| /* |
| Copyright 2014 The Kubernetes Authors. |
| |
| Licensed under the Apache License, Version 2.0 (the "License"); |
| you may not use this file except in compliance with the License. |
| You may obtain a copy of the License at |
| |
| http://www.apache.org/licenses/LICENSE-2.0 |
| |
| Unless required by applicable law or agreed to in writing, software |
| distributed under the License is distributed on an "AS IS" BASIS, |
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| See the License for the specific language governing permissions and |
| limitations under the License. |
| */ |
| |
| package cert |
| |
| import ( |
| "crypto/x509" |
| "fmt" |
| "io/ioutil" |
| "os" |
| "path/filepath" |
| ) |
| |
| // CanReadCertAndKey returns true if the certificate and key files already exists, |
| // otherwise returns false. If lost one of cert and key, returns error. |
| func CanReadCertAndKey(certPath, keyPath string) (bool, error) { |
| certReadable := canReadFile(certPath) |
| keyReadable := canReadFile(keyPath) |
| |
| if certReadable == false && keyReadable == false { |
| return false, nil |
| } |
| |
| if certReadable == false { |
| return false, fmt.Errorf("error reading %s, certificate and key must be supplied as a pair", certPath) |
| } |
| |
| if keyReadable == false { |
| return false, fmt.Errorf("error reading %s, certificate and key must be supplied as a pair", keyPath) |
| } |
| |
| return true, nil |
| } |
| |
| // If the file represented by path exists and |
| // readable, returns true otherwise returns false. |
| func canReadFile(path string) bool { |
| f, err := os.Open(path) |
| if err != nil { |
| return false |
| } |
| |
| defer f.Close() |
| |
| return true |
| } |
| |
| // WriteCert writes the pem-encoded certificate data to certPath. |
| // The certificate file will be created with file mode 0644. |
| // If the certificate file already exists, it will be overwritten. |
| // The parent directory of the certPath will be created as needed with file mode 0755. |
| func WriteCert(certPath string, data []byte) error { |
| if err := os.MkdirAll(filepath.Dir(certPath), os.FileMode(0755)); err != nil { |
| return err |
| } |
| return ioutil.WriteFile(certPath, data, os.FileMode(0644)) |
| } |
| |
| // NewPool returns an x509.CertPool containing the certificates in the given PEM-encoded file. |
| // Returns an error if the file could not be read, a certificate could not be parsed, or if the file does not contain any certificates |
| func NewPool(filename string) (*x509.CertPool, error) { |
| certs, err := CertsFromFile(filename) |
| if err != nil { |
| return nil, err |
| } |
| pool := x509.NewCertPool() |
| for _, cert := range certs { |
| pool.AddCert(cert) |
| } |
| return pool, nil |
| } |
| |
| // CertsFromFile returns the x509.Certificates contained in the given PEM-encoded file. |
| // Returns an error if the file could not be read, a certificate could not be parsed, or if the file does not contain any certificates |
| func CertsFromFile(file string) ([]*x509.Certificate, error) { |
| pemBlock, err := ioutil.ReadFile(file) |
| if err != nil { |
| return nil, err |
| } |
| certs, err := ParseCertsPEM(pemBlock) |
| if err != nil { |
| return nil, fmt.Errorf("error reading %s: %s", file, err) |
| } |
| return certs, nil |
| } |