Skip to content

Commit 528c3f1

Browse files
themiszamanithemiszamani
authored
Merge pull request #201 from ARGOeu/devel
Version 1.3.0
2 parents 3a71216 + e0e6edd commit 528c3f1

File tree

4 files changed

+89
-26
lines changed

4 files changed

+89
-26
lines changed

‎argo-api-authn.spec‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
Name: argo-api-authn
55
Summary: ARGO Authentication API. Map X509, OICD to token.
6-
Version: 1.2.0
6+
Version: 1.3.0
77
Release: 1%{?dist}
88
License: ASL 2.0
99
Buildroot: %{_tmppath}/%{name}-buildroot
@@ -60,8 +60,10 @@ go install -buildmode=pie -ldflags "-s -w -linkmode=external -extldflags '-z rel
6060
%attr(0644,root,root) /usr/lib/systemd/system/argo-api-authn.service
6161

6262
%changelog
63+
* Wed Jan 24 2024 Agelos Tsalapatis <agelos.tsal@gmail.com> - 1.3.0-1%{?dist}
64+
- Release of argo-api-authn version 1.3.0
6365
* Tue Dec 19 2023 Agelos Tsalapatis <agelos.tsal@gmail.com> - 1.2.0-1%{?dist}
64-
- Release of argo-api-authn version 1.1.0
66+
- Release of argo-api-authn version 1.2.0
6567
* Tue Sep 26 2023 Agelos Tsalapatis <agelos.tsal@gmail.com> - 1.1.0-1%{?dist}
6668
- Release of argo-api-authn version 1.1.0
6769
* Mon Oct 10 2022 Agelos Tsalapatis <agelos.tsal@gmail.com> - 1.0.0-1%{?dist}

‎auth/revoke.go‎

Lines changed: 72 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ func CRLCheckRevokedCert(ctx context.Context, cert *x509.Certificate) error {
2020

2121
var err error
2222
var goMaxP, psi, csi int
23-
var crtList x509.RevocationList
23+
var revokedCertificatesList []pkix.RevokedCertificate
2424
var errChan = make(chan error)
2525
var doneChan = make(chan bool, 1)
2626

@@ -49,7 +49,7 @@ func CRLCheckRevokedCert(ctx context.Context, cert *x509.Certificate) error {
4949
// count how much time it takes to fetch a crl
5050
t1 := time.Now()
5151
// grab the crl
52-
if crtList, err = FetchCRL(ctx, crlURL); err != nil {
52+
if revokedCertificatesList, err = FetchCRL(ctx, crlURL); err != nil {
5353
errChan <- err
5454
}
5555

@@ -70,7 +70,7 @@ func CRLCheckRevokedCert(ctx context.Context, cert *x509.Certificate) error {
7070
// representing the previous index where we sliced the revoked certificate list
7171
psi = 0
7272

73-
rvkCrtListLen := len(crtList.RevokedCertificates)
73+
rvkCrtListLen := len(revokedCertificatesList)
7474
log.WithFields(
7575
log.Fields{
7676
"trace_id": ctx.Value("trace_id"),
@@ -90,13 +90,13 @@ func CRLCheckRevokedCert(ctx context.Context, cert *x509.Certificate) error {
9090
for j := 1; j <= goMaxP; j++ {
9191

9292
csi = psi + rvkCrtListLen/goMaxP
93-
if len(crtList.RevokedCertificates[psi:])/goMaxP < 2 {
93+
if len(revokedCertificatesList[psi:])/goMaxP < 2 {
9494
wg.Add(1)
95-
go SynchronizedCheckInCRL(doneChan, errChan, crtList.RevokedCertificates[psi:], cert.SerialNumber, wg)
95+
go SynchronizedCheckInCRL(doneChan, errChan, revokedCertificatesList[psi:], cert.SerialNumber, wg)
9696
break
9797
}
9898
wg.Add(1)
99-
go SynchronizedCheckInCRL(doneChan, errChan, crtList.RevokedCertificates[psi:csi], cert.SerialNumber, wg)
99+
go SynchronizedCheckInCRL(doneChan, errChan, revokedCertificatesList[psi:csi], cert.SerialNumber, wg)
100100
psi = csi
101101
}
102102
}(doneChan, errChan, wg, crlURL)
@@ -156,8 +156,8 @@ loop:
156156
defer wg.Done()
157157
}
158158

159-
// FetchCRL fetches the CRL
160-
func FetchCRL(ctx context.Context, url string) (x509.RevocationList, error) {
159+
// FetchCRLV2 fetches the CRL using the V2 x509 version
160+
func FetchCRLV2(ctx context.Context, url string) ([]pkix.RevokedCertificate, error) {
161161

162162
var err error
163163
var resp *http.Response
@@ -178,7 +178,7 @@ func FetchCRL(ctx context.Context, url string) (x509.RevocationList, error) {
178178
},
179179
).Error("CRL Request error")
180180
err = utils.APIGenericInternalError(fmt.Sprintf("Could not access CRL %v", url))
181-
return x509.RevocationList{}, err
181+
return []pkix.RevokedCertificate{}, err
182182
}
183183

184184
// read the response
@@ -193,7 +193,7 @@ func FetchCRL(ctx context.Context, url string) (x509.RevocationList, error) {
193193
},
194194
).Error("Unable to read CRL data")
195195
err = utils.APIGenericInternalError("Unable to read CRL Data")
196-
return x509.RevocationList{}, err
196+
return []pkix.RevokedCertificate{}, err
197197
}
198198

199199
defer resp.Body.Close()
@@ -210,8 +210,68 @@ func FetchCRL(ctx context.Context, url string) (x509.RevocationList, error) {
210210
},
211211
).Error("Unable to parse CRL data")
212212
err = utils.APIGenericInternalError("Unable to parse CRL Data")
213-
return x509.RevocationList{}, err
213+
return []pkix.RevokedCertificate{}, err
214+
}
215+
216+
return crtList.RevokedCertificates, err
217+
}
218+
219+
// FetchCRL fetches the CRL
220+
func FetchCRL(ctx context.Context, url string) ([]pkix.RevokedCertificate, error) {
221+
222+
var err error
223+
var resp *http.Response
224+
var crlBytes []byte
225+
226+
var crtList = &pkix.CertificateList{}
227+
228+
// initialize the client and perform a get request to grab the crl
229+
client := &http.Client{Timeout: time.Duration(30 * time.Second)}
230+
if resp, err = client.Get(url); err != nil {
231+
log.WithFields(
232+
log.Fields{
233+
"trace_id": ctx.Value("trace_id"),
234+
"type": "backend_log",
235+
"backend_service": "crl",
236+
"backend_hosts": url,
237+
"details": err.Error(),
238+
},
239+
).Error("CRL Request error")
240+
err = utils.APIGenericInternalError(fmt.Sprintf("Could not access CRL %v", url))
241+
return []pkix.RevokedCertificate{}, err
242+
}
243+
244+
// read the response
245+
if crlBytes, err = io.ReadAll(resp.Body); err != nil {
246+
log.WithFields(
247+
log.Fields{
248+
"trace_id": ctx.Value("trace_id"),
249+
"type": "backend_log",
250+
"backend_service": "crl",
251+
"backend_hosts": url,
252+
"details": err.Error(),
253+
},
254+
).Error("Unable to read CRL data")
255+
err = utils.APIGenericInternalError("Unable to read CRL Data")
256+
return []pkix.RevokedCertificate{}, err
257+
}
258+
259+
defer resp.Body.Close()
260+
261+
// create the crl from the byte slice
262+
if crtList, err = x509.ParseCRL(crlBytes); err != nil {
263+
log.WithFields(
264+
log.Fields{
265+
"trace_id": ctx.Value("trace_id"),
266+
"type": "backend_log",
267+
"backend_service": "crl",
268+
"backend_hosts": url,
269+
"details": err.Error(),
270+
},
271+
).Error("Unable to parse CRL data")
272+
err = utils.APIGenericInternalError("Unable to parse CRL Data")
273+
return []pkix.RevokedCertificate{}, err
214274
}
215275

216-
return *crtList, err
276+
return crtList.TBSCertList.RevokedCertificates, err
217277
}

‎handlers/certificate_handlers.go‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,16 @@ func AuthViaCert(w http.ResponseWriter, r *http.Request) {
4040
return
4141
}
4242

43+
log.WithFields(
44+
log.Fields{
45+
"trace_id": rCTX.Value("trace_id"),
46+
"type": "service_log",
47+
"service_type": serviceType.Name,
48+
"host": vars["host"],
49+
"certificate": r.TLS.PeerCertificates[0].Subject.String(),
50+
},
51+
).Info("New Certificate request")
52+
4353
// validate the certificate
4454
if cfg.VerifyCertificate {
4555
err = auth.ValidateClientCertificate(rCTX, r.TLS.PeerCertificates[0], r.RemoteAddr, cfg.ClientCertHostVerification)
@@ -74,19 +84,10 @@ func AuthViaCert(w http.ResponseWriter, r *http.Request) {
7484
return
7585
}
7686

77-
// Find the binding associated with the provided certificate
87+
// If all checks have passed, extract the RDN sequence
7888
rdnSequence := auth.ExtractEnhancedRDNSequenceToString(r.TLS.PeerCertificates[0])
7989

80-
log.WithFields(
81-
log.Fields{
82-
"trace_id": rCTX.Value("trace_id"),
83-
"type": "service_log",
84-
"rdn": rdnSequence,
85-
"service_type": serviceType.Name,
86-
"host": vars["host"],
87-
},
88-
).Info("New Certificate request")
89-
90+
// Find the binding associated with the provided certificate
9091
if binding, err = bindings.FindBindingByAuthID(rCTX, rdnSequence, serviceType.UUID, vars["host"], "x509", store); err != nil {
9192
utils.RespondError(rCTX, w, err)
9293
return

‎version/version.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import (
1010

1111
var (
1212
// Release version of the service. Bump it up during new version release
13-
Release = "1.2.0"
13+
Release = "1.3.0"
1414
// Commit hash provided during build
1515
Commit = "Unknown"
1616
// BuildTime provided during build

0 commit comments

Comments
 (0)