148 lines
3.4 KiB
Go
148 lines
3.4 KiB
Go
/*
|
|
Copyright 2022 CAcert Inc.
|
|
SPDX-License-Identifier: Apache-2.0
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package hsm
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
|
|
"github.com/ThalesIgnite/crypto11"
|
|
|
|
"git.cacert.org/cacert-gosigner/pkg/config"
|
|
)
|
|
|
|
type ctxKey int
|
|
|
|
const (
|
|
ctxCADirectory ctxKey = iota
|
|
ctxP11Contexts
|
|
ctxSetupMode
|
|
ctxSignerConfig
|
|
ctxVerboseLogging
|
|
)
|
|
|
|
type ConfigOption func(ctx context.Context) context.Context
|
|
|
|
func CADirectoryOption(path string) func(ctx context.Context) context.Context {
|
|
return func(ctx context.Context) context.Context {
|
|
return context.WithValue(ctx, ctxCADirectory, path)
|
|
}
|
|
}
|
|
|
|
func CaConfigOption(signerConfig *config.SignerConfig) func(context.Context) context.Context {
|
|
return func(ctx context.Context) context.Context {
|
|
return context.WithValue(ctx, ctxSignerConfig, signerConfig)
|
|
}
|
|
}
|
|
|
|
func SetupModeOption() func(context.Context) context.Context {
|
|
return func(ctx context.Context) context.Context {
|
|
return context.WithValue(ctx, ctxSetupMode, true)
|
|
}
|
|
}
|
|
|
|
func VerboseLoggingOption() func(ctx context.Context) context.Context {
|
|
return func(ctx context.Context) context.Context {
|
|
return context.WithValue(ctx, ctxVerboseLogging, true)
|
|
}
|
|
}
|
|
|
|
// SetupContext sets global context for HSM operations.
|
|
func SetupContext(options ...ConfigOption) context.Context {
|
|
ctx := context.Background()
|
|
|
|
ctx = context.WithValue(ctx, ctxP11Contexts, make(map[string]*crypto11.Context))
|
|
|
|
for _, opt := range options {
|
|
ctx = opt(ctx)
|
|
}
|
|
|
|
return ctx
|
|
}
|
|
|
|
func GetSignerConfig(ctx context.Context) *config.SignerConfig {
|
|
signerConfig, ok := ctx.Value(ctxSignerConfig).(*config.SignerConfig)
|
|
if !ok {
|
|
return nil
|
|
}
|
|
|
|
return signerConfig
|
|
}
|
|
|
|
func IsSetupMode(ctx context.Context) bool {
|
|
setupMode, ok := ctx.Value(ctxSetupMode).(bool)
|
|
if !ok {
|
|
return false
|
|
}
|
|
|
|
return setupMode
|
|
}
|
|
|
|
func IsVerbose(ctx context.Context) bool {
|
|
verbose, ok := ctx.Value(ctxVerboseLogging).(bool)
|
|
if !ok {
|
|
return false
|
|
}
|
|
|
|
return verbose
|
|
}
|
|
|
|
func GetP11Context(ctx context.Context, entry *config.CaCertificateEntry) (*crypto11.Context, error) {
|
|
contexts, ok := ctx.Value(ctxP11Contexts).(map[string]*crypto11.Context)
|
|
if !ok {
|
|
return nil, errors.New("type assertion failed, use hsm.SetupContext first")
|
|
}
|
|
|
|
if p11Context, ok := contexts[entry.Storage]; ok {
|
|
return p11Context, nil
|
|
}
|
|
|
|
p11Context, err := prepareCrypto11Context(ctx, entry.Storage)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
contexts[entry.Storage] = p11Context
|
|
|
|
return p11Context, nil
|
|
}
|
|
|
|
func CloseP11Contexts(ctx context.Context) error {
|
|
contexts, ok := ctx.Value(ctxP11Contexts).(map[string]*crypto11.Context)
|
|
if !ok {
|
|
return errors.New("type assertion failed, use hsm.SetupContext first")
|
|
}
|
|
|
|
seen := make(map[*crypto11.Context]struct{}, 0)
|
|
|
|
for _, p11Context := range contexts {
|
|
if _, ok := seen[p11Context]; ok {
|
|
continue
|
|
}
|
|
|
|
seen[p11Context] = struct{}{}
|
|
|
|
err := p11Context.Close()
|
|
if err != nil {
|
|
return fmt.Errorf("could not close context: %w", err)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|