forked from cloudflare/cfssl
-
Notifications
You must be signed in to change notification settings - Fork 0
/
ca.go
88 lines (76 loc) · 2.16 KB
/
ca.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
package main
import (
"crypto/ecdsa"
"crypto/rsa"
"errors"
"flag"
"net"
"net/http"
"os"
"github.com/cloudflare/cfssl/api/info"
"github.com/cloudflare/cfssl/cmd/multirootca/config"
"github.com/cloudflare/cfssl/log"
"github.com/cloudflare/cfssl/signer"
"github.com/cloudflare/cfssl/signer/local"
"github.com/kisom/whitelist"
)
func parseSigner(root *config.Root) (signer.Signer, error) {
privateKey := root.PrivateKey
switch priv := privateKey.(type) {
case *rsa.PrivateKey, *ecdsa.PrivateKey:
s, err := local.NewSigner(priv, root.Certificate, signer.DefaultSigAlgo(priv), nil)
if err != nil {
return nil, err
}
s.SetPolicy(root.Config)
return s, nil
default:
return nil, errors.New("unsupported private key type")
}
}
var (
defaultLabel string
signers = map[string]signer.Signer{}
)
func main() {
flagAddr := flag.String("a", ":8888", "listening address")
flagRootFile := flag.String("roots", "", "configuration file specifying root keys")
flagDefaultLabel := flag.String("l", "", "specify a default label")
flag.IntVar(&log.Level, "loglevel", log.LevelInfo, "log level (0 = DEBUG, 4 = ERROR)")
flag.Parse()
if *flagRootFile == "" {
log.Criticalf("no root file specified")
os.Exit(1)
}
roots, err := config.Parse(*flagRootFile)
if err != nil {
log.Criticalf("%v", err)
os.Exit(1)
}
for label, root := range roots {
s, err := parseSigner(root)
if err != nil {
log.Criticalf("%v", err)
}
signers[label] = s
log.Info("loaded signer ", label)
}
defaultLabel = *flagDefaultLabel
initStats()
infoHandler, err := info.NewMultiHandler(signers, defaultLabel)
if err != nil {
log.Criticalf("%v", err)
}
var localhost = whitelist.NewBasic()
localhost.Add(net.ParseIP("127.0.0.1"))
localhost.Add(net.ParseIP("::1"))
metrics, err := whitelist.NewHandlerFunc(dumpMetrics, metricsDisallowed, localhost)
if err != nil {
log.Criticalf("failed to set up the metrics whitelist: %v", err)
}
http.HandleFunc("/api/v1/cfssl/authsign", dispatchRequest)
http.Handle("/api/v1/cfssl/info", infoHandler)
http.Handle("/api/v1/cfssl/metrics", metrics)
log.Info("listening on ", *flagAddr)
log.Error(http.ListenAndServe(*flagAddr, nil))
}