mirror of
https://github.com/pomerium/pomerium.git
synced 2025-05-31 09:57:17 +02:00
improve ca cert error message, use GetCertPool for databroker storage (#1666)
This commit is contained in:
Caleb Doxsey
GitHub
parent
82c7d1ee7a
commit
d18e8c661d
4 changed files with 19 additions and 30 deletions
|
|
@ -3,8 +3,6 @@ package main
|
|||
import (
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
|
|
@ -20,6 +18,8 @@ import (
|
|||
"golang.org/x/crypto/ssh/terminal"
|
||||
"golang.org/x/sync/errgroup"
|
||||
jose "gopkg.in/square/go-jose.v2"
|
||||
|
||||
"github.com/pomerium/pomerium/pkg/cryptutil"
|
||||
)
|
||||
|
||||
var kubernetesExecCredentialOption struct {
|
||||
|
|
@ -148,21 +148,12 @@ func runOpenBrowser(ctx context.Context, li net.Listener, serverURL *url.URL) er
|
|||
if kubernetesExecCredentialOption.disableTLSVerification {
|
||||
transport.TLSClientConfig.InsecureSkipVerify = true
|
||||
}
|
||||
if kubernetesExecCredentialOption.alternateCAPath != "" {
|
||||
data, err := ioutil.ReadFile(kubernetesExecCredentialOption.alternateCAPath)
|
||||
transport.TLSClientConfig.RootCAs, err = cryptutil.GetCertPool(
|
||||
kubernetesExecCredentialOption.caCert,
|
||||
kubernetesExecCredentialOption.alternateCAPath,
|
||||
)
|
||||
if err != nil {
|
||||
return fmt.Errorf("error reading CA certificate: %w", err)
|
||||
}
|
||||
transport.TLSClientConfig.RootCAs = x509.NewCertPool()
|
||||
transport.TLSClientConfig.RootCAs.AppendCertsFromPEM(data)
|
||||
}
|
||||
if kubernetesExecCredentialOption.caCert != "" {
|
||||
data, err := base64.StdEncoding.DecodeString(kubernetesExecCredentialOption.caCert)
|
||||
if err != nil {
|
||||
return fmt.Errorf("error reading CA certificate: %w", err)
|
||||
}
|
||||
transport.TLSClientConfig.RootCAs = x509.NewCertPool()
|
||||
transport.TLSClientConfig.RootCAs.AppendCertsFromPEM(data)
|
||||
return err
|
||||
}
|
||||
|
||||
client := &http.Client{
|
||||
|
|
|
|||
3
go.sum
3
go.sum
|
|
@ -519,6 +519,7 @@ github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40T
|
|||
github.com/rakyll/statik v0.1.7 h1:OF3QCZUuyPxuGEP7B4ypUa7sB/iHtqOTDYZXGM8KOdQ=
|
||||
github.com/rakyll/statik v0.1.7/go.mod h1:AlZONWzMtEnMs7W4e/1LURLiI49pIMmp6V9Unghqrcc=
|
||||
github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
|
||||
github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 h1:MkV+77GLUNo5oJ0jf870itWm3D0Sjh7+Za9gazKc5LQ=
|
||||
github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
|
||||
github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
|
||||
github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
|
||||
|
|
@ -721,6 +722,7 @@ golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4Iltr
|
|||
golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||
golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d h1:TzXSXBo42m9gQenoE3b9BGiEpg5IG2JkU5FkPIawgtw=
|
||||
golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||
golang.org/x/oauth2 v0.0.0-20201207163604-931764155e3f h1:bGuVhRryQ3m1t3U3cQOa4TdSuMIXKrTrvmdJjQLbMKc=
|
||||
golang.org/x/oauth2 v0.0.0-20201207163604-931764155e3f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
|
||||
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
|
|
@ -931,6 +933,7 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa
|
|||
google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
|
||||
google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
|
||||
google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
|
||||
google.golang.org/grpc v1.34.0 h1:raiipEjMOIC/TO2AvyTxP25XFdLxNIBwzDh3FM3XztI=
|
||||
google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
|
||||
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
|
||||
google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
|
||||
|
|
|
|||
|
|
@ -4,9 +4,7 @@ package databroker
|
|||
import (
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"reflect"
|
||||
"sort"
|
||||
"strings"
|
||||
|
|
@ -26,6 +24,7 @@ import (
|
|||
"github.com/pomerium/pomerium/internal/log"
|
||||
"github.com/pomerium/pomerium/internal/signal"
|
||||
"github.com/pomerium/pomerium/internal/telemetry/trace"
|
||||
"github.com/pomerium/pomerium/pkg/cryptutil"
|
||||
"github.com/pomerium/pomerium/pkg/grpc/databroker"
|
||||
"github.com/pomerium/pomerium/pkg/storage"
|
||||
"github.com/pomerium/pomerium/pkg/storage/inmemory"
|
||||
|
|
@ -464,14 +463,10 @@ func (srv *Server) getDB(recordType string, lock bool) (db storage.Backend, vers
|
|||
}
|
||||
|
||||
func (srv *Server) newDB(recordType string) (db storage.Backend, err error) {
|
||||
caCertPool := x509.NewCertPool()
|
||||
if srv.cfg.storageCAFile != "" {
|
||||
if caCert, err := ioutil.ReadFile(srv.cfg.storageCAFile); err == nil {
|
||||
caCertPool.AppendCertsFromPEM(caCert)
|
||||
} else {
|
||||
caCertPool, err := cryptutil.GetCertPool("", srv.cfg.storageCAFile)
|
||||
if err != nil {
|
||||
log.Warn().Err(err).Msg("failed to read databroker CA file")
|
||||
}
|
||||
}
|
||||
tlsConfig := &tls.Config{
|
||||
RootCAs: caCertPool,
|
||||
// nolint: gosec
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ import (
|
|||
func GetCertPool(ca, caFile string) (*x509.CertPool, error) {
|
||||
rootCAs, err := x509.SystemCertPool()
|
||||
if err != nil {
|
||||
log.Error().Msg("pkg/cryptutil: failed getting system cert pool making new one")
|
||||
log.Error().Err(err).Msg("pkg/cryptutil: failed getting system cert pool making new one")
|
||||
rootCAs = x509.NewCertPool()
|
||||
}
|
||||
if ca == "" && caFile == "" {
|
||||
|
|
@ -27,16 +27,16 @@ func GetCertPool(ca, caFile string) (*x509.CertPool, error) {
|
|||
if ca != "" {
|
||||
data, err = base64.StdEncoding.DecodeString(ca)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to decode certificate authority: %w", err)
|
||||
return nil, fmt.Errorf("failed to decode base64-encoded certificate authority: %w", err)
|
||||
}
|
||||
} else {
|
||||
data, err = ioutil.ReadFile(caFile)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("certificate authority file %v not readable: %w", caFile, err)
|
||||
return nil, fmt.Errorf("failed to read certificate authority file (%s): %w", caFile, err)
|
||||
}
|
||||
}
|
||||
if ok := rootCAs.AppendCertsFromPEM(data); !ok {
|
||||
return nil, fmt.Errorf("failed to append CA cert to certPool")
|
||||
return nil, fmt.Errorf("failed to append any PEM-encoded certificates")
|
||||
}
|
||||
log.Debug().Msg("pkg/cryptutil: added custom certificate authority")
|
||||
return rootCAs, nil
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue