Skip to content

Commit 93f7932

Browse files
azazealazazeal
committed
reworked meter signature
1 parent ecf2da6 commit 93f7932

File tree

5 files changed

+110
-121
lines changed

5 files changed

+110
-121
lines changed

‎authority/authority.go‎

Lines changed: 0 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ import (
88
"crypto/sha256"
99
"crypto/x509"
1010
"encoding/hex"
11-
"io"
1211
"log"
1312
"net/http"
1413
"strings"
@@ -972,50 +971,3 @@ func (a *Authority) startCRLGenerator() error {
972971

973972
return nil
974973
}
975-
976-
//nolint:gocritic // used in defered statements
977-
func (a *Authority) incrProvisionerCounter(prov *provisioner.Interface, err *error, count func(Meter, string, bool)) {
978-
var name string
979-
if p := *prov; p != nil {
980-
name = p.GetName()
981-
}
982-
983-
count(a.meter, name, *err == nil)
984-
}
985-
986-
func (a *Authority) incrWebhookCounter(prov provisioner.Interface, err error, count func(Meter, string, bool)) {
987-
var name string
988-
if prov != nil {
989-
name = prov.GetName()
990-
}
991-
992-
count(a.meter, name, err == nil)
993-
}
994-
995-
type instrumentedKeyManager struct {
996-
kms.KeyManager
997-
meter Meter
998-
}
999-
1000-
func (i *instrumentedKeyManager) CreateSigner(req *kmsapi.CreateSignerRequest) (s crypto.Signer, err error) {
1001-
if s, err = i.KeyManager.CreateSigner(req); err == nil {
1002-
s = &instrumentedKMSSigner{s, i.meter}
1003-
}
1004-
1005-
return
1006-
}
1007-
1008-
type instrumentedKMSSigner struct {
1009-
crypto.Signer
1010-
meter Meter
1011-
}
1012-
1013-
func (i *instrumentedKMSSigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error) {
1014-
if signature, err = i.Signer.Sign(rand, digest, opts); err != nil {
1015-
i.meter.KMSError()
1016-
} else {
1017-
i.meter.KMSSigned()
1018-
}
1019-
1020-
return
1021-
}

‎authority/meter.go‎

Lines changed: 57 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,87 @@
11
package authority
22

3+
import (
4+
"crypto"
5+
"io"
6+
7+
"go.step.sm/crypto/kms"
8+
kmsapi "go.step.sm/crypto/kms/apiv1"
9+
10+
"github.com/smallstep/certificates/authority/provisioner"
11+
)
12+
313
// Meter wraps the set of defined callbacks for metrics gatherers.
414
type Meter interface {
515
// X509Signed is called whenever an X509 certificate is signed.
6-
X509Signed(provisioner string, success bool)
16+
X509Signed(provisioner.Interface, error)
717

818
// X509Renewed is called whenever an X509 certificate is renewed.
9-
X509Renewed(provisioner string, success bool)
19+
X509Renewed(provisioner.Interface, error)
1020

1121
// X509Rekeyed is called whenever an X509 certificate is rekeyed.
12-
X509Rekeyed(provisioner string, success bool)
22+
X509Rekeyed(provisioner.Interface, error)
1323

1424
// X509WebhookAuthorized is called whenever an X509 authoring webhook is called.
15-
X509WebhookAuthorized(provisioner string, success bool)
25+
X509WebhookAuthorized(provisioner.Interface, error)
1626

1727
// X509WebhookEnriched is called whenever an X509 enriching webhook is called.
18-
X509WebhookEnriched(provisioner string, success bool)
28+
X509WebhookEnriched(provisioner.Interface, error)
1929

2030
// SSHSigned is called whenever an SSH certificate is signed.
21-
SSHSigned(provisioner string, success bool)
31+
SSHSigned(provisioner.Interface, error)
2232

2333
// SSHRenewed is called whenever an SSH certificate is renewed.
24-
SSHRenewed(provisioner string, success bool)
34+
SSHRenewed(provisioner.Interface, error)
2535

2636
// SSHRekeyed is called whenever an SSH certificate is rekeyed.
27-
SSHRekeyed(provisioner string, success bool)
37+
SSHRekeyed(provisioner.Interface, error)
2838

2939
// SSHWebhookAuthorized is called whenever an SSH authoring webhook is called.
30-
SSHWebhookAuthorized(provisioner string, success bool)
40+
SSHWebhookAuthorized(provisioner.Interface, error)
3141

3242
// SSHWebhookEnriched is called whenever an SSH enriching webhook is called.
33-
SSHWebhookEnriched(provisioner string, success bool)
43+
SSHWebhookEnriched(provisioner.Interface, error)
3444

3545
// KMSSigned is called per KMS signer signature.
36-
KMSSigned()
37-
38-
// KMSSigned is called per KMS signer signature error.
39-
KMSError()
46+
KMSSigned(error)
4047
}
4148

4249
// noopMeter implements a noop [Meter].
4350
type noopMeter struct{}
4451

45-
func (noopMeter) SSHRekeyed(string, bool) {}
46-
func (noopMeter) SSHRenewed(string, bool) {}
47-
func (noopMeter) SSHSigned(string, bool) {}
48-
func (noopMeter) SSHWebhookAuthorized(string, bool) {}
49-
func (noopMeter) SSHWebhookEnriched(string, bool) {}
50-
func (noopMeter) X509Rekeyed(string, bool) {}
51-
func (noopMeter) X509Renewed(string, bool) {}
52-
func (noopMeter) X509Signed(string, bool) {}
53-
func (noopMeter) X509WebhookAuthorized(string, bool) {}
54-
func (noopMeter) X509WebhookEnriched(string, bool) {}
55-
func (noopMeter) KMSSigned() {}
56-
func (noopMeter) KMSError() {}
52+
func (noopMeter) SSHRekeyed(provisioner.Interface, error) {}
53+
func (noopMeter) SSHRenewed(provisioner.Interface, error) {}
54+
func (noopMeter) SSHSigned(provisioner.Interface, error) {}
55+
func (noopMeter) SSHWebhookAuthorized(provisioner.Interface, error) {}
56+
func (noopMeter) SSHWebhookEnriched(provisioner.Interface, error) {}
57+
func (noopMeter) X509Rekeyed(provisioner.Interface, error) {}
58+
func (noopMeter) X509Renewed(provisioner.Interface, error) {}
59+
func (noopMeter) X509Signed(provisioner.Interface, error) {}
60+
func (noopMeter) X509WebhookAuthorized(provisioner.Interface, error) {}
61+
func (noopMeter) X509WebhookEnriched(provisioner.Interface, error) {}
62+
func (noopMeter) KMSSigned(error) {}
63+
64+
type instrumentedKeyManager struct {
65+
kms.KeyManager
66+
meter Meter
67+
}
68+
69+
func (i *instrumentedKeyManager) CreateSigner(req *kmsapi.CreateSignerRequest) (s crypto.Signer, err error) {
70+
if s, err = i.KeyManager.CreateSigner(req); err == nil {
71+
s = &instrumentedKMSSigner{s, i.meter}
72+
}
73+
74+
return
75+
}
76+
77+
type instrumentedKMSSigner struct {
78+
crypto.Signer
79+
meter Meter
80+
}
81+
82+
func (i *instrumentedKMSSigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) (signature []byte, err error) {
83+
signature, err = i.Signer.Sign(rand, digest, opts)
84+
i.meter.KMSSigned(err)
85+
86+
return
87+
}

‎authority/ssh.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ func (a *Authority) GetSSHBastion(ctx context.Context, user, hostname string) (*
148148
// SignSSH creates a signed SSH certificate with the given public key and options.
149149
func (a *Authority) SignSSH(_ context.Context, key ssh.PublicKey, opts provisioner.SignSSHOptions, signOpts ...provisioner.SignOption) (cert *ssh.Certificate, err error) {
150150
var prov provisioner.Interface
151-
defer a.incrProvisionerCounter(&prov, &err, Meter.SSHSigned)
151+
defer func() { a.meter.SSHSigned(prov, err) }()
152152

153153
var (
154154
certOptions []sshutil.Option
@@ -345,7 +345,7 @@ func (a *Authority) isAllowedToSignSSHCertificate(cert *ssh.Certificate) error {
345345
// RenewSSH creates a signed SSH certificate using the old SSH certificate as a template.
346346
func (a *Authority) RenewSSH(ctx context.Context, oldCert *ssh.Certificate) (cert *ssh.Certificate, err error) {
347347
var prov provisioner.Interface
348-
defer a.incrProvisionerCounter(&prov, &err, Meter.SSHRenewed)
348+
defer func() { a.meter.SSHRenewed(prov, err) }()
349349

350350
if oldCert.ValidAfter == 0 || oldCert.ValidBefore == 0 {
351351
err = errs.BadRequest("cannot renew a certificate without validity period")
@@ -426,7 +426,7 @@ func (a *Authority) RenewSSH(ctx context.Context, oldCert *ssh.Certificate) (cer
426426
// RekeySSH creates a signed SSH certificate using the old SSH certificate as a template.
427427
func (a *Authority) RekeySSH(ctx context.Context, oldCert *ssh.Certificate, pub ssh.PublicKey, signOpts ...provisioner.SignOption) (cert *ssh.Certificate, err error) {
428428
var prov provisioner.Interface
429-
defer a.incrProvisionerCounter(&prov, &err, Meter.SSHRekeyed)
429+
defer func() { a.meter.SSHRekeyed(prov, err) }()
430430

431431
var validators []provisioner.SSHCertValidator
432432

@@ -733,7 +733,7 @@ func (a *Authority) callEnrichingWebhooksSSH(prov provisioner.Interface, webhook
733733
); err == nil {
734734
err = webhookCtl.Enrich(whEnrichReq)
735735

736-
a.incrWebhookCounter(prov, err, Meter.SSHWebhookEnriched)
736+
a.meter.SSHWebhookEnriched(prov, err)
737737
}
738738

739739
return
@@ -750,7 +750,7 @@ func (a *Authority) callAuthorizingWebhooksSSH(prov provisioner.Interface, webho
750750
); err == nil {
751751
err = webhookCtl.Authorize(whAuthBody)
752752

753-
a.incrWebhookCounter(prov, err, Meter.SSHWebhookAuthorized)
753+
a.meter.SSHWebhookAuthorized(prov, err)
754754
}
755755

756756
return

‎authority/tls.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ func withDefaultASN1DN(def *config.ASN1DN) provisioner.CertificateModifierFunc {
9494
// Sign creates a signed certificate from a certificate signing request.
9595
func (a *Authority) Sign(csr *x509.CertificateRequest, signOpts provisioner.SignOptions, extraOpts ...provisioner.SignOption) (cert []*x509.Certificate, err error) {
9696
var prov provisioner.Interface
97-
defer a.incrProvisionerCounter(&prov, &err, Meter.X509Signed)
97+
defer func() { a.meter.X509Signed(prov, err) }()
9898

9999
var (
100100
certOptions []x509util.Option
@@ -374,9 +374,9 @@ func (a *Authority) Rekey(oldCert *x509.Certificate, pk crypto.PublicKey) ([]*x5
374374
func (a *Authority) RenewContext(ctx context.Context, oldCert *x509.Certificate, pk crypto.PublicKey) (cert []*x509.Certificate, err error) {
375375
var prov provisioner.Interface
376376
if pk == nil {
377-
defer a.incrProvisionerCounter(&prov, &err, Meter.X509Renewed)
377+
defer func() { a.meter.X509Renewed(prov, err) }()
378378
} else {
379-
defer a.incrProvisionerCounter(&prov, &err, Meter.X509Rekeyed)
379+
defer func() { a.meter.X509Rekeyed(prov, err) }()
380380
}
381381

382382
isRekey := (pk != nil)
@@ -1024,7 +1024,7 @@ func (a *Authority) callEnrichingWebhooksX509(prov provisioner.Interface, webhoo
10241024
); err == nil {
10251025
err = webhookCtl.Enrich(whEnrichReq)
10261026

1027-
a.incrWebhookCounter(prov, err, Meter.X509WebhookEnriched)
1027+
a.meter.X509WebhookEnriched(prov, err)
10281028
}
10291029

10301030
return
@@ -1049,7 +1049,7 @@ func (a *Authority) callAuthorizingWebhooksX509(prov provisioner.Interface, webh
10491049
); err == nil {
10501050
err = webhookCtl.Authorize(whAuthBody)
10511051

1052-
a.incrWebhookCounter(prov, err, Meter.X509WebhookAuthorized)
1052+
a.meter.X509WebhookAuthorized(prov, err)
10531053
}
10541054

10551055
return

0 commit comments

Comments
 (0)