From 285dc81dd767d8d1e5b021ec3bcf7e6094db8ccb Mon Sep 17 00:00:00 2001 From: AJ ONeal Date: Mon, 11 May 2020 04:41:13 +0000 Subject: [PATCH] update deps --- .../root/keypairs/LICENSE | 21 + .../root/keypairs/README.md | 63 ++ .../git.rootprojects.org/root/keypairs/doc.go | 40 ++ .../git.rootprojects.org/root/keypairs/go.mod | 3 + .../root/keypairs/keyfetch/fetch.go | 516 ++++++++++++++ .../root/keypairs/keyfetch/uncached/fetch.go | 183 +++++ .../root/keypairs/keypairs.go | 645 ++++++++++++++++++ vendor/github.com/joho/godotenv/.gitignore | 1 + vendor/github.com/joho/godotenv/.travis.yml | 8 + vendor/github.com/joho/godotenv/LICENCE | 23 + vendor/github.com/joho/godotenv/README.md | 163 +++++ .../joho/godotenv/autoload/autoload.go | 15 + vendor/github.com/joho/godotenv/godotenv.go | 346 ++++++++++ vendor/modules.txt | 7 + 14 files changed, 2034 insertions(+) create mode 100644 vendor/git.rootprojects.org/root/keypairs/LICENSE create mode 100644 vendor/git.rootprojects.org/root/keypairs/README.md create mode 100644 vendor/git.rootprojects.org/root/keypairs/doc.go create mode 100644 vendor/git.rootprojects.org/root/keypairs/go.mod create mode 100644 vendor/git.rootprojects.org/root/keypairs/keyfetch/fetch.go create mode 100644 vendor/git.rootprojects.org/root/keypairs/keyfetch/uncached/fetch.go create mode 100644 vendor/git.rootprojects.org/root/keypairs/keypairs.go create mode 100644 vendor/github.com/joho/godotenv/.gitignore create mode 100644 vendor/github.com/joho/godotenv/.travis.yml create mode 100644 vendor/github.com/joho/godotenv/LICENCE create mode 100644 vendor/github.com/joho/godotenv/README.md create mode 100644 vendor/github.com/joho/godotenv/autoload/autoload.go create mode 100644 vendor/github.com/joho/godotenv/godotenv.go create mode 100644 vendor/modules.txt diff --git a/vendor/git.rootprojects.org/root/keypairs/LICENSE b/vendor/git.rootprojects.org/root/keypairs/LICENSE new file mode 100644 index 0000000..ca2baf4 --- /dev/null +++ b/vendor/git.rootprojects.org/root/keypairs/LICENSE @@ -0,0 +1,21 @@ +The MIT License + +Copyright (c) 2018-2019 Big Squid, Inc + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/vendor/git.rootprojects.org/root/keypairs/README.md b/vendor/git.rootprojects.org/root/keypairs/README.md new file mode 100644 index 0000000..d9a5a5c --- /dev/null +++ b/vendor/git.rootprojects.org/root/keypairs/README.md @@ -0,0 +1,63 @@ +# go-keypairs + +JSON Web Key (JWK) support and type safety lightly placed over top of Go's `crypto/ecdsa` and `crypto/rsa` + +Useful for JWT, JOSE, etc. + +```go +key, err := keypairs.ParsePrivateKey(bytesForJWKOrPEMOrDER) + +pub, err := keypairs.ParsePublicKey(bytesForJWKOrPEMOrDER) + +jwk, err := keypairs.MarshalJWKPublicKey(pub, time.Now().Add(2 * time.Day)) + +kid, err := keypairs.ThumbprintPublicKey(pub) +``` + +# API Documentation + +See + +# Philosophy + +Go's standard library is great. + +Go has _excellent_ crytography support and provides wonderful +primitives for dealing with them. + +I prefer to stay as close to Go's `crypto` package as possible, +just adding a light touch for JWT support and type safety. + +# Type Safety + +`crypto.PublicKey` is a "marker interface", meaning that it is **not typesafe**! + +`go-keypairs` defines `type keypairs.PrivateKey interface { Public() crypto.PublicKey }`, +which is implemented by `crypto/rsa` and `crypto/ecdsa` +(but not `crypto/dsa`, which we really don't care that much about). + +Go1.15 will add `[PublicKey.Equal(crypto.PublicKey)](https://github.com/golang/go/issues/21704)`, +which will make it possible to remove the additional wrapper over `PublicKey` +and use an interface instead. + +Since there are no common methods between `rsa.PublicKey` and `ecdsa.PublicKey`, +go-keypairs lightly wraps each to implement `Thumbprint() string` (part of the JOSE/JWK spec). + +## JSON Web Key (JWK) as a "codec" + +Although there are many, many ways that JWKs could be interpreted +(possibly why they haven't made it into the standard library), `go-keypairs` +follows the basic pattern of `encoding/x509` to `Parse` and `Marshal` +only the most basic and most meaningful parts of a key. + +I highly recommend that you use `Thumbprint()` for `KeyID` you also +get the benefit of not losing information when encoding and decoding +between the ASN.1, x509, PEM, and JWK formats. + +# LICENSE + +Copyright (c) 2020-present AJ ONeal +Copyright (c) 2018-2019 Big Squid, Inc. + +This work is licensed under the terms of the MIT license. +For a copy, see . diff --git a/vendor/git.rootprojects.org/root/keypairs/doc.go b/vendor/git.rootprojects.org/root/keypairs/doc.go new file mode 100644 index 0000000..378c30c --- /dev/null +++ b/vendor/git.rootprojects.org/root/keypairs/doc.go @@ -0,0 +1,40 @@ +/* +Package keypairs complements Go's standard keypair-related packages +(encoding/pem, crypto/x509, crypto/rsa, crypto/ecdsa, crypto/elliptic) +with JWK encoding support and typesafe PrivateKey and PublicKey interfaces. + +Basics + + key, err := keypairs.ParsePrivateKey(bytesForJWKOrPEMOrDER) + + pub, err := keypairs.ParsePublicKey(bytesForJWKOrPEMOrDER) + + jwk, err := keypairs.MarshalJWKPublicKey(pub, time.Now().Add(2 * time.Day)) + + kid, err := keypairs.ThumbprintPublicKey(pub) + +Convenience functions are available which will fetch keys +(or retrieve them from cache) via OIDC, .well-known/jwks.json, and direct urls. +All keys are cached by Thumbprint, as well as kid(@issuer), if available. + + import "git.rootprojects.org/root/keypairs/keyfetch" + + pubs, err := keyfetch.OIDCJWKs("https://example.com/") + pubs, err := keyfetch.OIDCJWK(ThumbOrKeyID, "https://example.com/") + + pubs, err := keyfetch.WellKnownJWKs("https://example.com/") + pubs, err := keyfetch.WellKnownJWK(ThumbOrKeyID, "https://example.com/") + + pubs, err := keyfetch.JWKs("https://example.com/path/to/jwks/") + pubs, err := keyfetch.JWK(ThumbOrKeyID, "https://example.com/path/to/jwks/") + + // From URL + pub, err := keyfetch.Fetch("https://example.com/jwk.json") + + // From Cache only + pub := keyfetch.Get(thumbprint, "https://example.com/jwk.json") + +A non-caching version with the same capabilities is also available. + +*/ +package keypairs diff --git a/vendor/git.rootprojects.org/root/keypairs/go.mod b/vendor/git.rootprojects.org/root/keypairs/go.mod new file mode 100644 index 0000000..4021a21 --- /dev/null +++ b/vendor/git.rootprojects.org/root/keypairs/go.mod @@ -0,0 +1,3 @@ +module git.rootprojects.org/root/keypairs + +go 1.12 diff --git a/vendor/git.rootprojects.org/root/keypairs/keyfetch/fetch.go b/vendor/git.rootprojects.org/root/keypairs/keyfetch/fetch.go new file mode 100644 index 0000000..c609531 --- /dev/null +++ b/vendor/git.rootprojects.org/root/keypairs/keyfetch/fetch.go @@ -0,0 +1,516 @@ +// Package keyfetch retrieve and cache PublicKeys +// from OIDC (https://example.com/.well-known/openid-configuration) +// and Auth0 (https://example.com/.well-known/jwks.json) +// JWKs URLs and expires them when `exp` is reached +// (or a default expiry if the key does not provide one). +// It uses the keypairs package to Unmarshal the JWKs into their +// native types (with a very thin shim to provide the type safety +// that Go's crypto.PublicKey and crypto.PrivateKey interfaces lack). +package keyfetch + +import ( + "errors" + "fmt" + "log" + "net/http" + "net/url" + "strconv" + "strings" + "sync" + "time" + + "git.rootprojects.org/root/keypairs" + "git.rootprojects.org/root/keypairs/keyfetch/uncached" +) + +// TODO should be ErrInvalidJWKURL + +// EInvalidJWKURL means that the url did not provide JWKs +var EInvalidJWKURL = errors.New("url does not lead to valid JWKs") + +// KeyCache is an in-memory key cache +var KeyCache = map[string]CachableKey{} + +// KeyCacheMux is used to guard the in-memory cache +var KeyCacheMux = sync.Mutex{} + +// ErrInsecureDomain means that plain http was used where https was expected +var ErrInsecureDomain = errors.New("Whitelists should only allow secure URLs (i.e. https://). To allow unsecured private networking (i.e. Docker) pass PrivateWhitelist as a list of private URLs") + +// TODO Cacheable key (shouldn't this be private)? + +// CachableKey represents +type CachableKey struct { + Key keypairs.PublicKey + Expiry time.Time +} + +// maybe TODO use this poor-man's enum to allow kids thumbs to be accepted by the same method? +/* +type KeyID string + +func (kid KeyID) ID() string { + return string(kid) +} +func (kid KeyID) isID() {} + +type Thumbprint string + +func (thumb Thumbprint) ID() string { + return string(thumb) +} +func (thumb Thumbprint) isID() {} + +type ID interface { + ID() string + isID() +} +*/ + +// StaleTime defines when public keys should be renewed (15 minutes by default) +var StaleTime = 15 * time.Minute + +// DefaultKeyDuration defines how long a key should be considered fresh (48 hours by default) +var DefaultKeyDuration = 48 * time.Hour + +// MinimumKeyDuration defines the minimum time that a key will be cached (1 hour by default) +var MinimumKeyDuration = time.Hour + +// MaximumKeyDuration defines the maximum time that a key will be cached (72 hours by default) +var MaximumKeyDuration = 72 * time.Hour + +// PublicKeysMap is a newtype for a map of keypairs.PublicKey +type PublicKeysMap map[string]keypairs.PublicKey + +// OIDCJWKs fetches baseURL + ".well-known/openid-configuration" and then fetches and returns the Public Keys. +func OIDCJWKs(baseURL string) (PublicKeysMap, error) { + maps, keys, err := uncached.OIDCJWKs(baseURL) + + if nil != err { + return nil, err + } + cacheKeys(maps, keys, baseURL) + return keys, err +} + +// OIDCJWK fetches baseURL + ".well-known/openid-configuration" and then returns the key matching kid (or thumbprint) +func OIDCJWK(kidOrThumb, iss string) (keypairs.PublicKey, error) { + return immediateOneOrFetch(kidOrThumb, iss, uncached.OIDCJWKs) +} + +// WellKnownJWKs fetches baseURL + ".well-known/jwks.json" and caches and returns the keys +func WellKnownJWKs(kidOrThumb, iss string) (PublicKeysMap, error) { + maps, keys, err := uncached.WellKnownJWKs(iss) + + if nil != err { + return nil, err + } + cacheKeys(maps, keys, iss) + return keys, err +} + +// WellKnownJWK fetches baseURL + ".well-known/jwks.json" and returns the key matching kid (or thumbprint) +func WellKnownJWK(kidOrThumb, iss string) (keypairs.PublicKey, error) { + return immediateOneOrFetch(kidOrThumb, iss, uncached.WellKnownJWKs) +} + +// JWKs returns a map of keys identified by their thumbprint +// (since kid may or may not be present) +func JWKs(jwksurl string) (PublicKeysMap, error) { + maps, keys, err := uncached.JWKs(jwksurl) + + if nil != err { + return nil, err + } + iss := strings.Replace(jwksurl, ".well-known/jwks.json", "", 1) + cacheKeys(maps, keys, iss) + return keys, err +} + +// JWK tries to return a key from cache, falling back to the /.well-known/jwks.json of the issuer +func JWK(kidOrThumb, iss string) (keypairs.PublicKey, error) { + return immediateOneOrFetch(kidOrThumb, iss, uncached.JWKs) +} + +// PEM tries to return a key from cache, falling back to the specified PEM url +func PEM(url string) (keypairs.PublicKey, error) { + // url is kid in this case + return immediateOneOrFetch(url, url, func(string) (map[string]map[string]string, map[string]keypairs.PublicKey, error) { + m, key, err := uncached.PEM(url) + if nil != err { + return nil, nil, err + } + + // put in a map, just for caching + maps := map[string]map[string]string{} + maps[key.Thumbprint()] = m + maps[url] = m + + keys := map[string]keypairs.PublicKey{} + keys[key.Thumbprint()] = key + keys[url] = key + + return maps, keys, nil + }) +} + +// Fetch returns a key from cache, falling back to an exact url as the "issuer" +func Fetch(url string) (keypairs.PublicKey, error) { + // url is kid in this case + return immediateOneOrFetch(url, url, func(string) (map[string]map[string]string, map[string]keypairs.PublicKey, error) { + m, key, err := uncached.Fetch(url) + if nil != err { + return nil, nil, err + } + + // put in a map, just for caching + maps := map[string]map[string]string{} + maps[key.Thumbprint()] = m + + keys := map[string]keypairs.PublicKey{} + keys[key.Thumbprint()] = key + + return maps, keys, nil + }) +} + +// Get retrieves a key from cache, or returns an error. +// The issuer string may be empty if using a thumbprint rather than a kid. +func Get(kidOrThumb, iss string) keypairs.PublicKey { + if pub := get(kidOrThumb, iss); nil != pub { + return pub.Key + } + return nil +} + +func get(kidOrThumb, iss string) *CachableKey { + iss = normalizeIssuer(iss) + KeyCacheMux.Lock() + defer KeyCacheMux.Unlock() + + // we're safe to check the cache by kid alone + // by virtue that we never set it by kid alone + hit, ok := KeyCache[kidOrThumb] + if ok { + if now := time.Now(); hit.Expiry.Sub(now) > 0 { + // only return non-expired keys + return &hit + } + } + + id := kidOrThumb + "@" + iss + hit, ok = KeyCache[id] + if ok { + if now := time.Now(); hit.Expiry.Sub(now) > 0 { + // only return non-expired keys + return &hit + } + } + + return nil +} + +func immediateOneOrFetch(kidOrThumb, iss string, fetcher myfetcher) (keypairs.PublicKey, error) { + now := time.Now() + key := get(kidOrThumb, iss) + + if nil == key { + return fetchAndSelect(kidOrThumb, iss, fetcher) + } + + // Fetch just a little before the key actually expires + if key.Expiry.Sub(now) <= StaleTime { + go fetchAndSelect(kidOrThumb, iss, fetcher) + } + + return key.Key, nil +} + +type myfetcher func(string) (map[string]map[string]string, map[string]keypairs.PublicKey, error) + +func fetchAndSelect(id, baseURL string, fetcher myfetcher) (keypairs.PublicKey, error) { + maps, keys, err := fetcher(baseURL) + if nil != err { + return nil, err + } + cacheKeys(maps, keys, baseURL) + + for i := range keys { + key := keys[i] + + if id == key.Thumbprint() { + return key, nil + } + + if id == key.KeyID() { + return key, nil + } + } + + return nil, fmt.Errorf("Key identified by '%s' was not found at %s", id, baseURL) +} + +func cacheKeys(maps map[string]map[string]string, keys map[string]keypairs.PublicKey, issuer string) { + for i := range keys { + key := keys[i] + m := maps[i] + iss := issuer + if "" != m["iss"] { + iss = m["iss"] + } + iss = normalizeIssuer(iss) + cacheKey(m["kid"], iss, m["exp"], key) + } +} + +func cacheKey(kid, iss, expstr string, pub keypairs.PublicKey) error { + var expiry time.Time + iss = normalizeIssuer(iss) + + exp, _ := strconv.ParseInt(expstr, 10, 64) + if 0 == exp { + // use default + expiry = time.Now().Add(DefaultKeyDuration) + } else if exp < time.Now().Add(MinimumKeyDuration).Unix() || exp > time.Now().Add(MaximumKeyDuration).Unix() { + // use at least one hour + expiry = time.Now().Add(MinimumKeyDuration) + } else { + expiry = time.Unix(exp, 0) + } + + KeyCacheMux.Lock() + defer KeyCacheMux.Unlock() + // Put the key in the cache by both kid and thumbprint, and set the expiry + id := kid + "@" + iss + KeyCache[id] = CachableKey{ + Key: pub, + Expiry: expiry, + } + // Since thumbprints are crypto secure, iss isn't needed + thumb := pub.Thumbprint() + KeyCache[thumb] = CachableKey{ + Key: pub, + Expiry: expiry, + } + + return nil +} + +func clear() { + KeyCacheMux.Lock() + defer KeyCacheMux.Unlock() + KeyCache = map[string]CachableKey{} +} + +func normalizeIssuer(iss string) string { + return strings.TrimRight(iss, "/") +} + +func isTrustedIssuer(iss string, whitelist Whitelist, rs ...*http.Request) bool { + if "" == iss { + return false + } + + // Normalize the http:// and https:// and parse + iss = strings.TrimRight(iss, "/") + "/" + if strings.HasPrefix(iss, "http://") { + // ignore + } else if strings.HasPrefix(iss, "//") { + return false // TODO + } else if !strings.HasPrefix(iss, "https://") { + iss = "https://" + iss + } + issURL, err := url.Parse(iss) + if nil != err { + return false + } + + // Check that + // * schemes match (https: == https:) + // * paths match (/foo/ == /foo/, always with trailing slash added) + // * hostnames are compatible (a == b or "sub.foo.com".HasSufix(".foo.com")) + for i := range []*url.URL(whitelist) { + u := whitelist[i] + + if issURL.Scheme != u.Scheme { + continue + } else if u.Path != strings.TrimRight(issURL.Path, "/")+"/" { + continue + } else if issURL.Host != u.Host { + if '.' == u.Host[0] && strings.HasSuffix(issURL.Host, u.Host) { + return true + } + continue + } + // All failures have been handled + return true + } + + // Check if implicit issuer is available + if 0 == len(rs) { + return false + } + return hasImplicitTrust(issURL, rs[0]) +} + +// hasImplicitTrust relies on the security of DNS and TLS to determine if the +// headers of the request can be trusted as identifying the server itself as +// a valid issuer, without additional configuration. +// +// Helpful for testing, but in the wrong hands could easily lead to a zero-day. +func hasImplicitTrust(issURL *url.URL, r *http.Request) bool { + if nil == r { + return false + } + + // Sanity check that, if a load balancer exists, it isn't misconfigured + proto := r.Header.Get("X-Forwarded-Proto") + if "" != proto && proto != "https" { + return false + } + + // Get the host + // * If TLS, block Domain Fronting + // * Otherwise assume trusted proxy + // * Otherwise assume test environment + var host string + if nil != r.TLS { + // Note that if this were to be implemented for HTTP/2 it would need to + // check all names on the certificate, not just the one with which the + // original connection was established. However, not our problem here. + // See https://serverfault.com/a/908087/93930 + if r.TLS.ServerName != r.Host { + return false + } + host = r.Host + } else { + host = r.Header.Get("X-Forwarded-Host") + if "" == host { + host = r.Host + } + } + + // Same tests as above, adjusted since it can't handle wildcards and, since + // the path is variable, we make the assumption that a child can trust a + // parent, but that a parent cannot trust a child. + if r.Host != issURL.Host { + return false + } + if !strings.HasPrefix(strings.TrimRight(r.URL.Path, "/")+"/", issURL.Path) { + // Ex: Request URL Token Issuer + // !"https:example.com/johndoe/api/dothing".HasPrefix("https:example.com/") + return false + } + + return true +} + +// Whitelist is a newtype for an array of URLs +type Whitelist []*url.URL + +// NewWhitelist turns an array of URLs (such as https://example.com/) into +// a parsed array of *url.URLs that can be used by the IsTrustedIssuer function +func NewWhitelist(issuers []string, privateList ...[]string) (Whitelist, error) { + var err error + + list := []*url.URL{} + if 0 != len(issuers) { + insecure := false + list, err = newWhitelist(list, issuers, insecure) + if nil != err { + return nil, err + } + } + if 0 != len(privateList) && 0 != len(privateList[0]) { + insecure := true + list, err = newWhitelist(list, privateList[0], insecure) + if nil != err { + return nil, err + } + } + + return Whitelist(list), nil +} + +func newWhitelist(list []*url.URL, issuers []string, insecure bool) (Whitelist, error) { + for i := range issuers { + iss := issuers[i] + if "" == strings.TrimSpace(iss) { + fmt.Println("[Warning] You have an empty string in your keyfetch whitelist.") + continue + } + + // Should have a valid http or https prefix + // TODO support custom prefixes (i.e. app://) ? + if strings.HasPrefix(iss, "http://") { + if !insecure { + log.Println("Oops! You have an insecure domain in your whitelist: ", iss) + return nil, ErrInsecureDomain + } + } else if strings.HasPrefix(iss, "//") { + // TODO + return nil, errors.New("Rather than prefixing with // to support multiple protocols, add them seperately:" + iss) + } else if !strings.HasPrefix(iss, "https://") { + iss = "https://" + iss + } + + // trailing slash as a boundary character, which may or may not denote a directory + iss = strings.TrimRight(iss, "/") + "/" + u, err := url.Parse(iss) + if nil != err { + return nil, err + } + + // Strip any * prefix, for easier comparison later + // *.example.com => .example.com + if strings.HasPrefix(u.Host, "*.") { + u.Host = u.Host[1:] + } + + list = append(list, u) + } + + return list, nil +} + +/* + IsTrustedIssuer returns true when the `iss` (i.e. from a token) matches one + in the provided whitelist (also matches wildcard domains). + + You may explicitly allow insecure http (i.e. for automated testing) by + including http:// Otherwise the scheme in each item of the whitelist should + include the "https://" prefix. + + SECURITY CONSIDERATIONS (Please Read) + + You'll notice that *http.Request is optional. It should only be used under these + three circumstances: + + 1) Something else guarantees http -> https redirection happens before the + connection gets here AND this server directly handles TLS/SSL. + + 2) If you're using a load balancer or web server, and this doesn't handle + TLS/SSL directly, that server is _explicitly_ configured to protect + against Domain Fronting attacks. As of 2019, most web servers and load + balancers do not protect against that by default. + + 3) If you only use it to make your automated integration testing more + and it isn't enabled in production. + + Otherwise, DO NOT pass in *http.Request as you will introduce a 0-day + vulnerability allowing an attacker to spoof any token issuer of their choice. + The only reason I allowed this in a public library where non-experts would + encounter it is to make testing easier. +*/ +func (w Whitelist) IsTrustedIssuer(iss string, rs ...*http.Request) bool { + return isTrustedIssuer(iss, w, rs...) +} + +// String will generate a space-delimited list of whitelisted URLs +func (w Whitelist) String() string { + s := []string{} + for i := range w { + s = append(s, w[i].String()) + } + return strings.Join(s, " ") +} diff --git a/vendor/git.rootprojects.org/root/keypairs/keyfetch/uncached/fetch.go b/vendor/git.rootprojects.org/root/keypairs/keyfetch/uncached/fetch.go new file mode 100644 index 0000000..2e1c265 --- /dev/null +++ b/vendor/git.rootprojects.org/root/keypairs/keyfetch/uncached/fetch.go @@ -0,0 +1,183 @@ +// Package uncached provides uncached versions of go-keypairs/keyfetch +package uncached + +import ( + "bytes" + "encoding/json" + "errors" + "io" + "io/ioutil" + "net" + "net/http" + "strings" + "time" + + "git.rootprojects.org/root/keypairs" +) + +// OIDCJWKs gets the OpenID Connect configuration from the baseURL and then calls JWKs with the specified jwks_uri +func OIDCJWKs(baseURL string) (map[string]map[string]string, map[string]keypairs.PublicKey, error) { + baseURL = normalizeBaseURL(baseURL) + oidcConf := struct { + JWKSURI string `json:"jwks_uri"` + }{} + + // must come in as https:/// + url := baseURL + ".well-known/openid-configuration" + err := safeFetch(url, func(body io.Reader) error { + decoder := json.NewDecoder(body) + decoder.UseNumber() + return decoder.Decode(&oidcConf) + }) + if nil != err { + return nil, nil, err + } + + return JWKs(oidcConf.JWKSURI) +} + +// WellKnownJWKs calls JWKs with baseURL + /.well-known/jwks.json as constructs the jwks_uri +func WellKnownJWKs(baseURL string) (map[string]map[string]string, map[string]keypairs.PublicKey, error) { + baseURL = normalizeBaseURL(baseURL) + url := baseURL + ".well-known/jwks.json" + + return JWKs(url) +} + +// JWKs fetches and parses a jwks.json (assuming well-known format) +func JWKs(jwksurl string) (map[string]map[string]string, map[string]keypairs.PublicKey, error) { + keys := map[string]keypairs.PublicKey{} + maps := map[string]map[string]string{} + resp := struct { + Keys []map[string]interface{} `json:"keys"` + }{ + Keys: make([]map[string]interface{}, 0, 1), + } + + if err := safeFetch(jwksurl, func(body io.Reader) error { + decoder := json.NewDecoder(body) + decoder.UseNumber() + return decoder.Decode(&resp) + }); nil != err { + return nil, nil, err + } + + for i := range resp.Keys { + k := resp.Keys[i] + m := getStringMap(k) + + key, err := keypairs.NewJWKPublicKey(m) + + if nil != err { + return nil, nil, err + } + keys[key.Thumbprint()] = key + maps[key.Thumbprint()] = m + } + + return maps, keys, nil +} + +// PEM fetches and parses a PEM (assuming well-known format) +func PEM(pemurl string) (map[string]string, keypairs.PublicKey, error) { + var pub keypairs.PublicKey + if err := safeFetch(pemurl, func(body io.Reader) error { + pem, err := ioutil.ReadAll(body) + if nil != err { + return err + } + pub, err = keypairs.ParsePublicKey(pem) + return err + }); nil != err { + return nil, nil, err + } + + jwk := map[string]interface{}{} + body := bytes.NewBuffer(keypairs.MarshalJWKPublicKey(pub)) + decoder := json.NewDecoder(body) + decoder.UseNumber() + _ = decoder.Decode(&jwk) + + m := getStringMap(jwk) + m["kid"] = pemurl + + switch p := pub.(type) { + case *keypairs.ECPublicKey: + p.KID = pemurl + case *keypairs.RSAPublicKey: + p.KID = pemurl + default: + return nil, nil, errors.New("impossible key type") + } + + return m, pub, nil +} + +// Fetch retrieves a single JWK (plain, bare jwk) from a URL (off-spec) +func Fetch(url string) (map[string]string, keypairs.PublicKey, error) { + var m map[string]interface{} + if err := safeFetch(url, func(body io.Reader) error { + decoder := json.NewDecoder(body) + decoder.UseNumber() + return decoder.Decode(&m) + }); nil != err { + return nil, nil, err + } + + n := getStringMap(m) + key, err := keypairs.NewJWKPublicKey(n) + if nil != err { + return nil, nil, err + } + + return n, key, nil +} + +func getStringMap(m map[string]interface{}) map[string]string { + n := make(map[string]string) + + // TODO get issuer from x5c, if exists + + // convert map[string]interface{} to map[string]string + for j := range m { + switch s := m[j].(type) { + case string: + n[j] = s + default: + // safely ignore + } + } + + return n +} + +type decodeFunc func(io.Reader) error + +// TODO: also limit the body size +func safeFetch(url string, decoder decodeFunc) error { + var netTransport = &http.Transport{ + Dial: (&net.Dialer{ + Timeout: 5 * time.Second, + }).Dial, + TLSHandshakeTimeout: 5 * time.Second, + } + var client = &http.Client{ + Timeout: time.Second * 10, + Transport: netTransport, + } + + req, err := http.NewRequest("GET", url, nil) + req.Header.Set("User-Agent", "go-keypairs/keyfetch") + req.Header.Set("Accept", "application/json;q=0.9,*/*;q=0.8") + res, err := client.Do(req) + if nil != err { + return err + } + defer res.Body.Close() + + return decoder(res.Body) +} + +func normalizeBaseURL(iss string) string { + return strings.TrimRight(iss, "/") + "/" +} diff --git a/vendor/git.rootprojects.org/root/keypairs/keypairs.go b/vendor/git.rootprojects.org/root/keypairs/keypairs.go new file mode 100644 index 0000000..ae6012b --- /dev/null +++ b/vendor/git.rootprojects.org/root/keypairs/keypairs.go @@ -0,0 +1,645 @@ +package keypairs + +import ( + "bytes" + "crypto" + "crypto/dsa" + "crypto/ecdsa" + "crypto/elliptic" + "crypto/rsa" + "crypto/sha256" + "crypto/x509" + "encoding/base64" + "encoding/json" + "encoding/pem" + "errors" + "fmt" + "io" + "log" + "math/big" + "strings" + "time" +) + +// ErrInvalidPrivateKey means that the key is not a valid Private Key +var ErrInvalidPrivateKey = errors.New("PrivateKey must be of type *rsa.PrivateKey or *ecdsa.PrivateKey") + +// ErrInvalidPublicKey means that the key is not a valid Public Key +var ErrInvalidPublicKey = errors.New("PublicKey must be of type *rsa.PublicKey or *ecdsa.PublicKey") + +// ErrParsePublicKey means that the bytes cannot be parsed in any known format +var ErrParsePublicKey = errors.New("PublicKey bytes could not be parsed as PEM or DER (PKIX/SPKI, PKCS1, or X509 Certificate) or JWK") + +// ErrParsePrivateKey means that the bytes cannot be parsed in any known format +var ErrParsePrivateKey = errors.New("PrivateKey bytes could not be parsed as PEM or DER (PKCS8, SEC1, or PKCS1) or JWK") + +// ErrParseJWK means that the JWK is valid JSON but not a valid JWK +var ErrParseJWK = errors.New("JWK is missing required base64-encoded JSON fields") + +// ErrInvalidKeyType means that the key is not an acceptable type +var ErrInvalidKeyType = errors.New("The JWK's 'kty' must be either 'RSA' or 'EC'") + +// ErrInvalidCurve means that a non-standard curve was used +var ErrInvalidCurve = errors.New("The JWK's 'crv' must be either of the NIST standards 'P-256' or 'P-384'") + +// ErrUnexpectedPublicKey means that a Private Key was expected +var ErrUnexpectedPublicKey = errors.New("PrivateKey was given where PublicKey was expected") + +// ErrUnexpectedPrivateKey means that a Public Key was expected +var ErrUnexpectedPrivateKey = errors.New("PublicKey was given where PrivateKey was expected") + +// ErrDevSwapPrivatePublic means that the developer compiled bad code that swapped public and private keys +const ErrDevSwapPrivatePublic = "[Developer Error] You passed either crypto.PrivateKey or crypto.PublicKey where the other was expected." + +// ErrDevBadKeyType means that the developer compiled bad code that passes the wrong type +const ErrDevBadKeyType = "[Developer Error] crypto.PublicKey and crypto.PrivateKey are somewhat deceptive. They're actually empty interfaces that accept any object, even non-crypto objects. You passed an object of type '%T' by mistake." + +// PrivateKey is a zero-cost typesafe substitue for crypto.PrivateKey +type PrivateKey interface { + Public() crypto.PublicKey +} + +// PublicKey thinly veils crypto.PublicKey for type safety +type PublicKey interface { + crypto.PublicKey + Thumbprint() string + KeyID() string + Key() crypto.PublicKey + ExpiresAt() time.Time +} + +// ECPublicKey adds common methods to *ecdsa.PublicKey for type safety +type ECPublicKey struct { + PublicKey *ecdsa.PublicKey // empty interface + KID string + Expiry time.Time +} + +// RSAPublicKey adds common methods to *rsa.PublicKey for type safety +type RSAPublicKey struct { + PublicKey *rsa.PublicKey // empty interface + KID string + Expiry time.Time +} + +// Thumbprint returns a JWK thumbprint. See https://stackoverflow.com/questions/42588786/how-to-fingerprint-a-jwk +func (p *ECPublicKey) Thumbprint() string { + return ThumbprintUntypedPublicKey(p.PublicKey) +} + +// KeyID returns the JWK `kid`, which will be the Thumbprint for keys generated with this library +func (p *ECPublicKey) KeyID() string { + return p.KID +} + +// Key returns the PublicKey +func (p *ECPublicKey) Key() crypto.PublicKey { + return p.PublicKey +} + +// ExpireAt sets the time at which this Public Key should be considered invalid +func (p *ECPublicKey) ExpireAt(t time.Time) { + p.Expiry = t +} + +// ExpiresAt gets the time at which this Public Key should be considered invalid +func (p *ECPublicKey) ExpiresAt() time.Time { + return p.Expiry +} + +// Thumbprint returns a JWK thumbprint. See https://stackoverflow.com/questions/42588786/how-to-fingerprint-a-jwk +func (p *RSAPublicKey) Thumbprint() string { + return ThumbprintUntypedPublicKey(p.PublicKey) +} + +// KeyID returns the JWK `kid`, which will be the Thumbprint for keys generated with this library +func (p *RSAPublicKey) KeyID() string { + return p.KID +} + +// Key returns the PublicKey +func (p *RSAPublicKey) Key() crypto.PublicKey { + return p.PublicKey +} + +// ExpireAt sets the time at which this Public Key should be considered invalid +func (p *RSAPublicKey) ExpireAt(t time.Time) { + p.Expiry = t +} + +// ExpiresAt gets the time at which this Public Key should be considered invalid +func (p *RSAPublicKey) ExpiresAt() time.Time { + return p.Expiry +} + +// NewPublicKey wraps a crypto.PublicKey to make it typesafe. +func NewPublicKey(pub crypto.PublicKey, kid ...string) PublicKey { + var k PublicKey + switch p := pub.(type) { + case *ecdsa.PublicKey: + eckey := &ECPublicKey{ + PublicKey: p, + } + if 0 != len(kid) { + eckey.KID = kid[0] + } else { + eckey.KID = ThumbprintECPublicKey(p) + } + k = eckey + case *rsa.PublicKey: + rsakey := &RSAPublicKey{ + PublicKey: p, + } + if 0 != len(kid) { + rsakey.KID = kid[0] + } else { + rsakey.KID = ThumbprintRSAPublicKey(p) + } + k = rsakey + case *ecdsa.PrivateKey: + panic(errors.New(ErrDevSwapPrivatePublic)) + case *rsa.PrivateKey: + panic(errors.New(ErrDevSwapPrivatePublic)) + case *dsa.PublicKey: + panic(ErrInvalidPublicKey) + case *dsa.PrivateKey: + panic(ErrInvalidPrivateKey) + default: + panic(fmt.Errorf(ErrDevBadKeyType, pub)) + } + + return k +} + +// MarshalJWKPublicKey outputs a JWK with its key id (kid) and an optional expiration, +// making it suitable for use as an OIDC public key. +func MarshalJWKPublicKey(key PublicKey, exp ...time.Time) []byte { + // thumbprint keys are alphabetically sorted and only include the necessary public parts + switch k := key.Key().(type) { + case *rsa.PublicKey: + return MarshalRSAPublicKey(k, exp...) + case *ecdsa.PublicKey: + return MarshalECPublicKey(k, exp...) + case *dsa.PublicKey: + panic(ErrInvalidPublicKey) + default: + // this is unreachable because we know the types that we pass in + log.Printf("keytype: %t, %+v\n", key, key) + panic(ErrInvalidPublicKey) + } +} + +// ThumbprintPublicKey returns the SHA256 RFC-spec JWK thumbprint +func ThumbprintPublicKey(pub PublicKey) string { + return ThumbprintUntypedPublicKey(pub.Key()) +} + +// ThumbprintUntypedPublicKey is a non-typesafe version of ThumbprintPublicKey +// (but will still panic, to help you discover bugs in development rather than production). +func ThumbprintUntypedPublicKey(pub crypto.PublicKey) string { + switch p := pub.(type) { + case PublicKey: + return ThumbprintUntypedPublicKey(p.Key()) + case *ecdsa.PublicKey: + return ThumbprintECPublicKey(p) + case *rsa.PublicKey: + return ThumbprintRSAPublicKey(p) + default: + panic(ErrInvalidPublicKey) + } +} + +// MarshalECPublicKey will take an EC key and output a JWK, with optional expiration date +func MarshalECPublicKey(k *ecdsa.PublicKey, exp ...time.Time) []byte { + thumb := ThumbprintECPublicKey(k) + crv := k.Curve.Params().Name + x := base64.RawURLEncoding.EncodeToString(k.X.Bytes()) + y := base64.RawURLEncoding.EncodeToString(k.Y.Bytes()) + expstr := "" + if 0 != len(exp) { + expstr = fmt.Sprintf(`"exp":%d,`, exp[0].Unix()) + } + return []byte(fmt.Sprintf(`{"kid":%q,"use":"sig",%s"crv":%q,"kty":"EC","x":%q,"y":%q}`, thumb, expstr, crv, x, y)) +} + +// MarshalECPublicKeyWithoutKeyID will output the most minimal version of an EC JWK (no key id, no "use" flag, nada) +func MarshalECPublicKeyWithoutKeyID(k *ecdsa.PublicKey) []byte { + crv := k.Curve.Params().Name + x := base64.RawURLEncoding.EncodeToString(k.X.Bytes()) + y := base64.RawURLEncoding.EncodeToString(k.Y.Bytes()) + return []byte(fmt.Sprintf(`{"crv":%q,"kty":"EC","x":%q,"y":%q}`, crv, x, y)) +} + +// ThumbprintECPublicKey will output a RFC-spec SHA256 JWK thumbprint of an EC public key +func ThumbprintECPublicKey(k *ecdsa.PublicKey) string { + thumbprintable := MarshalECPublicKeyWithoutKeyID(k) + sha := sha256.Sum256(thumbprintable) + return base64.RawURLEncoding.EncodeToString(sha[:]) +} + +// MarshalRSAPublicKey will take an RSA key and output a JWK, with optional expiration date +func MarshalRSAPublicKey(p *rsa.PublicKey, exp ...time.Time) []byte { + thumb := ThumbprintRSAPublicKey(p) + e := base64.RawURLEncoding.EncodeToString(big.NewInt(int64(p.E)).Bytes()) + n := base64.RawURLEncoding.EncodeToString(p.N.Bytes()) + expstr := "" + if 0 != len(exp) { + expstr = fmt.Sprintf(`"exp":%d,`, exp[0].Unix()) + } + return []byte(fmt.Sprintf(`{"kid":%q,"use":"sig",%s"e":%q,"kty":"RSA","n":%q}`, thumb, expstr, e, n)) +} + +// MarshalRSAPublicKeyWithoutKeyID will output the most minimal version of an RSA JWK (no key id, no "use" flag, nada) +func MarshalRSAPublicKeyWithoutKeyID(p *rsa.PublicKey) []byte { + e := base64.RawURLEncoding.EncodeToString(big.NewInt(int64(p.E)).Bytes()) + n := base64.RawURLEncoding.EncodeToString(p.N.Bytes()) + return []byte(fmt.Sprintf(`{"e":%q,"kty":"RSA","n":%q}`, e, n)) +} + +// ThumbprintRSAPublicKey will output a RFC-spec SHA256 JWK thumbprint of an EC public key +func ThumbprintRSAPublicKey(p *rsa.PublicKey) string { + thumbprintable := MarshalRSAPublicKeyWithoutKeyID(p) + sha := sha256.Sum256([]byte(thumbprintable)) + return base64.RawURLEncoding.EncodeToString(sha[:]) +} + +// ParsePrivateKey will try to parse the bytes you give it +// in any of the supported formats: PEM, DER, PKCS8, PKCS1, SEC1, and JWK +func ParsePrivateKey(block []byte) (PrivateKey, error) { + blocks, err := getPEMBytes(block) + if nil != err { + return nil, ErrParsePrivateKey + } + + // Parse PEM blocks (openssl generates junk metadata blocks for ECs) + // or the original DER, or the JWK + for i := range blocks { + block = blocks[i] + if key, err := parsePrivateKey(block); nil == err { + return key, nil + } + } + + for i := range blocks { + block = blocks[i] + if _, err := parsePublicKey(block); nil == err { + return nil, ErrUnexpectedPublicKey + } + } + + // If we didn't parse a key arleady, we failed + return nil, ErrParsePrivateKey +} + +// ParsePrivateKeyString calls ParsePrivateKey([]byte(key)) for all you lazy folk. +func ParsePrivateKeyString(block string) (PrivateKey, error) { + return ParsePrivateKey([]byte(block)) +} + +func parsePrivateKey(der []byte) (PrivateKey, error) { + var key PrivateKey + + //fmt.Println("1. ParsePKCS8PrivateKey") + xkey, err := x509.ParsePKCS8PrivateKey(der) + if nil == err { + switch k := xkey.(type) { + case *rsa.PrivateKey: + key = k + case *ecdsa.PrivateKey: + key = k + default: + err = errors.New("Only RSA and ECDSA (EC) Private Keys are supported") + } + } + + if nil != err { + //fmt.Println("2. ParseECPrivateKey") + key, err = x509.ParseECPrivateKey(der) + if nil != err { + //fmt.Println("3. ParsePKCS1PrivateKey") + key, err = x509.ParsePKCS1PrivateKey(der) + if nil != err { + //fmt.Println("4. ParseJWKPrivateKey") + key, err = ParseJWKPrivateKey(der) + } + } + } + + // But did you know? + // You must return nil explicitly for interfaces + // https://golang.org/doc/faq#nil_error + if nil != err { + return nil, err + } + + return key, nil +} + +func getPEMBytes(block []byte) ([][]byte, error) { + var pemblock *pem.Block + var blocks = make([][]byte, 0, 1) + + // Parse the PEM, if it's a pem + for { + pemblock, block = pem.Decode(block) + if nil != pemblock { + // got one block, there may be more + blocks = append(blocks, pemblock.Bytes) + } else { + // the last block was not a PEM block + // therefore the next isn't either + if 0 != len(block) { + blocks = append(blocks, block) + } + break + } + } + + if len(blocks) > 0 { + return blocks, nil + } + return nil, errors.New("no PEM blocks found") +} + +// ParsePublicKey will try to parse the bytes you give it +// in any of the supported formats: PEM, DER, PKIX/SPKI, PKCS1, x509 Certificate, and JWK +func ParsePublicKey(block []byte) (PublicKey, error) { + blocks, err := getPEMBytes(block) + if nil != err { + return nil, ErrParsePublicKey + } + + // Parse PEM blocks (openssl generates junk metadata blocks for ECs) + // or the original DER, or the JWK + for i := range blocks { + block = blocks[i] + if key, err := parsePublicKey(block); nil == err { + return key, nil + } + } + + for i := range blocks { + block = blocks[i] + if _, err := parsePrivateKey(block); nil == err { + return nil, ErrUnexpectedPrivateKey + } + } + + // If we didn't parse a key arleady, we failed + return nil, ErrParsePublicKey +} + +// ParsePublicKeyString calls ParsePublicKey([]byte(key)) for all you lazy folk. +func ParsePublicKeyString(block string) (PublicKey, error) { + return ParsePublicKey([]byte(block)) +} + +func parsePublicKey(der []byte) (PublicKey, error) { + cert, err := x509.ParseCertificate(der) + if nil == err { + switch k := cert.PublicKey.(type) { + case *rsa.PublicKey: + return NewPublicKey(k), nil + case *ecdsa.PublicKey: + return NewPublicKey(k), nil + default: + return nil, errors.New("Only RSA and ECDSA (EC) Public Keys are supported") + } + } + + //fmt.Println("1. ParsePKIXPublicKey") + xkey, err := x509.ParsePKIXPublicKey(der) + if nil == err { + switch k := xkey.(type) { + case *rsa.PublicKey: + return NewPublicKey(k), nil + case *ecdsa.PublicKey: + return NewPublicKey(k), nil + default: + return nil, errors.New("Only RSA and ECDSA (EC) Public Keys are supported") + } + } + + //fmt.Println("3. ParsePKCS1PrublicKey") + rkey, err := x509.ParsePKCS1PublicKey(der) + if nil == err { + //fmt.Println("4. ParseJWKPublicKey") + return NewPublicKey(rkey), nil + } + + return ParseJWKPublicKey(der) + + /* + // But did you know? + // You must return nil explicitly for interfaces + // https://golang.org/doc/faq#nil_error + if nil != err { + return nil, err + } + */ +} + +// NewJWKPublicKey contstructs a PublicKey from the relevant pieces a map[string]string (generic JSON) +func NewJWKPublicKey(m map[string]string) (PublicKey, error) { + switch m["kty"] { + case "RSA": + return parseRSAPublicKey(m) + case "EC": + return parseECPublicKey(m) + default: + return nil, ErrInvalidKeyType + } +} + +// ParseJWKPublicKey parses a JSON-encoded JWK and returns a PublicKey, or a (hopefully) helpful error message +func ParseJWKPublicKey(b []byte) (PublicKey, error) { + // RSA and EC have "d" as a private part + if bytes.Contains(b, []byte(`"d"`)) { + return nil, ErrUnexpectedPrivateKey + } + return newJWKPublicKey(b) +} + +// ParseJWKPublicKeyString calls ParseJWKPublicKey([]byte(key)) for all you lazy folk. +func ParseJWKPublicKeyString(s string) (PublicKey, error) { + if strings.Contains(s, `"d"`) { + return nil, ErrUnexpectedPrivateKey + } + return newJWKPublicKey(s) +} + +// DecodeJWKPublicKey stream-decodes a JSON-encoded JWK and returns a PublicKey, or a (hopefully) helpful error message +func DecodeJWKPublicKey(r io.Reader) (PublicKey, error) { + m := make(map[string]string) + if err := json.NewDecoder(r).Decode(&m); nil != err { + return nil, err + } + if d := m["d"]; "" != d { + return nil, ErrUnexpectedPrivateKey + } + return newJWKPublicKey(m) +} + +// the underpinnings of the parser as used by the typesafe wrappers +func newJWKPublicKey(data interface{}) (PublicKey, error) { + var m map[string]string + + switch d := data.(type) { + case map[string]string: + m = d + case string: + if err := json.Unmarshal([]byte(d), &m); nil != err { + return nil, err + } + case []byte: + if err := json.Unmarshal(d, &m); nil != err { + return nil, err + } + default: + panic("Developer Error: unsupported interface type") + } + + return NewJWKPublicKey(m) +} + +// ParseJWKPrivateKey parses a JSON-encoded JWK and returns a PrivateKey, or a (hopefully) helpful error message +func ParseJWKPrivateKey(b []byte) (PrivateKey, error) { + var m map[string]string + if err := json.Unmarshal(b, &m); nil != err { + return nil, err + } + + switch m["kty"] { + case "RSA": + return parseRSAPrivateKey(m) + case "EC": + return parseECPrivateKey(m) + default: + return nil, ErrInvalidKeyType + } +} + +func parseRSAPublicKey(m map[string]string) (*RSAPublicKey, error) { + // TODO grab expiry? + kid, _ := m["kid"] + n, _ := base64.RawURLEncoding.DecodeString(m["n"]) + e, _ := base64.RawURLEncoding.DecodeString(m["e"]) + if 0 == len(n) || 0 == len(e) { + return nil, ErrParseJWK + } + ni := &big.Int{} + ni.SetBytes(n) + ei := &big.Int{} + ei.SetBytes(e) + + pub := &rsa.PublicKey{ + N: ni, + E: int(ei.Int64()), + } + + return &RSAPublicKey{ + PublicKey: pub, + KID: kid, + }, nil +} + +func parseRSAPrivateKey(m map[string]string) (key *rsa.PrivateKey, err error) { + pub, err := parseRSAPublicKey(m) + if nil != err { + return + } + + d, _ := base64.RawURLEncoding.DecodeString(m["d"]) + p, _ := base64.RawURLEncoding.DecodeString(m["p"]) + q, _ := base64.RawURLEncoding.DecodeString(m["q"]) + dp, _ := base64.RawURLEncoding.DecodeString(m["dp"]) + dq, _ := base64.RawURLEncoding.DecodeString(m["dq"]) + qinv, _ := base64.RawURLEncoding.DecodeString(m["qi"]) + if 0 == len(d) || 0 == len(p) || 0 == len(dp) || 0 == len(dq) || 0 == len(qinv) { + return nil, ErrParseJWK + } + + di := &big.Int{} + di.SetBytes(d) + pi := &big.Int{} + pi.SetBytes(p) + qi := &big.Int{} + qi.SetBytes(q) + dpi := &big.Int{} + dpi.SetBytes(dp) + dqi := &big.Int{} + dqi.SetBytes(dq) + qinvi := &big.Int{} + qinvi.SetBytes(qinv) + + key = &rsa.PrivateKey{ + PublicKey: *pub.PublicKey, + D: di, + Primes: []*big.Int{pi, qi}, + Precomputed: rsa.PrecomputedValues{ + Dp: dpi, + Dq: dqi, + Qinv: qinvi, + }, + } + + return +} + +func parseECPublicKey(m map[string]string) (*ECPublicKey, error) { + // TODO grab expiry? + kid, _ := m["kid"] + x, _ := base64.RawURLEncoding.DecodeString(m["x"]) + y, _ := base64.RawURLEncoding.DecodeString(m["y"]) + if 0 == len(x) || 0 == len(y) || 0 == len(m["crv"]) { + return nil, ErrParseJWK + } + + xi := &big.Int{} + xi.SetBytes(x) + + yi := &big.Int{} + yi.SetBytes(y) + + var crv elliptic.Curve + switch m["crv"] { + case "P-256": + crv = elliptic.P256() + case "P-384": + crv = elliptic.P384() + case "P-521": + crv = elliptic.P521() + default: + return nil, ErrInvalidCurve + } + + pub := &ecdsa.PublicKey{ + Curve: crv, + X: xi, + Y: yi, + } + + return &ECPublicKey{ + PublicKey: pub, + KID: kid, + }, nil +} + +func parseECPrivateKey(m map[string]string) (*ecdsa.PrivateKey, error) { + pub, err := parseECPublicKey(m) + if nil != err { + return nil, err + } + + d, _ := base64.RawURLEncoding.DecodeString(m["d"]) + if 0 == len(d) { + return nil, ErrParseJWK + } + di := &big.Int{} + di.SetBytes(d) + + return &ecdsa.PrivateKey{ + PublicKey: *pub.PublicKey, + D: di, + }, nil +} diff --git a/vendor/github.com/joho/godotenv/.gitignore b/vendor/github.com/joho/godotenv/.gitignore new file mode 100644 index 0000000..e43b0f9 --- /dev/null +++ b/vendor/github.com/joho/godotenv/.gitignore @@ -0,0 +1 @@ +.DS_Store diff --git a/vendor/github.com/joho/godotenv/.travis.yml b/vendor/github.com/joho/godotenv/.travis.yml new file mode 100644 index 0000000..f0db1ad --- /dev/null +++ b/vendor/github.com/joho/godotenv/.travis.yml @@ -0,0 +1,8 @@ +language: go + +go: + - 1.x + +os: + - linux + - osx diff --git a/vendor/github.com/joho/godotenv/LICENCE b/vendor/github.com/joho/godotenv/LICENCE new file mode 100644 index 0000000..e7ddd51 --- /dev/null +++ b/vendor/github.com/joho/godotenv/LICENCE @@ -0,0 +1,23 @@ +Copyright (c) 2013 John Barton + +MIT License + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + diff --git a/vendor/github.com/joho/godotenv/README.md b/vendor/github.com/joho/godotenv/README.md new file mode 100644 index 0000000..4e8fcf2 --- /dev/null +++ b/vendor/github.com/joho/godotenv/README.md @@ -0,0 +1,163 @@ +# GoDotEnv [![Build Status](https://travis-ci.org/joho/godotenv.svg?branch=master)](https://travis-ci.org/joho/godotenv) [![Build status](https://ci.appveyor.com/api/projects/status/9v40vnfvvgde64u4?svg=true)](https://ci.appveyor.com/project/joho/godotenv) [![Go Report Card](https://goreportcard.com/badge/github.com/joho/godotenv)](https://goreportcard.com/report/github.com/joho/godotenv) + +A Go (golang) port of the Ruby dotenv project (which loads env vars from a .env file) + +From the original Library: + +> Storing configuration in the environment is one of the tenets of a twelve-factor app. Anything that is likely to change between deployment environments–such as resource handles for databases or credentials for external services–should be extracted from the code into environment variables. +> +> But it is not always practical to set environment variables on development machines or continuous integration servers where multiple projects are run. Dotenv load variables from a .env file into ENV when the environment is bootstrapped. + +It can be used as a library (for loading in env for your own daemons etc) or as a bin command. + +There is test coverage and CI for both linuxish and windows environments, but I make no guarantees about the bin version working on windows. + +## Installation + +As a library + +```shell +go get github.com/joho/godotenv +``` + +or if you want to use it as a bin command +```shell +go get github.com/joho/godotenv/cmd/godotenv +``` + +## Usage + +Add your application configuration to your `.env` file in the root of your project: + +```shell +S3_BUCKET=YOURS3BUCKET +SECRET_KEY=YOURSECRETKEYGOESHERE +``` + +Then in your Go app you can do something like + +```go +package main + +import ( + "github.com/joho/godotenv" + "log" + "os" +) + +func main() { + err := godotenv.Load() + if err != nil { + log.Fatal("Error loading .env file") + } + + s3Bucket := os.Getenv("S3_BUCKET") + secretKey := os.Getenv("SECRET_KEY") + + // now do something with s3 or whatever +} +``` + +If you're even lazier than that, you can just take advantage of the autoload package which will read in `.env` on import + +```go +import _ "github.com/joho/godotenv/autoload" +``` + +While `.env` in the project root is the default, you don't have to be constrained, both examples below are 100% legit + +```go +_ = godotenv.Load("somerandomfile") +_ = godotenv.Load("filenumberone.env", "filenumbertwo.env") +``` + +If you want to be really fancy with your env file you can do comments and exports (below is a valid env file) + +```shell +# I am a comment and that is OK +SOME_VAR=someval +FOO=BAR # comments at line end are OK too +export BAR=BAZ +``` + +Or finally you can do YAML(ish) style + +```yaml +FOO: bar +BAR: baz +``` + +as a final aside, if you don't want godotenv munging your env you can just get a map back instead + +```go +var myEnv map[string]string +myEnv, err := godotenv.Read() + +s3Bucket := myEnv["S3_BUCKET"] +``` + +... or from an `io.Reader` instead of a local file + +```go +reader := getRemoteFile() +myEnv, err := godotenv.Parse(reader) +``` + +... or from a `string` if you so desire + +```go +content := getRemoteFileContent() +myEnv, err := godotenv.Unmarshal(content) +``` + +### Command Mode + +Assuming you've installed the command as above and you've got `$GOPATH/bin` in your `$PATH` + +``` +godotenv -f /some/path/to/.env some_command with some args +``` + +If you don't specify `-f` it will fall back on the default of loading `.env` in `PWD` + +### Writing Env Files + +Godotenv can also write a map representing the environment to a correctly-formatted and escaped file + +```go +env, err := godotenv.Unmarshal("KEY=value") +err := godotenv.Write(env, "./.env") +``` + +... or to a string + +```go +env, err := godotenv.Unmarshal("KEY=value") +content, err := godotenv.Marshal(env) +``` + +## Contributing + +Contributions are most welcome! The parser itself is pretty stupidly naive and I wouldn't be surprised if it breaks with edge cases. + +*code changes without tests will not be accepted* + +1. Fork it +2. Create your feature branch (`git checkout -b my-new-feature`) +3. Commit your changes (`git commit -am 'Added some feature'`) +4. Push to the branch (`git push origin my-new-feature`) +5. Create new Pull Request + +## Releases + +Releases should follow [Semver](http://semver.org/) though the first couple of releases are `v1` and `v1.1`. + +Use [annotated tags for all releases](https://github.com/joho/godotenv/issues/30). Example `git tag -a v1.2.1` + +## CI + +Linux: [![Build Status](https://travis-ci.org/joho/godotenv.svg?branch=master)](https://travis-ci.org/joho/godotenv) Windows: [![Build status](https://ci.appveyor.com/api/projects/status/9v40vnfvvgde64u4)](https://ci.appveyor.com/project/joho/godotenv) + +## Who? + +The original library [dotenv](https://github.com/bkeepers/dotenv) was written by [Brandon Keepers](http://opensoul.org/), and this port was done by [John Barton](https://johnbarton.co/) based off the tests/fixtures in the original library. diff --git a/vendor/github.com/joho/godotenv/autoload/autoload.go b/vendor/github.com/joho/godotenv/autoload/autoload.go new file mode 100644 index 0000000..fbcd2bd --- /dev/null +++ b/vendor/github.com/joho/godotenv/autoload/autoload.go @@ -0,0 +1,15 @@ +package autoload + +/* + You can just read the .env file on import just by doing + + import _ "github.com/joho/godotenv/autoload" + + And bob's your mother's brother +*/ + +import "github.com/joho/godotenv" + +func init() { + godotenv.Load() +} diff --git a/vendor/github.com/joho/godotenv/godotenv.go b/vendor/github.com/joho/godotenv/godotenv.go new file mode 100644 index 0000000..29b436c --- /dev/null +++ b/vendor/github.com/joho/godotenv/godotenv.go @@ -0,0 +1,346 @@ +// Package godotenv is a go port of the ruby dotenv library (https://github.com/bkeepers/dotenv) +// +// Examples/readme can be found on the github page at https://github.com/joho/godotenv +// +// The TL;DR is that you make a .env file that looks something like +// +// SOME_ENV_VAR=somevalue +// +// and then in your go code you can call +// +// godotenv.Load() +// +// and all the env vars declared in .env will be available through os.Getenv("SOME_ENV_VAR") +package godotenv + +import ( + "bufio" + "errors" + "fmt" + "io" + "os" + "os/exec" + "regexp" + "sort" + "strings" +) + +const doubleQuoteSpecialChars = "\\\n\r\"!$`" + +// Load will read your env file(s) and load them into ENV for this process. +// +// Call this function as close as possible to the start of your program (ideally in main) +// +// If you call Load without any args it will default to loading .env in the current path +// +// You can otherwise tell it which files to load (there can be more than one) like +// +// godotenv.Load("fileone", "filetwo") +// +// It's important to note that it WILL NOT OVERRIDE an env variable that already exists - consider the .env file to set dev vars or sensible defaults +func Load(filenames ...string) (err error) { + filenames = filenamesOrDefault(filenames) + + for _, filename := range filenames { + err = loadFile(filename, false) + if err != nil { + return // return early on a spazout + } + } + return +} + +// Overload will read your env file(s) and load them into ENV for this process. +// +// Call this function as close as possible to the start of your program (ideally in main) +// +// If you call Overload without any args it will default to loading .env in the current path +// +// You can otherwise tell it which files to load (there can be more than one) like +// +// godotenv.Overload("fileone", "filetwo") +// +// It's important to note this WILL OVERRIDE an env variable that already exists - consider the .env file to forcefilly set all vars. +func Overload(filenames ...string) (err error) { + filenames = filenamesOrDefault(filenames) + + for _, filename := range filenames { + err = loadFile(filename, true) + if err != nil { + return // return early on a spazout + } + } + return +} + +// Read all env (with same file loading semantics as Load) but return values as +// a map rather than automatically writing values into env +func Read(filenames ...string) (envMap map[string]string, err error) { + filenames = filenamesOrDefault(filenames) + envMap = make(map[string]string) + + for _, filename := range filenames { + individualEnvMap, individualErr := readFile(filename) + + if individualErr != nil { + err = individualErr + return // return early on a spazout + } + + for key, value := range individualEnvMap { + envMap[key] = value + } + } + + return +} + +// Parse reads an env file from io.Reader, returning a map of keys and values. +func Parse(r io.Reader) (envMap map[string]string, err error) { + envMap = make(map[string]string) + + var lines []string + scanner := bufio.NewScanner(r) + for scanner.Scan() { + lines = append(lines, scanner.Text()) + } + + if err = scanner.Err(); err != nil { + return + } + + for _, fullLine := range lines { + if !isIgnoredLine(fullLine) { + var key, value string + key, value, err = parseLine(fullLine, envMap) + + if err != nil { + return + } + envMap[key] = value + } + } + return +} + +//Unmarshal reads an env file from a string, returning a map of keys and values. +func Unmarshal(str string) (envMap map[string]string, err error) { + return Parse(strings.NewReader(str)) +} + +// Exec loads env vars from the specified filenames (empty map falls back to default) +// then executes the cmd specified. +// +// Simply hooks up os.Stdin/err/out to the command and calls Run() +// +// If you want more fine grained control over your command it's recommended +// that you use `Load()` or `Read()` and the `os/exec` package yourself. +func Exec(filenames []string, cmd string, cmdArgs []string) error { + Load(filenames...) + + command := exec.Command(cmd, cmdArgs...) + command.Stdin = os.Stdin + command.Stdout = os.Stdout + command.Stderr = os.Stderr + return command.Run() +} + +// Write serializes the given environment and writes it to a file +func Write(envMap map[string]string, filename string) error { + content, error := Marshal(envMap) + if error != nil { + return error + } + file, error := os.Create(filename) + if error != nil { + return error + } + _, err := file.WriteString(content) + return err +} + +// Marshal outputs the given environment as a dotenv-formatted environment file. +// Each line is in the format: KEY="VALUE" where VALUE is backslash-escaped. +func Marshal(envMap map[string]string) (string, error) { + lines := make([]string, 0, len(envMap)) + for k, v := range envMap { + lines = append(lines, fmt.Sprintf(`%s="%s"`, k, doubleQuoteEscape(v))) + } + sort.Strings(lines) + return strings.Join(lines, "\n"), nil +} + +func filenamesOrDefault(filenames []string) []string { + if len(filenames) == 0 { + return []string{".env"} + } + return filenames +} + +func loadFile(filename string, overload bool) error { + envMap, err := readFile(filename) + if err != nil { + return err + } + + currentEnv := map[string]bool{} + rawEnv := os.Environ() + for _, rawEnvLine := range rawEnv { + key := strings.Split(rawEnvLine, "=")[0] + currentEnv[key] = true + } + + for key, value := range envMap { + if !currentEnv[key] || overload { + os.Setenv(key, value) + } + } + + return nil +} + +func readFile(filename string) (envMap map[string]string, err error) { + file, err := os.Open(filename) + if err != nil { + return + } + defer file.Close() + + return Parse(file) +} + +func parseLine(line string, envMap map[string]string) (key string, value string, err error) { + if len(line) == 0 { + err = errors.New("zero length string") + return + } + + // ditch the comments (but keep quoted hashes) + if strings.Contains(line, "#") { + segmentsBetweenHashes := strings.Split(line, "#") + quotesAreOpen := false + var segmentsToKeep []string + for _, segment := range segmentsBetweenHashes { + if strings.Count(segment, "\"") == 1 || strings.Count(segment, "'") == 1 { + if quotesAreOpen { + quotesAreOpen = false + segmentsToKeep = append(segmentsToKeep, segment) + } else { + quotesAreOpen = true + } + } + + if len(segmentsToKeep) == 0 || quotesAreOpen { + segmentsToKeep = append(segmentsToKeep, segment) + } + } + + line = strings.Join(segmentsToKeep, "#") + } + + firstEquals := strings.Index(line, "=") + firstColon := strings.Index(line, ":") + splitString := strings.SplitN(line, "=", 2) + if firstColon != -1 && (firstColon < firstEquals || firstEquals == -1) { + //this is a yaml-style line + splitString = strings.SplitN(line, ":", 2) + } + + if len(splitString) != 2 { + err = errors.New("Can't separate key from value") + return + } + + // Parse the key + key = splitString[0] + if strings.HasPrefix(key, "export") { + key = strings.TrimPrefix(key, "export") + } + key = strings.Trim(key, " ") + + // Parse the value + value = parseValue(splitString[1], envMap) + return +} + +func parseValue(value string, envMap map[string]string) string { + + // trim + value = strings.Trim(value, " ") + + // check if we've got quoted values or possible escapes + if len(value) > 1 { + rs := regexp.MustCompile(`\A'(.*)'\z`) + singleQuotes := rs.FindStringSubmatch(value) + + rd := regexp.MustCompile(`\A"(.*)"\z`) + doubleQuotes := rd.FindStringSubmatch(value) + + if singleQuotes != nil || doubleQuotes != nil { + // pull the quotes off the edges + value = value[1 : len(value)-1] + } + + if doubleQuotes != nil { + // expand newlines + escapeRegex := regexp.MustCompile(`\\.`) + value = escapeRegex.ReplaceAllStringFunc(value, func(match string) string { + c := strings.TrimPrefix(match, `\`) + switch c { + case "n": + return "\n" + case "r": + return "\r" + default: + return match + } + }) + // unescape characters + e := regexp.MustCompile(`\\([^$])`) + value = e.ReplaceAllString(value, "$1") + } + + if singleQuotes == nil { + value = expandVariables(value, envMap) + } + } + + return value +} + +func expandVariables(v string, m map[string]string) string { + r := regexp.MustCompile(`(\\)?(\$)(\()?\{?([A-Z0-9_]+)?\}?`) + + return r.ReplaceAllStringFunc(v, func(s string) string { + submatch := r.FindStringSubmatch(s) + + if submatch == nil { + return s + } + if submatch[1] == "\\" || submatch[2] == "(" { + return submatch[0][1:] + } else if submatch[4] != "" { + return m[submatch[4]] + } + return s + }) +} + +func isIgnoredLine(line string) bool { + trimmedLine := strings.Trim(line, " \n\t") + return len(trimmedLine) == 0 || strings.HasPrefix(trimmedLine, "#") +} + +func doubleQuoteEscape(line string) string { + for _, c := range doubleQuoteSpecialChars { + toReplace := "\\" + string(c) + if c == '\n' { + toReplace = `\n` + } + if c == '\r' { + toReplace = `\r` + } + line = strings.Replace(line, string(c), toReplace, -1) + } + return line +} diff --git a/vendor/modules.txt b/vendor/modules.txt new file mode 100644 index 0000000..baf40b9 --- /dev/null +++ b/vendor/modules.txt @@ -0,0 +1,7 @@ +# git.rootprojects.org/root/keypairs v0.5.2 +git.rootprojects.org/root/keypairs +git.rootprojects.org/root/keypairs/keyfetch +git.rootprojects.org/root/keypairs/keyfetch/uncached +# github.com/joho/godotenv v1.3.0 +github.com/joho/godotenv +github.com/joho/godotenv/autoload