From 8c081c50d4f16e9cb429f2f3d1421952747bbb6d Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Thu, 18 Apr 2024 12:55:49 -0700 Subject: [PATCH] Use ptls package to determine TLS config when probing webhook for status --- .../webhookcachefiller/webhookcachefiller.go | 7 ++-- .../webhookcachefiller_test.go | 36 +++++++++++-------- 2 files changed, 23 insertions(+), 20 deletions(-) diff --git a/internal/controller/authenticator/webhookcachefiller/webhookcachefiller.go b/internal/controller/authenticator/webhookcachefiller/webhookcachefiller.go index a6ebd96a9..d1bc470a8 100644 --- a/internal/controller/authenticator/webhookcachefiller/webhookcachefiller.go +++ b/internal/controller/authenticator/webhookcachefiller/webhookcachefiller.go @@ -34,6 +34,7 @@ import ( "go.pinniped.dev/internal/controller/authenticator/authncache" "go.pinniped.dev/internal/controller/conditionsutil" "go.pinniped.dev/internal/controllerlib" + "go.pinniped.dev/internal/crypto/ptls" "go.pinniped.dev/internal/endpointaddr" "go.pinniped.dev/internal/plog" ) @@ -282,11 +283,7 @@ func (c *webhookCacheFillerController) validateConnection(certPool *x509.CertPoo return conditions, nil } - conn, err := c.tlsDialerFunc("tcp", endpointHostPort.Endpoint(), &tls.Config{ - MinVersion: tls.VersionTLS12, - // If certPool is nil then RootCAs will be set to nil and TLS will use the host's root CA set automatically. - RootCAs: certPool, - }) + conn, err := c.tlsDialerFunc("tcp", endpointHostPort.Endpoint(), ptls.Default(certPool)) if err != nil { errText := "cannot dial server" diff --git a/internal/controller/authenticator/webhookcachefiller/webhookcachefiller_test.go b/internal/controller/authenticator/webhookcachefiller/webhookcachefiller_test.go index 081603236..21c53dba3 100644 --- a/internal/controller/authenticator/webhookcachefiller/webhookcachefiller_test.go +++ b/internal/controller/authenticator/webhookcachefiller/webhookcachefiller_test.go @@ -897,10 +897,12 @@ func TestController(t *testing.T) { tlsDialerFunc: func(network string, addr string, config *tls.Config) (*tls.Conn, error) { assert.Equal(t, "tcp", network) assert.Equal(t, "[0:0:0:0:0:0:0:1]:4242", addr) + defaultTLSConfig := ptls.Default(nil) assert.True(t, caForLocalhostAs127001.Pool().Equal(config.RootCAs)) - assert.Equal(t, uint16(tls.VersionTLS12), config.MinVersion) - - return nil, errors.New("IPv6 test fake error to skip real dial in prod code, this is actually success") + assert.Equal(t, defaultTLSConfig.MinVersion, config.MinVersion) + assert.Equal(t, defaultTLSConfig.CipherSuites, config.CipherSuites) + assert.Equal(t, defaultTLSConfig.NextProtos, config.NextProtos) + return nil, errors.New("IPv6 fake dial error") }, webhooks: []runtime.Object{ &auth1alpha1.WebhookAuthenticator{ @@ -930,7 +932,7 @@ func TestController(t *testing.T) { Conditions: conditionstestutil.Replace( allHappyConditionsSuccess("https://[0:0:0:0:0:0:0:1]:4242/some/fake/path", frozenMetav1Now, 0), []metav1.Condition{ - sadWebhookConnectionValidWithMessage(frozenMetav1Now, 0, "cannot dial server: IPv6 test fake error to skip real dial in prod code, this is actually success"), + sadWebhookConnectionValidWithMessage(frozenMetav1Now, 0, "cannot dial server: IPv6 fake dial error"), sadReadyCondition(frozenMetav1Now, 0), unknownAuthenticatorValid(frozenMetav1Now, 0), }, @@ -945,7 +947,7 @@ func TestController(t *testing.T) { updateStatusAction, } }, - wantSyncLoopErr: testutil.WantExactErrorString(`cannot dial server: IPv6 test fake error to skip real dial in prod code, this is actually success`), + wantSyncLoopErr: testutil.WantExactErrorString(`cannot dial server: IPv6 fake dial error`), wantCacheEntries: 0, }, { @@ -954,10 +956,12 @@ func TestController(t *testing.T) { tlsDialerFunc: func(network string, addr string, config *tls.Config) (*tls.Conn, error) { assert.Equal(t, "tcp", network) assert.Equal(t, "[0:0:0:0:0:0:0:1]:443", addr, "should add default port when port not provided") + defaultTLSConfig := ptls.Default(nil) assert.True(t, caForLocalhostAs127001.Pool().Equal(config.RootCAs)) - assert.Equal(t, uint16(tls.VersionTLS12), config.MinVersion) - - return nil, errors.New("IPv6 test fake error to skip real dial in prod code, this is actually success") + assert.Equal(t, defaultTLSConfig.MinVersion, config.MinVersion) + assert.Equal(t, defaultTLSConfig.CipherSuites, config.CipherSuites) + assert.Equal(t, defaultTLSConfig.NextProtos, config.NextProtos) + return nil, errors.New("IPv6 fake dial error") }, webhooks: []runtime.Object{ &auth1alpha1.WebhookAuthenticator{ @@ -987,7 +991,7 @@ func TestController(t *testing.T) { Conditions: conditionstestutil.Replace( allHappyConditionsSuccess("https://[0:0:0:0:0:0:0:1]/some/fake/path", frozenMetav1Now, 0), []metav1.Condition{ - sadWebhookConnectionValidWithMessage(frozenMetav1Now, 0, "cannot dial server: IPv6 test fake error to skip real dial in prod code, this is actually success"), + sadWebhookConnectionValidWithMessage(frozenMetav1Now, 0, "cannot dial server: IPv6 fake dial error"), sadReadyCondition(frozenMetav1Now, 0), unknownAuthenticatorValid(frozenMetav1Now, 0), }, @@ -1002,7 +1006,7 @@ func TestController(t *testing.T) { updateStatusAction, } }, - wantSyncLoopErr: testutil.WantExactErrorString(`cannot dial server: IPv6 test fake error to skip real dial in prod code, this is actually success`), + wantSyncLoopErr: testutil.WantExactErrorString(`cannot dial server: IPv6 fake dial error`), wantCacheEntries: 0, }, { @@ -1094,10 +1098,12 @@ func TestController(t *testing.T) { tlsDialerFunc: func(network string, addr string, config *tls.Config) (*tls.Conn, error) { assert.Equal(t, "tcp", network) assert.Equal(t, "[0:0:0:0:0:0:0:1]:443", addr) + defaultTLSConfig := ptls.Default(nil) assert.True(t, caForLocalhostAs127001.Pool().Equal(config.RootCAs)) - assert.Equal(t, uint16(tls.VersionTLS12), config.MinVersion) - - return nil, errors.New("IPv6 test fake error to skip real dial in prod code, this is actually success") + assert.Equal(t, defaultTLSConfig.MinVersion, config.MinVersion) + assert.Equal(t, defaultTLSConfig.CipherSuites, config.CipherSuites) + assert.Equal(t, defaultTLSConfig.NextProtos, config.NextProtos) + return nil, errors.New("IPv6 fake dial error") }, webhooks: []runtime.Object{ &auth1alpha1.WebhookAuthenticator{ @@ -1127,7 +1133,7 @@ func TestController(t *testing.T) { Conditions: conditionstestutil.Replace( allHappyConditionsSuccess("https://0:0:0:0:0:0:0:1/some/fake/path", frozenMetav1Now, 0), []metav1.Condition{ - sadWebhookConnectionValidWithMessage(frozenMetav1Now, 0, "cannot dial server: IPv6 test fake error to skip real dial in prod code, this is actually success"), + sadWebhookConnectionValidWithMessage(frozenMetav1Now, 0, "cannot dial server: IPv6 fake dial error"), sadReadyCondition(frozenMetav1Now, 0), unknownAuthenticatorValid(frozenMetav1Now, 0), }, @@ -1142,7 +1148,7 @@ func TestController(t *testing.T) { updateStatusAction, } }, - wantSyncLoopErr: testutil.WantExactErrorString(`cannot dial server: IPv6 test fake error to skip real dial in prod code, this is actually success`), + wantSyncLoopErr: testutil.WantExactErrorString(`cannot dial server: IPv6 fake dial error`), wantCacheEntries: 0, }, {