| 303 | } |
| 304 | |
| 305 | func (h *certRequestHandler) saveSigningRequest(config ssh_ca_util.SignerdConfig, environment, reason, requestIDStr string, requestSerial uint64, cert *ssh.Certificate) (bool, error) { |
| 306 | requesterFp := ssh_ca_util.MakeFingerprint(cert.SignatureKey.Marshal()) |
| 307 | |
| 308 | maxValidBefore := uint64(time.Now().Add(time.Duration(config.MaxCertLifetime) * time.Second).Unix()) |
| 309 | |
| 310 | if config.MaxCertLifetime != 0 && cert.ValidBefore > maxValidBefore { |
| 311 | return false, fmt.Errorf("Certificate is valid longer than maximum permitted by configuration %d > %d", |
| 312 | cert.ValidBefore, maxValidBefore) |
| 313 | } |
| 314 | |
| 315 | // We override keyid here so that its a server controlled value. Instead of |
| 316 | // letting a requester attempt to spoof it. |
| 317 | var ok bool |
| 318 | cert.KeyId, ok = config.AuthorizedUsers[requesterFp] |
| 319 | if !ok { |
| 320 | return false, fmt.Errorf("Requester fingerprint (%s) not found in config", requesterFp) |
| 321 | } |
| 322 | |
| 323 | if requestSerial == 0 { |
| 324 | return false, fmt.Errorf("Serial number not set.") |
| 325 | } |
| 326 | cert.Serial = requestSerial |
| 327 | |
| 328 | certRequest := newcertRequest() |
| 329 | certRequest.request = cert |
| 330 | if environment == "" { |
| 331 | return false, fmt.Errorf("Environment is a required field") |
| 332 | } |
| 333 | certRequest.environment = environment |
| 334 | |
| 335 | if reason == "" { |
| 336 | return false, fmt.Errorf("Reason is a required field") |
| 337 | } |
| 338 | certRequest.reason = reason |
| 339 | |
| 340 | if len(requestIDStr) < 12 { |
| 341 | return false, fmt.Errorf("Request id is too short to be useful.") |
| 342 | } |
| 343 | h.stateMutex.RLock() |
| 344 | _, ok = h.state[requestIDStr] |
| 345 | h.stateMutex.RUnlock() |
| 346 | if ok { |
| 347 | return false, fmt.Errorf("Request id '%s' already in use.", requestIDStr) |
| 348 | } |
| 349 | h.stateMutex.Lock() |
| 350 | h.state[requestIDStr] = certRequest |
| 351 | h.stateMutex.Unlock() |
| 352 | |
| 353 | // This is the special case of supporting auto-signing. |
| 354 | if config.NumberSignersRequired < 0 { |
| 355 | signed, err := h.maybeSignWithCa(requestIDStr, config.NumberSignersRequired, config.SigningKeyFingerprint) |
| 356 | if signed && err == nil { |
| 357 | return true, nil |
| 358 | } |
| 359 | } |
| 360 | |
| 361 | return false, nil |
| 362 | } |