misc: addressed comments

backend/src/ee/routes/v1/index.ts

@@ -9,8 +9,8 @@ import { registerDynamicSecretRouter } from "./dynamic-secret-router";
 import { registerExternalKmsRouter } from "./external-kms-router";
 import { registerGroupRouter } from "./group-router";
 import { registerIdentityProjectAdditionalPrivilegeRouter } from "./identity-project-additional-privilege-router";
-import { registerKmipOperationRouter } from "./kmip-operation-router";
 import { registerKmipRouter } from "./kmip-router";
+import { registerKmipSpecRouter } from "./kmip-spec-router";
 import { registerLdapRouter } from "./ldap-router";
 import { registerLicenseRouter } from "./license-router";
 import { registerOidcRouter } from "./oidc-router";
@@ -112,6 +112,12 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
   });
 
   await server.register(registerProjectTemplateRouter, { prefix: "/project-templates" });
-  await server.register(registerKmipRouter, { prefix: "/kmip" });
+
-  await server.register(registerKmipOperationRouter, { prefix: "/kmip-operations" });
+  await server.register(
+    async (kmipRouter) => {
+      await kmipRouter.register(registerKmipRouter);
+      await kmipRouter.register(registerKmipSpecRouter, { prefix: "/spec" });
+    },
+    { prefix: "/kmip" }
+  );
 };

backend/src/ee/routes/v1/kmip-spec-router.ts

@@ -8,7 +8,7 @@ import { writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { ActorType, AuthMode } from "@app/services/auth/auth-type";
 
-export const registerKmipOperationRouter = async (server: FastifyZodProvider) => {
+export const registerKmipSpecRouter = async (server: FastifyZodProvider) => {
   server.decorateRequest("kmipUser", null);
 
   server.addHook("onRequest", async (req) => {

backend/src/ee/services/kmip/kmip-client-certificate-dal.ts

@@ -7,7 +7,5 @@ export type TKmipClientCertificateDALFactory = ReturnType<typeof kmipClientCerti
 export const kmipClientCertificateDALFactory = (db: TDbClient) => {
   const kmipClientCertOrm = ormify(db, TableName.KmipClientCertificates);
 
-  return {
+  return kmipClientCertOrm;
-    ...kmipClientCertOrm
-  };
 };

backend/src/ee/services/kmip/kmip-org-config-dal.ts

@@ -6,7 +6,6 @@ export type TKmipOrgConfigDALFactory = ReturnType<typeof kmipOrgConfigDALFactory
 
 export const kmipOrgConfigDALFactory = (db: TDbClient) => {
   const kmipOrgConfigOrm = ormify(db, TableName.KmipOrgConfig);
-  return {
+
-    ...kmipOrgConfigOrm
+  return kmipOrgConfigOrm;
-  };
 };

backend/src/ee/services/kmip/kmip-org-server-certificate-dal.ts

@@ -7,7 +7,5 @@ export type TKmipOrgServerCertificateDALFactory = ReturnType<typeof kmipOrgServe
 export const kmipOrgServerCertificateDALFactory = (db: TDbClient) => {
   const kmipOrgServerCertificateOrm = ormify(db, TableName.KmipOrgServerCertificates);
 
-  return {
+  return kmipOrgServerCertificateOrm;
-    ...kmipOrgServerCertificateOrm
-  };
 };

backend/src/ee/services/kmip/kmip-service.ts

@@ -5,13 +5,13 @@ import ms from "ms";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { BadRequestError, InternalServerError, NotFoundError } from "@app/lib/errors";
-import { isValidIp } from "@app/lib/ip";
+import { isValidHostname, isValidIp } from "@app/lib/ip";
+import { constructPemChainFromCerts } from "@app/services/certificate/certificate-fns";
 import { CertExtendedKeyUsage, CertKeyAlgorithm, CertKeyUsage } from "@app/services/certificate/certificate-types";
 import {
   createSerialNumber,
   keyAlgorithmToAlgCfg
 } from "@app/services/certificate-authority/certificate-authority-fns";
-import { hostnameRegex } from "@app/services/certificate-authority/certificate-authority-validators";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 
@@ -363,7 +363,7 @@ export const kmipServiceFactory = ({
       serialNumber,
       privateKey: skLeafObj.export({ format: "pem", type: "pkcs8" }) as string,
       certificate: leafCert.toString("pem"),
-      certificateChain: `${serverIntermediateCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim(),
+      certificateChain: constructPemChainFromCerts([serverIntermediateCaCert, rootCaCert]),
       projectId: kmipClient.projectId
     };
   };
@@ -553,8 +553,8 @@ export const kmipServiceFactory = ({
     });
 
     return {
-      serverCertificateChain: `${serverIntermediateCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim(),
+      serverCertificateChain: constructPemChainFromCerts([serverIntermediateCaCert, rootCaCert]),
-      clientCertificateChain: `${clientIntermediateCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim()
+      clientCertificateChain: constructPemChainFromCerts([clientIntermediateCaCert, rootCaCert])
     };
   };
 
@@ -587,8 +587,8 @@ export const kmipServiceFactory = ({
 
     return {
       id: kmipConfig.id,
-      serverCertificateChain: `${serverIntermediateCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim(),
+      serverCertificateChain: constructPemChainFromCerts([serverIntermediateCaCert, rootCaCert]),
-      clientCertificateChain: `${clientIntermediateCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim()
+      clientCertificateChain: constructPemChainFromCerts([clientIntermediateCaCert, rootCaCert])
     };
   };
 
@@ -665,15 +665,13 @@ export const kmipServiceFactory = ({
       .split(",")
       .map((name) => name.trim())
       .map((altName) => {
-        // check if the altName is a valid hostname
+        if (isValidHostname(altName)) {
-        if (hostnameRegex.test(altName)) {
           return {
             type: "dns",
             value: altName
           };
         }
 
-        // check if the altName is a valid IP
         if (isValidIp(altName)) {
           return {
             type: "ip",

backend/src/lib/ip/index.ts

@@ -107,6 +107,12 @@ export const isValidIp = (ip: string) => {
   return net.isIPv4(ip) || net.isIPv6(ip);
 };
 
+export const isValidHostname = (name: string) => {
+  const hostnameRegex = /^(?!:\/\/)(\*\.)?([a-zA-Z0-9-_]{1,63}\.?)+(?!:\/\/)([a-zA-Z]{2,63})$/;
+
+  return hostnameRegex.test(name);
+};
+
 export type TIp = {
   ipAddress: string;
   type: IPType;

backend/src/services/certificate/certificate-fns.ts

@@ -40,3 +40,9 @@ export const isCertChainValid = async (certificates: x509.X509Certificate[]) =>
   // chain.build() implicitly verifies the chain
   return chainItems.length === certificates.length;
 };
+
+export const constructPemChainFromCerts = (certificates: x509.X509Certificate[]) =>
+  certificates
+    .map((cert) => cert.toString("pem"))
+    .join("\n")
+    .trim();

backend/src/services/kms/kms-key-dal.ts

@@ -104,7 +104,6 @@ export const kmskeyDALFactory = (db: TDbClient) => {
         .join(TableName.InternalKms, `${TableName.KmsKey}.id`, `${TableName.InternalKms}.kmsKeyId`)
         .select(selectAllTableCols(TableName.KmsKey))
         .select(
-          db.ref("encryptedKey").withSchema(TableName.InternalKms).as("internalKmsEncryptedKey"),
           db.ref("encryptionAlgorithm").withSchema(TableName.InternalKms).as("internalKmsEncryptionAlgorithm"),
           db.ref("version").withSchema(TableName.InternalKms).as("internalKmsVersion")
         );
@@ -112,7 +111,6 @@ export const kmskeyDALFactory = (db: TDbClient) => {
       return result.map((entry) => ({
         ...KmsKeysSchema.parse(entry),
         isActive: !entry.isDisabled,
-        encryptedKey: entry.internalKmsEncryptedKey,
         algorithm: entry.internalKmsEncryptionAlgorithm,
         version: entry.internalKmsVersion
       }));

cli/go.mod

@@ -11,7 +11,7 @@ require (
 	github.com/gitleaks/go-gitdiff v0.8.0
 	github.com/h2non/filetype v1.1.3
 	github.com/infisical/go-sdk v0.4.8
-	github.com/infisical/infisical-kmip v0.3.4
+	github.com/infisical/infisical-kmip v0.3.5
 	github.com/mattn/go-isatty v0.0.20
 	github.com/muesli/ansi v0.0.0-20221106050444-61f0cd9a192a
 	github.com/muesli/mango-cobra v1.2.0

cli/go.sum

@@ -273,8 +273,8 @@ github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7P
 github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/infisical/go-sdk v0.4.8 h1:aphRnaauC5//PkP1ZbY9RSK2RiT1LjPS5o4CbX0x5OQ=
 github.com/infisical/go-sdk v0.4.8/go.mod h1:bMO9xSaBeXkDBhTIM4FkkREAfw2V8mv5Bm7lvo4+uDk=
-github.com/infisical/infisical-kmip v0.3.4 h1:X7wsW/vnqrTAtilYyuz+xFtkUu025wD5Yfk2u/LbniQ=
+github.com/infisical/infisical-kmip v0.3.5 h1:QM3s0e18B+mYv3a9HQNjNAlbwZJBzXq5BAJM2scIeiE=
-github.com/infisical/infisical-kmip v0.3.4/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs=
+github.com/infisical/infisical-kmip v0.3.5/go.mod h1:bO1M4YtKyutNg1bREPmlyZspC5duSR7hyQ3lPmLzrIs=
 github.com/jedib0t/go-pretty v4.3.0+incompatible h1:CGs8AVhEKg/n9YbUenWmNStRW2PHJzaeDodcfvRAbIo=
 github.com/jedib0t/go-pretty v4.3.0+incompatible/go.mod h1:XemHduiw8R651AF9Pt4FwCTKeG3oo7hrHJAoznj9nag=
 github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=

cli/packages/cmd/kmip.go

@@ -30,7 +30,7 @@ var kmipStartCmd = &cobra.Command{
 }
 
 func startKmipServer(cmd *cobra.Command, args []string) {
-	addr, err := cmd.Flags().GetString("addr")
+	listenAddr, err := cmd.Flags().GetString("listen-address")
 	if err != nil {
 		util.HandleError(err, "Unable to parse flag")
 	}
@@ -79,7 +79,7 @@ func startKmipServer(cmd *cobra.Command, args []string) {
 	}
 
 	kmip.StartServer(kmip.ServerConfig{
-		Addr:                 addr,
+		Addr:                 listenAddr,
 		InfisicalBaseAPIURL:  config.INFISICAL_URL,
 		IdentityClientId:     identityClientId,
 		IdentityClientSecret: identityClientSecret,
@@ -90,7 +90,7 @@ func startKmipServer(cmd *cobra.Command, args []string) {
 }
 
 func init() {
-	kmipStartCmd.Flags().String("addr", "localhost:5696", "The address for the KMIP server to listen on. Defaults to localhost:5696")
+	kmipStartCmd.Flags().String("listen-address", "localhost:5696", "The address for the KMIP server to listen on. Defaults to localhost:5696")
 	kmipStartCmd.Flags().String("identity-auth-method", string(util.AuthStrategy.UNIVERSAL_AUTH), "The auth method to use for authenticating the machine identity. Defaults to universal-auth.")
 	kmipStartCmd.Flags().String("identity-client-id", "", "Universal auth client ID of machine identity")
 	kmipStartCmd.Flags().String("identity-client-secret", "", "Universal auth client secret of machine identity")

docs/documentation/platform/kms/kmip.mdx

@@ -101,7 +101,7 @@ Follow these steps to configure and deploy a KMIP server.
     ```
 
     The following flags are available for the `infisical kmip start` command::
-    - **addr** (default: localhost:5696): The address the KMIP server listens on.
+    - **listen-address** (default: localhost:5696): The address the KMIP server listens on.
     - **identity-auth-method** (default: universal-auth): The authentication method for the machine identity.
     - **identity-client-id**:  The client ID of the machine identity. This can be set by defining the `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` ENV variable.
     - **identity-client-secret**: The client secret of the machine identity. This can be set by defining the `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` ENV variable.