return auto_encrypt cert for listeners #6489

hanshasselberg · 2019-09-16T13:05:10Z

banks · 2019-09-16T13:26:22Z

tlsutil/config.go

-		return c.manual.cert, nil
+		cert := c.manual.cert
+		if cert == nil {
+			cert = c.autoEncrypt.cert


can c.autoEncrypt ever be nil? If it is this will panic.

NewConfigurator initializes it:

consul/tlsutil/config.go

Lines 169 to 176 in ef52147

func NewConfigurator(config Config, logger *log.Logger) (*Configurator, error) {

c := &Configurator{logger: logger, manual: &manual{}, autoEncrypt: &autoEncrypt{}}

err := c.Update(config)

if err != nil {

return nil, err

}

return c, nil

}

.

banks

Couple of points in tests but the code looks good.

One inline but a meta one: the significant behaviour change here is in GetCertificate yet the tests have no diff that mentions that method? How are we testing the actual change here that GetCertificate now returns auto TLS?

banks · 2019-09-18T15:33:21Z

tlsutil/config_test.go

+	require.NoError(t, err)
+	require.Equal(t, c.autoEncrypt.cert, cert)
+
+	c.manual.cert = &tls.Certificate{Certificate: [][]byte{}}


Should we add some actual payload to this Certificate that means it can't accidentally compare equal to the auto one above due to deep-equals rather than exact pointer checking?

I'm actually not sure this assertion prooves anything currently because I think it would still pass even if we were returning the auto cert not the manual cert after this since they both have equivalent values and require.Equal does a deep equality not a pointer match IIRC.

Making them obviously different would make the intent of this test clearer too.

hanshasselberg · 2019-09-23T10:31:37Z

Thanks for the review @banks! I addressed your points and made the tests more meaningful. And improved the code as well.

hanshasselberg · 2019-09-23T10:32:26Z

tlsutil/config.go

@@ -351,7 +351,7 @@ func (c *Config) baseVerifyIncoming() bool {

 func loadKeyPair(certFile, keyFile string) (*tls.Certificate, error) {
 	if certFile == "" || keyFile == "" {
-		return &tls.Certificate{}, nil
+		return nil, nil


Returning an empty cert here led to all kinds of strange things. This is gone now for good.

banks

Changes look good to me. I realise @i0rek is not likely to be around to make the small comment tweak suggested here or merge but we can find someone else who can hopefully!

banks · 2019-09-23T15:21:36Z

tlsutil/config_test.go

+	require.NoError(t, err)
+	require.Equal(t, c.autoEncrypt.cert, cert)
+
+	c2, err := loadKeyPair("../test/key/ourdomain.cer", "../test/key/ourdomain.key")


nit: this test looks good now but it might not be obvious to future us exactly what the signficance f this behaviour is.

Maybe add comments that adding one cert as the auto_encrypt one gets returned as the regular server cert above and then that loading a different one as well as the "manual" cert means we still server the manual one not the auto-encrypt one.

…manual certificates

for empty string certFile or keyFile arg

* fix cert check * fix lock * add tests * test: add comments describing expected behavior for auto-encrypt and manual certificates * test: expect nil *tls.Certificate for empty string certFile or keyFile arg

ghost · 2020-01-25T02:19:03Z

Hey there,

This issue has been automatically locked because it is closed and there hasn't been any activity for at least 30 days.

If you are still experiencing problems, or still have questions, feel free to open a new one 👍.

banks reviewed Sep 16, 2019

View reviewed changes

hanshasselberg requested a review from a team September 17, 2019 12:40

hanshasselberg mentioned this pull request Sep 17, 2019

Use certificates generated by auto_encrypt for HTTPS API and not only RPC #6403

Closed

banks requested changes Sep 18, 2019

View reviewed changes

hanshasselberg commented Sep 23, 2019

View reviewed changes

banks approved these changes Sep 23, 2019

View reviewed changes

mikemorris self-assigned this Sep 23, 2019

banks added the backport/1.6 label Oct 17, 2019

hanshasselberg and others added 7 commits November 12, 2019 11:53

return auto_encrypt cert for listeners

531fda6

fix cert check

4888a4a

fix lock

53778c4

add tests

d1be52e

improve tests

b867448

remove strange condition

13be5f2

test: add comments describing expected behavior for auto-encrypt and …

d28773e

…manual certificates

mikemorris force-pushed the auto_encrypt_get_cert branch from 4ce1363 to d28773e Compare November 12, 2019 16:59

mikemorris requested a review from banks November 12, 2019 16:59

test: expect nil *tls.Certificate

9f18bc4

for empty string certFile or keyFile arg

mikemorris force-pushed the auto_encrypt_get_cert branch from 9528c02 to 9f18bc4 Compare November 12, 2019 18:03

mikemorris merged commit a3f4910 into master Nov 12, 2019

mikemorris deleted the auto_encrypt_get_cert branch November 12, 2019 18:40

mikemorris added a commit that referenced this pull request Nov 12, 2019

Update CHANGELOG.md (#6489)

4f29a22

mikemorris added a commit that referenced this pull request Nov 12, 2019

Update CHANGELOG.md (#6489)

d449b80

hanshasselberg mentioned this pull request Nov 14, 2019

Client agent not starting when auto_encrypt.tls enabled #6398

Closed

hanshasselberg mentioned this pull request Dec 13, 2019

Auto encrypt k8s #6944

Merged

2 tasks

ghost locked and limited conversation to collaborators Jan 25, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

return auto_encrypt cert for listeners #6489

return auto_encrypt cert for listeners #6489

hanshasselberg commented Sep 16, 2019 •

edited by mikemorris

Loading

banks Sep 16, 2019

hanshasselberg Sep 16, 2019

banks left a comment

banks Sep 18, 2019

hanshasselberg commented Sep 23, 2019

hanshasselberg Sep 23, 2019

banks left a comment

banks Sep 23, 2019

ghost commented Jan 25, 2020

	func NewConfigurator(config Config, logger log.Logger) (Configurator, error) {
	c := &Configurator{logger: logger, manual: &manual{}, autoEncrypt: &autoEncrypt{}}
	err := c.Update(config)
	if err != nil {
	return nil, err
	}
	return c, nil
	}

return auto_encrypt cert for listeners #6489

return auto_encrypt cert for listeners #6489

Conversation

hanshasselberg commented Sep 16, 2019 • edited by mikemorris Loading

banks Sep 16, 2019

Choose a reason for hiding this comment

hanshasselberg Sep 16, 2019

Choose a reason for hiding this comment

banks left a comment

Choose a reason for hiding this comment

banks Sep 18, 2019

Choose a reason for hiding this comment

hanshasselberg commented Sep 23, 2019

hanshasselberg Sep 23, 2019

Choose a reason for hiding this comment

banks left a comment

Choose a reason for hiding this comment

banks Sep 23, 2019

Choose a reason for hiding this comment

ghost commented Jan 25, 2020

hanshasselberg commented Sep 16, 2019 •

edited by mikemorris

Loading