Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cert verification for non-CA certs #2761

Merged
merged 3 commits into from
May 25, 2017
Merged

Cert verification for non-CA certs #2761

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9fcf50f
Cert verification for non-CA certs
vishalnayak May 24, 2017
2866451
Added test case to ensure login fails with expired non-CA cert
vishalnayak May 25, 2017
18aca03
Address review feedback
vishalnayak May 25, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions builtin/credential/cert/path_login.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,15 @@ func (b *backend) verifyCredentials(req *logical.Request, d *framework.FieldData
if tCert.SerialNumber.Cmp(clientCert.SerialNumber) == 0 &&
bytes.Equal(tCert.AuthorityKeyId, clientCert.AuthorityKeyId) &&
b.matchesConstraints(clientCert, trustedNonCA.Certificates, trustedNonCA) {

// We are not looking for trusted chains here since this is a
// non-CA cert. But validating the connection state detects
// expired certificates.
_, err := validateConnState(roots, connState)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we can just move this check that is happening after this block above the block and avoid the code duplication.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done!

if err != nil {
return nil, nil, err
}

return trustedNonCA, nil, nil
}
}
Expand Down