|
| 1 | +/* |
| 2 | + Copyright The containerd Authors. |
| 3 | +
|
| 4 | + Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | + you may not use this file except in compliance with the License. |
| 6 | + You may obtain a copy of the License at |
| 7 | +
|
| 8 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +
|
| 10 | + Unless required by applicable law or agreed to in writing, software |
| 11 | + distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | + See the License for the specific language governing permissions and |
| 14 | + limitations under the License. |
| 15 | +*/ |
| 16 | + |
| 17 | +package certutil |
| 18 | + |
| 19 | +import ( |
| 20 | + "crypto/tls" |
| 21 | + "crypto/x509" |
| 22 | + "io/ioutil" |
| 23 | + "path/filepath" |
| 24 | + "runtime" |
| 25 | + "sort" |
| 26 | + "strings" |
| 27 | + |
| 28 | + "github.com/containerd/containerd/errdefs" |
| 29 | + "github.com/pkg/errors" |
| 30 | +) |
| 31 | + |
| 32 | +// SystemCertPool returns a copy of the system cert pool, |
| 33 | +// returns an error if failed to load or empty pool on windows. |
| 34 | +// |
| 35 | +// SystemCertPool was ported from Docker 19.03 |
| 36 | +// https://github.com/docker/engine/blob/v19.03.1/vendor/github.com/docker/go-connections/tlsconfig/certpool_go17.go#L12 |
| 37 | +func SystemCertPool() (*x509.CertPool, error) { |
| 38 | + certpool, err := x509.SystemCertPool() |
| 39 | + if err != nil && runtime.GOOS == "windows" { |
| 40 | + return x509.NewCertPool(), nil |
| 41 | + } |
| 42 | + return certpool, err |
| 43 | +} |
| 44 | + |
| 45 | +// LoadCACerts loads CA certificates into tlsConfig from glob. |
| 46 | +// glob should be like "/etc/docker/certs.d/example.com/*.crt" . |
| 47 | +// LoadCACerts returns the paths of the loaded certs. |
| 48 | +func LoadCACerts(tlsConfig *tls.Config, glob string) ([]string, error) { |
| 49 | + if tlsConfig == nil { |
| 50 | + tlsConfig = &tls.Config{} |
| 51 | + } |
| 52 | + files, err := filepath.Glob(glob) |
| 53 | + if err != nil { |
| 54 | + return nil, err |
| 55 | + } |
| 56 | + sort.Strings(files) |
| 57 | + if tlsConfig.RootCAs == nil { |
| 58 | + systemPool, err := SystemCertPool() |
| 59 | + if err != nil { |
| 60 | + return nil, errors.Wrap(err, "unable to get system cert poolv") |
| 61 | + } |
| 62 | + tlsConfig.RootCAs = systemPool |
| 63 | + } |
| 64 | + var loaded []string |
| 65 | + for _, f := range files { |
| 66 | + data, err := ioutil.ReadFile(f) |
| 67 | + if err != nil { |
| 68 | + return loaded, errors.Wrapf(err, "unable to read CA cert %q", f) |
| 69 | + } |
| 70 | + if !tlsConfig.RootCAs.AppendCertsFromPEM(data) { |
| 71 | + return loaded, errors.Errorf("unable to load CA cert %q", f) |
| 72 | + } |
| 73 | + loaded = append(loaded, f) |
| 74 | + } |
| 75 | + return loaded, nil |
| 76 | +} |
| 77 | + |
| 78 | +// KeyPairCertLocator is used to resolve the cert path from the key path. |
| 79 | +type KeyPairCertLocator func(keyPath string) (certPath string, err error) |
| 80 | + |
| 81 | +// DockerKeyPairCertLocator implements the Docker-style convention. ("*.key" -> "*.cert") |
| 82 | +var DockerKeyPairCertLocator KeyPairCertLocator = func(keyPath string) (string, error) { |
| 83 | + if !strings.HasSuffix(keyPath, ".key") { |
| 84 | + return "", errors.Errorf("expected key path with \".key\" suffix, got %q", keyPath) |
| 85 | + } |
| 86 | + // Docker convention uses *.crt for CA certs, *.cert for keypair certs. |
| 87 | + certPath := keyPath[:len(keyPath)-4] + ".cert" |
| 88 | + return certPath, nil |
| 89 | +} |
| 90 | + |
| 91 | +// LoadKeyPairs loads key pairs into tlsConfig from keyGlob. |
| 92 | +// keyGlob should be like "/etc/docker/certs.d/example.com/*.key" . |
| 93 | +// certLocator is used to resolve the cert path from the key path. |
| 94 | +// Use DockerKeyPairCertLocator for the Docker-style convention. ("*.key" -> "*.cert") |
| 95 | +// LoadKeyParis returns the paths of the loaded certs and the loaded keys. |
| 96 | +func LoadKeyPairs(tlsConfig *tls.Config, keyGlob string, certLocator KeyPairCertLocator) ([]string, []string, error) { |
| 97 | + if tlsConfig == nil { |
| 98 | + tlsConfig = &tls.Config{} |
| 99 | + } |
| 100 | + if certLocator == nil { |
| 101 | + return nil, nil, errors.Wrap(errdefs.ErrInvalidArgument, "missing cert locator") |
| 102 | + } |
| 103 | + keyPaths, err := filepath.Glob(keyGlob) |
| 104 | + if err != nil { |
| 105 | + return nil, nil, err |
| 106 | + } |
| 107 | + sort.Strings(keyPaths) |
| 108 | + var ( |
| 109 | + loadedCerts []string |
| 110 | + loadedKeys []string |
| 111 | + ) |
| 112 | + for _, keyPath := range keyPaths { |
| 113 | + certPath, err := certLocator(keyPath) |
| 114 | + if err != nil { |
| 115 | + return loadedCerts, loadedKeys, err |
| 116 | + } |
| 117 | + keyPair, err := tls.LoadX509KeyPair(certPath, keyPath) |
| 118 | + if err != nil { |
| 119 | + return loadedCerts, loadedKeys, err |
| 120 | + } |
| 121 | + tlsConfig.Certificates = append(tlsConfig.Certificates, keyPair) |
| 122 | + loadedCerts = append(loadedCerts, certPath) |
| 123 | + loadedKeys = append(loadedKeys, keyPath) |
| 124 | + } |
| 125 | + return loadedCerts, loadedKeys, nil |
| 126 | +} |
0 commit comments