104 lines
4.1 KiB
Rust
104 lines
4.1 KiB
Rust
use clap::{App, Arg, ArgMatches, SubCommand};
|
|
use jwt::{AlgorithmType, Header, ToBase64};
|
|
use rust_util::util_clap::{Command, CommandError};
|
|
use rust_util::XResult;
|
|
use serde_json::{Map, Value};
|
|
|
|
use crate::cmd_sign_jwt::{build_jwt_parts, merge_header_claims, merge_payload_claims, print_jwt_token};
|
|
use crate::keychain::{KeychainKey, KeychainKeyValue};
|
|
use crate::{cmd_sign_jwt, cmdutil, digestutil, ecdsautil, hmacutil, keychain, rsautil, util};
|
|
|
|
const SEPARATOR: &str = ".";
|
|
|
|
pub struct CommandImpl;
|
|
|
|
impl Command for CommandImpl {
|
|
fn name(&self) -> &str {
|
|
"sign-jwt-soft"
|
|
}
|
|
|
|
fn subcommand<'a>(&self) -> App<'a, 'a> {
|
|
let app = SubCommand::with_name(self.name()).about("Sign JWT subcommand")
|
|
.arg(Arg::with_name("private-key").short("k").long("private-key").takes_value(true).help("Private key PKCS#8"))
|
|
.arg(cmdutil::build_json_arg());
|
|
cmd_sign_jwt::fill_sign_jwt_app_args(app)
|
|
}
|
|
|
|
fn run(&self, _arg_matches: &ArgMatches, sub_arg_matches: &ArgMatches) -> CommandError {
|
|
let json_output = cmdutil::check_json_output(sub_arg_matches);
|
|
|
|
let private_key = opt_value_result!(
|
|
sub_arg_matches.value_of("private-key"),
|
|
"Private key PKCS#8 DER base64 encoded or PEM"
|
|
);
|
|
|
|
let private_key = hmacutil::try_hmac_decrypt_to_string(private_key)?;
|
|
|
|
let private_key = if keychain::is_keychain_key_uri(&private_key) {
|
|
debugging!("Private key keychain key URI: {}", &private_key);
|
|
let keychain_key = KeychainKey::parse_key_uri(&private_key)?;
|
|
let keychain_key_value_bytes = opt_value_result!(
|
|
keychain_key.get_password()?,
|
|
"Keychain key URI: {} not found",
|
|
&private_key
|
|
);
|
|
let keychain_key_value: KeychainKeyValue =
|
|
serde_json::from_slice(&keychain_key_value_bytes)?;
|
|
debugging!("Keychain key value {:?}", &keychain_key_value);
|
|
keychain_key_value.pkcs8_base64
|
|
} else {
|
|
private_key
|
|
};
|
|
|
|
let (header, payload, jwt_claims) = build_jwt_parts(sub_arg_matches)?;
|
|
|
|
let token_string = sign_jwt(&private_key, header, &payload, &jwt_claims)?;
|
|
print_jwt_token(json_output, token_string);
|
|
|
|
Ok(None)
|
|
}
|
|
}
|
|
|
|
fn sign_jwt(
|
|
private_key: &str,
|
|
mut header: Header,
|
|
payload: &Option<String>,
|
|
claims: &Map<String, Value>,
|
|
) -> XResult<String> {
|
|
let p256_private_key_d = ecdsautil::parse_p256_private_key(private_key).ok();
|
|
let p384_private_key_d = ecdsautil::parse_p384_private_key(private_key).ok();
|
|
|
|
let (jwt_algorithm, private_key_d) = match (p256_private_key_d, p384_private_key_d) {
|
|
(Some(p256_private_key_d), None) => (AlgorithmType::Es256, p256_private_key_d),
|
|
(None, Some(p384_private_key_d)) => (AlgorithmType::Es384, p384_private_key_d),
|
|
_ => return simple_error!("Invalid private key: {}", private_key),
|
|
};
|
|
|
|
header.algorithm = jwt_algorithm;
|
|
debugging!("Header: {:?}", header);
|
|
debugging!("Claims: {:?}", claims);
|
|
|
|
let header = opt_result!(header.to_base64(), "Header to base64 failed: {}");
|
|
let claims = merge_payload_claims(payload, claims)?;
|
|
let tobe_signed = merge_header_claims(header.as_bytes(), claims.as_bytes());
|
|
|
|
let raw_in = match jwt_algorithm {
|
|
AlgorithmType::Rs256 => {
|
|
rsautil::pkcs15_sha256_rsa_2048_padding_for_sign(&digestutil::sha256_bytes(&tobe_signed))
|
|
}
|
|
AlgorithmType::Es256 => digestutil::sha256_bytes(&tobe_signed),
|
|
AlgorithmType::Es384 => digestutil::sha384_bytes(&tobe_signed),
|
|
_ => return simple_error!("SHOULD NOT HAPPEN: {:?}", jwt_algorithm),
|
|
};
|
|
|
|
let signed_data = match jwt_algorithm {
|
|
AlgorithmType::Es256 => ecdsautil::sign_p256_rs(&private_key_d, &raw_in)?,
|
|
AlgorithmType::Es384 => ecdsautil::sign_p384_rs(&private_key_d, &raw_in)?,
|
|
_ => return simple_error!("SHOULD NOT HAPPEN: {:?}", jwt_algorithm),
|
|
};
|
|
|
|
let signature = util::base64_encode_url_safe_no_pad(&signed_data);
|
|
|
|
Ok([&*header, &*claims, &signature].join(SEPARATOR))
|
|
}
|