// Verify checks the given credentials
Verify checks the given credentials
// Verify checks the given credentials
func (v *Verifier) Verify(ctx context.Context, req *dockerregistryproxyv1.VerifyRequest) (*empty.Empty, error) {
	encodedPassword := req.GetPassword()
	instanceIdentityPassword := &aws.InstanceIdentityPassword{}
	if err := instanceIdentityPassword.Decode(encodedPassword); err != nil {
		return nil, fmt.Errorf("could not decode password: %w", err)
	}
	instanceIdentityPassword.Signature = []byte(fmt.Sprintf("-----BEGIN PKCS7-----\n%s\n-----END PKCS7-----", instanceIdentityPassword.Signature))
	decodedSig, _ := pem.Decode(instanceIdentityPassword.Signature)
	p7, err := pkcs7.Parse(decodedSig.Bytes)
	if err != nil {
		return nil, fmt.Errorf("could not parse PKCS7 signature '%s': %w", instanceIdentityPassword.Signature, err)
	}
	p7.Content = instanceIdentityPassword.Payload
	p7.Certificates = v.certs
	if err := p7.Verify(); err != nil {
		return nil, fmt.Errorf("could not verify signed data: %w", err)
	}
	doc := &aws.InstanceIdentityDocument{}
	if err := json.Unmarshal(p7.Content, doc); err != nil {
		return nil, fmt.Errorf("could not unmarshal document: %w", err)
	}
	if found := aws.CheckWhitelist(doc.AvailabilityZone, v.availabilityZones); !found {
		return nil, fmt.Errorf("%s: %w", doc.AvailabilityZone, aws.ErrNotWhitelisted)
	}
	if found := aws.CheckWhitelist(doc.PrivateIP, v.privateIPs); !found {
		return nil, fmt.Errorf("%s: %w", doc.PrivateIP, aws.ErrNotWhitelisted)
	}
	if found := aws.CheckWhitelist(doc.InstanceID, v.instanceIDs); !found {
		return nil, fmt.Errorf("%s: %w", doc.InstanceID, aws.ErrNotWhitelisted)
	}
	if found := aws.CheckWhitelist(doc.AccountID, v.accountIDs); !found {
		return nil, fmt.Errorf("%s: %w", doc.AccountID, aws.ErrNotWhitelisted)
	}
	if found := aws.CheckWhitelist(doc.ImageID, v.imageIDs); !found {
		return nil, fmt.Errorf("%s: %w", doc.ImageID, aws.ErrNotWhitelisted)
	}
	if found := aws.CheckWhitelist(doc.Region, v.regions); !found {
		return nil, fmt.Errorf("%s: %w", doc.Region, aws.ErrNotWhitelisted)
	}
	return &empty.Empty{}, nil
}
func ( v * Verifier ) Verify ( ctx context . Context , req * dockerregistryproxyv1 . VerifyRequest ) ( * empty . Empty , error ) { encodedPassword := req . GetPassword ( ) instanceIdentityPassword := & aws . InstanceIdentityPassword { } if err := instanceIdentityPassword . Decode ( encodedPassword ) ; err != nil { return nil , fmt . Errorf ( " " , err ) } instanceIdentityPassword . Signature = [ ] byte ( fmt . Sprintf ( " \n \n " , instanceIdentityPassword . Signature ) ) decodedSig , _ := pem . Decode ( instanceIdentityPassword . Signature ) p7 , err := pkcs7 . Parse ( decodedSig . Bytes ) if err != nil { return nil , fmt . Errorf ( " " , instanceIdentityPassword . Signature , err ) } p7 . Content = instanceIdentityPassword . Payload p7 . Certificates = v . certs if err := p7 . Verify ( ) ; err != nil { return nil , fmt . Errorf ( " " , err ) } doc := & aws . InstanceIdentityDocument { } if err := json . Unmarshal ( p7 . Content , doc ) ; err != nil { return nil , fmt . Errorf ( " " , err ) } if found := aws . CheckWhitelist ( doc . AvailabilityZone , v . availabilityZones ) ; ! found { return nil , fmt . Errorf ( " " , doc . AvailabilityZone , aws . ErrNotWhitelisted ) } if found := aws . CheckWhitelist ( doc . PrivateIP , v . privateIPs ) ; ! found { return nil , fmt . Errorf ( " " , doc . PrivateIP , aws . ErrNotWhitelisted ) } if found := aws . CheckWhitelist ( doc . InstanceID , v . instanceIDs ) ; ! found { return nil , fmt . Errorf ( " " , doc . InstanceID , aws . ErrNotWhitelisted ) } if found := aws . CheckWhitelist ( doc . AccountID , v . accountIDs ) ; ! found { return nil , fmt . Errorf ( " " , doc . AccountID , aws . ErrNotWhitelisted ) } if found := aws . CheckWhitelist ( doc . ImageID , v . imageIDs ) ; ! found { return nil , fmt . Errorf ( " " , doc . ImageID , aws . ErrNotWhitelisted ) } if found := aws . CheckWhitelist ( doc . Region , v . regions ) ; ! found { return nil , fmt . Errorf ( " " , doc . Region , aws . ErrNotWhitelisted ) } return & empty . Empty { } , nil }
Verify checks the given credentials
Verify checks the given credentials