diff --git a/authority/ssh.go b/authority/ssh.go index 7b8f26e2..4a67b28c 100644 --- a/authority/ssh.go +++ b/authority/ssh.go @@ -198,6 +198,13 @@ func (a *Authority) SignSSH(ctx context.Context, key ssh.PublicKey, opts provisi errs.WithKeyVal("signOptions", signOpts), ) } + // explicitly check for unmarshaling errors, which are most probably caused by JSON template syntax errors + if strings.HasPrefix(err.Error(), "error unmarshaling certificate") { + return nil, errs.InternalServerErr(templatingError(err), + errs.WithKeyVal("signOptions", signOpts), + errs.WithMessage("error applying certificate template"), + ) + } return nil, errs.Wrap(http.StatusInternalServerError, err, "authority.SignSSH") } diff --git a/authority/ssh_test.go b/authority/ssh_test.go index b0907a79..2ea65352 100644 --- a/authority/ssh_test.go +++ b/authority/ssh_test.go @@ -172,6 +172,14 @@ func TestAuthority_SignSSH(t *testing.T) { SSH: &provisioner.SSHOptions{Template: `{{ fail "an error"}}`}, }, sshutil.CreateTemplateData(sshutil.UserCert, "key-id", []string{"user"})) assert.FatalError(t, err) + userJSONSyntaxErrorTemplateFile, err := provisioner.TemplateSSHOptions(&provisioner.Options{ + SSH: &provisioner.SSHOptions{TemplateFile: "./testdata/templates/badjsonsyntax.tpl"}, + }, sshutil.CreateTemplateData(sshutil.UserCert, "key-id", []string{"user"})) + assert.FatalError(t, err) + userJSONValueErrorTemplateFile, err := provisioner.TemplateSSHOptions(&provisioner.Options{ + SSH: &provisioner.SSHOptions{TemplateFile: "./testdata/templates/badjsonvalue.tpl"}, + }, sshutil.CreateTemplateData(sshutil.UserCert, "key-id", []string{"user"})) + assert.FatalError(t, err) now := time.Now() @@ -222,6 +230,8 @@ func TestAuthority_SignSSH(t *testing.T) { {"fail-no-host-key", fields{signer, nil}, args{pub, provisioner.SignSSHOptions{CertType: "host"}, []provisioner.SignOption{hostTemplate}}, want{}, true}, {"fail-bad-type", fields{signer, nil}, args{pub, provisioner.SignSSHOptions{}, []provisioner.SignOption{userTemplate, sshTestModifier{CertType: 100}}}, want{}, true}, {"fail-custom-template", fields{signer, signer}, args{pub, provisioner.SignSSHOptions{}, []provisioner.SignOption{userFailTemplate, userOptions}}, want{}, true}, + {"fail-custom-template-syntax-error-file", fields{signer, signer}, args{pub, provisioner.SignSSHOptions{}, []provisioner.SignOption{userJSONSyntaxErrorTemplateFile, userOptions}}, want{}, true}, + {"fail-custom-template-syntax-value-file", fields{signer, signer}, args{pub, provisioner.SignSSHOptions{}, []provisioner.SignOption{userJSONValueErrorTemplateFile, userOptions}}, want{}, true}, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { diff --git a/authority/testdata/templates/badjsonsyntax.tpl b/authority/testdata/templates/badjsonsyntax.tpl new file mode 100644 index 00000000..1088f142 --- /dev/null +++ b/authority/testdata/templates/badjsonsyntax.tpl @@ -0,0 +1,3 @@ +{ + "subject": "badjson.localhost, +} \ No newline at end of file diff --git a/authority/testdata/templates/badjsonvalue.tpl b/authority/testdata/templates/badjsonvalue.tpl new file mode 100644 index 00000000..107cde02 --- /dev/null +++ b/authority/testdata/templates/badjsonvalue.tpl @@ -0,0 +1,10 @@ +{ + "subject": 1, + "sans": {{ toJson .SANs }}, +{{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }} + "keyUsage": ["keyEncipherment", "digitalSignature"], +{{- else }} + "keyUsage": ["digitalSignature"], +{{- end }} + "extKeyUsage": ["serverAuth", "clientAuth"] +} \ No newline at end of file diff --git a/authority/tls.go b/authority/tls.go index dfa88ac3..cc049655 100644 --- a/authority/tls.go +++ b/authority/tls.go @@ -7,8 +7,11 @@ import ( "crypto/x509" "encoding/asn1" "encoding/base64" + "encoding/json" "encoding/pem" + "fmt" "net/http" + "strings" "time" "github.com/pkg/errors" @@ -126,6 +129,14 @@ func (a *Authority) Sign(csr *x509.CertificateRequest, signOpts provisioner.Sign errs.WithKeyVal("signOptions", signOpts), ) } + // explicitly check for unmarshaling errors, which are most probably caused by JSON template (syntax) errors + if strings.HasPrefix(err.Error(), "error unmarshaling certificate") { + return nil, errs.InternalServerErr(templatingError(err), + errs.WithKeyVal("csr", csr), + errs.WithKeyVal("signOptions", signOpts), + errs.WithMessage("error applying certificate template"), + ) + } return nil, errs.Wrap(http.StatusInternalServerError, err, "authority.Sign", opts...) } @@ -549,3 +560,22 @@ func (a *Authority) GetTLSCertificate() (*tls.Certificate, error) { tlsCrt.Leaf = resp.Certificate return &tlsCrt, nil } + +// templatingError tries to extract more information about the cause of +// an error related to (most probably) malformed template data and adds +// this to the error message. +func templatingError(err error) error { + cause := errors.Cause(err) + var ( + syntaxError *json.SyntaxError + typeError *json.UnmarshalTypeError + ) + if errors.As(err, &syntaxError) { + // offset is arguably not super clear to the user, but it's the best we can do here + cause = fmt.Errorf("%s at offset %d", cause.Error(), syntaxError.Offset) + } else if errors.As(err, &typeError) { + // slightly rewriting the default error message to include the offset + cause = fmt.Errorf("cannot unmarshal %s at offset %d into Go value of type %s", typeError.Value, typeError.Offset, typeError.Type) + } + return errors.Wrap(cause, "error applying certificate template") +} diff --git a/authority/tls_test.go b/authority/tls_test.go index 3acf05f5..3a0c999e 100644 --- a/authority/tls_test.go +++ b/authority/tls_test.go @@ -396,6 +396,64 @@ ZYtQ9Ot36qc= code: http.StatusBadRequest, } }, + "fail bad JSON syntax template file": func(t *testing.T) *signTest { + csr := getCSR(t, priv) + testAuthority := testAuthority(t) + p, ok := testAuthority.provisioners.Load("step-cli:4UELJx8e0aS9m0CH3fZ0EB7D5aUPICb759zALHFejvc") + if !ok { + t.Fatal("provisioner not found") + } + p.(*provisioner.JWK).Options = &provisioner.Options{ + X509: &provisioner.X509Options{ + TemplateFile: "./testdata/templates/badjsonsyntax.tpl", + }, + } + testExtraOpts, err := testAuthority.Authorize(ctx, token) + assert.FatalError(t, err) + testAuthority.db = &db.MockAuthDB{ + MStoreCertificate: func(crt *x509.Certificate) error { + assert.Equals(t, crt.Subject.CommonName, "smallstep test") + return nil + }, + } + return &signTest{ + auth: testAuthority, + csr: csr, + extraOpts: testExtraOpts, + signOpts: signOpts, + err: errors.New("error applying certificate template: invalid character"), + code: http.StatusInternalServerError, + } + }, + "fail bad JSON value template file": func(t *testing.T) *signTest { + csr := getCSR(t, priv) + testAuthority := testAuthority(t) + p, ok := testAuthority.provisioners.Load("step-cli:4UELJx8e0aS9m0CH3fZ0EB7D5aUPICb759zALHFejvc") + if !ok { + t.Fatal("provisioner not found") + } + p.(*provisioner.JWK).Options = &provisioner.Options{ + X509: &provisioner.X509Options{ + TemplateFile: "./testdata/templates/badjsonvalue.tpl", + }, + } + testExtraOpts, err := testAuthority.Authorize(ctx, token) + assert.FatalError(t, err) + testAuthority.db = &db.MockAuthDB{ + MStoreCertificate: func(crt *x509.Certificate) error { + assert.Equals(t, crt.Subject.CommonName, "smallstep test") + return nil + }, + } + return &signTest{ + auth: testAuthority, + csr: csr, + extraOpts: testExtraOpts, + signOpts: signOpts, + err: errors.New("error applying certificate template: cannot unmarshal"), + code: http.StatusInternalServerError, + } + }, "ok": func(t *testing.T) *signTest { csr := getCSR(t, priv) _a := testAuthority(t)