github.com/mitchellh/packer@v1.3.2/builder/azure/pkcs12/safebags.go (about) 1 // Copyright 2015 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 package pkcs12 6 7 import ( 8 "crypto/x509" 9 "crypto/x509/pkix" 10 "encoding/asn1" 11 "errors" 12 ) 13 14 var ( 15 // see https://tools.ietf.org/html/rfc7292#appendix-D 16 oidCertTypeX509Certificate = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 9, 22, 1}) 17 oidPKCS8ShroudedKeyBag = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 10, 1, 2}) 18 oidCertBag = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 10, 1, 3}) 19 ) 20 21 type certBag struct { 22 Id asn1.ObjectIdentifier 23 Data []byte `asn1:"tag:0,explicit"` 24 } 25 26 func getAlgorithmParams(salt []byte, iterations int) (asn1.RawValue, error) { 27 params := pbeParams{ 28 Salt: salt, 29 Iterations: iterations, 30 } 31 32 return convertToRawVal(params) 33 } 34 35 func encodePkcs8ShroudedKeyBag(privateKey interface{}, password []byte) (bytes []byte, err error) { 36 privateKeyBytes, err := marshalPKCS8PrivateKey(privateKey) 37 38 if err != nil { 39 return nil, errors.New("pkcs12: error encoding PKCS#8 private key: " + err.Error()) 40 } 41 42 salt, err := makeSalt(pbeSaltSizeBytes) 43 if err != nil { 44 return nil, errors.New("pkcs12: error creating PKCS#8 salt: " + err.Error()) 45 } 46 47 pkData, err := pbEncrypt(privateKeyBytes, salt, password, pbeIterationCount) 48 if err != nil { 49 return nil, errors.New("pkcs12: error encoding PKCS#8 shrouded key bag when encrypting cert bag: " + err.Error()) 50 } 51 52 params, err := getAlgorithmParams(salt, pbeIterationCount) 53 if err != nil { 54 return nil, errors.New("pkcs12: error encoding PKCS#8 shrouded key bag algorithm's parameters: " + err.Error()) 55 } 56 57 pkinfo := encryptedPrivateKeyInfo{ 58 AlgorithmIdentifier: pkix.AlgorithmIdentifier{ 59 Algorithm: oidPBEWithSHAAnd3KeyTripleDESCBC, 60 Parameters: params, 61 }, 62 EncryptedData: pkData, 63 } 64 65 bytes, err = asn1.Marshal(pkinfo) 66 if err != nil { 67 return nil, errors.New("pkcs12: error encoding PKCS#8 shrouded key bag: " + err.Error()) 68 } 69 70 return bytes, err 71 } 72 73 func decodePkcs8ShroudedKeyBag(asn1Data, password []byte) (privateKey interface{}, err error) { 74 pkinfo := new(encryptedPrivateKeyInfo) 75 if err = unmarshal(asn1Data, pkinfo); err != nil { 76 return nil, errors.New("pkcs12: error decoding PKCS#8 shrouded key bag: " + err.Error()) 77 } 78 79 pkData, err := pbDecrypt(pkinfo, password) 80 if err != nil { 81 return nil, errors.New("pkcs12: error decrypting PKCS#8 shrouded key bag: " + err.Error()) 82 } 83 84 ret := new(asn1.RawValue) 85 if err = unmarshal(pkData, ret); err != nil { 86 return nil, errors.New("pkcs12: error unmarshalling decrypted private key: " + err.Error()) 87 } 88 89 if privateKey, err = x509.ParsePKCS8PrivateKey(pkData); err != nil { 90 return nil, errors.New("pkcs12: error parsing PKCS#8 private key: " + err.Error()) 91 } 92 93 return privateKey, nil 94 } 95 96 func decodeCertBag(asn1Data []byte) (x509Certificates []byte, err error) { 97 bag := new(certBag) 98 if err := unmarshal(asn1Data, bag); err != nil { 99 return nil, errors.New("pkcs12: error decoding cert bag: " + err.Error()) 100 } 101 if !bag.Id.Equal(oidCertTypeX509Certificate) { 102 return nil, NotImplementedError("only X509 certificates are supported") 103 } 104 return bag.Data, nil 105 }