3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-05-28 16:37:24 +02:00
Code Issues Projects Releases Packages Wiki Activity

config: extra CA and CRL validation (#4455)

Browse source 
Return an error from DownstreamMTLSSettings.validate() if both CA and
CAFile are populated, or if both CRL and CRLFile are populated.
This commit is contained in:
Kenneth Jenkins 2023-08-10 16:15:11 -07:00 • committed by GitHub
parent 50e6cf7466
commit ed9a93fe5b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 40 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

41
config/options_test.go
View file

@ -705,18 +705,37 @@ func TestDeprecatedClientCAOptions(t *testing.T) {
zl := zerolog.New(&logOutput)
testutil.SetLogger(t, &zl)
o := NewDefaultOptions()
o.ClientCA = "LS0tIEZBS0UgQ0EgQ0VSVCAtLS0="
o.ClientCAFile = caFile
o.AutocertOptions.Enable = true // suppress an unrelated warning
t.Run("CA", func(t *testing.T) {
logOutput.Reset()
err := o.Validate()
require.NoError(t, err)
assert.Equal(t, "LS0tIEZBS0UgQ0EgQ0VSVCAtLS0=", o.DownstreamMTLS.CA)
assert.Equal(t, caFile, o.DownstreamMTLS.CAFile)
assert.Equal(t, `{"level":"warn","message":"config: client_ca is deprecated, set downstream_mtls.ca instead"}
{"level":"warn","message":"config: client_ca_file is deprecated, set downstream_mtls.ca_file instead"}
`, logOutput.String())
o := NewDefaultOptions()
o.AutocertOptions.Enable = true // suppress an unrelated warning
o.ClientCA = "LS0tIEZBS0UgQ0EgQ0VSVCAtLS0="
err := o.Validate()
require.NoError(t, err)
assert.Equal(t, "LS0tIEZBS0UgQ0EgQ0VSVCAtLS0=", o.DownstreamMTLS.CA)
assert.Equal(t, `{"level":"warn","message":"config: client_ca is deprecated, set downstream_mtls.ca instead"}
`,
logOutput.String())
})
t.Run("CAFile", func(t *testing.T) {
logOutput.Reset()
o := NewDefaultOptions()
o.AutocertOptions.Enable = true // suppress an unrelated warning
o.ClientCAFile = caFile
err := o.Validate()
require.NoError(t, err)
assert.Equal(t, caFile, o.DownstreamMTLS.CAFile)
assert.Equal(t, `{"level":"warn","message":"config: client_ca_file is deprecated, set downstream_mtls.ca_file instead"}
`,
logOutput.String())
})
}
func TestOptions_DefaultURL(t *testing.T) {