From 1f094d818a2d96d0438ceb43c2c146089021618e Mon Sep 17 00:00:00 2001 From: Max Lerebourg Date: Mon, 5 Dec 2022 08:10:56 +0100 Subject: [PATCH] :lipstick: move getTlsConfig to configuration pkg --- bouncer.go | 50 +------------------------ bouncer_test.go | 27 ------------- pkg/configuration/configuration.go | 46 +++++++++++++++++++++++ pkg/configuration/configuration_test.go | 28 ++++++++++++++ 4 files changed, 75 insertions(+), 76 deletions(-) diff --git a/bouncer.go b/bouncer.go index a786940..255fd69 100644 --- a/bouncer.go +++ b/bouncer.go @@ -5,8 +5,6 @@ package crowdsec_bouncer_traefik_plugin //nolint:revive,stylecheck import ( "bytes" "context" - "crypto/tls" - "crypto/x509" "encoding/json" "fmt" "io" @@ -71,7 +69,7 @@ func New(ctx context.Context, next http.Handler, config *configuration.Config, n serverChecker, _ := ip.NewChecker(config.ForwardedHeadersTrustedIPs) clientChecker, _ := ip.NewChecker(config.ClientTrustedIPs) - tlsConfig, err := getTLSConfigCrowdsec(config) + tlsConfig, err := configuration.GetTLSConfigCrowdsec(config) if err != nil { logger.Error(fmt.Sprintf("New:getTLSConfigCrowdsec fail to get tlsConfig %s", err.Error())) return nil, err @@ -336,49 +334,3 @@ func crowdsecQuery(bouncer *Bouncer, stringURL string) ([]byte, error) { } return body, nil } - -func getTLSConfigCrowdsec(config *configuration.Config) (*tls.Config, error) { - tlsConfig := new(tls.Config) - tlsConfig.RootCAs = x509.NewCertPool() - //nolint:gocritic - if config.CrowdsecLapiScheme != "https" { - logger.Debug("getTLSConfigCrowdsec:CrowdsecLapiScheme not https") - return tlsConfig, nil - } else if config.CrowdsecLapiTLSInsecureVerify { - logger.Debug("getTLSConfigCrowdsec:CrowdsecLapiTLSInsecureVerify is true") - tlsConfig.InsecureSkipVerify = true - // If we return here and still want to use client auth this won't work - // return tlsConfig, nil - } else { - certAuthority, err := configuration.GetVariable(config, "CrowdsecLapiTLSCertificateAuthority") - if err != nil { - return nil, err - } - cert := []byte(certAuthority) - if !tlsConfig.RootCAs.AppendCertsFromPEM(cert) { - logger.Debug("getTLSConfigCrowdsec:CrowdsecLapiTLSCertificateAuthority read cert failed") - // here we return because if CrowdsecLapiTLSInsecureVerify is false - // and CA not load, we can't communicate with https - return nil, fmt.Errorf("getTLSConfigCrowdsec:cannot load CA and verify cert is enabled") - } - } - - certBouncer, err := configuration.GetVariable(config, "CrowdsecLapiTLSCertificateBouncer") - if err != nil { - return nil, err - } - certBouncerKey, err := configuration.GetVariable(config, "CrowdsecLapiTLSCertificateBouncerKey") - if err != nil { - return nil, err - } - if certBouncer == "" || certBouncerKey == "" { - return tlsConfig, nil - } - clientCert, err := tls.X509KeyPair([]byte(certBouncer), []byte(certBouncerKey)) - if err != nil { - return nil, fmt.Errorf("getTLSClientConfigCrowdsec impossible to generate ClientCert %w", err) - } - tlsConfig.Certificates = append(tlsConfig.Certificates, clientCert) - - return tlsConfig, nil -} diff --git a/bouncer_test.go b/bouncer_test.go index 5c2a42a..7fb33a9 100644 --- a/bouncer_test.go +++ b/bouncer_test.go @@ -2,7 +2,6 @@ package crowdsec_bouncer_traefik_plugin //nolint:revive,stylecheck import ( "context" - "crypto/tls" "net/http" "net/http/httptest" "reflect" @@ -178,29 +177,3 @@ func Test_crowdsecQuery(t *testing.T) { }) } } - -func Test_getTLSConfigCrowdsec(t *testing.T) { - type args struct { - config *configuration.Config - } - tests := []struct { - name string - args args - want *tls.Config - wantErr bool - }{ - // TODO: Add test cases. - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - got, err := getTLSConfigCrowdsec(tt.args.config) - if (err != nil) != tt.wantErr { - t.Errorf("getTLSConfigCrowdsec() error = %v, wantErr %v", err, tt.wantErr) - return - } - if !reflect.DeepEqual(got, tt.want) { - t.Errorf("getTLSConfigCrowdsec() = %v, want %v", got, tt.want) - } - }) - } -} diff --git a/pkg/configuration/configuration.go b/pkg/configuration/configuration.go index cbbccd0..8b859f3 100644 --- a/pkg/configuration/configuration.go +++ b/pkg/configuration/configuration.go @@ -208,3 +208,49 @@ func validateParamsRequired(config *Config) error { } return nil } + +func GetTLSConfigCrowdsec(config *Config) (*tls.Config, error) { + tlsConfig := new(tls.Config) + tlsConfig.RootCAs = x509.NewCertPool() + //nolint:gocritic + if config.CrowdsecLapiScheme != "https" { + logger.Debug("getTLSConfigCrowdsec:CrowdsecLapiScheme not https") + return tlsConfig, nil + } else if config.CrowdsecLapiTLSInsecureVerify { + logger.Debug("getTLSConfigCrowdsec:CrowdsecLapiTLSInsecureVerify is true") + tlsConfig.InsecureSkipVerify = true + // If we return here and still want to use client auth this won't work + // return tlsConfig, nil + } else { + certAuthority, err := GetVariable(config, "CrowdsecLapiTLSCertificateAuthority") + if err != nil { + return nil, err + } + cert := []byte(certAuthority) + if !tlsConfig.RootCAs.AppendCertsFromPEM(cert) { + logger.Debug("getTLSConfigCrowdsec:CrowdsecLapiTLSCertificateAuthority read cert failed") + // here we return because if CrowdsecLapiTLSInsecureVerify is false + // and CA not load, we can't communicate with https + return nil, fmt.Errorf("getTLSConfigCrowdsec:cannot load CA and verify cert is enabled") + } + } + + certBouncer, err := GetVariable(config, "CrowdsecLapiTLSCertificateBouncer") + if err != nil { + return nil, err + } + certBouncerKey, err := GetVariable(config, "CrowdsecLapiTLSCertificateBouncerKey") + if err != nil { + return nil, err + } + if certBouncer == "" || certBouncerKey == "" { + return tlsConfig, nil + } + clientCert, err := tls.X509KeyPair([]byte(certBouncer), []byte(certBouncerKey)) + if err != nil { + return nil, fmt.Errorf("getTLSClientConfigCrowdsec impossible to generate ClientCert %w", err) + } + tlsConfig.Certificates = append(tlsConfig.Certificates, clientCert) + + return tlsConfig, nil +} \ No newline at end of file diff --git a/pkg/configuration/configuration_test.go b/pkg/configuration/configuration_test.go index d371d59..f91d394 100644 --- a/pkg/configuration/configuration_test.go +++ b/pkg/configuration/configuration_test.go @@ -1,7 +1,9 @@ package configuration import ( + "crypto/tls" "testing" + "reflect" ) func getMinimalConfig() *Config { @@ -182,3 +184,29 @@ func Test_validateParamsRequired(t *testing.T) { }) } } + +func Test_GetTLSConfigCrowdsec(t *testing.T) { + type args struct { + config *Config + } + tests := []struct { + name string + args args + want *tls.Config + wantErr bool + }{ + // TODO: Add test cases. + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got, err := GetTLSConfigCrowdsec(tt.args.config) + if (err != nil) != tt.wantErr { + t.Errorf("getTLSConfigCrowdsec() error = %v, wantErr %v", err, tt.wantErr) + return + } + if !reflect.DeepEqual(got, tt.want) { + t.Errorf("getTLSConfigCrowdsec() = %v, want %v", got, tt.want) + } + }) + } +}