|
|
hashFunc crypto.Hash
|
|
|
|
privateKey *rsa.PrivateKey
|
|
}
|
|
|
|
type PrivateKeySignerInput struct {
|
|
KeyID string
|
|
PrivateKeyMaterial []byte
|
|
AccountName string
|
|
Username string
|
|
}
|
|
|
|
func NewPrivateKeySigner(input PrivateKeySignerInput) (*PrivateKeySigner, error) {
|
|
keyFingerprintMD5 := strings.Replace(input.KeyID, ":", "", -1)
|
|
|
|
block, _ := pem.Decode(input.PrivateKeyMaterial)
|
|
if block == nil {
|
|
return nil, errors.New("Error PEM-decoding private key material: nil block received")
|
|
}
|
|
|
|
rsakey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
|
|
if err != nil {
|
|
return nil, errors.Wrap(err, "unable to parse private key")
|
|
}
|
|
|
|
sshPublicKey, err := ssh.NewPublicKey(rsakey.Public())
|
|
if err != nil {
|
|
return nil, errors.Wrap(err, "unable to parse SSH key from private key")
|
|
}
|
|
|
|
matchKeyFingerprint := formatPublicKeyFingerprint(sshPublicKey, false)
|
|
displayKeyFingerprint := formatPublicKeyFingerprint(sshPublicKey, true)
|
|
if matchKeyFingerprint != keyFingerprintMD5 {
|
|
return nil, errors.New("Private key file does not match public key fingerprint")
|
|
}
|
|
|
|
signer := &PrivateKeySigner{
|
|
formattedKeyFingerprint: displayKeyFingerprint,
|
|
keyFingerprint: input.KeyID,
|
|
accountName: input.AccountName,
|
|
|
|
hashFunc: crypto.SHA1,
|
|
privateKey: rsakey,
|
|
}
|
|
|
|
if input.Username != "" {
|
|
signer.userName = input.Username
|
|
}
|
|
|
|
_, algorithm, err := signer.SignRaw("HelloWorld")
|
|
if err != nil {
|
|
return nil, fmt.Errorf("Cannot sign using ssh agent: %s", err)
|
|
}
|
|
signer.algorithm = algorithm
|
|
|
|
return signer, nil
|
|
}
|
|
|
|
func (s *PrivateKeySigner) Sign(dateHeader string, isManta bool) (string, error) {
|
|
const headerName = "date"
|
|
|
|
hash := s.hashFunc.New()
|
|
hash.Write([]byte(fmt.Sprintf("%s: %s", headerName, dateHeader)))
|
|
digest := hash.Sum(nil)
|
|
|
|
signed, err := rsa.SignPKCS1v15(rand.Reader, s.privateKey, s.hashFunc, digest)
|
|
if err != nil {
|
|
return "", errors.Wrap(err, "unable to sign date header")
|
|
}
|
|
signedBase64 := base64.StdEncoding.EncodeToString(signed)
|
|
|
|
key := &KeyID{
|
|
UserName: s.userName,
|
|
AccountName: s.accountName,
|
|
Fingerprint: s.formattedKeyFingerprint,
|
|
IsManta: isManta,
|
|
}
|
|
|
|
return fmt.Sprintf(authorizationHeaderFormat, key.generate(), "rsa-sha1", headerName, signedBase64), nil
|
|
}
|
|
|
|
func (s *PrivateKeySigner) SignRaw(toSign string) (string, string, error) {
|
|
hash := s.hashFunc.New()
|
|
hash.Write([]byte(toSign))
|
|
digest := hash.Sum(nil)
|
|
|
|
signed, err := rsa.SignPKCS1v15(rand.Reader, s.privateKey, s.hashFunc, digest)
|
|
if err != nil {
|
|
return "", "", errors.Wrap(err, "unable to sign date header")
|
|
}
|
|
signedBase64 := base64.StdEncoding.EncodeToString(signed)
|
|
return signedBase64, "rsa-sha1", nil
|
|
}
|
|
|
|
func (s *PrivateKeySigner) KeyFingerprint() string {
|
|
return s.formattedKeyFingerprint
|
|
}
|
|
|
|
func (s *PrivateKeySigner) DefaultAlgorithm() string {
|
|
return s.algorithm
|
|
}
|