3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-06-04 03:42:49 +02:00
Code Issues Projects Releases Packages Wiki Activity

envoy: check certificates for must-staple flag and drop them if they are missing the response (#2909)

Browse source 
* envoy: check certificates for must-staple flag and drop them if they are missing the response

* Update config/envoyconfig/tls_test.go

Co-authored-by: Denis Mishin <dmishin@pomerium.com>

Co-authored-by: Denis Mishin <dmishin@pomerium.com>
This commit is contained in:
Caleb Doxsey 2022-01-10 10:51:56 -07:00 • committed by GitHub
parent 58ca681f40
commit 49fb00c895
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 63 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

16
config/envoyconfig/tls_test.go
View file

@ -1,12 +1,16 @@
package envoyconfig
import (
"crypto/x509"
"crypto/x509/pkix"
"net/url"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/pomerium/pomerium/internal/testutil"
"github.com/pomerium/pomerium/pkg/cryptutil"
)
func TestBuildSubjectAlternativeNameMatcher(t *testing.T) {
@ -31,3 +35,15 @@ func TestBuildSubjectNameIndication(t *testing.T) {
assert.Equal(t, "example.org", b.buildSubjectNameIndication(&url.URL{Host: "example.com:1234"}, "example.org"))
assert.Equal(t, "example.example.org", b.buildSubjectNameIndication(&url.URL{Host: "example.com:1234"}, "*.example.org"))
}
func TestValidateCertificate(t *testing.T) {
cert, err := cryptutil.GenerateSelfSignedCertificate("example.com", func(tpl *x509.Certificate) {
// set the must staple flag on the cert
tpl.ExtraExtensions = append(tpl.ExtraExtensions, pkix.Extension{
Id: oidMustStaple,
})
})
require.NoError(t, err)
assert.Error(t, validateCertificate(cert), "should return an error for a must-staple TLS certificate that has no stapled OCSP response")
}