-
Notifications
You must be signed in to change notification settings - Fork 278
/
testing_utilities.go
153 lines (144 loc) · 5.22 KB
/
testing_utilities.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
// Copyright 2017 Yahoo Holdings, Inc.
// Licensed under the terms of the Apache version 2.0 license. See LICENSE file for terms.
package devel
import (
"bytes"
"crypto"
"crypto/x509"
"encoding/base64"
"encoding/json"
"encoding/pem"
"fmt"
"github.com/AthenZ/athenz/clients/go/zts"
"github.com/AthenZ/athenz/libs/go/zmssvctoken"
"github.com/AthenZ/athenz/utils/zpe-updater/util"
"github.com/ardielle/ardielle-go/rdl"
"io/ioutil"
"os"
"gopkg.in/square/go-jose.v2"
)
func CreateFile(fileName, content string) error {
if util.Exists(fileName) {
err := os.Remove(fileName)
if err != nil {
return fmt.Errorf("unable to remove file: %v, Error:%v", fileName, err)
}
}
err := ioutil.WriteFile(fileName, []byte(content), 0755)
if err != nil {
return fmt.Errorf("unable to write file: %v, Error:%v", fileName, err)
}
return nil
}
func loadPrivateKey(privateKeyPEM []byte) (crypto.PrivateKey, error) {
block, _ := pem.Decode(privateKeyPEM)
if block == nil {
return nil, fmt.Errorf("unable to load private key")
}
switch block.Type {
case "EC PRIVATE KEY":
key, err := x509.ParseECPrivateKey(block.Bytes)
if err != nil {
return nil, err
}
return key, nil
case "RSA PRIVATE KEY":
key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
if err != nil {
return nil, err
}
return key, nil
default:
return nil, fmt.Errorf("unsupported private key type: %s", block.Type)
}
}
func GenerateSignedPolicyData(filename string, privateKeyPEM []byte, keyVersion string, expiryOffset float64) (*zts.DomainSignedPolicyData, error) {
data, err := ioutil.ReadFile(filename)
if err != nil {
return nil, fmt.Errorf("failed to read the data file, Error:%v", err)
}
var domainSignedPolicyData *zts.DomainSignedPolicyData
err = json.Unmarshal(data, &domainSignedPolicyData)
if err != nil {
return nil, fmt.Errorf("failed to parse the signed policy data file, Error:%v", err)
}
policyData := domainSignedPolicyData.SignedPolicyData.PolicyData
input, err := util.ToCanonicalString(policyData)
if err != nil {
return nil, fmt.Errorf("failed to generate cannonical string, Error:%v", err)
}
signer, err := zmssvctoken.NewSigner(privateKeyPEM)
if err != nil {
return nil, fmt.Errorf("failed to generate new signer, Error:%v", err)
}
domainSignedPolicyData.SignedPolicyData.ZmsSignature, err = signer.Sign(input)
if err != nil {
return nil, fmt.Errorf("failed to generate signature, Error:%v", err)
}
if err != nil {
return nil, fmt.Errorf("failed to generate signature, Error:%v", err)
}
domainSignedPolicyData.SignedPolicyData.ZmsKeyId = keyVersion
domainSignedPolicyData.SignedPolicyData.Modified = rdl.TimestampNow()
domainSignedPolicyData.SignedPolicyData.Expires = rdl.TimestampFromEpoch(rdl.TimestampNow().SecondsSinceEpoch() + expiryOffset)
input, err = util.ToCanonicalString(domainSignedPolicyData.SignedPolicyData)
if err != nil {
return nil, fmt.Errorf("failed to generate cannonical string, Error:%v", err)
}
domainSignedPolicyData.Signature, err = signer.Sign(input)
if err != nil {
return nil, fmt.Errorf("failed to generate signature, Error:%v", err)
}
domainSignedPolicyData.KeyId = keyVersion
return domainSignedPolicyData, nil
}
func GenerateJWSPolicyData(filename string, privateKeyPEM []byte, keyVersion, algorithm string, expiryOffset float64) (*zts.JWSPolicyData, error) {
data, err := ioutil.ReadFile(filename)
if err != nil {
return nil, fmt.Errorf("failed to read the data file, Error:%v", err)
}
var domainSignedPolicyData *zts.DomainSignedPolicyData
err = json.Unmarshal(data, &domainSignedPolicyData)
if err != nil {
return nil, fmt.Errorf("failed to parse the signed policy data file, Error:%v", err)
}
signedPolicyData := domainSignedPolicyData.SignedPolicyData
signedPolicyData.ZmsSignature = ""
signedPolicyData.ZmsKeyId = ""
signedPolicyData.Modified = rdl.TimestampNow()
signedPolicyData.Expires = rdl.TimestampFromEpoch(rdl.TimestampNow().SecondsSinceEpoch() + expiryOffset)
payloadData, err := json.Marshal(signedPolicyData)
if err != nil {
return nil, fmt.Errorf("failed to generate payload datar, Error:%v", err)
}
jwsPolicyData := new(zts.JWSPolicyData)
jwsPolicyData.Header=make(map[string]string)
jwsPolicyData.Header["kid"]=keyVersion
encoding := base64.RawURLEncoding
jwsPolicyData.Payload = encoding.EncodeToString(payloadData)
protectedData := "{\"alg\":\"" + algorithm + "\",\"kid\":\"" + keyVersion + "\"}"
jwsPolicyData.Protected = encoding.EncodeToString([]byte(protectedData))
var signData bytes.Buffer
signData.WriteString(jwsPolicyData.Protected)
signData.WriteByte('.')
signData.WriteString(jwsPolicyData.Payload)
privateKey, err := loadPrivateKey(privateKeyPEM)
if err != nil {
return nil, fmt.Errorf("unable to create private key signer: %v", err)
}
opts := &jose.SignerOptions{
ExtraHeaders: map[jose.HeaderKey]interface{}{
jose.HeaderKey("kid"): keyVersion,
},
}
signer, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.ES384, Key: privateKey}, opts)
if err != nil {
return nil, fmt.Errorf("unable to create signer: %v", err)
}
object, err := signer.Sign(payloadData)
if err != nil {
return nil, fmt.Errorf("unable to sign data: %v", err)
}
jwsPolicyData.Signature = encoding.EncodeToString(object.Signatures[0].Signature)
return jwsPolicyData, nil
}