mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-12 19:32:48 -06:00
Anders Eknert
e43ef0a979
Earlier this evening I tried to run the Go [modernize](https://pkg.go.dev/golang.org/x/tools/gopls/internal/analysis/modernize) analyzer on OPA. That didn't go as planned: - https://github.com/golang/go/issues/73661 - https://github.com/golang/go/issues/73663 While we wait for that to be fixed, I figured an old-fashioned search-and-replace across the repo may work for at least the `interface{}` to `any` conversion. That should help make it easier to see the other fixes as applied by the modernize tool once it has had those issues resolved. Signed-off-by: Anders Eknert <anders@styra.com>
67 lines
1.4 KiB
Go
67 lines
1.4 KiB
Go
package sign
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"crypto/sha512"
|
|
"errors"
|
|
"fmt"
|
|
"hash"
|
|
|
|
"github.com/open-policy-agent/opa/internal/jwx/jwa"
|
|
)
|
|
|
|
var hmacSignFuncs = map[jwa.SignatureAlgorithm]hmacSignFunc{}
|
|
|
|
func init() {
|
|
algs := map[jwa.SignatureAlgorithm]func() hash.Hash{
|
|
jwa.HS256: sha256.New,
|
|
jwa.HS384: sha512.New384,
|
|
jwa.HS512: sha512.New,
|
|
}
|
|
|
|
for alg, h := range algs {
|
|
hmacSignFuncs[alg] = makeHMACSignFunc(h)
|
|
|
|
}
|
|
}
|
|
|
|
func newHMAC(alg jwa.SignatureAlgorithm) (*HMACSigner, error) {
|
|
signer, ok := hmacSignFuncs[alg]
|
|
if !ok {
|
|
return nil, fmt.Errorf(`unsupported algorithm while trying to create HMAC signer: %s`, alg)
|
|
}
|
|
|
|
return &HMACSigner{
|
|
alg: alg,
|
|
sign: signer,
|
|
}, nil
|
|
}
|
|
|
|
func makeHMACSignFunc(hfunc func() hash.Hash) hmacSignFunc {
|
|
return hmacSignFunc(func(payload []byte, key []byte) ([]byte, error) {
|
|
h := hmac.New(hfunc, key)
|
|
h.Write(payload)
|
|
return h.Sum(nil), nil
|
|
})
|
|
}
|
|
|
|
// Algorithm returns the signer algorithm
|
|
func (s HMACSigner) Algorithm() jwa.SignatureAlgorithm {
|
|
return s.alg
|
|
}
|
|
|
|
// Sign signs payload with a Symmetric key
|
|
func (s HMACSigner) Sign(payload []byte, key any) ([]byte, error) {
|
|
hmackey, ok := key.([]byte)
|
|
if !ok {
|
|
return nil, fmt.Errorf(`invalid key type %T. []byte is required`, key)
|
|
}
|
|
|
|
if len(hmackey) == 0 {
|
|
return nil, errors.New(`missing key while signing payload`)
|
|
}
|
|
|
|
return s.sign(payload, hmackey)
|
|
}
|