Skip to content

Make it possible to mock the current time in spiffetls dialer #357

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Make it possible to mock the current time in spiffetls dialer #357

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion spiffetls/dial.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ func DialWithMode(ctx context.Context, network, addr string, mode DialMode, opti

switch m.mode {
case tlsClientMode:
tlsconfig.HookTLSClientConfig(tlsConfig, m.bundle, m.authorizer)
tlsconfig.HookTLSClientConfig(tlsConfig, m.bundle, m.authorizer, opt.tlsOptions...)
case mtlsClientMode:
tlsconfig.HookMTLSClientConfig(tlsConfig, m.svid, m.bundle, m.authorizer, opt.tlsOptions...)
case mtlsWebClientMode:
Expand Down
29 changes: 26 additions & 3 deletions spiffetls/tlsconfig/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package tlsconfig
import (
"crypto/tls"
"crypto/x509"
"time"

"github.com/spiffe/go-spiffe/v2/bundle/x509bundle"
"github.com/spiffe/go-spiffe/v2/svid/x509svid"
Expand Down Expand Up @@ -36,7 +37,9 @@ type option func(*options)
func (fn option) apply(o *options) { fn(o) }

type options struct {
trace Trace
trace Trace
hasNow bool
now time.Time
}

func newOptions(opts []Option) *options {
Expand All @@ -55,6 +58,15 @@ func WithTrace(trace Trace) Option {
})
}

// WithTime sets the time used when verifying validity periods on X509 SVIDs.
// If not used, the current time will be used.
func WithTime(now time.Time) Option {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To be consistent in the way we've passed through options in other packages, I'd recommend that we instead add a function func WithVerifyOptions(opts ...x509svid.VerifyOption) Option instead of replicating the individual options here.

return option(func(opts *options) {
opts.hasNow = true
opts.now = now
})
}

// MTLSClientConfig returns a TLS configuration which presents an X509-SVID
// to the server and verifies and authorizes the server X509-SVID.
func MTLSClientConfig(svid x509svid.Source, bundle x509bundle.Source, authorizer Authorizer, opts ...Option) *tls.Config {
Expand Down Expand Up @@ -167,12 +179,22 @@ func GetClientCertificate(svid x509svid.Source, opts ...Option) func(*tls.Certif
}
}

func optionsToSVIDOptions(opts []Option) []x509svid.VerifyOption {
opt := newOptions(opts)
var svidopt []x509svid.VerifyOption
if opt.hasNow {
svidopt = append(svidopt, x509svid.WithTime(opt.now))
}
return svidopt
}

// VerifyPeerCertificate returns a VerifyPeerCertificate callback for
// tls.Config. It uses the given bundle source and authorizer to verify and
// authorize X509-SVIDs provided by peers during the TLS handshake.
func VerifyPeerCertificate(bundle x509bundle.Source, authorizer Authorizer, opts ...Option) func([][]byte, [][]*x509.Certificate) error {
svidopt := optionsToSVIDOptions(opts)
return func(raw [][]byte, _ [][]*x509.Certificate) error {
id, certs, err := x509svid.ParseAndVerify(raw, bundle)
id, certs, err := x509svid.ParseAndVerify(raw, bundle, svidopt...)
if err != nil {
return err
}
Expand All @@ -190,8 +212,9 @@ func WrapVerifyPeerCertificate(wrapped func([][]byte, [][]*x509.Certificate) err
return VerifyPeerCertificate(bundle, authorizer, opts...)
}

svidopt := optionsToSVIDOptions(opts)
return func(raw [][]byte, _ [][]*x509.Certificate) error {
id, certs, err := x509svid.ParseAndVerify(raw, bundle)
id, certs, err := x509svid.ParseAndVerify(raw, bundle, svidopt...)
if err != nil {
return err
}
Expand Down