-
Notifications
You must be signed in to change notification settings - Fork 454
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
5 changed files
with
110 additions
and
121 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,56 +1,87 @@ | ||
| package authority | ||
|
|
||
| import ( | ||
| "crypto" | ||
| "io" | ||
|
|
||
| "go.step.sm/crypto/kms" | ||
| kmsapi "go.step.sm/crypto/kms/apiv1" | ||
|
|
||
| "github.com/smallstep/certificates/authority/provisioner" | ||
| ) | ||
|
|
||
| // Meter wraps the set of defined callbacks for metrics gatherers. | ||
| type Meter interface { | ||
| // X509Signed is called whenever an X509 certificate is signed. | ||
| X509Signed(provisioner string, success bool) | ||
| X509Signed(provisioner.Interface, error) | ||
|
|
||
| // X509Renewed is called whenever an X509 certificate is renewed. | ||
| X509Renewed(provisioner string, success bool) | ||
| X509Renewed(provisioner.Interface, error) | ||
|
|
||
| // X509Rekeyed is called whenever an X509 certificate is rekeyed. | ||
| X509Rekeyed(provisioner string, success bool) | ||
| X509Rekeyed(provisioner.Interface, error) | ||
|
|
||
| // X509WebhookAuthorized is called whenever an X509 authoring webhook is called. | ||
| X509WebhookAuthorized(provisioner string, success bool) | ||
| X509WebhookAuthorized(provisioner.Interface, error) | ||
|
|
||
| // X509WebhookEnriched is called whenever an X509 enriching webhook is called. | ||
| X509WebhookEnriched(provisioner string, success bool) | ||
| X509WebhookEnriched(provisioner.Interface, error) | ||
|
|
||
| // SSHSigned is called whenever an SSH certificate is signed. | ||
| SSHSigned(provisioner string, success bool) | ||
| SSHSigned(provisioner.Interface, error) | ||
|
|
||
| // SSHRenewed is called whenever an SSH certificate is renewed. | ||
| SSHRenewed(provisioner string, success bool) | ||
| SSHRenewed(provisioner.Interface, error) | ||
|
|
||
| // SSHRekeyed is called whenever an SSH certificate is rekeyed. | ||
| SSHRekeyed(provisioner string, success bool) | ||
| SSHRekeyed(provisioner.Interface, error) | ||
|
|
||
| // SSHWebhookAuthorized is called whenever an SSH authoring webhook is called. | ||
| SSHWebhookAuthorized(provisioner string, success bool) | ||
| SSHWebhookAuthorized(provisioner.Interface, error) | ||
|
|
||
| // SSHWebhookEnriched is called whenever an SSH enriching webhook is called. | ||
| SSHWebhookEnriched(provisioner string, success bool) | ||
| SSHWebhookEnriched(provisioner.Interface, error) | ||
|
|
||
| // KMSSigned is called per KMS signer signature. | ||
| KMSSigned() | ||
|
|
||
| // KMSSigned is called per KMS signer signature error. | ||
| KMSError() | ||
| KMSSigned(error) | ||
| } | ||
|
|
||
| // noopMeter implements a noop [Meter]. | ||
| type noopMeter struct{} | ||
|
|
||
| func (noopMeter) SSHRekeyed(string, bool) {} | ||
| func (noopMeter) SSHRenewed(string, bool) {} | ||
| func (noopMeter) SSHSigned(string, bool) {} | ||
| func (noopMeter) SSHWebhookAuthorized(string, bool) {} | ||
| func (noopMeter) SSHWebhookEnriched(string, bool) {} | ||
| func (noopMeter) X509Rekeyed(string, bool) {} | ||
| func (noopMeter) X509Renewed(string, bool) {} | ||
| func (noopMeter) X509Signed(string, bool) {} | ||
| func (noopMeter) X509WebhookAuthorized(string, bool) {} | ||
| func (noopMeter) X509WebhookEnriched(string, bool) {} | ||
| func (noopMeter) KMSSigned() {} | ||
| func (noopMeter) KMSError() {} | ||
| func (noopMeter) SSHRekeyed(provisioner.Interface, error) {} | ||
| func (noopMeter) SSHRenewed(provisioner.Interface, error) {} | ||
| func (noopMeter) SSHSigned(provisioner.Interface, error) {} | ||
| func (noopMeter) SSHWebhookAuthorized(provisioner.Interface, error) {} | ||
| func (noopMeter) SSHWebhookEnriched(provisioner.Interface, error) {} | ||
| func (noopMeter) X509Rekeyed(provisioner.Interface, error) {} | ||
| func (noopMeter) X509Renewed(provisioner.Interface, error) {} | ||
| func (noopMeter) X509Signed(provisioner.Interface, error) {} | ||
| func (noopMeter) X509WebhookAuthorized(provisioner.Interface, error) {} | ||
| func (noopMeter) X509WebhookEnriched(provisioner.Interface, error) {} | ||
| func (noopMeter) KMSSigned(error) {} | ||
|
|
||
| type instrumentedKeyManager struct { | ||
| kms.KeyManager | ||
| meter Meter | ||
| } | ||
|
|
||
| func (i *instrumentedKeyManager) CreateSigner(req *kmsapi.CreateSignerRequest) (s crypto.Signer, err error) { | ||
| if s, err = i.KeyManager.CreateSigner(req); err == nil { | ||
| s = &instrumentedKMSSigner{s, i.meter} | ||
| } | ||
|
|
||
| return | ||
| } | ||
|
|
||
| type instrumentedKMSSigner struct { | ||
| crypto.Signer | ||
| meter Meter | ||
| } | ||
|
|
||
| func (i *instrumentedKMSSigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error) { | ||
| signature, err = i.Signer.Sign(rand, digest, opts) | ||
| i.meter.KMSSigned(err) | ||
|
|
||
| return | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.