1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
|
package main
import (
"crypto/ecdsa"
"crypto/ed25519"
"crypto/rsa"
"errors"
"flag"
"net"
"net/http"
"github.com/cloudflare/cfssl/api/info"
"github.com/cloudflare/cfssl/certdb/sql"
"github.com/cloudflare/cfssl/log"
"github.com/cloudflare/cfssl/multiroot/config"
"github.com/cloudflare/cfssl/signer"
"github.com/cloudflare/cfssl/signer/local"
"github.com/cloudflare/cfssl/whitelist"
"github.com/prometheus/client_golang/prometheus/promhttp"
_ "github.com/go-sql-driver/mysql" // import to support MySQL
_ "github.com/lib/pq" // import to support Postgres
_ "github.com/mattn/go-sqlite3" // import to support SQLite
)
func parseSigner(root *config.Root) (signer.Signer, error) {
privateKey := root.PrivateKey
switch priv := privateKey.(type) {
case *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey:
s, err := local.NewSigner(priv, root.Certificate, signer.DefaultSigAlgo(priv), nil)
if err != nil {
return nil, err
}
s.SetPolicy(root.Config)
if root.DB != nil {
dbAccessor := sql.NewAccessor(root.DB)
s.SetDBAccessor(dbAccessor)
}
return s, nil
default:
return nil, errors.New("unsupported private key type")
}
}
var (
defaultLabel string
signers = map[string]signer.Signer{}
whitelists = map[string]whitelist.NetACL{}
)
func main() {
flagAddr := flag.String("a", ":8888", "listening address")
flagRootFile := flag.String("roots", "", "configuration file specifying root keys")
flagDefaultLabel := flag.String("l", "", "specify a default label")
flagEndpointCert := flag.String("tls-cert", "", "server certificate")
flagEndpointKey := flag.String("tls-key", "", "server private key")
flag.IntVar(&log.Level, "loglevel", log.LevelInfo, "Log level (0 = DEBUG, 5 = FATAL)")
flag.Parse()
if *flagRootFile == "" {
log.Fatal("no root file specified")
}
roots, err := config.Parse(*flagRootFile)
if err != nil {
log.Fatalf("%v", err)
}
for label, root := range roots {
s, err := parseSigner(root)
if err != nil {
log.Criticalf("%v", err)
}
signers[label] = s
if root.ACL != nil {
whitelists[label] = root.ACL
}
log.Info("loaded signer ", label)
}
defaultLabel = *flagDefaultLabel
infoHandler, err := info.NewMultiHandler(signers, defaultLabel)
if err != nil {
log.Criticalf("%v", err)
}
var localhost = whitelist.NewBasic()
localhost.Add(net.ParseIP("127.0.0.1"))
localhost.Add(net.ParseIP("::1"))
http.HandleFunc("/api/v1/cfssl/authsign", dispatchRequest)
http.Handle("/api/v1/cfssl/info", infoHandler)
http.Handle("/metrics", promhttp.Handler())
if *flagEndpointCert == "" && *flagEndpointKey == "" {
log.Info("Now listening on ", *flagAddr)
log.Fatal(http.ListenAndServe(*flagAddr, nil))
} else {
log.Info("Now listening on https:// ", *flagAddr)
log.Fatal(http.ListenAndServeTLS(*flagAddr, *flagEndpointCert, *flagEndpointKey, nil))
}
}
|
