local: generate lintPriv key when required by profiles.

Daniel · Daniel · commit 66f7d5d783cf · 2019-06-28T12:42:27.000-04:00
diff --git a/signer/local/local.go b/signer/local/local.go
@@ -4,6 +4,8 @@ package local
 import (
 	"bytes"
 	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/x509"
 	"crypto/x509/pkix"
@@ -35,8 +37,11 @@ import (
 // Signer contains a signer that uses the standard library to
 // support both ECDSA and RSA CA keys.
 type Signer struct {
-	ca         *x509.Certificate
-	priv       crypto.Signer
+	ca   *x509.Certificate
+	priv crypto.Signer
+	// lintPriv is generated randomly when pre-issuance linting is configured and
+	// used to sign TBSCertificates for linting.
+	lintPriv   crypto.Signer
 	policy     *config.Signing
 	sigAlgo    x509.SignatureAlgorithm
 	dbAccessor certdb.Accessor
@@ -55,11 +60,30 @@ func NewSigner(priv crypto.Signer, cert *x509.Certificate, sigAlgo x509.Signatur
 		return nil, cferr.New(cferr.PolicyError, cferr.InvalidPolicy)
 	}
 
+	var lintPriv crypto.Signer
+	// If there is at least one profile that configures pre-issuance linting then
+	// generate the one-off lintPriv key.
+	for _, profile := range policy.Profiles {
+		if profile.LintErrLevel > 0 || policy.Default.LintErrLevel > 0 {
+			// In the future there may be demand for specifying the type of signer used
+			// for pre-issuance linting in configuration. For now we assume that signing
+			// with a randomly generated P-256 ECDSA private key is acceptable for all cases
+			// where linting is requested.
+			k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+			if err != nil {
+				return nil, cferr.New(cferr.PrivateKeyError, cferr.GenerationFailed)
+			}
+			lintPriv = k
+			break
+		}
+	}
+
 	return &Signer{
-		ca:      cert,
-		priv:    priv,
-		sigAlgo: sigAlgo,
-		policy:  policy,
+		ca:       cert,
+		priv:     priv,
+		lintPriv: lintPriv,
+		sigAlgo:  sigAlgo,
+		policy:   policy,
 	}, nil
 }
 
diff --git a/signer/local/local_test.go b/signer/local/local_test.go
@@ -69,10 +69,13 @@ func TestNewSignerFromFilePolicy(t *testing.T) {
 			},
 		},
 	}
-	_, err := NewSignerFromFile(testCaFile, testCaKeyFile, CAConfig.Signing)
+	signer, err := NewSignerFromFile(testCaFile, testCaKeyFile, CAConfig.Signing)
 	if err != nil {
 		t.Fatal(err)
 	}
+	if signer.lintPriv != nil {
+		t.Error("expected signer with LintErrLevel == 0 to have lintPriv == nil")
+	}
 }
 
 func TestNewSignerFromFileInvalidPolicy(t *testing.T) {
@@ -150,6 +153,51 @@ func TestNewSignerFromFileEdgeCases(t *testing.T) {
 	}
 }
 
+func TestNewSignerFromFilePolicyLinting(t *testing.T) {
+	// CAConfig is a config that has an explicit "signature" profile that enables
+	// pre-issuance linting.
+	var CAConfig = &config.Config{
+		Signing: &config.Signing{
+			Profiles: map[string]*config.SigningProfile{
+				"signature": {
+					Usage:        []string{"digital signature"},
+					Expiry:       expiry,
+					LintErrLevel: 3,
+				},
+			},
+			Default: &config.SigningProfile{
+				Usage:        []string{"cert sign", "crl sign"},
+				ExpiryString: "43800h",
+				Expiry:       expiry,
+				CAConstraint: config.CAConstraint{IsCA: true},
+			},
+		},
+	}
+	signer, err := NewSignerFromFile(testCaFile, testCaKeyFile, CAConfig.Signing)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// A CAConfig with a signing profile that sets LintErrLevel > 0 should have
+	// a lintPriv key generated.
+	if signer.lintPriv == nil {
+		t.Error("expected signer with profile LintErrLevel > 0 to have lintPriv != nil")
+	}
+
+	// Reconfigure caConfig so that the explicit "signature" profile doesn't
+	// enable pre-issuance linting but the default profile does.
+	CAConfig.Signing.Profiles["signature"].LintErrLevel = 0
+	CAConfig.Signing.Default.LintErrLevel = 3
+	signer, err = NewSignerFromFile(testCaFile, testCaKeyFile, CAConfig.Signing)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// A CAConfig with a default profile that sets LintErrLevel > 0 should have
+	// a lintPriv key generated.
+	if signer.lintPriv == nil {
+		t.Error("expected signer with default profile LintErrLevel > 0 to have lintPriv != nil")
+	}
+}
+
 func TestSign(t *testing.T) {
 	s, err := NewSignerFromFile("testdata/ca.pem", "testdata/ca_key.pem", nil)
 	if err != nil {
