s-christoffandJim
6b78108ecf
* add new error funcs which take a ctx and deprecate existing funcs * use context where available when writing error events * remove circular internal/errors pkg dep * suppress some chatty errors using errors.WithoutEvent() * convert auth oidc funcs to take context where needed to write events Co-authored-by: Jim <jlambert@hashicorp.com>
71 lines
2.1 KiB
Go
71 lines
2.1 KiB
Go
package credentialstores
|
|
|
|
import (
|
|
"encoding/pem"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/hashicorp/boundary/internal/errors"
|
|
)
|
|
|
|
// extractClientCertAndPk takes the values passed into the api for client
|
|
// certificate and client certificate key and parses them into pem blocks.
|
|
// Any non certificate pem blocks are treated as a private key. An error is
|
|
// returned if there is more than 1 private key provided across both fields.
|
|
func extractClientCertAndPk(cert, pk string) ([]*pem.Block, *pem.Block, error) {
|
|
const op = "credentialstores.extractClientCertAndPk"
|
|
pks, err := decodePemBlocks(pk)
|
|
if err != nil {
|
|
return nil, nil, errors.WrapDeprecated(err, op, errors.WithMsg("failed to parse client certificate private key"))
|
|
}
|
|
var pkPem *pem.Block
|
|
switch len(pks) {
|
|
case 0:
|
|
case 1:
|
|
pkPem = pks[0]
|
|
default:
|
|
return nil, nil, errors.NewDeprecated(errors.InvalidParameter, op, "private key payload contained multiple pem blocks")
|
|
}
|
|
|
|
bs, err := decodePemBlocks(cert)
|
|
if err != nil {
|
|
return nil, nil, errors.WrapDeprecated(err, op, errors.WithMsg("failed to parse client certificate into pem blocks"))
|
|
}
|
|
pkIdx := -1
|
|
for i, b := range bs {
|
|
if !strings.Contains(b.Type, "CERTIFICATE") {
|
|
switch {
|
|
case pkPem == nil:
|
|
pkIdx, pkPem = i, b
|
|
case pkIdx < 0:
|
|
return nil, nil, errors.NewDeprecated(errors.InvalidParameter, op, "client certificate contains a private key when one was also provided separately")
|
|
default:
|
|
return nil, nil, errors.NewDeprecated(errors.InvalidParameter, op, fmt.Sprintf("second primary key found at %d after previous one found at %d", i, pkIdx))
|
|
}
|
|
}
|
|
}
|
|
if pkIdx >= 0 {
|
|
bs = append(bs[:pkIdx], bs[pkIdx+1:]...)
|
|
}
|
|
return bs, pkPem, nil
|
|
}
|
|
|
|
func decodePemBlocks(input string) ([]*pem.Block, error) {
|
|
const op = "credentialstores.decodePemBlocks"
|
|
cpIn := make([]byte, len(input))
|
|
copy(cpIn, input)
|
|
var p *pem.Block
|
|
var ret []*pem.Block
|
|
for {
|
|
p, cpIn = pem.Decode(cpIn)
|
|
if p == nil {
|
|
break
|
|
}
|
|
ret = append(ret, p)
|
|
}
|
|
if len(cpIn) > 0 {
|
|
return nil, errors.NewDeprecated(errors.InvalidParameter, op, "not all data parseable by pem block")
|
|
}
|
|
return ret, nil
|
|
}
|