Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Parse CA certificate to catch more specific errors #4340

Merged
merged 6 commits into from
May 30, 2018
Merged

Parse CA certificate to catch more specific errors #4340

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d4152c7
parse CA certificate to catch more specific errors
chelseakomlo May 25, 2018
a8ff38f
remove unnecessary type conversation
chelseakomlo May 29, 2018
5ae88d9
handle parsing multiple certificates in a pem file
chelseakomlo May 29, 2018
ac8afe0
changelog
chelseakomlo May 29, 2018
8e2da4e
refactor to remove duplication
chelseakomlo May 29, 2018
f547535
Merge branch 'master' into f-tls-parse-certs
dadgar May 30, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 12 additions & 1 deletion helper/tlsutil/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package tlsutil
import (
"crypto/tls"
"crypto/x509"
"encoding/pem"
"fmt"
"io/ioutil"
"net"
Expand Down Expand Up @@ -146,8 +147,18 @@ func (c *Config) AppendCA(pool *x509.CertPool) error {
return fmt.Errorf("Failed to read CA file: %v", err)
}

block, _ := pem.Decode([]byte(data))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PEM file can have multiple certificates in it. You are only parsing the first. See: https://golang.org/src/crypto/x509/cert_pool.go?s=2791:2855#L102

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good to know Decode only handles the first, expanding to handle multiple.

if block == nil {
return fmt.Errorf("Failed to decode CA file from pem format")
}

// Parse the certificate to ensure that it is properly formatted
if _, err := x509.ParseCertificates(block.Bytes); err != nil {
return fmt.Errorf("Failed to parse CA file: %v", err)
}

if !pool.AppendCertsFromPEM(data) {
return fmt.Errorf("Failed to parse any CA certificates")
return fmt.Errorf("Failed to add any CA certificates")
}

return nil
Expand Down
50 changes: 46 additions & 4 deletions helper/tlsutil/config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (
"io"
"io/ioutil"
"net"
"os"
"strings"
"testing"

Expand All @@ -26,14 +27,55 @@ const (
)

func TestConfig_AppendCA_None(t *testing.T) {
require := require.New(t)

conf := &Config{}
pool := x509.NewCertPool()
err := conf.AppendCA(pool)
if err != nil {
t.Fatalf("err: %v", err)

require.Nil(err)
}

func TestConfig_AppendCA_Valid(t *testing.T) {
require := require.New(t)

conf := &Config{
CAFile: cacert,
}
pool := x509.NewCertPool()
err := conf.AppendCA(pool)

require.Nil(err)
}

func TestConfig_AppendCA_Invalid(t *testing.T) {
require := require.New(t)
{
conf := &Config{
CAFile: "invalidFile",
}
pool := x509.NewCertPool()
err := conf.AppendCA(pool)
require.NotNil(err)
require.Contains(err.Error(), "Failed to read CA file")
require.Equal(len(pool.Subjects()), 0)
}
if len(pool.Subjects()) != 0 {
t.Fatalf("bad: %v", pool.Subjects())

{
tmpFile, err := ioutil.TempFile("/tmp", "test_ca_file")
require.Nil(err)
defer os.Remove(tmpFile.Name())
_, err = tmpFile.Write([]byte("Invalid CA Content!"))
require.Nil(err)

conf := &Config{
CAFile: tmpFile.Name(),
}
pool := x509.NewCertPool()
err = conf.AppendCA(pool)
require.NotNil(err)
require.Contains(err.Error(), "Failed to decode CA file from pem format")
require.Equal(len(pool.Subjects()), 0)
}
}

Expand Down