TrueCloudLab/certificates
16
0
Fork 2
Code Issues 1 Pull requests 1 Releases Activity Actions

Use the provisioner controller in Nebula renewals

Browse source
This commit is contained in:
Mariano Cano 2022-03-10 10:45:12 -08:00
parent afb5d36206
commit 8ef8f4f665
2 changed files with 11 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
authority/provisioner/nebula.go
View file

@ -260,10 +260,7 @@ func (p *Nebula) AuthorizeSSHSign(ctx context.Context, token string) ([]SignOpti
// AuthorizeRenew returns an error if the renewal is disabled. // AuthorizeRenew returns an error if the renewal is disabled.
func (p *Nebula) AuthorizeRenew(ctx context.Context, crt *x509.Certificate) error { func (p *Nebula) AuthorizeRenew(ctx context.Context, crt *x509.Certificate) error {
if p.ctl.Claimer.IsDisableRenewal() { return p.ctl.AuthorizeRenew(ctx, crt)
return errs.Unauthorized("renew is disabled for nebula provisioner '%s'", p.GetName())
}
return nil
} }
// AuthorizeRevoke returns an error if the token is not valid. // AuthorizeRevoke returns an error if the token is not valid.

12
authority/provisioner/nebula_test.go
View file

@ -549,6 +549,8 @@ func TestNebula_AuthorizeSSHSign(t *testing.T) {
func TestNebula_AuthorizeRenew(t *testing.T) { func TestNebula_AuthorizeRenew(t *testing.T) {
ctx := context.TODO() ctx := context.TODO()
now := time.Now().Truncate(time.Second)
// Ok provisioner // Ok provisioner
p, _, _ := mustNebulaProvisioner(t) p, _, _ := mustNebulaProvisioner(t)
@ -567,8 +569,14 @@ func TestNebula_AuthorizeRenew(t *testing.T) {
args args args args
wantErr bool wantErr bool
}{ }{
{"ok", p, args{ctx, &x509.Certificate{}}, false}, {"ok", p, args{ctx, &x509.Certificate{
{"fail disabled", pDisabled, args{ctx, &x509.Certificate{}}, true}, NotBefore: now,
NotAfter: now.Add(time.Hour),
}}, false},
{"fail disabled", pDisabled, args{ctx, &x509.Certificate{
NotBefore: now,
NotAfter: now.Add(time.Hour),
}}, true},
} }
for _, tt := range tests { for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) { t.Run(tt.name, func(t *testing.T) {