1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
package x509svid
import (
"crypto/x509"
"time"
"github.com/spiffe/go-spiffe/v2/bundle/x509bundle"
"github.com/spiffe/go-spiffe/v2/internal/x509util"
"github.com/spiffe/go-spiffe/v2/spiffeid"
"github.com/zeebo/errs"
)
var x509svidErr = errs.Class("x509svid")
// VerifyOption is an option used when verifying X509-SVIDs.
type VerifyOption interface {
apply(config *verifyConfig)
}
// WithTime sets the time used when verifying validity periods on the X509-SVID.
// If not used, the current time will be used.
func WithTime(now time.Time) VerifyOption {
return verifyOption(func(config *verifyConfig) {
config.now = now
})
}
// Verify verifies an X509-SVID chain using the X.509 bundle source. It
// returns the SPIFFE ID of the X509-SVID and one or more chains back to a root
// in the bundle.
func Verify(certs []*x509.Certificate, bundleSource x509bundle.Source, opts ...VerifyOption) (spiffeid.ID, [][]*x509.Certificate, error) {
config := &verifyConfig{}
for _, opt := range opts {
opt.apply(config)
}
switch {
case len(certs) == 0:
return spiffeid.ID{}, nil, x509svidErr.New("empty certificates chain")
case bundleSource == nil:
return spiffeid.ID{}, nil, x509svidErr.New("bundleSource is required")
}
leaf := certs[0]
id, err := IDFromCert(leaf)
if err != nil {
return spiffeid.ID{}, nil, x509svidErr.New("could not get leaf SPIFFE ID: %w", err)
}
switch {
case leaf.IsCA:
return id, nil, x509svidErr.New("leaf certificate with CA flag set to true")
case leaf.KeyUsage&x509.KeyUsageCertSign > 0:
return id, nil, x509svidErr.New("leaf certificate with KeyCertSign key usage")
case leaf.KeyUsage&x509.KeyUsageCRLSign > 0:
return id, nil, x509svidErr.New("leaf certificate with KeyCrlSign key usage")
}
bundle, err := bundleSource.GetX509BundleForTrustDomain(id.TrustDomain())
if err != nil {
return id, nil, x509svidErr.New("could not get X509 bundle: %w", err)
}
verifiedChains, err := leaf.Verify(x509.VerifyOptions{
Roots: x509util.NewCertPool(bundle.X509Authorities()),
Intermediates: x509util.NewCertPool(certs[1:]),
KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageAny},
CurrentTime: config.now,
})
if err != nil {
return id, nil, x509svidErr.New("could not verify leaf certificate: %w", err)
}
return id, verifiedChains, nil
}
// ParseAndVerify parses and verifies an X509-SVID chain using the X.509
// bundle source. It returns the SPIFFE ID of the X509-SVID and one or more
// chains back to a root in the bundle.
func ParseAndVerify(rawCerts [][]byte, bundleSource x509bundle.Source, opts ...VerifyOption) (spiffeid.ID, [][]*x509.Certificate, error) {
var certs []*x509.Certificate
for _, rawCert := range rawCerts {
cert, err := x509.ParseCertificate(rawCert)
if err != nil {
return spiffeid.ID{}, nil, x509svidErr.New("unable to parse certificate: %w", err)
}
certs = append(certs, cert)
}
return Verify(certs, bundleSource, opts...)
}
// IDFromCert extracts the SPIFFE ID from the URI SAN of the provided
// certificate. It will return an an error if the certificate does not have
// exactly one URI SAN with a well-formed SPIFFE ID.
func IDFromCert(cert *x509.Certificate) (spiffeid.ID, error) {
switch {
case len(cert.URIs) == 0:
return spiffeid.ID{}, errs.New("certificate contains no URI SAN")
case len(cert.URIs) > 1:
return spiffeid.ID{}, errs.New("certificate contains more than one URI SAN")
}
return spiffeid.FromURI(cert.URIs[0])
}
type verifyConfig struct {
now time.Time
}
type verifyOption func(config *verifyConfig)
func (fn verifyOption) apply(config *verifyConfig) {
fn(config)
}
|
