|
1 | 1 | package sm |
2 | 2 |
|
3 | 3 | import ( |
| 4 | + "crypto" |
| 5 | + "crypto/rand" |
| 6 | + "crypto/rsa" |
4 | 7 | "crypto/x509" |
| 8 | + "crypto/x509/pkix" |
5 | 9 | "encoding/pem" |
6 | 10 | "errors" |
7 | 11 | "fmt" |
| 12 | + "github.com/AliyunContainerService/notation-alibabacloud-secret-manager/internal/log" |
8 | 13 | "github.com/alibabacloud-go/tea/tea" |
9 | 14 | dedicatedkmsopenapi "github.com/aliyun/alibabacloud-dkms-gcs-go-sdk/openapi" |
10 | 15 | dedicatedkmssdk "github.com/aliyun/alibabacloud-dkms-gcs-go-sdk/sdk" |
11 | 16 | "github.com/notaryproject/notation-plugin-framework-go/plugin" |
| 17 | + "io" |
| 18 | + "math/big" |
| 19 | + "time" |
12 | 20 | ) |
13 | 21 |
|
14 | 22 | const ( |
15 | 23 | KMS_RSA_2048 = "RSA_2048" |
16 | 24 | KMS_RSA_3072 = "RSA_3072" |
17 | 25 | KMS_RSA_4096 = "RSA_4096" |
18 | 26 | KMS_EC_P256 = "EC_P256" |
| 27 | + //sign algorithm supported by KMS |
| 28 | + KMS_ALG_RSA_PSS_SHA_256 = "RSA_PSS_SHA_256" |
| 29 | + KMS_ALG_RSA_PKCS1_SHA_256 = "RSA_PKCS1_SHA_256" |
| 30 | + |
| 31 | + NOTATION_CN = "notation" |
19 | 32 | ) |
20 | 33 |
|
| 34 | +type KmsPrivateKeySigner struct { |
| 35 | + client *dedicatedkmssdk.Client |
| 36 | + publicKey crypto.PublicKey |
| 37 | + keyId string |
| 38 | + algorithm string |
| 39 | +} |
| 40 | + |
| 41 | +func (ks *KmsPrivateKeySigner) Public() crypto.PublicKey { |
| 42 | + return ks.publicKey |
| 43 | +} |
| 44 | + |
| 45 | +func (ks *KmsPrivateKeySigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error) { |
| 46 | + request := &dedicatedkmssdk.SignRequest{ |
| 47 | + KeyId: tea.String(ks.keyId), |
| 48 | + Message: digest, |
| 49 | + MessageType: tea.String("DIGEST"), |
| 50 | + Algorithm: tea.String(ks.algorithm), |
| 51 | + } |
| 52 | + resp, err := ks.client.Sign(request) |
| 53 | + if err != nil { |
| 54 | + return nil, err |
| 55 | + } |
| 56 | + return resp.Signature, nil |
| 57 | +} |
| 58 | + |
| 59 | +func genSerialNum() (*big.Int, error) { |
| 60 | + serialNumLimit := new(big.Int).Lsh(big.NewInt(1), 128) |
| 61 | + serialNum, err := rand.Int(rand.Reader, serialNumLimit) |
| 62 | + if err != nil { |
| 63 | + return nil, fmt.Errorf("serial number generation failure (%v)", err) |
| 64 | + } |
| 65 | + return serialNum, nil |
| 66 | +} |
| 67 | + |
| 68 | +func GetCertDataFromKey(dkmsClient *dedicatedkmssdk.Client, pub *rsa.PublicKey, keyId string) ([]byte, error) { |
| 69 | + //init csr subject |
| 70 | + subject := pkix.Name{ |
| 71 | + Country: []string{"CN"}, |
| 72 | + Organization: []string{"AlibabaCloud"}, |
| 73 | + OrganizationalUnit: []string{"Ack"}, |
| 74 | + CommonName: NOTATION_CN, |
| 75 | + } |
| 76 | + |
| 77 | + //Create kms service signer object |
| 78 | + priv := &KmsPrivateKeySigner{ |
| 79 | + client: dkmsClient, //kms client |
| 80 | + keyId: keyId, //kms instance asymmetric key Id |
| 81 | + publicKey: pub, //kms instance asymmetric public key |
| 82 | + algorithm: KMS_ALG_RSA_PSS_SHA_256, //kms instance signing algorithm, RSA_PKCS1_SHA_256 is not conform with notation specification |
| 83 | + } |
| 84 | + |
| 85 | + serialNum, err := genSerialNum() |
| 86 | + if err != nil { |
| 87 | + log.Logger.Errorf("Failed to generate serail number, err %v", err) |
| 88 | + return nil, err |
| 89 | + } |
| 90 | + |
| 91 | + // Create a new certificate template |
| 92 | + template := x509.Certificate{ |
| 93 | + SerialNumber: serialNum, |
| 94 | + Subject: subject, |
| 95 | + NotBefore: time.Now(), |
| 96 | + NotAfter: time.Now().Add(365 * 24 * time.Hour), // Valid for 1 year |
| 97 | + IsCA: false, |
| 98 | + KeyUsage: x509.KeyUsageDigitalSignature, |
| 99 | + SignatureAlgorithm: x509.SHA256WithRSAPSS, //only support RSA_PSS_SHA_256 here |
| 100 | + } |
| 101 | + |
| 102 | + // Create the certificate |
| 103 | + certBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, pub, priv) |
| 104 | + if err != nil { |
| 105 | + log.Logger.Errorf("Failed to generate certificate from key %s, err %v", keyId, err) |
| 106 | + return nil, err |
| 107 | + } |
| 108 | + return certBytes, nil |
| 109 | +} |
| 110 | + |
| 111 | +func GetPublicKey(client *dedicatedkmssdk.Client, keyId string) (*rsa.PublicKey, error) { |
| 112 | + request := &dedicatedkmssdk.GetPublicKeyRequest{ |
| 113 | + KeyId: tea.String(keyId), |
| 114 | + } |
| 115 | + response, err := client.GetPublicKey(request) |
| 116 | + if err != nil { |
| 117 | + return nil, err |
| 118 | + } |
| 119 | + block, _ := pem.Decode([]byte(*response.PublicKey)) |
| 120 | + if block == nil || block.Type != "PUBLIC KEY" { |
| 121 | + return nil, errors.New("failed to decode public key") |
| 122 | + } |
| 123 | + pub, err := x509.ParsePKIXPublicKey(block.Bytes) |
| 124 | + if err != nil { |
| 125 | + return nil, err |
| 126 | + } |
| 127 | + //return rsa public key |
| 128 | + rsaPub, ok := pub.(*rsa.PublicKey) |
| 129 | + if !ok { |
| 130 | + return nil, errors.New(fmt.Sprintf("unsupport public key type %T", pub)) |
| 131 | + } |
| 132 | + |
| 133 | + return rsaPub, nil |
| 134 | +} |
| 135 | + |
21 | 136 | func GetDkmsClientByClientKeyFile(clientKeyPath, password, endpoint string) (*dedicatedkmssdk.Client, error) { |
| 137 | + // 创建DKMS Client配置 |
22 | 138 | config := &dedicatedkmsopenapi.Config{ |
23 | | - Protocol: tea.String("https"), |
| 139 | + Protocol: tea.String("https"), |
| 140 | + // 请替换为您在KMS应用管理获取的ClientKey文件的路径 |
24 | 141 | ClientKeyFile: tea.String(clientKeyPath), |
25 | | - Password: tea.String(password), |
26 | | - Endpoint: tea.String(endpoint), |
| 142 | + // 请替换为您在KMS应用管理创建ClientKey时输入的加密口令 |
| 143 | + Password: tea.String(password), |
| 144 | + // 请替换为您实际的专属KMS实例服务地址(不包括协议头https://) |
| 145 | + Endpoint: tea.String(endpoint), |
27 | 146 | } |
28 | | - // Init DKMS client |
| 147 | + // 创建DKMS Client对象 |
29 | 148 | client, err := dedicatedkmssdk.NewClient(config) |
30 | 149 | if err != nil { |
31 | 150 | return nil, err |
|
0 commit comments