-
Notifications
You must be signed in to change notification settings - Fork 413
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #496 from smallstep/max/acme
Convert to ACME DB interface
- Loading branch information
Showing
51 changed files
with
10,580 additions
and
10,968 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,197 +1,42 @@ | ||
package acme | ||
|
||
import ( | ||
"context" | ||
"crypto" | ||
"encoding/base64" | ||
"encoding/json" | ||
"time" | ||
|
||
"github.com/pkg/errors" | ||
"github.com/smallstep/nosql" | ||
"go.step.sm/crypto/jose" | ||
) | ||
|
||
// Account is a subset of the internal account type containing only those | ||
// attributes required for responses in the ACME protocol. | ||
type Account struct { | ||
Contact []string `json:"contact,omitempty"` | ||
Status string `json:"status"` | ||
Orders string `json:"orders"` | ||
ID string `json:"-"` | ||
Key *jose.JSONWebKey `json:"-"` | ||
ID string `json:"-"` | ||
Key *jose.JSONWebKey `json:"-"` | ||
Contact []string `json:"contact,omitempty"` | ||
Status Status `json:"status"` | ||
OrdersURL string `json:"orders"` | ||
} | ||
|
||
// ToLog enables response logging. | ||
func (a *Account) ToLog() (interface{}, error) { | ||
b, err := json.Marshal(a) | ||
if err != nil { | ||
return nil, ServerInternalErr(errors.Wrap(err, "error marshaling account for logging")) | ||
return nil, WrapErrorISE(err, "error marshaling account for logging") | ||
} | ||
return string(b), nil | ||
} | ||
|
||
// GetID returns the account ID. | ||
func (a *Account) GetID() string { | ||
return a.ID | ||
} | ||
|
||
// GetKey returns the JWK associated with the account. | ||
func (a *Account) GetKey() *jose.JSONWebKey { | ||
return a.Key | ||
} | ||
|
||
// IsValid returns true if the Account is valid. | ||
func (a *Account) IsValid() bool { | ||
return a.Status == StatusValid | ||
} | ||
|
||
// AccountOptions are the options needed to create a new ACME account. | ||
type AccountOptions struct { | ||
Key *jose.JSONWebKey | ||
Contact []string | ||
} | ||
|
||
// account represents an ACME account. | ||
type account struct { | ||
ID string `json:"id"` | ||
Created time.Time `json:"created"` | ||
Deactivated time.Time `json:"deactivated"` | ||
Key *jose.JSONWebKey `json:"key"` | ||
Contact []string `json:"contact,omitempty"` | ||
Status string `json:"status"` | ||
} | ||
|
||
// newAccount returns a new acme account type. | ||
func newAccount(db nosql.DB, ops AccountOptions) (*account, error) { | ||
id, err := randID() | ||
if err != nil { | ||
return nil, err | ||
} | ||
|
||
a := &account{ | ||
ID: id, | ||
Key: ops.Key, | ||
Contact: ops.Contact, | ||
Status: "valid", | ||
Created: clock.Now(), | ||
} | ||
return a, a.saveNew(db) | ||
} | ||
|
||
// toACME converts the internal Account type into the public acmeAccount | ||
// type for presentation in the ACME protocol. | ||
func (a *account) toACME(ctx context.Context, db nosql.DB, dir *directory) (*Account, error) { | ||
return &Account{ | ||
Status: a.Status, | ||
Contact: a.Contact, | ||
Orders: dir.getLink(ctx, OrdersByAccountLink, true, a.ID), | ||
Key: a.Key, | ||
ID: a.ID, | ||
}, nil | ||
} | ||
|
||
// save writes the Account to the DB. | ||
// If the account is new then the necessary indices will be created. | ||
// Else, the account in the DB will be updated. | ||
func (a *account) saveNew(db nosql.DB) error { | ||
kid, err := keyToID(a.Key) | ||
if err != nil { | ||
return err | ||
} | ||
kidB := []byte(kid) | ||
|
||
// Set the jwkID -> acme account ID index | ||
_, swapped, err := db.CmpAndSwap(accountByKeyIDTable, kidB, nil, []byte(a.ID)) | ||
switch { | ||
case err != nil: | ||
return ServerInternalErr(errors.Wrap(err, "error setting key-id to account-id index")) | ||
case !swapped: | ||
return ServerInternalErr(errors.Errorf("key-id to account-id index already exists")) | ||
default: | ||
if err = a.save(db, nil); err != nil { | ||
db.Del(accountByKeyIDTable, kidB) | ||
return err | ||
} | ||
return nil | ||
} | ||
} | ||
|
||
func (a *account) save(db nosql.DB, old *account) error { | ||
var ( | ||
err error | ||
oldB []byte | ||
) | ||
if old == nil { | ||
oldB = nil | ||
} else { | ||
if oldB, err = json.Marshal(old); err != nil { | ||
return ServerInternalErr(errors.Wrap(err, "error marshaling old acme order")) | ||
} | ||
} | ||
|
||
b, err := json.Marshal(*a) | ||
if err != nil { | ||
return errors.Wrap(err, "error marshaling new account object") | ||
} | ||
// Set the Account | ||
_, swapped, err := db.CmpAndSwap(accountTable, []byte(a.ID), oldB, b) | ||
switch { | ||
case err != nil: | ||
return ServerInternalErr(errors.Wrap(err, "error storing account")) | ||
case !swapped: | ||
return ServerInternalErr(errors.New("error storing account; " + | ||
"value has changed since last read")) | ||
default: | ||
return nil | ||
} | ||
} | ||
|
||
// update updates the acme account object stored in the database if, | ||
// and only if, the account has not changed since the last read. | ||
func (a *account) update(db nosql.DB, contact []string) (*account, error) { | ||
b := *a | ||
b.Contact = contact | ||
if err := b.save(db, a); err != nil { | ||
return nil, err | ||
} | ||
return &b, nil | ||
} | ||
|
||
// deactivate deactivates the acme account. | ||
func (a *account) deactivate(db nosql.DB) (*account, error) { | ||
b := *a | ||
b.Status = StatusDeactivated | ||
b.Deactivated = clock.Now() | ||
if err := b.save(db, a); err != nil { | ||
return nil, err | ||
} | ||
return &b, nil | ||
} | ||
|
||
// getAccountByID retrieves the account with the given ID. | ||
func getAccountByID(db nosql.DB, id string) (*account, error) { | ||
ab, err := db.Get(accountTable, []byte(id)) | ||
if err != nil { | ||
if nosql.IsErrNotFound(err) { | ||
return nil, MalformedErr(errors.Wrapf(err, "account %s not found", id)) | ||
} | ||
return nil, ServerInternalErr(errors.Wrapf(err, "error loading account %s", id)) | ||
} | ||
|
||
a := new(account) | ||
if err = json.Unmarshal(ab, a); err != nil { | ||
return nil, ServerInternalErr(errors.Wrap(err, "error unmarshaling account")) | ||
} | ||
return a, nil | ||
return Status(a.Status) == StatusValid | ||
} | ||
|
||
// getAccountByKeyID retrieves Id associated with the given Kid. | ||
func getAccountByKeyID(db nosql.DB, kid string) (*account, error) { | ||
id, err := db.Get(accountByKeyIDTable, []byte(kid)) | ||
// KeyToID converts a JWK to a thumbprint. | ||
func KeyToID(jwk *jose.JSONWebKey) (string, error) { | ||
kid, err := jwk.Thumbprint(crypto.SHA256) | ||
if err != nil { | ||
if nosql.IsErrNotFound(err) { | ||
return nil, MalformedErr(errors.Wrapf(err, "account with key id %s not found", kid)) | ||
} | ||
return nil, ServerInternalErr(errors.Wrapf(err, "error loading key-account index")) | ||
return "", WrapErrorISE(err, "error generating jwk thumbprint") | ||
} | ||
return getAccountByID(db, string(id)) | ||
return base64.RawURLEncoding.EncodeToString(kid), nil | ||
} |
Oops, something went wrong.