github.phpd.cn/hashicorp/packer@v1.3.2/builder/azure/pkcs12/safebags.go (about)

     1  // Copyright 2015 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package pkcs12
     6  
     7  import (
     8  	"crypto/x509"
     9  	"crypto/x509/pkix"
    10  	"encoding/asn1"
    11  	"errors"
    12  )
    13  
    14  var (
    15  	// see https://tools.ietf.org/html/rfc7292#appendix-D
    16  	oidCertTypeX509Certificate = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 9, 22, 1})
    17  	oidPKCS8ShroudedKeyBag     = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 10, 1, 2})
    18  	oidCertBag                 = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 10, 1, 3})
    19  )
    20  
    21  type certBag struct {
    22  	Id   asn1.ObjectIdentifier
    23  	Data []byte `asn1:"tag:0,explicit"`
    24  }
    25  
    26  func getAlgorithmParams(salt []byte, iterations int) (asn1.RawValue, error) {
    27  	params := pbeParams{
    28  		Salt:       salt,
    29  		Iterations: iterations,
    30  	}
    31  
    32  	return convertToRawVal(params)
    33  }
    34  
    35  func encodePkcs8ShroudedKeyBag(privateKey interface{}, password []byte) (bytes []byte, err error) {
    36  	privateKeyBytes, err := marshalPKCS8PrivateKey(privateKey)
    37  
    38  	if err != nil {
    39  		return nil, errors.New("pkcs12: error encoding PKCS#8 private key: " + err.Error())
    40  	}
    41  
    42  	salt, err := makeSalt(pbeSaltSizeBytes)
    43  	if err != nil {
    44  		return nil, errors.New("pkcs12: error creating PKCS#8 salt: " + err.Error())
    45  	}
    46  
    47  	pkData, err := pbEncrypt(privateKeyBytes, salt, password, pbeIterationCount)
    48  	if err != nil {
    49  		return nil, errors.New("pkcs12: error encoding PKCS#8 shrouded key bag when encrypting cert bag: " + err.Error())
    50  	}
    51  
    52  	params, err := getAlgorithmParams(salt, pbeIterationCount)
    53  	if err != nil {
    54  		return nil, errors.New("pkcs12: error encoding PKCS#8 shrouded key bag algorithm's parameters: " + err.Error())
    55  	}
    56  
    57  	pkinfo := encryptedPrivateKeyInfo{
    58  		AlgorithmIdentifier: pkix.AlgorithmIdentifier{
    59  			Algorithm:  oidPBEWithSHAAnd3KeyTripleDESCBC,
    60  			Parameters: params,
    61  		},
    62  		EncryptedData: pkData,
    63  	}
    64  
    65  	bytes, err = asn1.Marshal(pkinfo)
    66  	if err != nil {
    67  		return nil, errors.New("pkcs12: error encoding PKCS#8 shrouded key bag: " + err.Error())
    68  	}
    69  
    70  	return bytes, err
    71  }
    72  
    73  func decodePkcs8ShroudedKeyBag(asn1Data, password []byte) (privateKey interface{}, err error) {
    74  	pkinfo := new(encryptedPrivateKeyInfo)
    75  	if err = unmarshal(asn1Data, pkinfo); err != nil {
    76  		return nil, errors.New("pkcs12: error decoding PKCS#8 shrouded key bag: " + err.Error())
    77  	}
    78  
    79  	pkData, err := pbDecrypt(pkinfo, password)
    80  	if err != nil {
    81  		return nil, errors.New("pkcs12: error decrypting PKCS#8 shrouded key bag: " + err.Error())
    82  	}
    83  
    84  	ret := new(asn1.RawValue)
    85  	if err = unmarshal(pkData, ret); err != nil {
    86  		return nil, errors.New("pkcs12: error unmarshalling decrypted private key: " + err.Error())
    87  	}
    88  
    89  	if privateKey, err = x509.ParsePKCS8PrivateKey(pkData); err != nil {
    90  		return nil, errors.New("pkcs12: error parsing PKCS#8 private key: " + err.Error())
    91  	}
    92  
    93  	return privateKey, nil
    94  }
    95  
    96  func decodeCertBag(asn1Data []byte) (x509Certificates []byte, err error) {
    97  	bag := new(certBag)
    98  	if err := unmarshal(asn1Data, bag); err != nil {
    99  		return nil, errors.New("pkcs12: error decoding cert bag: " + err.Error())
   100  	}
   101  	if !bag.Id.Equal(oidCertTypeX509Certificate) {
   102  		return nil, NotImplementedError("only X509 certificates are supported")
   103  	}
   104  	return bag.Data, nil
   105  }