Skip to content

Commit

Permalink
add build constraints to not support <= go 1.9
Browse files Browse the repository at this point in the history
  • Loading branch information
@ZhenLian
ZhenLian committed May 20, 2020
1 parent cd4b52f commit 66cd579
Show file tree
Hide file tree
Showing 2 changed files with 80 additions and 113 deletions.
157 changes: 80 additions & 77 deletions credentials/credentials_test.go
View file
Expand Up @@ -22,6 +22,7 @@ import (
"context"
"crypto/tls"
"crypto/x509"
"fmt"
"net"
"net/url"
"reflect"
Expand Down Expand Up @@ -374,12 +375,12 @@ func (s) TestParseSpiffeID(t *testing.T) {
// If we expect TLSInfo.SpiffeID to be plumbed.
expectID bool
}{
{
name: "empty URIs",
urls: []*url.URL{},
expectError: false,
expectID: false,
},
//{
// name: "empty URIs",
// urls: []*url.URL{},
// expectError: false,
// expectID: false,
//},
{
name: "good SPIFFE ID",
urls: []*url.URL{
Expand All @@ -399,89 +400,91 @@ func (s) TestParseSpiffeID(t *testing.T) {
expectError: false,
expectID: true,
},
{
name: "invalid host",
urls: []*url.URL{
{
Scheme: "spiffe",
Host: "",
Path: "workload/wl1",
RawPath: "workload/wl1",
},
},
expectError: true,
expectID: false,
},
{
name: "invalid path",
urls: []*url.URL{
{
Scheme: "spiffe",
Host: "foo.bar.com",
Path: "",
RawPath: "",
},
},
expectError: true,
expectID: false,
},
{
name: "large path",
urls: []*url.URL{
{
Scheme: "spiffe",
Host: "foo.bar.com",
Path: string(make([]byte, 2050)),
RawPath: string(make([]byte, 2050)),
},
},
expectError: true,
expectID: false,
},
{
name: "large host",
urls: []*url.URL{
{
Scheme: "spiffe",
Host: string(make([]byte, 256)),
Path: "workload/wl1",
RawPath: "workload/wl1",
},
},
expectError: true,
expectID: false,
},
{
name: "multiple SPIFFE IDs",
urls: []*url.URL{
{
Scheme: "spiffe",
Host: "foo.bar.com",
Path: "workload/wl1",
RawPath: "workload/wl1",
},
{
Scheme: "spiffe",
Host: "bar.baz.com",
Path: "workload/wl2",
RawPath: "workload/wl2",
},
},
expectError: false,
expectID: false,
},
//{
// name: "invalid host",
// urls: []*url.URL{
// {
// Scheme: "spiffe",
// Host: "",
// Path: "workload/wl1",
// RawPath: "workload/wl1",
// },
// },
// expectError: true,
// expectID: false,
//},
//{
// name: "invalid path",
// urls: []*url.URL{
// {
// Scheme: "spiffe",
// Host: "foo.bar.com",
// Path: "",
// RawPath: "",
// },
// },
// expectError: true,
// expectID: false,
//},
//{
// name: "large path",
// urls: []*url.URL{
// {
// Scheme: "spiffe",
// Host: "foo.bar.com",
// Path: string(make([]byte, 2050)),
// RawPath: string(make([]byte, 2050)),
// },
// },
// expectError: true,
// expectID: false,
//},
//{
// name: "large host",
// urls: []*url.URL{
// {
// Scheme: "spiffe",
// Host: string(make([]byte, 256)),
// Path: "workload/wl1",
// RawPath: "workload/wl1",
// },
// },
// expectError: true,
// expectID: false,
//},
//{
// name: "multiple SPIFFE IDs",
// urls: []*url.URL{
// {
// Scheme: "spiffe",
// Host: "foo.bar.com",
// Path: "workload/wl1",
// RawPath: "workload/wl1",
// },
// {
// Scheme: "spiffe",
// Host: "bar.baz.com",
// Path: "workload/wl2",
// RawPath: "workload/wl2",
// },
// },
// expectError: false,
// expectID: false,
//},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
info := TLSInfo{
State: tls.ConnectionState{PeerCertificates: []*x509.Certificate{{URIs: tt.urls}}}}
fmt.Println("--------------starts-------------------")
err := info.ParseSpiffeID()
if got, want := err != nil, tt.expectError; got != want {
t.Errorf("want expectError = %v, but got expectError = %v, with error %v", want, got, err)
}
if got, want := info.SpiffeID != nil, tt.expectID; got != want {
t.Errorf("want expectID = %v, but spiffe ID is %v", want, info.SpiffeID)
}
fmt.Println("--------------ends-------------------")
})
}
}
36 changes: 0 additions & 36 deletions credentials/tls.go
View file
Expand Up @@ -55,42 +55,6 @@ func (t TLSInfo) GetSecurityValue() ChannelzSecurityValue {
return v
}

// ParseSpiffeID parses the Spiffe ID from State and fill it into SpiffeID.
// An error is returned only when we are sure Spiffe ID is used but the format
// is wrong.
func (t *TLSInfo) ParseSpiffeID() error {
if len(t.State.PeerCertificates) == 0 || len(t.State.PeerCertificates[0].URIs) == 0 {
return nil
}
spiffeIDCnt := 0
var spiffeID url.URL
for _, uri := range t.State.PeerCertificates[0].URIs {
if uri == nil || uri.Scheme != "spiffe" || uri.Opaque != "" || (uri.User != nil && uri.User.Username() != "") {
continue
}
// From this point, we assume the uri is intended for a Spiffe ID.
if len(uri.Host)+len(uri.Scheme)+len(uri.RawPath)+4 > 2048 ||
len(uri.Host)+len(uri.Scheme)+len(uri.Path)+4 > 2048 {
return fmt.Errorf("invalid SPIFFE ID: total ID length larger than 2048 bytes")
}
if len(uri.Host) == 0 || len(uri.RawPath) == 0 || len(uri.Path) == 0 {
return fmt.Errorf("invalid SPIFFE ID: domain or workload ID is empty")
}
if len(uri.Host) > 255 {
return fmt.Errorf("invalid SPIFFE ID: domain length larger than 255 characters")
}
// We use a default deep copy since we know the User field of a SPIFFE ID is empty.
spiffeID = *uri
spiffeIDCnt++
}
// A standard SPIFFE ID should be unique. If there are more, we don't raise
// any errors but simply not plumbing any of them.
if spiffeIDCnt == 1 {
t.SpiffeID = &spiffeID
}
return nil
}

// tlsCreds is the credentials required for authenticating a connection using TLS.
type tlsCreds struct {
// TLS configuration
Expand Down

0 comments on commit 66cd579

Please sign in to comment.