Add logging to certpoolwatcher

Logging now indicates what certificate (by file and X.509 name) is being watched

Signed-off-by: Todd Short <[email protected]>

Author: tmshort

internal/httputil/certpoolwatcher.go

@@ -2,8 +2,10 @@ package httputil
 
 import (
 	"crypto/x509"
+	"encoding/pem"
 	"fmt"
 	"os"
+	"path/filepath"
 	"slices"
 	"strings"
 	"sync"
@@ -66,6 +68,7 @@ func NewCertPoolWatcher(caDir string, log logr.Logger) (*CertPoolWatcher, error)
 		if err := watcher.Add(p); err != nil {
 			return nil, err
 		}
+		logPath(p, log)
 	}
 
 	cpw := &CertPoolWatcher{
@@ -126,3 +129,77 @@ func (cpw *CertPoolWatcher) drainEvents() {
 		}
 	}
 }
+
+func logPath(p string, log logr.Logger) {
+	fi, err := os.Stat(p)
+	if err != nil {
+		log.Error(err, "error in os.Stat()", "path", p)
+		return
+	}
+	if !fi.IsDir() {
+		logFile(p, log)
+		return
+	}
+	dirEntries, err := os.ReadDir(p)
+	if err != nil {
+		log.Error(err, "error in os.ReadDir()", "path", p)
+		return
+	}
+	for _, e := range dirEntries {
+		file := filepath.Join(p, e.Name())
+		fi, err := os.Stat(file)
+		if err != nil {
+			log.Error(err, "error in os.Stat()", "file", file)
+			continue
+		}
+		if fi.IsDir() {
+			log.Info("ignoring subdirectory", "directory", file)
+			continue
+		}
+		logFile(file, log)
+	}
+}
+
+func logFile(f string, log logr.Logger) {
+	data, err := os.ReadFile(f)
+	if err != nil {
+		log.Error(err, "error in os.ReadFile()", "file", f)
+		return
+	}
+	var block *pem.Block
+	block, data = pem.Decode(data)
+	if block == nil {
+		log.Error(nil, "no block returned from pem.Decode()", "file", f)
+		return
+	}
+	crt, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		log.Error(err, "error in x509.ParseCertificate()", "file", f)
+		return
+	}
+
+	count := 0
+	for len(data) > 0 {
+		block, data = pem.Decode(data)
+		if block != nil {
+			_, err := x509.ParseCertificate(block.Bytes)
+			if err == nil {
+				count = count + 1
+			}
+		}
+	}
+
+	// Find an appopriate certificate identifier
+	args := []any{"file", f}
+	if s := crt.Subject.String(); s != "" {
+		args = append(args, "subject", s)
+	} else if crt.DNSNames != nil {
+		args = append(args, "DNSNames", crt.DNSNames)
+	} else if s := crt.SerialNumber.String(); s != "" {
+		args = append(args, "serial", s)
+	}
+	if count > 1 {
+		args = append(args, "additional-certs", count)
+	}
+	log.Info("watching certificate", args...)
+}