Skip to content

Commit b115f1d

Browse files
joshdrakejoshdrake
authored
Merge pull request #770 from smallstep/josh/capi-delete-key
Add support for 'DeleteKey' in CAPIKMS.
2 parents ba5a852 + 85735d6 commit b115f1d

File tree

10 files changed

+65
-26
lines changed

10 files changed

+65
-26
lines changed

‎internal/bcrypt_pbkdf/bcrypt_pbkdf.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
// Package bcrypt_pbkdf implements password-based key derivation function based
66
// on bcrypt compatible with bcrypt_pbkdf(3) from OpenBSD.
77
//
8-
//nolint:revive,stylecheck // ignore underscore in package
8+
//nolint:revive,staticcheck // ignore underscore in package
99
package bcrypt_pbkdf
1010

1111
import (

‎internal/bcrypt_pbkdf/bcrypt_pbkdf_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
// Use of this source code is governed by a BSD-style
33
// license that can be found in the LICENSE file.
44
//
5-
//nolint:revive,stylecheck // ignore underscore in package
5+
//nolint:revive,staticcheck // ignore underscore in package
66
package bcrypt_pbkdf
77

88
import (

‎jose/encrypt_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ func rsaEqual(priv *rsa.PrivateKey, x crypto.PrivateKey) bool {
103103
if !ok {
104104
return false
105105
}
106-
if !(priv.PublicKey.N.Cmp(xx.N) == 0 && priv.PublicKey.E == xx.E) || priv.D.Cmp(xx.D) != 0 {
106+
if (priv.PublicKey.N.Cmp(xx.N) != 0 || priv.PublicKey.E != xx.E) || priv.D.Cmp(xx.D) != 0 {
107107
return false
108108
}
109109
if len(priv.Primes) != len(xx.Primes) {

‎jose/types.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ var ErrIssuedInTheFuture = jwt.ErrIssuedInTheFuture
133133

134134
// Key management algorithms
135135
//
136-
//nolint:stylecheck,revive // use standard names in upper-case
136+
//nolint:staticcheck,revive // use standard names in upper-case
137137
const (
138138
RSA1_5 = KeyAlgorithm("RSA1_5") // RSA-PKCS1v1.5
139139
RSA_OAEP = KeyAlgorithm("RSA-OAEP") // RSA-OAEP-SHA1
@@ -174,7 +174,7 @@ const (
174174

175175
// Content encryption algorithms
176176
//
177-
//nolint:revive,stylecheck // use standard names in upper-case
177+
//nolint:revive,staticcheck // use standard names in upper-case
178178
const (
179179
A128CBC_HS256 = ContentEncryption("A128CBC-HS256") // AES-CBC + HMAC-SHA256 (128)
180180
A192CBC_HS384 = ContentEncryption("A192CBC-HS384") // AES-CBC + HMAC-SHA384 (192)

‎kms/awskms/decrypter_test.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ func TestCreateDecrypter(t *testing.T) {
5252
}
5353

5454
func TestDecrypterDecrypts(t *testing.T) {
55-
kms, pub := createTestKMS(t, 2048)
55+
km, pub := createTestKMS(t, 2048)
5656
fail1024KMS, _ := createTestKMS(t, 1024)
5757

5858
// prepare encrypted contents
@@ -62,15 +62,15 @@ func TestDecrypterDecrypts(t *testing.T) {
6262
require.NoError(t, err)
6363

6464
// create a decrypter, identified by "test-sha256", and check the public key
65-
d256, err := kms.CreateDecrypter(&apiv1.CreateDecrypterRequest{
65+
d256, err := km.CreateDecrypter(&apiv1.CreateDecrypterRequest{
6666
DecryptionKey: "test-sha256",
6767
})
6868
require.NoError(t, err)
6969
require.NotNil(t, d256)
7070
require.True(t, pub.Equal(d256.Public()))
7171

7272
// create a decrypter, identified by "test-sha1", and check the public key
73-
d1, err := kms.CreateDecrypter(&apiv1.CreateDecrypterRequest{
73+
d1, err := km.CreateDecrypter(&apiv1.CreateDecrypterRequest{
7474
DecryptionKey: "test-sha1",
7575
})
7676
require.NoError(t, err)

‎kms/capi/capi.go

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -643,6 +643,28 @@ func (k *CAPIKMS) CreateKey(req *apiv1.CreateKeyRequest) (*apiv1.CreateKeyRespon
643643
}, nil
644644
}
645645

646+
// DeleteKey deletes the key from the key id (Microsoft calls it 'Key Container Name') passed in via the URI
647+
func (k *CAPIKMS) DeleteKey(req *apiv1.DeleteKeyRequest) error {
648+
u, err := uri.ParseWithScheme(Scheme, req.Name)
649+
if err != nil {
650+
return fmt.Errorf("failed to parse URI: %w", err)
651+
}
652+
653+
var containerName string
654+
if containerName = u.Get(ContainerNameArg); containerName == "" {
655+
return fmt.Errorf("%v not specified", ContainerNameArg)
656+
}
657+
658+
kh, err := nCryptOpenKey(k.providerHandle, containerName, 0, 0)
659+
if err != nil {
660+
return fmt.Errorf("unable to open key: %w", err)
661+
}
662+
663+
defer nCryptFreeObject(kh)
664+
665+
return nCryptDeleteKey(kh)
666+
}
667+
646668
// GetPublicKey returns the public key from the key id (Microsoft calls it 'Key Container Name') passed in via the URI
647669
func (k *CAPIKMS) GetPublicKey(req *apiv1.GetPublicKeyRequest) (crypto.PublicKey, error) {
648670
u, err := uri.ParseWithScheme(Scheme, req.Name)

‎kms/capi/ncrypt_windows.go

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ const (
3434

3535
// Key Storage Flags
3636
NCRYPT_MACHINE_KEY_FLAG = 0x00000001
37+
NCRYPT_SILENT_FLAG = 0x00000040
3738

3839
// Errors
3940
NTE_NOT_SUPPORTED = uint32(0x80090029)
@@ -141,6 +142,7 @@ var (
141142
procNCryptFinalizeKey = nCrypt.MustFindProc("NCryptFinalizeKey")
142143
procNCryptFreeObject = nCrypt.MustFindProc("NCryptFreeObject")
143144
procNCryptOpenKey = nCrypt.MustFindProc("NCryptOpenKey")
145+
procNCryptDeleteKey = nCrypt.MustFindProc("NCryptDeleteKey")
144146
procNCryptOpenStorageProvider = nCrypt.MustFindProc("NCryptOpenStorageProvider")
145147
procNCryptGetProperty = nCrypt.MustFindProc("NCryptGetProperty")
146148
procNCryptSetProperty = nCrypt.MustFindProc("NCryptSetProperty")
@@ -289,6 +291,21 @@ func nCryptOpenKey(provisionerHandle uintptr, containerName string, legacyKeySpe
289291
return kh, nil
290292
}
291293

294+
func nCryptDeleteKey(keyHandle uintptr) error {
295+
r, _, err := procNCryptDeleteKey.Call(
296+
keyHandle,
297+
0,
298+
)
299+
if !errors.Is(err, windows.Errno(0)) {
300+
return fmt.Errorf("NCryptDeleteKey returned %w", err)
301+
}
302+
if r != 0 {
303+
return fmt.Errorf("NCryptDeleteKey returned %v", errNoToStr(uint32(r)))
304+
}
305+
306+
return nil
307+
}
308+
292309
func nCryptFinalizeKey(keyHandle uintptr, flags uint32) error {
293310
r, _, err := procNCryptFinalizeKey.Call(keyHandle, uintptr(flags))
294311
if !errors.Is(err, windows.Errno(0)) {

‎nssdb/attributes.go

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -5,32 +5,32 @@ import "encoding/binary"
55
// CKA_CLASS values
66
// https://github.com/nss-dev/nss/blob/NSS_3_107_RTM/lib/util/pkcs11t.h#L320-L334
77
const (
8-
CKO_DATA = iota //nolint:stylecheck,revive // name matches source
9-
CKO_CERTIFICATE //nolint:stylecheck,revive // name matches source
10-
CKO_PUBLIC_KEY //nolint:stylecheck,revive // name matches source
11-
CKO_PRIVATE_KEY //nolint:stylecheck,revive // name matches source
12-
CKO_SECRET_KEY //nolint:stylecheck,revive // name matches source
13-
CKO_HW_FEATURE //nolint:stylecheck,revive // name matches source
14-
CKO_DOMAIN_PARAMETERS //nolint:stylecheck,revive // name matches source
15-
CKO_MECHANISM //nolint:stylecheck,revive // name matches source
16-
CKO_PROFILE //nolint:stylecheck,revive // name matches source
8+
CKO_DATA = iota //nolint:staticcheck,revive // name matches source
9+
CKO_CERTIFICATE //nolint:staticcheck,revive // name matches source
10+
CKO_PUBLIC_KEY //nolint:staticcheck,revive // name matches source
11+
CKO_PRIVATE_KEY //nolint:staticcheck,revive // name matches source
12+
CKO_SECRET_KEY //nolint:staticcheck,revive // name matches source
13+
CKO_HW_FEATURE //nolint:staticcheck,revive // name matches source
14+
CKO_DOMAIN_PARAMETERS //nolint:staticcheck,revive // name matches source
15+
CKO_MECHANISM //nolint:staticcheck,revive // name matches source
16+
CKO_PROFILE //nolint:staticcheck,revive // name matches source
1717
)
1818

1919
// CKA_KEY_TYPE values
2020
// https://github.com/nss-dev/nss/blob/NSS_3_107_RTM/lib/util/pkcs11t.h#L366
2121
const (
22-
CKK_RSA = iota //nolint:stylecheck,revive // name matches source
23-
CKK_DSA //nolint:stylecheck,revive // name matches source
24-
CKK_DH //nolint:stylecheck,revive // name matches source
25-
CKK_EC //nolint:stylecheck,revive // name matches source
22+
CKK_RSA = iota //nolint:staticcheck,revive // name matches source
23+
CKK_DSA //nolint:staticcheck,revive // name matches source
24+
CKK_DH //nolint:staticcheck,revive // name matches source
25+
CKK_EC //nolint:staticcheck,revive // name matches source
2626
)
2727

2828
// CKA_CERTIFICATE_TYPE values
2929
// https://github.com/nss-dev/nss/blob/NSS_3_107_RTM/lib/util/pkcs11t.h#L453-L458
3030
const (
31-
CKC_X_509 = iota //nolint:stylecheck,revive // name matches source
32-
CKC_X_509_ATTR_CERT //nolint:stylecheck,revive // name matches source
33-
CKC_WTLS //nolint:stylecheck,revive // name matches source
31+
CKC_X_509 = iota //nolint:staticcheck,revive // name matches source
32+
CKC_X_509_ATTR_CERT //nolint:staticcheck,revive // name matches source
33+
CKC_WTLS //nolint:staticcheck,revive // name matches source
3434
)
3535

3636
// https://github.com/nss-dev/nss/blob/NSS_3_107_RTM/lib/softoken/sftkdb.c#L47

‎x509util/certificate.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ func (c *Certificate) GetCertificate() *x509.Certificate {
188188
// See also https://datatracker.ietf.org/doc/html/rfc5280.html#section-4.2.1.6
189189
func (c *Certificate) hasExtendedSANs() bool {
190190
for _, san := range c.SANs {
191-
if !(san.Type == DNSType || san.Type == EmailType || san.Type == IPType || san.Type == URIType || san.Type == AutoType || san.Type == "") {
191+
if !(san.Type == DNSType || san.Type == EmailType || san.Type == IPType || san.Type == URIType || san.Type == AutoType || san.Type == "") { //nolint:staticcheck // QF1001, this version is more semantically readable
192192
return true
193193
}
194194
}

‎x509util/certificate_request.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -320,7 +320,7 @@ func (c *CertificateRequest) GetLeafCertificate() *Certificate {
320320
// See also https://datatracker.ietf.org/doc/html/rfc5280.html#section-4.2.1.6
321321
func (c *CertificateRequest) hasExtendedSANs() bool {
322322
for _, san := range c.SANs {
323-
if !(san.Type == DNSType || san.Type == EmailType || san.Type == IPType || san.Type == URIType || san.Type == AutoType || san.Type == "") {
323+
if !(san.Type == DNSType || san.Type == EmailType || san.Type == IPType || san.Type == URIType || san.Type == AutoType || san.Type == "") { //nolint:staticcheck // QF1001, this version is more semantically readable
324324
return true
325325
}
326326
}

0 commit comments

Comments
 (0)