-
Notifications
You must be signed in to change notification settings - Fork 888
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
GODRIVER-364 Support PKCS8 encrypted client private keys #565
Changes from 8 commits
b703ea6
6dd9e81
698deac
480b63b
0e6899c
c92c563
45441c5
f82bfc6
da41f0f
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,52 @@ | ||
-----BEGIN ENCRYPTED PRIVATE KEY----- | ||
MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIsqMuOBMVHM4CAggA | ||
MBQGCCqGSIb3DQMHBAjGoriU4YaS6wSCBMhu0dQ8OjzcAJzyhe3osPWFQObhlpsi | ||
sD6Hzx2mcJcZMAv1AG7/MPpPQixiZipQLIiQPOozgjHDqmBp1lGz4FW7sXT01SJT | ||
xlALdUGVrHp5BZRVZGhfZ/SeRknqxoQKqIEZQZeTBJDVZ/dWrLOUfycp0rLWxctq | ||
FVUcb0jq2YL7u9IBIAmFgFyj2ZVWu68HiiwuhKJ0botuFSHe76DP0lthwlHMOR+L | ||
brK7IrMuGhp4xAI16pDoQbwj4AFz2JWhb5WeYhE2CMFhzoZZLgfafBeO/GG04QTt | ||
VB2/Tj5M6jbeCO8H3rYo9yDuWijeOxNDEwRHpLrRcK0T9TouETYzcSFpZIJXhHS3 | ||
0ZV44JMGmPP5fkt34mbkBs68nNqcaWuInBx4k7FZZqkd7LyjGRP3mWeqfMhqDaw+ | ||
KhAADLRCY7P7ooa3WGGP8+/hdI+I1SR+TCwmiHzY6FRgBlnmlqNH1WS3je4/Dx3w | ||
H8YzPurMpyLlETN1u1DIIZEQteZHVNcZBkTdW1eWOgoOt30wNzrJQPEgPEZgAzvR | ||
4vgKVF68892g755hyOgXl5Hoqf1w2q85l+3qp1zb2UDUvcIkbU7HXnmgZWRJ9T94 | ||
kgDlJ82Y+BECQFPVTrEhoVGO0q0eF6On8r7slCoY5edqGdXcyLCuYolEgFHqUFQg | ||
Hjj6x17HQBRa3nnkF3j8tho5kxa6pdvmJcXghJ4Y6Tfs2x9qyjHVYqJH2emuuP9f | ||
Gk5oyicOBTjDnGHG0Hvdd3OSpzQP9P6xMhVByomnz+iGO2CYiJdplKHCeS62Lh7D | ||
px0p7CNxIZtWCBWeQXKqofrJm7PQP+izAqurzGLhMTggCfH8QRZPhiykRnRaIwdV | ||
Ml1veBN6JA91OBkwuioiTH+/zEL8KmpFW5f5okpicUSw6NTx5N2OGqYzqIdo1D0B | ||
0MThRHQszOF4v89O3OPy2PXrYZdxM521CckBsEEVvyKWWd/xlXzheqZvpao2me05 | ||
Dmrjb6VTuE5kev/3I6mC6aJMi7CF6fqXaUGm+StlPEAbUudjBnwav8PWTv2hF1VS | ||
Ogj9K6nNG1EyTik4uEltZL6h1EWeZqYap/VJXfwNQn+BAv5xX2mLieIVHpltLQY7 | ||
ushULJhMTkMJVQbtHulMyUibE/JBT70ra5GgpjRdpib+3M/7OZOZAm0tWZMovZZS | ||
+UfoC7JApa1FXcsQ03WhGHu3q6kL7TB6VW+QrBnxi8MQBeEydu2cAwrdGKJWtIjL | ||
gBWuAJCEwH/wenim+7YzFYg72aCsaVQxcjYvHAiqEFPDziqk+CLebfZkgF4IEfdF | ||
XbCnAYb8GQmlaJsbEVPtLvVVCYN0/RAEn6ec3ivHkCt4tM67F9pOEaIyk7PWOfpm | ||
ViyUn62O30fQNfWKfjfhD5ttSY/8X0Fa7B9+V4s+2Exb2r0P/wd9k2sjK2IyDNMu | ||
rim0ILriuQ3geBXdJi+uauPA3VnS0uoJoUPs4+nrWHITPOH8ZS7KeZYb9bdEtt61 | ||
I47cMXZl9LZASzRnhzgMYN0QBcnnwOXDHKQhwC0FSpB8NZ/gFjgy141/NM1VIIw0 | ||
fC9OjnidYxYTv58uFXCPKqCk+iEDQLj68M+VUJgwMSov7M5BA/ymwIPy/548vTZ4 | ||
rgE= | ||
-----END ENCRYPTED PRIVATE KEY----- | ||
-----BEGIN CERTIFICATE----- | ||
MIIDdjCCAl6gAwIBAgIDBpgxMA0GCSqGSIb3DQEBBQUAMG4xEzARBgNVBAMTCkNE | ||
cml2ZXIgQ0ExEDAOBgNVBAsTB0RyaXZlcnMxEDAOBgNVBAoTB01vbmdvREIxEjAQ | ||
BgNVBAcTCVJleWtqYXZpazESMBAGA1UECBMJUmV5a2phdmlrMQswCQYDVQQGEwJJ | ||
UzAeFw0xODAyMjgyMDQ0NDhaFw0zODAyMjgyMDQ0NDhaMG0xETAPBgNVBAMTCGV4 | ||
dGVybmFsMQ4wDAYDVQQLEwVvdGhlcjEQMA4GA1UEChMHTW9uZ29EQjEWMBQGA1UE | ||
BxMNTmV3IFlvcmsgQ2l0eTERMA8GA1UECBMITmV3IFlvcmsxCzAJBgNVBAYTAlVT | ||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmaii9Oq1jnOjD/NvCOE5 | ||
XJAU0xSdWLi28q/HhsrIUwT2aRRObkVPx57Cl90/QKfwYmY4Z1E6oEXQX0F7tcV0 | ||
/e9easzBFB69ZS/ztF91xuofeK6tOmAPzRJx4pEAgoY5tlG+Ifs4BS23qe278w51 | ||
u1JWo1v50v5qr2MzDt/zZHz1EFz0Q5SBhVe9x5/jyVgd7f6gts2aXFrwE53OavlD | ||
QS3d1aC3xlCGo8tH7UmI0rtJNiwmcPrvbkgSkxmsUDZW4kuvrrY3oDxeLEgaUrZq | ||
rHkVY4WXbbe2359izlpZql5JsaW9FCcqmRP0xmjMZfTcMCLVKCK9JObGj/jlkOzg | ||
QQIDAQABox4wHDAaBgNVHREEEzARgglsb2NhbGhvc3SHBH8AAAEwDQYJKoZIhvcN | ||
AQEFBQADggEBAJ2pQoO8zf2BW5jZ8U5WVQlRm/s9LflH7jCkqqIIxRwFENtHEeK0 | ||
tOxfW1/JYw6GAuGsLrCXwVI1OeV0KPquoh26sFtrxHeeIxJjAOZ5ov/tLDBciBBD | ||
QCnqPOCehvv/OH9BLFoFdW/3hLqHuKTiiDL9537CiZuDqiKyjucwSlqLk3fBcrna | ||
Se8n2w+g3btD8dEYe0+G+dh2k0EJZ+78LW8Gr642knebxMjrsqD+wooryBBn8jls | ||
9hJjG0D5TbX1koIHDYJE727FC/kWmNhK1Rvt1AKnsMFlrrQBbNK9YvEP6y3KQrb0 | ||
R1YgAaV74AIDaGGT1Id+mSteN7KOK34Ruso= | ||
-----END CERTIFICATE----- | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,50 @@ | ||
-----BEGIN PRIVATE KEY----- | ||
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCZqKL06rWOc6MP | ||
828I4TlckBTTFJ1YuLbyr8eGyshTBPZpFE5uRU/HnsKX3T9Ap/BiZjhnUTqgRdBf | ||
QXu1xXT9715qzMEUHr1lL/O0X3XG6h94rq06YA/NEnHikQCChjm2Ub4h+zgFLbep | ||
7bvzDnW7UlajW/nS/mqvYzMO3/NkfPUQXPRDlIGFV73Hn+PJWB3t/qC2zZpcWvAT | ||
nc5q+UNBLd3VoLfGUIajy0ftSYjSu0k2LCZw+u9uSBKTGaxQNlbiS6+utjegPF4s | ||
SBpStmqseRVjhZdtt7bfn2LOWlmqXkmxpb0UJyqZE/TGaMxl9NwwItUoIr0k5saP | ||
+OWQ7OBBAgMBAAECggEAUm1YHTHa+vOlQWVA5u6KqtDPmvuv/Gv6F+2bhv84vvAm | ||
ju/JsvWTem37zSNuTuzH0sEq+KFmZZuNz8t85WFrBN1nNLtpx7VFvAYhIV0j/PSS | ||
tVZerrXhRAzk8rj+IQaH5vmqmOf+gSipIYraC+Rx226r8y3fsgOwjy0TsqMIGZrp | ||
puczHAaMFvSXzTn2rD7d0AYnTgdIPJNDSwnTvTbnwMNDA4F7E/pJjjkm2kABdXSJ | ||
wTuPnPSeUz0mTYpu4cOc+q+4jhpZr5GaF1declyIl8uU9gyK+gZRdrMHLVsFzdIM | ||
Z+6beF+aCta5wXACou7kRvXQhatiQfTmOe4cpTElwQKBgQDMnkZVhDE7BryVnRE2 | ||
N/OJD64g/ygvJOL7rT+dqrNGhJCDHw30Vast2fxmibMk6iI3PkCj3XuTnXEtEOLr | ||
td2bDpWCreMmj0hlFnFAh/p7J6olgbsnJO1Vhn7PcKevUfQVlpcDcu+GcvBHly2r | ||
exAwKNxj6ZxqXf+KtI8w8Ca+PQKBgQDAPnfy7mMg/ytJtSlQz3srWSUERkOI1xcF | ||
GimnVdofKu1PeqAsHOyNTRgoLDmI1NXG+1jva9ML8yBJQAf/+4a8IXKEwCQDVVHs | ||
9iNa7gs6ULo41YRouL8cmat4XLh/OxWwYKZdxQWGTgnHKjVNdf6Df7OOm7uZBbU4 | ||
i4sYii/uVQKBgQCCJ39HsDF8gVl9tY4YNdjkayPw+zy9WDJFsrsPeGBWz8X4kc1X | ||
iRK8tLcXJincpk2jZCbL1PthNzmhV+dv1ZwjoFA78o3VnjiHjJH3YUdUBTP2baH1 | ||
UUjiKQ4Kt3cCTxf6j3J5kCeKFxx9/UzgkgQHDka6CwQiqK3+tcGLeIa8ZQKBgQCM | ||
wfBvde4s7chTKor6uT/UyGubCptOKTaYrMRM2kZfxb2GESIPyonFF+qVF3R05Gk2 | ||
TTib7NXVDQnZuEFjQ1Yuj0rbOhfkPOdEWiAe5uZfp1YCYQuW5ZZAqZ9r/G+18Jv7 | ||
zXhideyKnr74DcaDVd6ph6n/w7UC4LQEl9+bcyqPFQKBgATRW/owDjadRVuDB9C4 | ||
qzdyXuibMqRRUtvm6k4hs+HyirkrTnWb2YVbRMvrdT783s2wIeKB1oR5aG12A8ln | ||
Hn7CeoLtRU12q65yOkX7vzER6oRmcyBVLhC+izRdoaBmKRuFdmQpXOALZRb/iNzQ | ||
2nUsi2lvjvL42tYvIa8rtm4o | ||
-----END PRIVATE KEY----- | ||
-----BEGIN CERTIFICATE----- | ||
MIIDdjCCAl6gAwIBAgIDBpgxMA0GCSqGSIb3DQEBBQUAMG4xEzARBgNVBAMTCkNE | ||
cml2ZXIgQ0ExEDAOBgNVBAsTB0RyaXZlcnMxEDAOBgNVBAoTB01vbmdvREIxEjAQ | ||
BgNVBAcTCVJleWtqYXZpazESMBAGA1UECBMJUmV5a2phdmlrMQswCQYDVQQGEwJJ | ||
UzAeFw0xODAyMjgyMDQ0NDhaFw0zODAyMjgyMDQ0NDhaMG0xETAPBgNVBAMTCGV4 | ||
dGVybmFsMQ4wDAYDVQQLEwVvdGhlcjEQMA4GA1UEChMHTW9uZ29EQjEWMBQGA1UE | ||
BxMNTmV3IFlvcmsgQ2l0eTERMA8GA1UECBMITmV3IFlvcmsxCzAJBgNVBAYTAlVT | ||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmaii9Oq1jnOjD/NvCOE5 | ||
XJAU0xSdWLi28q/HhsrIUwT2aRRObkVPx57Cl90/QKfwYmY4Z1E6oEXQX0F7tcV0 | ||
/e9easzBFB69ZS/ztF91xuofeK6tOmAPzRJx4pEAgoY5tlG+Ifs4BS23qe278w51 | ||
u1JWo1v50v5qr2MzDt/zZHz1EFz0Q5SBhVe9x5/jyVgd7f6gts2aXFrwE53OavlD | ||
QS3d1aC3xlCGo8tH7UmI0rtJNiwmcPrvbkgSkxmsUDZW4kuvrrY3oDxeLEgaUrZq | ||
rHkVY4WXbbe2359izlpZql5JsaW9FCcqmRP0xmjMZfTcMCLVKCK9JObGj/jlkOzg | ||
QQIDAQABox4wHDAaBgNVHREEEzARgglsb2NhbGhvc3SHBH8AAAEwDQYJKoZIhvcN | ||
AQEFBQADggEBAJ2pQoO8zf2BW5jZ8U5WVQlRm/s9LflH7jCkqqIIxRwFENtHEeK0 | ||
tOxfW1/JYw6GAuGsLrCXwVI1OeV0KPquoh26sFtrxHeeIxJjAOZ5ov/tLDBciBBD | ||
QCnqPOCehvv/OH9BLFoFdW/3hLqHuKTiiDL9537CiZuDqiKyjucwSlqLk3fBcrna | ||
Se8n2w+g3btD8dEYe0+G+dh2k0EJZ+78LW8Gr642knebxMjrsqD+wooryBBn8jls | ||
9hJjG0D5TbX1koIHDYJE727FC/kWmNhK1Rvt1AKnsMFlrrQBbNK9YvEP6y3KQrb0 | ||
R1YgAaV74AIDaGGT1Id+mSteN7KOK34Ruso= | ||
-----END CERTIFICATE----- | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -19,6 +19,7 @@ import ( | |
"strings" | ||
"time" | ||
|
||
"github.com/youmark/pkcs8" | ||
"go.mongodb.org/mongo-driver/bson/bsoncodec" | ||
"go.mongodb.org/mongo-driver/event" | ||
"go.mongodb.org/mongo-driver/mongo/readconcern" | ||
|
@@ -902,14 +903,34 @@ func addClientCertFromBytes(cfg *tls.Config, data []byte, keyPasswd string) (str | |
certDecodedBlock = currentBlock.Bytes | ||
start += len(certBlock) | ||
} else if strings.HasSuffix(currentBlock.Type, "PRIVATE KEY") { | ||
if keyPasswd != "" && x509.IsEncryptedPEMBlock(currentBlock) { | ||
var encoded bytes.Buffer | ||
buf, err := x509.DecryptPEMBlock(currentBlock, []byte(keyPasswd)) | ||
if err != nil { | ||
return "", err | ||
isEncrypted := x509.IsEncryptedPEMBlock(currentBlock) || strings.Contains(currentBlock.Type, "ENCRYPTED PRIVATE KEY") | ||
if isEncrypted { | ||
if keyPasswd == "" { | ||
return "", fmt.Errorf("no password provided to decrypt private key") | ||
} | ||
|
||
pem.Encode(&encoded, &pem.Block{Type: currentBlock.Type, Bytes: buf}) | ||
var keyBytes []byte | ||
var err error | ||
// Process the X.509-encrypted or PKCS-encrypted PEM block. | ||
if x509.IsEncryptedPEMBlock(currentBlock) { | ||
// Only covers encrypted PEM data with a DEK-Info header. | ||
keyBytes, err = x509.DecryptPEMBlock(currentBlock, []byte(keyPasswd)) | ||
if err != nil { | ||
return "", err | ||
} | ||
} else if strings.Contains(currentBlock.Type, "ENCRYPTED") { | ||
// The pkcs8 package only handles the PKCS #5 v2.0 scheme. | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This parsing code is from the TOOLS-2013 PR. This was also brought up there, but
Furthermore, did we need support for a specific scheme? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Good point, the command used to generate seems worth leaving a comment in GODRIVER-364 for future reference (anytime I need to generate certs, I need to google around...). Given the conversation in TOOLS-2013 and related tickets, I think v2.0 is only requirement. It seems v1.5 was superseded (judging from RFC-8018 and and an article describing the v2.0 key derivation function. cc @markbenvenuto in case you'd like to weigh in. I do not think we need to support more than PKCS 5 v2.0. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I can leave the two commands (one for encrypted and one for unencrypted) in the original ticket. And good to know 2.0 supersedes other versions; thanks for doing that research. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yes, we only need to support PKCS#5 v2.0. We don't need to support the older version since it uses a weaker key derivation function. |
||
decrypted, err := pkcs8.ParsePKCS8PrivateKey(currentBlock.Bytes, []byte(keyPasswd)) | ||
if err != nil { | ||
return "", err | ||
} | ||
keyBytes, err = x509MarshalPKCS8PrivateKey(decrypted) | ||
if err != nil { | ||
return "", err | ||
} | ||
} | ||
var encoded bytes.Buffer | ||
pem.Encode(&encoded, &pem.Block{Type: currentBlock.Type, Bytes: keyBytes}) | ||
keyBlock = encoded.Bytes() | ||
start = len(data) - len(remaining) | ||
} else { | ||
|
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice, good idea making this into a table test!