Function WithNebulaCert

token/options.go:261–317

WithNebulaCert returns a Options that sets the nebula header.

(certFile string, anyKey any)

// WithNebulaCert returns a Options that sets the nebula header.
func WithNebulaCert(certFile string, anyKey any) Options {
	return func(c *Claims) error {
		b, err := os.ReadFile(certFile)
		if err != nil {
			return errors.Wrapf(err, "error reading %s", certFile)
		}

		blockType := nebula.CertificateBanner // default to a v1 Nebula certificate
		if bytes.HasPrefix(b, pemCertPrefix) {
			block, _ := pem.Decode(b)
			if block == nil || (block.Type != nebula.CertificateBanner && block.Type != nebula.CertificateV2Banner) {
				return errors.Errorf("error reading %s: not a proper nebula certificate", certFile)
			}
			b = block.Bytes
			blockType = block.Type
		}

		pemData := pem.EncodeToMemory(&pem.Block{Type: blockType, Bytes: b})
		crt, _, err := nebula.UnmarshalCertificateFromPEM(pemData)
		if err != nil {
			return errors.Wrapf(err, "error reading %s", certFile)
		}

		var key []byte
		var curve nebula.Curve
		switch k := anyKey.(type) {
		case x25519.PrivateKey:
			key = []byte(k)
			curve = nebula.Curve_CURVE25519
		case ed25519.PrivateKey:
			key = []byte(k)
			curve = nebula.Curve_CURVE25519
		case []byte:
			key = k
			curve = nebula.Curve_CURVE25519
		case *ecdsa.PrivateKey:
			pk, err := k.ECDH()
			if err != nil {
				return fmt.Errorf("failed transforming to ECDH key: %w", err)
			}
			key = pk.Bytes()
			curve = nebula.Curve_P256
		case *ecdh.PrivateKey:
			key = k.Bytes()
			curve = nebula.Curve_P256
		default:
			return errors.Errorf("key content is not a valid nebula key; got type %T", anyKey)
		}

		if err := crt.VerifyPrivateKey(curve, key); err != nil {
			return errors.Wrapf(err, "error validating %s", certFile)
		}

		c.SetHeader("nebula", b)
		return nil
	}
}