diff --git a/backend/src/ee/routes/v1/index.ts b/backend/src/ee/routes/v1/index.ts index 2a83ba097..0567c76ef 100644 --- a/backend/src/ee/routes/v1/index.ts +++ b/backend/src/ee/routes/v1/index.ts @@ -9,8 +9,8 @@ import { registerDynamicSecretRouter } from "./dynamic-secret-router"; import { registerExternalKmsRouter } from "./external-kms-router"; import { registerGroupRouter } from "./group-router"; import { registerIdentityProjectAdditionalPrivilegeRouter } from "./identity-project-additional-privilege-router"; -import { registerKmipOperationRouter } from "./kmip-operation-router"; import { registerKmipRouter } from "./kmip-router"; +import { registerKmipSpecRouter } from "./kmip-spec-router"; import { registerLdapRouter } from "./ldap-router"; import { registerLicenseRouter } from "./license-router"; import { registerOidcRouter } from "./oidc-router"; @@ -112,6 +112,12 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => { }); await server.register(registerProjectTemplateRouter, { prefix: "/project-templates" }); - await server.register(registerKmipRouter, { prefix: "/kmip" }); - await server.register(registerKmipOperationRouter, { prefix: "/kmip-operations" }); + + await server.register( + async (kmipRouter) => { + await kmipRouter.register(registerKmipRouter); + await kmipRouter.register(registerKmipSpecRouter, { prefix: "/spec" }); + }, + { prefix: "/kmip" } + ); }; diff --git a/backend/src/ee/routes/v1/kmip-operation-router.ts b/backend/src/ee/routes/v1/kmip-spec-router.ts similarity index 99% rename from backend/src/ee/routes/v1/kmip-operation-router.ts rename to backend/src/ee/routes/v1/kmip-spec-router.ts index 83414dd16..c9899c98e 100644 --- a/backend/src/ee/routes/v1/kmip-operation-router.ts +++ b/backend/src/ee/routes/v1/kmip-spec-router.ts @@ -8,7 +8,7 @@ import { writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { ActorType, AuthMode } from "@app/services/auth/auth-type"; -export const registerKmipOperationRouter = async (server: FastifyZodProvider) => { +export const registerKmipSpecRouter = async (server: FastifyZodProvider) => { server.decorateRequest("kmipUser", null); server.addHook("onRequest", async (req) => { diff --git a/backend/src/ee/services/kmip/kmip-client-certificate-dal.ts b/backend/src/ee/services/kmip/kmip-client-certificate-dal.ts index a1829c9f6..989b53324 100644 --- a/backend/src/ee/services/kmip/kmip-client-certificate-dal.ts +++ b/backend/src/ee/services/kmip/kmip-client-certificate-dal.ts @@ -7,7 +7,5 @@ export type TKmipClientCertificateDALFactory = ReturnType { const kmipClientCertOrm = ormify(db, TableName.KmipClientCertificates); - return { - ...kmipClientCertOrm - }; + return kmipClientCertOrm; }; diff --git a/backend/src/ee/services/kmip/kmip-org-config-dal.ts b/backend/src/ee/services/kmip/kmip-org-config-dal.ts index 7f1ebead3..a6567fafd 100644 --- a/backend/src/ee/services/kmip/kmip-org-config-dal.ts +++ b/backend/src/ee/services/kmip/kmip-org-config-dal.ts @@ -6,7 +6,6 @@ export type TKmipOrgConfigDALFactory = ReturnType { const kmipOrgConfigOrm = ormify(db, TableName.KmipOrgConfig); - return { - ...kmipOrgConfigOrm - }; + + return kmipOrgConfigOrm; }; diff --git a/backend/src/ee/services/kmip/kmip-org-server-certificate-dal.ts b/backend/src/ee/services/kmip/kmip-org-server-certificate-dal.ts index 956d2615c..98626aad1 100644 --- a/backend/src/ee/services/kmip/kmip-org-server-certificate-dal.ts +++ b/backend/src/ee/services/kmip/kmip-org-server-certificate-dal.ts @@ -7,7 +7,5 @@ export type TKmipOrgServerCertificateDALFactory = ReturnType { const kmipOrgServerCertificateOrm = ormify(db, TableName.KmipOrgServerCertificates); - return { - ...kmipOrgServerCertificateOrm - }; + return kmipOrgServerCertificateOrm; }; diff --git a/backend/src/ee/services/kmip/kmip-service.ts b/backend/src/ee/services/kmip/kmip-service.ts index 49d90bf21..c7ae6b728 100644 --- a/backend/src/ee/services/kmip/kmip-service.ts +++ b/backend/src/ee/services/kmip/kmip-service.ts @@ -5,13 +5,13 @@ import ms from "ms"; import { ActionProjectType } from "@app/db/schemas"; import { BadRequestError, InternalServerError, NotFoundError } from "@app/lib/errors"; -import { isValidIp } from "@app/lib/ip"; +import { isValidHostname, isValidIp } from "@app/lib/ip"; +import { constructPemChainFromCerts } from "@app/services/certificate/certificate-fns"; import { CertExtendedKeyUsage, CertKeyAlgorithm, CertKeyUsage } from "@app/services/certificate/certificate-types"; import { createSerialNumber, keyAlgorithmToAlgCfg } from "@app/services/certificate-authority/certificate-authority-fns"; -import { hostnameRegex } from "@app/services/certificate-authority/certificate-authority-validators"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; import { KmsDataKey } from "@app/services/kms/kms-types"; @@ -363,7 +363,7 @@ export const kmipServiceFactory = ({ serialNumber, privateKey: skLeafObj.export({ format: "pem", type: "pkcs8" }) as string, certificate: leafCert.toString("pem"), - certificateChain: `${serverIntermediateCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim(), + certificateChain: constructPemChainFromCerts([serverIntermediateCaCert, rootCaCert]), projectId: kmipClient.projectId }; }; @@ -553,8 +553,8 @@ export const kmipServiceFactory = ({ }); return { - serverCertificateChain: `${serverIntermediateCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim(), - clientCertificateChain: `${clientIntermediateCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim() + serverCertificateChain: constructPemChainFromCerts([serverIntermediateCaCert, rootCaCert]), + clientCertificateChain: constructPemChainFromCerts([clientIntermediateCaCert, rootCaCert]) }; }; @@ -587,8 +587,8 @@ export const kmipServiceFactory = ({ return { id: kmipConfig.id, - serverCertificateChain: `${serverIntermediateCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim(), - clientCertificateChain: `${clientIntermediateCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim() + serverCertificateChain: constructPemChainFromCerts([serverIntermediateCaCert, rootCaCert]), + clientCertificateChain: constructPemChainFromCerts([clientIntermediateCaCert, rootCaCert]) }; }; @@ -665,15 +665,13 @@ export const kmipServiceFactory = ({ .split(",") .map((name) => name.trim()) .map((altName) => { - // check if the altName is a valid hostname - if (hostnameRegex.test(altName)) { + if (isValidHostname(altName)) { return { type: "dns", value: altName }; } - // check if the altName is a valid IP if (isValidIp(altName)) { return { type: "ip", diff --git a/backend/src/lib/ip/index.ts b/backend/src/lib/ip/index.ts index 0b35a2759..1e247dcde 100644 --- a/backend/src/lib/ip/index.ts +++ b/backend/src/lib/ip/index.ts @@ -107,6 +107,12 @@ export const isValidIp = (ip: string) => { return net.isIPv4(ip) || net.isIPv6(ip); }; +export const isValidHostname = (name: string) => { + const hostnameRegex = /^(?!:\/\/)(\*\.)?([a-zA-Z0-9-_]{1,63}\.?)+(?!:\/\/)([a-zA-Z]{2,63})$/; + + return hostnameRegex.test(name); +}; + export type TIp = { ipAddress: string; type: IPType; diff --git a/backend/src/services/certificate/certificate-fns.ts b/backend/src/services/certificate/certificate-fns.ts index 1768a5011..45ad5963c 100644 --- a/backend/src/services/certificate/certificate-fns.ts +++ b/backend/src/services/certificate/certificate-fns.ts @@ -40,3 +40,9 @@ export const isCertChainValid = async (certificates: x509.X509Certificate[]) => // chain.build() implicitly verifies the chain return chainItems.length === certificates.length; }; + +export const constructPemChainFromCerts = (certificates: x509.X509Certificate[]) => + certificates + .map((cert) => cert.toString("pem")) + .join("\n") + .trim(); diff --git a/backend/src/services/kms/kms-key-dal.ts b/backend/src/services/kms/kms-key-dal.ts index c5c8a5ec5..a0dd12191 100644 --- a/backend/src/services/kms/kms-key-dal.ts +++ b/backend/src/services/kms/kms-key-dal.ts @@ -104,7 +104,6 @@ export const kmskeyDALFactory = (db: TDbClient) => { .join(TableName.InternalKms, `${TableName.KmsKey}.id`, `${TableName.InternalKms}.kmsKeyId`) .select(selectAllTableCols(TableName.KmsKey)) .select( - db.ref("encryptedKey").withSchema(TableName.InternalKms).as("internalKmsEncryptedKey"), db.ref("encryptionAlgorithm").withSchema(TableName.InternalKms).as("internalKmsEncryptionAlgorithm"), db.ref("version").withSchema(TableName.InternalKms).as("internalKmsVersion") ); @@ -112,7 +111,6 @@ export const kmskeyDALFactory = (db: TDbClient) => { return result.map((entry) => ({ ...KmsKeysSchema.parse(entry), isActive: !entry.isDisabled, - encryptedKey: entry.internalKmsEncryptedKey, algorithm: entry.internalKmsEncryptionAlgorithm, version: entry.internalKmsVersion })); diff --git a/cli/go.mod b/cli/go.mod index cd957a584..b96772c91 100644 --- a/cli/go.mod +++ b/cli/go.mod @@ -11,7 +11,7 @@ require ( github.com/gitleaks/go-gitdiff v0.8.0 github.com/h2non/filetype v1.1.3 github.com/infisical/go-sdk v0.4.8 - github.com/infisical/infisical-kmip v0.3.4 + github.com/infisical/infisical-kmip v0.3.5 github.com/mattn/go-isatty v0.0.20 github.com/muesli/ansi v0.0.0-20221106050444-61f0cd9a192a github.com/muesli/mango-cobra v1.2.0 diff --git a/cli/go.sum b/cli/go.sum index c6d4d26c0..67a3d3275 100644 --- a/cli/go.sum +++ b/cli/go.sum @@ -273,8 +273,8 @@ github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7P github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/infisical/go-sdk v0.4.8 h1:aphRnaauC5//PkP1ZbY9RSK2RiT1LjPS5o4CbX0x5OQ= github.com/infisical/go-sdk v0.4.8/go.mod h1:bMO9xSaBeXkDBhTIM4FkkREAfw2V8mv5Bm7lvo4+uDk= -github.com/infisical/infisical-kmip v0.3.4 h1:X7wsW/vnqrTAtilYyuz+xFtkUu025wD5Yfk2u/LbniQ= -github.com/infisical/infisical-kmip v0.3.4/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= +github.com/infisical/infisical-kmip v0.3.5 h1:QM3s0e18B+mYv3a9HQNjNAlbwZJBzXq5BAJM2scIeiE= +github.com/infisical/infisical-kmip v0.3.5/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs= github.com/jedib0t/go-pretty v4.3.0+incompatible h1:CGs8AVhEKg/n9YbUenWmNStRW2PHJzaeDodcfvRAbIo= github.com/jedib0t/go-pretty v4.3.0+incompatible/go.mod h1:XemHduiw8R651AF9Pt4FwCTKeG3oo7hrHJAoznj9nag= github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4= diff --git a/cli/packages/cmd/kmip.go b/cli/packages/cmd/kmip.go index dbee60c5f..b0c397895 100644 --- a/cli/packages/cmd/kmip.go +++ b/cli/packages/cmd/kmip.go @@ -30,7 +30,7 @@ var kmipStartCmd = &cobra.Command{ } func startKmipServer(cmd *cobra.Command, args []string) { - addr, err := cmd.Flags().GetString("addr") + listenAddr, err := cmd.Flags().GetString("listen-address") if err != nil { util.HandleError(err, "Unable to parse flag") } @@ -79,7 +79,7 @@ func startKmipServer(cmd *cobra.Command, args []string) { } kmip.StartServer(kmip.ServerConfig{ - Addr: addr, + Addr: listenAddr, InfisicalBaseAPIURL: config.INFISICAL_URL, IdentityClientId: identityClientId, IdentityClientSecret: identityClientSecret, @@ -90,7 +90,7 @@ func startKmipServer(cmd *cobra.Command, args []string) { } func init() { - kmipStartCmd.Flags().String("addr", "localhost:5696", "The address for the KMIP server to listen on. Defaults to localhost:5696") + kmipStartCmd.Flags().String("listen-address", "localhost:5696", "The address for the KMIP server to listen on. Defaults to localhost:5696") kmipStartCmd.Flags().String("identity-auth-method", string(util.AuthStrategy.UNIVERSAL_AUTH), "The auth method to use for authenticating the machine identity. Defaults to universal-auth.") kmipStartCmd.Flags().String("identity-client-id", "", "Universal auth client ID of machine identity") kmipStartCmd.Flags().String("identity-client-secret", "", "Universal auth client secret of machine identity") diff --git a/docs/documentation/platform/kms/kmip.mdx b/docs/documentation/platform/kms/kmip.mdx index 6237fc402..1e025d51a 100644 --- a/docs/documentation/platform/kms/kmip.mdx +++ b/docs/documentation/platform/kms/kmip.mdx @@ -101,7 +101,7 @@ Follow these steps to configure and deploy a KMIP server. ``` The following flags are available for the `infisical kmip start` command:: - - **addr** (default: localhost:5696): The address the KMIP server listens on. + - **listen-address** (default: localhost:5696): The address the KMIP server listens on. - **identity-auth-method** (default: universal-auth): The authentication method for the machine identity. - **identity-client-id**: The client ID of the machine identity. This can be set by defining the `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` ENV variable. - **identity-client-secret**: The client secret of the machine identity. This can be set by defining the `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` ENV variable.