mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-18 22:14:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Introduce type alias CABundleHash for the hash of a CA bundle ([32]byte)

Browse Source 
Co-authored-by: Ryan Richard <richardry@vmware.com>
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com>
This commit is contained in:
Joshua Casey
2024-08-05 11:32:20 -07:00
committed by Ryan Richard
co-authored by Ryan Richard Ashish Amarnath
parent 99cfc4fbce
commit a888083c50
15 changed files with 185 additions and 179 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/controller/supervisorconfig/activedirectoryupstreamwatcher/active_directory_upstream_watcher_test.go
+32 -32
View File
@@ -5,7 +5,6 @@ package activedirectoryupstreamwatcher
import (
"context"
"crypto/sha256"
"encoding/base64"
"errors"
"fmt"
@@ -28,6 +27,7 @@ import (
supervisorinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions"
"go.pinniped.dev/internal/certauthority"
"go.pinniped.dev/internal/controller/supervisorconfig/upstreamwatchers"
"go.pinniped.dev/internal/controller/tlsconfigutil"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/endpointaddr"
"go.pinniped.dev/internal/federationdomain/dynamicupstreamprovider"
@@ -237,7 +237,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
testGroupSearchNameAttrName = "test-group-name-attr"
caBundleConfigMapName = "test-ca-bundle-cm"
caBundleSecretName = "test-ca-bundle-secret"
caBundleSecretName = "test-ca-bundle-secret" //nolint:gosec // this is not a credential
)
testValidSecretData := map[string][]byte{"username": []byte(testBindUsername), "password": []byte(testBindPassword)}
@@ -517,7 +517,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -544,7 +544,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -571,7 +571,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -599,7 +599,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -800,7 +800,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(nil),
CABundleHash: tlsconfigutil.NewCABundleHash(nil),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -871,7 +871,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(nil),
CABundleHash: tlsconfigutil.NewCABundleHash(nil),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -948,7 +948,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
IDPSpecGeneration: 1234,
CABundlePEMSHA256: sha256.Sum256(testCABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(testCABundle),
ConnectionValidCondition: &metav1.Condition{
Type: "LDAPConnectionValid",
Status: "True",
@@ -1083,7 +1083,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(nil),
CABundleHash: tlsconfigutil.NewCABundleHash(nil),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -1136,7 +1136,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -1298,7 +1298,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -1319,7 +1319,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -1391,7 +1391,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
BindSecretResourceVersion: "4242",
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: exampleDefaultNamingContext,
CABundlePEMSHA256: sha256.Sum256(testCABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(testCABundle),
GroupSearchBase: testGroupSearchBase,
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
@@ -1414,7 +1414,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: exampleDefaultNamingContext,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(testCABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(testCABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInRootDSECondition(0))),
@@ -1467,7 +1467,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: exampleDefaultNamingContext,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(testCABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(testCABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInRootDSECondition(0))),
@@ -1487,7 +1487,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
BindSecretResourceVersion: "4242",
LDAPConnectionProtocol: upstreamldap.StartTLS,
IDPSpecGeneration: 1234,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithStartTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithStartTLS.CABundle),
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
@@ -1509,7 +1509,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.StartTLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithStartTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithStartTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -1529,7 +1529,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1233,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -1552,7 +1552,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -1573,7 +1573,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
IDPSpecGeneration: 1234,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")), // already previously validated with version 4242
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
}},
@@ -1594,7 +1594,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -1634,7 +1634,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -1654,7 +1654,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4241")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -1677,7 +1677,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -1739,7 +1739,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(testCABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(testCABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
@@ -1805,7 +1805,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: exampleDefaultNamingContext,
GroupSearchBase: exampleDefaultNamingContext,
CABundlePEMSHA256: sha256.Sum256(testCABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(testCABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInRootDSECondition(0))),
@@ -1870,7 +1870,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: exampleDefaultNamingContext,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(testCABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(testCABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInRootDSECondition(0))),
@@ -1935,7 +1935,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: exampleDefaultNamingContext,
CABundlePEMSHA256: sha256.Sum256(testCABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(testCABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInRootDSECondition(0))),
@@ -2092,7 +2092,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(testCABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(testCABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4241")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInRootDSECondition(0))),
@@ -2149,7 +2149,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
GroupSearchBase: exampleDefaultNamingContext,
UserSearchBase: testUserSearchBase,
CABundlePEMSHA256: sha256.Sum256(testCABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(testCABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInRootDSECondition(0))),
@@ -2220,7 +2220,7 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(testCABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(testCABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(activeDirectoryConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
SearchBaseFoundCondition: condPtr(withoutTime(searchBaseFoundInConfigCondition(0))),
internal/controller/supervisorconfig/githubupstreamwatcher/github_upstream_watcher.go
+16 -21
View File
@@ -6,9 +6,7 @@ package githubupstreamwatcher
import (
"context"
"crypto/sha256"
"crypto/tls"
"crypto/x509"
"errors"
"fmt"
"net"
@@ -74,8 +72,8 @@ type UpstreamGitHubIdentityProviderICache interface {
}
type GitHubValidatedAPICacheI interface {
MarkAsValidated(address string, caBundlePEM []byte)
IsValid(address string, caBundlePEM []byte) bool
MarkAsValidated(address string, caBundleHash tlsconfigutil.CABundleHash)
IsValid(address string, caBundleHash tlsconfigutil.CABundleHash) bool
}
type GitHubValidatedAPICache struct {
@@ -83,24 +81,24 @@ type GitHubValidatedAPICache struct {
}
type GitHubValidatedAPICacheKey struct {
address string
caBundlePEMSHA256 [32]byte
address string
caBundleHash tlsconfigutil.CABundleHash
}
func (g *GitHubValidatedAPICache) MarkAsValidated(address string, caBundlePEM []byte) {
func (g *GitHubValidatedAPICache) MarkAsValidated(address string, caBundleHash tlsconfigutil.CABundleHash) {
key := GitHubValidatedAPICacheKey{
address: address,
caBundlePEMSHA256: sha256.Sum256(caBundlePEM),
address: address,
caBundleHash: caBundleHash,
}
// Existence in the cache means it has been validated.
// The TTL in the cache is not important, it's just a "really long time".
g.cache.Set(key, nil, 365*24*time.Hour)
}
func (g *GitHubValidatedAPICache) IsValid(address string, caBundlePEM []byte) bool {
func (g *GitHubValidatedAPICache) IsValid(address string, caBundleHash tlsconfigutil.CABundleHash) bool {
key := GitHubValidatedAPICacheKey{
address: address,
caBundlePEMSHA256: sha256.Sum256(caBundlePEM),
address: address,
caBundleHash: caBundleHash,
}
_, ok := g.cache.Get(key)
return ok
@@ -335,8 +333,7 @@ func (c *gitHubWatcherController) validateUpstreamAndUpdateConditions(ctx contro
githubConnectionCondition, hostURL, httpClient, githubConnectionErr := c.validateGitHubConnection(
hostPort,
caBundle.PEMBytes(),
caBundle.CertPool(),
caBundle,
hostCondition.Status == metav1.ConditionTrue,
tlsConfigCondition.Status == metav1.ConditionTrue,
)
@@ -425,11 +422,9 @@ func validateHost(gitHubAPIConfig idpv1alpha1.GitHubAPIConfig) (*metav1.Conditio
}, &hostPort
}
// TODO: this should take in a tlsconfigutil.CABundle
func (c *gitHubWatcherController) validateGitHubConnection(
hostPort *endpointaddr.HostPort,
caBundlePEM []byte,
certPool *x509.CertPool,
caBundle *tlsconfigutil.CABundle,
hostConditionOk, tlsConfigConditionOk bool,
) (*metav1.Condition, string, *http.Client, error) {
if !hostConditionOk || !tlsConfigConditionOk {
@@ -443,8 +438,8 @@ func (c *gitHubWatcherController) validateGitHubConnection(
address := hostPort.Endpoint()
if !c.validatedCache.IsValid(address, caBundlePEM) {
conn, tlsDialErr := c.dialFunc("tcp", address, ptls.Default(certPool))
if !c.validatedCache.IsValid(address, caBundle.Hash()) {
conn, tlsDialErr := c.dialFunc("tcp", address, ptls.Default(caBundle.CertPool()))
if tlsDialErr != nil {
return &metav1.Condition{
Type: GitHubConnectionValid,
@@ -457,14 +452,14 @@ func (c *gitHubWatcherController) validateGitHubConnection(
_ = conn.Close()
}
c.validatedCache.MarkAsValidated(address, caBundlePEM)
c.validatedCache.MarkAsValidated(address, caBundle.Hash())
return &metav1.Condition{
Type: GitHubConnectionValid,
Status: metav1.ConditionTrue,
Reason: conditionsutil.ReasonSuccess,
Message: fmt.Sprintf("spec.githubAPI.host (%q) is reachable and TLS verification succeeds", address),
}, fmt.Sprintf("https://%s", address), phttp.Default(certPool), nil
}, fmt.Sprintf("https://%s", address), phttp.Default(caBundle.CertPool()), nil
}
// buildDialErrorMessage standardizes DNS error messages that appear differently on different platforms, so that tests and log grepping is uniform.
internal/controller/supervisorconfig/githubupstreamwatcher/github_upstream_watcher_test.go
+17 -17
View File
@@ -6,7 +6,6 @@ package githubupstreamwatcher
import (
"bytes"
"context"
"crypto/sha256"
"crypto/tls"
"crypto/x509"
"encoding/base64"
@@ -40,6 +39,7 @@ import (
"go.pinniped.dev/internal/certauthority"
"go.pinniped.dev/internal/controller/conditionsutil"
"go.pinniped.dev/internal/controller/supervisorconfig/upstreamwatchers"
"go.pinniped.dev/internal/controller/tlsconfigutil"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/federationdomain/dynamicupstreamprovider"
"go.pinniped.dev/internal/federationdomain/upstreamprovider"
@@ -451,8 +451,8 @@ func TestController(t *testing.T) {
},
wantValidatedCache: []GitHubValidatedAPICacheKey{
{
address: goodServerDomain,
caBundlePEMSHA256: sha256.Sum256(goodServerCA),
address: goodServerDomain,
caBundleHash: tlsconfigutil.NewCABundleHash(goodServerCA),
},
},
wantResultingUpstreams: []idpv1alpha1.GitHubIdentityProvider{
@@ -513,8 +513,8 @@ func TestController(t *testing.T) {
},
wantValidatedCache: []GitHubValidatedAPICacheKey{
{
address: goodServerDomain,
caBundlePEMSHA256: sha256.Sum256(goodServerCA),
address: goodServerDomain,
caBundleHash: tlsconfigutil.NewCABundleHash(goodServerCA),
},
},
wantResultingUpstreams: []idpv1alpha1.GitHubIdentityProvider{
@@ -591,8 +591,8 @@ func TestController(t *testing.T) {
},
wantValidatedCache: []GitHubValidatedAPICacheKey{
{
address: "github.com:443",
caBundlePEMSHA256: sha256.Sum256(goodServerCA),
address: "github.com:443",
caBundleHash: tlsconfigutil.NewCABundleHash(goodServerCA),
},
},
wantResultingUpstreams: []idpv1alpha1.GitHubIdentityProvider{
@@ -665,8 +665,8 @@ func TestController(t *testing.T) {
},
wantValidatedCache: []GitHubValidatedAPICacheKey{
{
address: goodServerIPv6Domain,
caBundlePEMSHA256: sha256.Sum256(goodServerIPv6CA),
address: goodServerIPv6Domain,
caBundleHash: tlsconfigutil.NewCABundleHash(goodServerIPv6CA),
},
},
wantResultingUpstreams: []idpv1alpha1.GitHubIdentityProvider{
@@ -780,8 +780,8 @@ func TestController(t *testing.T) {
},
wantValidatedCache: []GitHubValidatedAPICacheKey{
{
address: goodServerDomain,
caBundlePEMSHA256: sha256.Sum256(goodServerCA),
address: goodServerDomain,
caBundleHash: tlsconfigutil.NewCABundleHash(goodServerCA),
},
},
wantResultingUpstreams: []idpv1alpha1.GitHubIdentityProvider{
@@ -961,8 +961,8 @@ func TestController(t *testing.T) {
},
wantValidatedCache: []GitHubValidatedAPICacheKey{
{
address: goodServerDomain,
caBundlePEMSHA256: sha256.Sum256(goodServerCA),
address: goodServerDomain,
caBundleHash: tlsconfigutil.NewCABundleHash(goodServerCA),
},
},
wantResultingUpstreams: []idpv1alpha1.GitHubIdentityProvider{
@@ -1058,8 +1058,8 @@ func TestController(t *testing.T) {
},
preexistingValidatedCache: []GitHubValidatedAPICacheKey{
{
address: goodServerDomain,
caBundlePEMSHA256: sha256.Sum256(goodServerCA),
address: goodServerDomain,
caBundleHash: tlsconfigutil.NewCABundleHash(goodServerCA),
},
},
wantResultingCache: []*upstreamgithub.ProviderConfig{
@@ -1087,8 +1087,8 @@ func TestController(t *testing.T) {
},
wantValidatedCache: []GitHubValidatedAPICacheKey{
{
address: goodServerDomain,
caBundlePEMSHA256: sha256.Sum256(goodServerCA),
address: goodServerDomain,
caBundleHash: tlsconfigutil.NewCABundleHash(goodServerCA),
},
},
wantResultingUpstreams: []idpv1alpha1.GitHubIdentityProvider{
internal/controller/supervisorconfig/ldapupstreamwatcher/ldap_upstream_watcher_test.go
+22 -22
View File
@@ -5,7 +5,6 @@ package ldapupstreamwatcher
import (
"context"
"crypto/sha256"
"encoding/base64"
"errors"
"fmt"
@@ -27,6 +26,7 @@ import (
supervisorinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions"
"go.pinniped.dev/internal/certauthority"
"go.pinniped.dev/internal/controller/supervisorconfig/upstreamwatchers"
"go.pinniped.dev/internal/controller/tlsconfigutil"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/endpointaddr"
"go.pinniped.dev/internal/federationdomain/dynamicupstreamprovider"
@@ -236,7 +236,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
testGroupSearchNameAttrName = "test-group-name-attr"
caBundleConfigMapName = "test-ca-bundle-cm"
caBundleSecretName = "test-ca-bundle-secret"
caBundleSecretName = "test-ca-bundle-secret" //nolint:gosec // this is not a credential
)
testValidSecretData := map[string][]byte{"username": []byte(testBindUsername), "password": []byte(testBindPassword)}
@@ -447,7 +447,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
@@ -474,7 +474,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
@@ -501,7 +501,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
@@ -528,7 +528,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
@@ -721,7 +721,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(nil),
CABundleHash: tlsconfigutil.NewCABundleHash(nil),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
@@ -789,7 +789,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.StartTLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(testCABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(testCABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: &metav1.Condition{
Type: "LDAPConnectionValid",
@@ -910,7 +910,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(nil),
CABundleHash: tlsconfigutil.NewCABundleHash(nil),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
@@ -962,7 +962,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
@@ -1015,7 +1015,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
@@ -1035,7 +1035,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
@@ -1054,7 +1054,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.StartTLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithStartTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithStartTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
@@ -1074,7 +1074,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.StartTLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithStartTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithStartTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
@@ -1092,7 +1092,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
BindSecretResourceVersion: "4242",
LDAPConnectionProtocol: upstreamldap.TLS,
IDPSpecGeneration: 1233,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
}},
@@ -1114,7 +1114,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
@@ -1134,7 +1134,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
IDPSpecGeneration: 1234,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")), // already previously validated with version 4242
}},
setupMocks: func(conn *mockldapconn.MockConn) {
@@ -1154,7 +1154,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
@@ -1193,7 +1193,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
@@ -1237,7 +1237,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
@@ -1276,7 +1276,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(providerConfigForValidUpstreamWithTLS.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(providerConfigForValidUpstreamWithTLS.CABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}}},
@@ -1338,7 +1338,7 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
LDAPConnectionProtocol: upstreamldap.TLS,
UserSearchBase: testUserSearchBase,
GroupSearchBase: testGroupSearchBase,
CABundlePEMSHA256: sha256.Sum256(testCABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(testCABundle),
IDPSpecGeneration: 1234,
ConnectionValidCondition: condPtr(ldapConnectionValidTrueConditionWithoutTimeOrGeneration("4242")),
}},
internal/controller/supervisorconfig/oidcupstreamwatcher/oidc_upstream_watcher.go
+2 -2
View File
@@ -96,7 +96,7 @@ type UpstreamOIDCIdentityProviderICache interface {
// oidcDiscoveryCacheKey is the type of keys in an oidcDiscoveryCache.
type oidcDiscoveryCacheKey struct {
issuer string
caBundleHash [32]byte
caBundleHash tlsconfigutil.CABundleHash
}
// oidcDiscoveryCacheValue is the type of cache entries in an oidcDiscoveryCache.
@@ -359,7 +359,7 @@ func (c *oidcWatcherController) validateIssuer(ctx context.Context, upstream *id
// Get the discovered provider and HTTP client from cache, if they are found in the cache.
cacheKey := oidcDiscoveryCacheKey{
issuer: upstream.Spec.Issuer,
caBundleHash: caBundle.Hash(), // note that this will always return the same hash for nil input
caBundleHash: caBundle.Hash(),
}
if cacheEntry := c.validatorCache.getProvider(cacheKey); cacheEntry != nil {
discoveredProvider = cacheEntry.provider
internal/controller/supervisorconfig/oidcupstreamwatcher/oidc_upstream_watcher_test.go
+2 -2
View File
@@ -6,7 +6,6 @@ package oidcupstreamwatcher
import (
"bytes"
"context"
"crypto/sha256"
"crypto/x509"
"encoding/base64"
"encoding/json"
@@ -32,6 +31,7 @@ import (
supervisorfake "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake"
supervisorinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions"
"go.pinniped.dev/internal/certauthority"
"go.pinniped.dev/internal/controller/tlsconfigutil"
"go.pinniped.dev/internal/controllerlib"
"go.pinniped.dev/internal/federationdomain/dynamicupstreamprovider"
"go.pinniped.dev/internal/federationdomain/upstreamprovider"
@@ -1114,7 +1114,7 @@ func TestOIDCUpstreamWatcherControllerSync(t *testing.T) {
// without encountering any errors.
cacheKey := oidcDiscoveryCacheKey{
issuer: testIssuerURL + "/this-path-does-not-exist",
caBundleHash: sha256.Sum256([]byte(testIssuerCA)),
caBundleHash: tlsconfigutil.NewCABundleHash([]byte(testIssuerCA)),
}
// Put it into the initial cache for this test.
return map[oidcDiscoveryCacheKey]*oidcDiscoveryCacheValue{
internal/controller/supervisorconfig/upstreamwatchers/upstream_watchers.go
+5 -6
View File
@@ -5,7 +5,6 @@ package upstreamwatchers
import (
"context"
"crypto/sha256"
"fmt"
"time"
@@ -41,9 +40,9 @@ const (
// ValidatedSettings is the struct which is cached by the ValidatedSettingsCacheI interface.
type ValidatedSettings struct {
IDPSpecGeneration int64 // which IDP spec was used during the validation
BindSecretResourceVersion string // which bind secret was used during the validation
CABundlePEMSHA256 [32]byte // hash of the CA bundle used during the validation
IDPSpecGeneration int64 // which IDP spec was used during the validation
BindSecretResourceVersion string // which bind secret was used during the validation
CABundleHash tlsconfigutil.CABundleHash // hash of the CA bundle used during the validation
// Cache the setting for TLS vs StartTLS. This is always auto-discovered by probing the server.
LDAPConnectionProtocol upstreamldap.LDAPConnectionProtocol
@@ -285,7 +284,7 @@ func validateAndSetLDAPServerConnectivityAndSearchBase(
if hasPreviousValidatedSettings &&
validatedSettings.UserSearchBase != "" &&
validatedSettings.GroupSearchBase != "" &&
validatedSettings.CABundlePEMSHA256 == sha256.Sum256(config.CABundle) {
validatedSettings.CABundleHash.Equal(tlsconfigutil.NewCABundleHash(config.CABundle)) {
// Found previously validated settings in the cache (which is also not missing search base fields), so use them.
config.ConnectionProtocol = validatedSettings.LDAPConnectionProtocol
config.UserSearch.Base = validatedSettings.UserSearchBase
@@ -313,7 +312,7 @@ func validateAndSetLDAPServerConnectivityAndSearchBase(
validatedSettingsCache.Set(upstream.Name(), ValidatedSettings{
IDPSpecGeneration: upstream.Generation(),
BindSecretResourceVersion: currentSecretVersion,
CABundlePEMSHA256: sha256.Sum256(config.CABundle),
CABundleHash: tlsconfigutil.NewCABundleHash(config.CABundle),
LDAPConnectionProtocol: config.ConnectionProtocol,
UserSearchBase: config.UserSearch.Base,
GroupSearchBase: config.GroupSearch.Base,