github.com/Venafi/vcert/v5@v5.10.2/pkg/venafi/cloud/certificatePolicies.go (about)

     1  /*
     2   * Copyright 2018 Venafi, Inc.
     3   *
     4   * Licensed under the Apache License, Version 2.0 (the "License");
     5   * you may not use this file except in compliance with the License.
     6   * You may obtain a copy of the License at
     7   *
     8   *  http://www.apache.org/licenses/LICENSE-2.0
     9   *
    10   * Unless required by applicable law or agreed to in writing, software
    11   * distributed under the License is distributed on an "AS IS" BASIS,
    12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13   * See the License for the specific language governing permissions and
    14   * limitations under the License.
    15   */
    16  
    17  package cloud
    18  
    19  import (
    20  	"strings"
    21  	"time"
    22  
    23  	"github.com/Venafi/vcert/v5/pkg/certificate"
    24  	"github.com/Venafi/vcert/v5/pkg/endpoint"
    25  )
    26  
    27  type certificateTemplate struct {
    28  	ID                                  string `json:"id,omitempty"`
    29  	CompanyID                           string `json:"companyId,omitempty"`
    30  	CertificateAuthority                string `json:"certificateAuthority"`
    31  	Name                                string `json:"name,omitempty"`
    32  	CertificateAuthorityAccountId       string `json:"certificateAuthorityAccountId"`
    33  	CertificateAuthorityProductOptionId string `json:"certificateAuthorityProductOptionId"`
    34  	Product                             struct {
    35  		CertificateAuthority string `json:"certificateAuthority"`
    36  		ProductName          string `json:"productName"`
    37  	} `json:"product"`
    38  	Priority                            int              `json:"priority"`
    39  	SystemGenerated                     bool             `json:"systemGenerated,omitempty"`
    40  	CreationDateString                  string           `json:"creationDate,omitempty"`
    41  	CreationDate                        time.Time        `json:"-"`
    42  	ModificationDateString              string           `json:"modificationDate"`
    43  	ModificationDate                    time.Time        `json:"-"`
    44  	Status                              string           `json:"status"`
    45  	Reason                              string           `json:"reason"`
    46  	SubjectCNRegexes                    []string         `json:"subjectCNRegexes,omitempty"`
    47  	SubjectORegexes                     []string         `json:"subjectORegexes,omitempty"`
    48  	SubjectOURegexes                    []string         `json:"subjectOURegexes,omitempty"`
    49  	SubjectSTRegexes                    []string         `json:"subjectSTRegexes,omitempty"`
    50  	SubjectLRegexes                     []string         `json:"subjectLRegexes,omitempty"`
    51  	SubjectCValues                      []string         `json:"subjectCValues,omitempty"`
    52  	SANRegexes                          []string         `json:"sanRegexes,omitempty"`
    53  	SanRfc822NameRegexes                []string         `json:"sanRfc822NameRegexes,omitempty"`
    54  	SanIpAddressRegexes                 []string         `json:"sanIpAddressRegexes,omitempty"`
    55  	SanUniformResourceIdentifierRegexes []string         `json:"sanUniformResourceIdentifierRegexes,omitempty"`
    56  	KeyTypes                            []allowedKeyType `json:"keyTypes,omitempty"`
    57  	KeyReuse                            bool             `json:"keyReuse,omitempty"`
    58  	RecommendedSettings                 struct {
    59  		SubjectOValue, SubjectOUValue,
    60  		SubjectSTValue, SubjectLValue,
    61  		SubjectCValue string
    62  		Key struct {
    63  			Type   string
    64  			Length int
    65  			Curve  string
    66  		}
    67  		keyReuse bool
    68  	}
    69  	ValidityPeriod              string `json:"validityPeriod,omitempty"`
    70  	CsrUploadAllowed            bool   `json:"csrUploadAllowed"`
    71  	KeyGeneratedByVenafiAllowed bool   `json:"keyGeneratedByVenafiAllowed"`
    72  }
    73  
    74  type CertificateTemplates struct {
    75  	CertificateTemplates []certificateTemplate `json:"certificateIssuingTemplates"`
    76  }
    77  
    78  type allowedKeyType struct {
    79  	KeyType    keyType
    80  	KeyLengths []int
    81  	KeyCurves  []string `json:"keyCurves,omitempty"`
    82  }
    83  
    84  type keyType string
    85  
    86  func (ct certificateTemplate) toPolicy() (p endpoint.Policy) {
    87  	addStartEnd := func(s string) string {
    88  		if !strings.HasPrefix(s, "^") {
    89  			s = "^" + s
    90  		}
    91  		if !strings.HasSuffix(s, "$") {
    92  			s = s + "$"
    93  		}
    94  		return s
    95  	}
    96  	addStartEndToArray := func(ss []string) []string {
    97  		// if the array is nil, return nil
    98  		if ss == nil {
    99  			return nil
   100  		}
   101  
   102  		a := make([]string, len(ss))
   103  		for i, s := range ss {
   104  			a[i] = addStartEnd(s)
   105  		}
   106  		return a
   107  	}
   108  
   109  	p.SubjectCNRegexes = addStartEndToArray(ct.SubjectCNRegexes)
   110  	p.SubjectOURegexes = addStartEndToArray(ct.SubjectOURegexes)
   111  	p.SubjectCRegexes = addStartEndToArray(ct.SubjectCValues) // For some reason, the API field is named subjectCValues instead of subjectCRegexes
   112  	p.SubjectSTRegexes = addStartEndToArray(ct.SubjectSTRegexes)
   113  	p.SubjectLRegexes = addStartEndToArray(ct.SubjectLRegexes)
   114  	p.SubjectORegexes = addStartEndToArray(ct.SubjectORegexes)
   115  
   116  	p.DnsSanRegExs = addStartEndToArray(ct.SANRegexes)
   117  	p.IpSanRegExs = addStartEndToArray(ct.SanIpAddressRegexes)
   118  	p.EmailSanRegExs = addStartEndToArray(ct.SanRfc822NameRegexes)
   119  	p.UriSanRegExs = addStartEndToArray(ct.SanUniformResourceIdentifierRegexes)
   120  	p.UpnSanRegExs = nil // UPN regexes are not provided by the API
   121  
   122  	p.AllowKeyReuse = ct.KeyReuse
   123  	allowWildCards := false
   124  	for _, s := range p.SubjectCNRegexes {
   125  		if strings.HasPrefix(s, `^.*`) {
   126  			allowWildCards = true
   127  		}
   128  	}
   129  	for _, s := range p.DnsSanRegExs {
   130  		if strings.HasPrefix(s, `^.*`) {
   131  			allowWildCards = true
   132  		}
   133  	}
   134  	p.AllowWildcards = allowWildCards
   135  
   136  	for _, kt := range ct.KeyTypes {
   137  		keyConfiguration := endpoint.AllowedKeyConfiguration{}
   138  		if err := keyConfiguration.KeyType.Set(string(kt.KeyType), ""); err != nil {
   139  			panic(err)
   140  		}
   141  
   142  		keyConfiguration.KeySizes = kt.KeyLengths[:]
   143  		for _, keyCurve := range kt.KeyCurves {
   144  			v := certificate.EllipticCurveNotSet
   145  			if err := (&v).Set(keyCurve); err != nil {
   146  				panic(err)
   147  			}
   148  
   149  			keyConfiguration.KeyCurves = append(keyConfiguration.KeyCurves, v)
   150  		}
   151  		p.AllowedKeyConfigurations = append(p.AllowedKeyConfigurations, keyConfiguration)
   152  	}
   153  	return
   154  }
   155  
   156  func (ct certificateTemplate) toZoneConfig(zc *endpoint.ZoneConfiguration) {
   157  	r := ct.RecommendedSettings
   158  	zc.Country = r.SubjectCValue
   159  	zc.Province = r.SubjectSTValue
   160  	zc.Locality = r.SubjectLValue
   161  	zc.Organization = r.SubjectOValue
   162  	if r.SubjectOUValue != "" {
   163  		zc.OrganizationalUnit = []string{r.SubjectOUValue}
   164  	}
   165  	key := endpoint.AllowedKeyConfiguration{}
   166  	err := key.KeyType.Set(r.Key.Type, r.Key.Curve)
   167  	if err != nil {
   168  		return
   169  	}
   170  	if r.Key.Length == 0 {
   171  		return
   172  	}
   173  	key.KeySizes = []int{r.Key.Length}
   174  	zc.KeyConfiguration = &key
   175  }
   176  
   177  /*
   178  "signatureAlgorithm":{"type":"string","enum":["MD2_WITH_RSA_ENCRYPTION","MD5_WITH_RSA_ENCRYPTION","SHA1_WITH_RSA_ENCRYPTION","SHA1_WITH_RSA_ENCRYPTION2","SHA256_WITH_RSA_ENCRYPTION","SHA384_WITH_RSA_ENCRYPTION","SHA512_WITH_RSA_ENCRYPTION","ID_DSA_WITH_SHA1","dsaWithSHA1","EC_DSA_WITH_SHA1","EC_DSA_WITH_SHA224","EC_DSA_WITH_SHA256","EC_DSA_WITH_SHA384","EC_DSA_WITH_SHA512","UNKNOWN","SHA1_WITH_RSAandMGF1","GOST_R3411_94_WITH_GOST_R3410_2001","GOST_R3411_94_WITH_GOST_R3410_94"]},
   179  "signatureHashAlgorithm":{"type":"string","enum":["MD5","SHA1","MD2","SHA224","SHA256","SHA384","SHA512","UNKNOWN","GOSTR3411_94"]}
   180  */