TrueCloudLab/certificates
16
0
Fork 2
Code Issues 1 Pull requests 1 Releases Activity Actions

Make the constraint service public

Browse source
This commit is contained in:
Mariano Cano 2022-09-20 11:36:45 -07:00
parent 7bea2f4d0e
commit 45e594f98c
2 changed files with 10 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
authority/internal/constraints/constraints.go
View file

@ -22,7 +22,9 @@ func (e ConstraintError) Error() string {
return e.Detail return e.Detail
} }
type service struct { // Service implements a constraint validator for DNS names, IP addresses, Email
// addresses and URIs.
type Service struct {
hasNameConstraints bool hasNameConstraints bool
permittedDNSDomains []string permittedDNSDomains []string
excludedDNSDomains []string excludedDNSDomains []string
@ -36,8 +38,8 @@ type service struct {
// New creates a constraint validation service that contains the given chain of // New creates a constraint validation service that contains the given chain of
// certificates. // certificates.
func New(chain ...*x509.Certificate) *service { func New(chain ...*x509.Certificate) *Service {
s := new(service) s := new(Service)
for _, crt := range chain { for _, crt := range chain {
s.permittedDNSDomains = append(s.permittedDNSDomains, crt.PermittedDNSDomains...) s.permittedDNSDomains = append(s.permittedDNSDomains, crt.PermittedDNSDomains...)
s.excludedDNSDomains = append(s.excludedDNSDomains, crt.ExcludedDNSDomains...) s.excludedDNSDomains = append(s.excludedDNSDomains, crt.ExcludedDNSDomains...)
@ -62,7 +64,7 @@ func New(chain ...*x509.Certificate) *service {
// Validate checks the given names with the name constraints defined in the // Validate checks the given names with the name constraints defined in the
// service. // service.
func (s *service) Validate(dnsNames []string, ipAddresses []net.IP, emailAddresses []string, uris []*url.URL) error { func (s *Service) Validate(dnsNames []string, ipAddresses []net.IP, emailAddresses []string, uris []*url.URL) error {
if !s.hasNameConstraints { if !s.hasNameConstraints {
return nil return nil
} }

8
authority/internal/constraints/constraints_test.go
View file

@ -47,12 +47,12 @@ func TestNew(t *testing.T) {
tests := []struct { tests := []struct {
name string name string
args args args args
want *service want *Service
}{ }{
{"ok", args{[]*x509.Certificate{ca1.Intermediate, ca1.Root}}, &service{ {"ok", args{[]*x509.Certificate{ca1.Intermediate, ca1.Root}}, &Service{
hasNameConstraints: false, hasNameConstraints: false,
}}, }},
{"ok with constraints", args{[]*x509.Certificate{ca2.Intermediate, ca2.Root}}, &service{ {"ok with constraints", args{[]*x509.Certificate{ca2.Intermediate, ca2.Root}}, &Service{
hasNameConstraints: true, hasNameConstraints: true,
permittedDNSDomains: []string{"internal.example.org"}, permittedDNSDomains: []string{"internal.example.org"},
excludedDNSDomains: []string{"internal.example.com"}, excludedDNSDomains: []string{"internal.example.com"},
@ -205,7 +205,7 @@ func Test_service_Validate(t *testing.T) {
} }
for _, tt := range tests { for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) { t.Run(tt.name, func(t *testing.T) {
s := &service{ s := &Service{
hasNameConstraints: tt.fields.hasNameConstraints, hasNameConstraints: tt.fields.hasNameConstraints,
permittedDNSDomains: tt.fields.permittedDNSDomains, permittedDNSDomains: tt.fields.permittedDNSDomains,
excludedDNSDomains: tt.fields.excludedDNSDomains, excludedDNSDomains: tt.fields.excludedDNSDomains,