💄 move getTlsConfig to configuration pkg

bouncer.go

@@ -5,8 +5,6 @@ package crowdsec_bouncer_traefik_plugin //nolint:revive,stylecheck
 import (
 	"bytes"
 	"context"
-	"crypto/tls"
-	"crypto/x509"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -71,7 +69,7 @@ func New(ctx context.Context, next http.Handler, config *configuration.Config, n
 	serverChecker, _ := ip.NewChecker(config.ForwardedHeadersTrustedIPs)
 	clientChecker, _ := ip.NewChecker(config.ClientTrustedIPs)
 
-	tlsConfig, err := getTLSConfigCrowdsec(config)
+	tlsConfig, err := configuration.GetTLSConfigCrowdsec(config)
 	if err != nil {
 		logger.Error(fmt.Sprintf("New:getTLSConfigCrowdsec fail to get tlsConfig %s", err.Error()))
 		return nil, err
@@ -336,49 +334,3 @@ func crowdsecQuery(bouncer *Bouncer, stringURL string) ([]byte, error) {
 	}
 	return body, nil
 }
-
-func getTLSConfigCrowdsec(config *configuration.Config) (*tls.Config, error) {
-	tlsConfig := new(tls.Config)
-	tlsConfig.RootCAs = x509.NewCertPool()
-	//nolint:gocritic
-	if config.CrowdsecLapiScheme != "https" {
-		logger.Debug("getTLSConfigCrowdsec:CrowdsecLapiScheme not https")
-		return tlsConfig, nil
-	} else if config.CrowdsecLapiTLSInsecureVerify {
-		logger.Debug("getTLSConfigCrowdsec:CrowdsecLapiTLSInsecureVerify is true")
-		tlsConfig.InsecureSkipVerify = true
-		// If we return here and still want to use client auth this won't work
-		// return tlsConfig, nil
-	} else {
-		certAuthority, err := configuration.GetVariable(config, "CrowdsecLapiTLSCertificateAuthority")
-		if err != nil {
-			return nil, err
-		}
-		cert := []byte(certAuthority)
-		if !tlsConfig.RootCAs.AppendCertsFromPEM(cert) {
-			logger.Debug("getTLSConfigCrowdsec:CrowdsecLapiTLSCertificateAuthority read cert failed")
-			// here we return because if CrowdsecLapiTLSInsecureVerify is false
-			// and CA not load, we can't communicate with https
-			return nil, fmt.Errorf("getTLSConfigCrowdsec:cannot load CA and verify cert is enabled")
-		}
-	}
-
-	certBouncer, err := configuration.GetVariable(config, "CrowdsecLapiTLSCertificateBouncer")
-	if err != nil {
-		return nil, err
-	}
-	certBouncerKey, err := configuration.GetVariable(config, "CrowdsecLapiTLSCertificateBouncerKey")
-	if err != nil {
-		return nil, err
-	}
-	if certBouncer == "" || certBouncerKey == "" {
-		return tlsConfig, nil
-	}
-	clientCert, err := tls.X509KeyPair([]byte(certBouncer), []byte(certBouncerKey))
-	if err != nil {
-		return nil, fmt.Errorf("getTLSClientConfigCrowdsec impossible to generate ClientCert %w", err)
-	}
-	tlsConfig.Certificates = append(tlsConfig.Certificates, clientCert)
-
-	return tlsConfig, nil
-}

bouncer_test.go

@@ -2,7 +2,6 @@ package crowdsec_bouncer_traefik_plugin //nolint:revive,stylecheck
 
 import (
 	"context"
-	"crypto/tls"
 	"net/http"
 	"net/http/httptest"
 	"reflect"
@@ -178,29 +177,3 @@ func Test_crowdsecQuery(t *testing.T) {
 		})
 	}
 }
-
-func Test_getTLSConfigCrowdsec(t *testing.T) {
-	type args struct {
-		config *configuration.Config
-	}
-	tests := []struct {
-		name    string
-		args    args
-		want    *tls.Config
-		wantErr bool
-	}{
-		// TODO: Add test cases.
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := getTLSConfigCrowdsec(tt.args.config)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("getTLSConfigCrowdsec() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-			if !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("getTLSConfigCrowdsec() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}

pkg/configuration/configuration.go

@@ -208,3 +208,49 @@ func validateParamsRequired(config *Config) error {
 	}
 	return nil
 }
+
+func GetTLSConfigCrowdsec(config *Config) (*tls.Config, error) {
+	tlsConfig := new(tls.Config)
+	tlsConfig.RootCAs = x509.NewCertPool()
+	//nolint:gocritic
+	if config.CrowdsecLapiScheme != "https" {
+		logger.Debug("getTLSConfigCrowdsec:CrowdsecLapiScheme not https")
+		return tlsConfig, nil
+	} else if config.CrowdsecLapiTLSInsecureVerify {
+		logger.Debug("getTLSConfigCrowdsec:CrowdsecLapiTLSInsecureVerify is true")
+		tlsConfig.InsecureSkipVerify = true
+		// If we return here and still want to use client auth this won't work
+		// return tlsConfig, nil
+	} else {
+		certAuthority, err := GetVariable(config, "CrowdsecLapiTLSCertificateAuthority")
+		if err != nil {
+			return nil, err
+		}
+		cert := []byte(certAuthority)
+		if !tlsConfig.RootCAs.AppendCertsFromPEM(cert) {
+			logger.Debug("getTLSConfigCrowdsec:CrowdsecLapiTLSCertificateAuthority read cert failed")
+			// here we return because if CrowdsecLapiTLSInsecureVerify is false
+			// and CA not load, we can't communicate with https
+			return nil, fmt.Errorf("getTLSConfigCrowdsec:cannot load CA and verify cert is enabled")
+		}
+	}
+
+	certBouncer, err := GetVariable(config, "CrowdsecLapiTLSCertificateBouncer")
+	if err != nil {
+		return nil, err
+	}
+	certBouncerKey, err := GetVariable(config, "CrowdsecLapiTLSCertificateBouncerKey")
+	if err != nil {
+		return nil, err
+	}
+	if certBouncer == "" || certBouncerKey == "" {
+		return tlsConfig, nil
+	}
+	clientCert, err := tls.X509KeyPair([]byte(certBouncer), []byte(certBouncerKey))
+	if err != nil {
+		return nil, fmt.Errorf("getTLSClientConfigCrowdsec impossible to generate ClientCert %w", err)
+	}
+	tlsConfig.Certificates = append(tlsConfig.Certificates, clientCert)
+
+	return tlsConfig, nil
+}

pkg/configuration/configuration_test.go

@@ -1,7 +1,9 @@
 package configuration
 
 import (
+	"crypto/tls"
 	"testing"
+	"reflect"
 )
 
 func getMinimalConfig() *Config {
@@ -182,3 +184,29 @@ func Test_validateParamsRequired(t *testing.T) {
 		})
 	}
 }
+
+func Test_GetTLSConfigCrowdsec(t *testing.T) {
+	type args struct {
+		config *Config
+	}
+	tests := []struct {
+		name    string
+		args    args
+		want    *tls.Config
+		wantErr bool
+	}{
+		// TODO: Add test cases.
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := GetTLSConfigCrowdsec(tt.args.config)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("getTLSConfigCrowdsec() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("getTLSConfigCrowdsec() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}