scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-11-02 19:47:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Move around some logic to be neater

Browse Source
This commit is contained in:
Jeff Mitchell
2018-01-18 11:47:24 -05:00
parent f0acb3a995
commit 66206f264e
1 changed files with 13 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
builtin/credential/cert/path_login.go
View File

@@ -206,12 +206,6 @@ func (b *backend) verifyCredentials(req *logical.Request, d *framework.FieldData
// Load the trusted certificates // Load the trusted certificates
roots, trusted, trustedNonCAs := b.loadTrustedCerts(req.Storage, certName) roots, trusted, trustedNonCAs := b.loadTrustedCerts(req.Storage, certName)
// Get the list of full chains matching the connection
trustedChains, err := validateConnState(roots, connState)
if err != nil {
return nil, nil, err
}
// If trustedNonCAs is not empty it means that client had registered a non-CA cert // If trustedNonCAs is not empty it means that client had registered a non-CA cert
// with the backend. // with the backend.
if len(trustedNonCAs) != 0 { if len(trustedNonCAs) != 0 {
@@ -226,6 +220,11 @@ func (b *backend) verifyCredentials(req *logical.Request, d *framework.FieldData
} }
} }
// Get the list of full chains matching the connection
trustedChains, err := validateConnState(roots, connState)
if err != nil {
return nil, nil, err
}
// If no trusted chain was found, client is not authenticated // If no trusted chain was found, client is not authenticated
if len(trustedChains) == 0 { if len(trustedChains) == 0 {
return nil, logical.ErrorResponse("invalid certificate or no client certificate supplied"), nil return nil, logical.ErrorResponse("invalid certificate or no client certificate supplied"), nil
@@ -415,17 +414,20 @@ func parsePEM(raw []byte) (certs []*x509.Certificate) {
// verification logic here: http://golang.org/src/crypto/tls/handshake_server.go // verification logic here: http://golang.org/src/crypto/tls/handshake_server.go
// The trusted chains are returned. // The trusted chains are returned.
func validateConnState(roots *x509.CertPool, cs *tls.ConnectionState) ([][]*x509.Certificate, error) { func validateConnState(roots *x509.CertPool, cs *tls.ConnectionState) ([][]*x509.Certificate, error) {
certs := cs.PeerCertificates
if len(certs) == 0 {
return nil, nil
}
if certs[0].IsCA {
return nil, nil
}
opts := x509.VerifyOptions{ opts := x509.VerifyOptions{
Roots: roots, Roots: roots,
Intermediates: x509.NewCertPool(), Intermediates: x509.NewCertPool(),
KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}, KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
} }
certs := cs.PeerCertificates
if len(certs) == 0 {
return nil, nil
}
if len(certs) > 1 { if len(certs) > 1 {
for _, cert := range certs[1:] { for _, cert := range certs[1:] {
opts.Intermediates.AddCert(cert) opts.Intermediates.AddCert(cert)