diff options
Diffstat (limited to 'certServiceK8sExternalProvider/src/x509')
3 files changed, 107 insertions, 22 deletions
diff --git a/certServiceK8sExternalProvider/src/x509/testdata/test_data.go b/certServiceK8sExternalProvider/src/x509/testdata/test_data.go index dad5d094..b45d6102 100644 --- a/certServiceK8sExternalProvider/src/x509/testdata/test_data.go +++ b/certServiceK8sExternalProvider/src/x509/testdata/test_data.go @@ -20,8 +20,8 @@ package testdata - -const ValidCertificateSignRequest = (`-----BEGIN CERTIFICATE REQUEST----- +const ( + ValidCertificateSignRequest = `-----BEGIN CERTIFICATE REQUEST----- MIIDgjCCAmoCAQAwgaQxCzAJBgNVBAYTAlBMMRMwEQYDVQQIEwpEb2xueVNsYXNr MRAwDgYDVQQHEwdXcm9jbGF3MREwDwYDVQQJEwhMb3RuaWN6YTEPMA0GA1UEERMG MTItMzQ1MQ0wCwYDVQQKEwRPTkFQMQ0wCwYDVQQLEwRvbmFwMRwwGgYDVQQDExNj @@ -41,9 +41,8 @@ dnjRRFio75nCNRJdLOJ9FU3wIgdDZwGaiXdn5NDQxCe0BWcbElDJSYR/xOi7V0AM bcm17a8owa5dH9u/rmTmlrIT7PV4JHkZIogctIcSqod6xdr1mbi8G9DMFAqV+o7W 9kV7XDKhTqYoBIsXwfehNMu3lo72VuklIyVNiEVz4mVzpeZy2DgjRjCLt106yDHZ f3nco6O4y2EyexBVKq6QRFfZDUab6YcoEVvPAio01RmFrHgnxHs= ------END CERTIFICATE REQUEST-----`) - -const InvalidCertificateSignRequest = (`-----BEGIN INVALID REQUEST----- +-----END CERTIFICATE REQUEST-----` + InvalidCertificateSignRequest = `-----BEGIN INVALID REQUEST----- MIIDgjCCAmoCAQAwgaQxCzAJBgNVBAYTAlBMMRMwEQYDVQQIEwpEb2xueVNsYXNr MRAwDgYDVQQHEwdXcm9jbGF3MREwDwYDVQQJEwhMb3RuaWN6YTEPMA0GA1UEERMG MTItMzQ1MQ0wCwYDVQQKEwRPTkFQMQ0wCwYDVQQLEwRvbmFwMRwwGgYDVQQDExNj @@ -63,4 +62,61 @@ dnjRRFio75nCNRJdLOJ9FU3wIgdDZwGaiXdn5NDQxCe0BWcbElDJSYR/xOi7V0AM bcm17a8owa5dH9u/rmTmlrIT7PV4JHkZIogctIcSqod6xdr1mbi8G9DMFAqV+o7W 9kV7XDKhTqYoBIsXwfehNMu3lo72VuklIyVNiEVz4mVzpeZy2DgjRjCLt106yDHZ f3nco6O4y2EyexBVKq6QRFfZDUab6YcoEVvPAio01RmFrHgnxHs= ------END CERTIFICATE REQUEST-----`) +-----END CERTIFICATE REQUEST-----` + ValidPrivateKey = `-----BEGIN PRIVATE KEY----- +MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCeAKePTza3B9+Q +5wmjwAmIU18mDsNmiI01W/nY3nwAi5RyOZyU2Nm6nUyqB44Wb+g/2sjz5zVcVBp/ +cF+hnrbmwb8M4R2ImRyj3Em3huPq0oOuMqPP4YG0JJG7IzMDpL8r4HwR+mFJZUo+ +XiAbHcirEyGe5cPN645xbuZTzzMgvQ0etMn3p7OT4hUc5GO5XTeBInYrEAMmKPhw +2vOj+V/0to+euQ+QKO5poTWK3k8UOlx/QFTXUXC+CVs5ahDNPX6Gbw6h9v0kROG8 +bRZO4Hhk+NnygT5Lx8ErtMOacmFF1/yqSU5ehoMWGhqfcLzzFshRcwpsYBwDNq02 +VHDGSE5VAgMBAAECggEAfvAvricJ4kplBtlXGUOzZN72VnEN81ZJfFEEjYNRRG7f +OFWowrzlT9QIP6IKOWR2xrZTNADREfhPwYraidIlR4boosRJIfFA3TSh1Nx+R64R +NOZiTSTzO3MV0a8Z0ReOrwWPKDJr7rd9ylV8ncxz511baXlWsh1JN0DNsw+IGAgH +G2pzauF08SFK5SUCXG0a+id924zKiC2ko2p1RFyKuqbXEduyGaASBx7pUKgUhUO8 +Z820CnK0xb/Jnxj+B0QS+KiGt4NDv9xEpbLUARlwg3EzZKj3o5vuAJuscI3x9gYb +md6RU9v6EfE+45C0oAHJVEi54B/jW8W+m/1tfLZSEQKBgQDQzMGUSvihVLGKnMx0 +7oM0+yU2xrznicLpvcdy/24A877+pyxp2DrGWXWvIxMOfu0QhokeKea2xUIZKmZK +V0PV/gQA0vvDYrUzC4OWFNNv2XS8F2Z8UFR6B1VoFOrQwUqVfq3P84+3KeF3oE45 +ckiTQF4zb7Gk+8pk6M/l3HKJBwKBgQDBuELCb5yJqs52W/9kKCX/dEJ7645qX1lf +gLCLownAZ9KCM8SP1SGeaTNSXQ03ONLDbRq7aZE8+W/XHfU46eqsEaYfNvZs6OfI +CtMqcKK9X1ceWjzAj0e0nWRev7ooPD4firMlpK5Dj2+dCpyDTiFrtPGvmYtN/pGN +tLYIIbEiwwKBgCU0tzHTgiZNTy2h7xTPA3ZHYkQ2eabQd3jrJkUpmtJ0nI4H//QE +YcTCYCQLHfQxTdDqCDjlwoTC9ZpCYePRVPcmwlPbRJ12U097N8FgiKSfnRt/F/YC +4mq0L9XSFF2Kc93bquEpR2yd+90zJX07Dg+fIqoLtx3s+A2vJoyREZ+1AoGAJkXV +SrzqXHiWmePLLWqRN0ss53a+iF2WNrwiJTRs9MqOWJMJvrEJF1cJgLhJqCNd4KZp +paVRwI43fnS4winU53IFNB2TyiipwmgBGF1wiaGQgLqrThAAxrph3iZbDR/51hl9 +E27ZzxdDoe86xOZmy/TP2zWmxB4Le8e8PxcI/CkCgYAMXDDF9Au/Xdqtg/72NRhJ +cwNajA+qN007/CckuL0h4q6686di9p1CFycY/DVoKrBV+3jIRmgYQNpCz/dGTkLk +HIebZi6IKihtSgXHHHMUpCrMJusUmi/dS32o0oLaAgt0xLvm2YpWg5Xo8oHcGFg0 +nVrkIZBTARzDWwpdDfkjBA== +-----END PRIVATE KEY-----` + InvalidPrivateKey = `-----BEGIN INVALID KEY----- +MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCeAKePTza3B9+Q +5wmjwAmIU18mDsNmiI01W/nY3nwAi5RyOZyU2Nm6nUyqB44Wb+g/2sjz5zVcVBp/ +cF+hnrbmwb8M4R2ImRyj3Em3huPq0oOuMqPP4YG0JJG7IzMDpL8r4HwR+mFJZUo+ +XiAbHcirEyGe5cPN645xbuZTzzMgvQ0etMn3p7OT4hUc5GO5XTeBInYrEAMmKPhw +2vOj+V/0to+euQ+QKO5poTWK3k8UOlx/QFTXUXC+CVs5ahDNPX6Gbw6h9v0kROG8 +bRZO4Hhk+NnygT5Lx8ErtMOacmFF1/yqSU5ehoMWGhqfcLzzFshRcwpsYBwDNq02 +VHDGSE5VAgMBAAECggEAfvAvricJ4kplBtlXGUOzZN72VnEN81ZJfFEEjYNRRG7f +OFWowrzlT9QIP6IKOWR2xrZTNADREfhPwYraidIlR4boosRJIfFA3TSh1Nx+R64R +NOZiTSTzO3MV0a8Z0ReOrwWPKDJr7rd9ylV8ncxz511baXlWsh1JN0DNsw+IGAgH +G2pzauF08SFK5SUCXG0a+id924zKiC2ko2p1RFyKuqbXEduyGaASBx7pUKgUhUO8 +Z820CnK0xb/Jnxj+B0QS+KiGt4NDv9xEpbLUARlwg3EzZKj3o5vuAJuscI3x9gYb +md6RU9v6EfE+45C0oAHJVEi54B/jW8W+m/1tfLZSEQKBgQDQzMGUSvihVLGKnMx0 +7oM0+yU2xrznicLpvcdy/24A877+pyxp2DrGWXWvIxMOfu0QhokeKea2xUIZKmZK +V0PV/gQA0vvDYrUzC4OWFNNv2XS8F2Z8UFR6B1VoFOrQwUqVfq3P84+3KeF3oE45 +ckiTQF4zb7Gk+8pk6M/l3HKJBwKBgQDBuELCb5yJqs52W/9kKCX/dEJ7645qX1lf +gLCLownAZ9KCM8SP1SGeaTNSXQ03ONLDbRq7aZE8+W/XHfU46eqsEaYfNvZs6OfI +CtMqcKK9X1ceWjzAj0e0nWRev7ooPD4firMlpK5Dj2+dCpyDTiFrtPGvmYtN/pGN +tLYIIbEiwwKBgCU0tzHTgiZNTy2h7xTPA3ZHYkQ2eabQd3jrJkUpmtJ0nI4H//QE +YcTCYCQLHfQxTdDqCDjlwoTC9ZpCYePRVPcmwlPbRJ12U097N8FgiKSfnRt/F/YC +4mq0L9XSFF2Kc93bquEpR2yd+90zJX07Dg+fIqoLtx3s+A2vJoyREZ+1AoGAJkXV +SrzqXHiWmePLLWqRN0ss53a+iF2WNrwiJTRs9MqOWJMJvrEJF1cJgLhJqCNd4KZp +paVRwI43fnS4winU53IFNB2TyiipwmgBGF1wiaGQgLqrThAAxrph3iZbDR/51hl9 +E27ZzxdDoe86xOZmy/TP2zWmxB4Le8e8PxcI/CkCgYAMXDDF9Au/Xdqtg/72NRhJ +cwNajA+qN007/CckuL0h4q6686di9p1CFycY/DVoKrBV+3jIRmgYQNpCz/dGTkLk +HIebZi6IKihtSgXHHHMUpCrMJusUmi/dS32o0oLaAgt0xLvm2YpWg5Xo8oHcGFg0 +nVrkIZBTARzDWwpdDfkjBA== +-----END PRIVATE KEY-----` +) diff --git a/certServiceK8sExternalProvider/src/x509/x509_utils.go b/certServiceK8sExternalProvider/src/x509/x509_utils.go index b2530132..e1e887f0 100644 --- a/certServiceK8sExternalProvider/src/x509/x509_utils.go +++ b/certServiceK8sExternalProvider/src/x509/x509_utils.go @@ -27,14 +27,16 @@ import ( "fmt" ) -// decodeCSR decodes a certificate request in PEM format and returns the +const ( + PemCsrType = "CERTIFICATE REQUEST" + pemPrivateKeyType = "PRIVATE KEY" +) + +// decodeCSR decodes a certificate request in PEM format func DecodeCSR(data []byte) (*x509.CertificateRequest, error) { - block, rest := pem.Decode(data) - if block == nil || len(rest) > 0 { - return nil, fmt.Errorf("unexpected CSR PEM on sign request") - } - if block.Type != "CERTIFICATE REQUEST" { - return nil, fmt.Errorf("PEM is not a certificate request") + block, err := decodePemBlock(data, PemCsrType) + if err != nil { + return nil, fmt.Errorf("error decoding CSR PEM: %v", err) } csr, err := x509.ParseCertificateRequest(block.Bytes) if err != nil { @@ -46,16 +48,30 @@ func DecodeCSR(data []byte) (*x509.CertificateRequest, error) { return csr, nil } -// encodeX509 will encode a *x509.Certificate into PEM format. -func EncodeX509(cert *x509.Certificate) ([]byte, error) { - caPem := bytes.NewBuffer([]byte{}) - err := pem.Encode(caPem, &pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw}) +func DecodePrivateKey(data []byte) (interface{}, error) { + block, err := decodePemBlock(data, pemPrivateKeyType) + if err != nil { + return nil, fmt.Errorf("error decoding Private Key PEM: %v", err) + } + key, err := x509.ParsePKCS8PrivateKey(block.Bytes) if err != nil { - return nil, err + return nil, fmt.Errorf("error parsing Private Key: %v", err) } - return caPem.Bytes(), nil + return key, nil } +func decodePemBlock(data []byte, pemType string) (*pem.Block, error) { + block, rest := pem.Decode(data) + if block == nil || len(rest) > 0 { + return nil, fmt.Errorf("unexpected PEM") + } + if block.Type != pemType { + return nil, fmt.Errorf("PEM is not: %s", pemType) + } + return block, nil +} + + func ParseCertificateArrayToBytes(certificateArray []string) ([]byte, error) { buffer := bytes.NewBuffer([]byte{}) for _, cert := range certificateArray { diff --git a/certServiceK8sExternalProvider/src/x509/x509_utils_test.go b/certServiceK8sExternalProvider/src/x509/x509_utils_test.go index 2692bf4e..c867d2e8 100644 --- a/certServiceK8sExternalProvider/src/x509/x509_utils_test.go +++ b/certServiceK8sExternalProvider/src/x509/x509_utils_test.go @@ -28,15 +28,28 @@ import ( "onap.org/oom-certservice/k8s-external-provider/src/x509/testdata" ) -func TestShouldDecodeCSR(t *testing.T) { +func Test_DecodeCSR_ShouldDecodeValidCsr(t *testing.T) { csr, err := DecodeCSR([]byte(testdata.ValidCertificateSignRequest)) assert.Nil(t, err) assert.Equal(t, "ONAP", csr.Subject.Organization[0]) } -func TestShouldReturnError(t *testing.T) { +func Test_DecodeCSR_ShouldReturnErrorForInvalidCsr(t *testing.T) { _, err := DecodeCSR([]byte(testdata.InvalidCertificateSignRequest)) - assert.NotNil(t, err) + assert.Error(t, err) +} + +func Test_DecodePrivateKey_ShouldDecodeValidPrivateKey(t *testing.T) { + privateKey, err := DecodePrivateKey([]byte(testdata.ValidPrivateKey)) + + assert.Nil(t, err) + assert.NotNil(t, privateKey) +} + +func Test_DecodePrivateKey_ShouldReturnErrorForInvalidPrivateKey(t *testing.T) { + _, err := DecodePrivateKey([]byte(testdata.InvalidPrivateKey)) + + assert.Error(t, err) } |