alexvanin/certificates
1
0
Fork 0
forked from TrueCloudLab/certificates
Code Pull requests Activity

Rename constraint.Service to constraint.Engine

Browse source
This commit is contained in:
Mariano Cano 2022-09-20 11:38:32 -07:00
parent 45e594f98c
commit 2a15e3eee1
3 changed files with 12 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
authority/authority.go
View file

@ -80,6 +80,8 @@ type Authority struct {
authorizeRenewFunc provisioner.AuthorizeRenewFunc authorizeRenewFunc provisioner.AuthorizeRenewFunc
authorizeSSHRenewFunc provisioner.AuthorizeSSHRenewFunc authorizeSSHRenewFunc provisioner.AuthorizeSSHRenewFunc
// Constraint engine
// Policy engines // Policy engines
policyEngine *policy.Engine policyEngine *policy.Engine

12
authority/internal/constraints/constraints.go
View file

@ -22,9 +22,9 @@ func (e ConstraintError) Error() string {
return e.Detail return e.Detail
} }
// Service implements a constraint validator for DNS names, IP addresses, Email // Engine implements a constraint validator for DNS names, IP addresses, Email
// addresses and URIs. // addresses and URIs.
type Service struct { type Engine struct {
hasNameConstraints bool hasNameConstraints bool
permittedDNSDomains []string permittedDNSDomains []string
excludedDNSDomains []string excludedDNSDomains []string
@ -36,10 +36,10 @@ type Service struct {
excludedURIDomains []string excludedURIDomains []string
} }
// New creates a constraint validation service that contains the given chain of // New creates a constraint validation engine that contains the given chain of
// certificates. // certificates.
func New(chain ...*x509.Certificate) *Service { func New(chain ...*x509.Certificate) *Engine {
s := new(Service) s := new(Engine)
for _, crt := range chain { for _, crt := range chain {
s.permittedDNSDomains = append(s.permittedDNSDomains, crt.PermittedDNSDomains...) s.permittedDNSDomains = append(s.permittedDNSDomains, crt.PermittedDNSDomains...)
s.excludedDNSDomains = append(s.excludedDNSDomains, crt.ExcludedDNSDomains...) s.excludedDNSDomains = append(s.excludedDNSDomains, crt.ExcludedDNSDomains...)
@ -64,7 +64,7 @@ func New(chain ...*x509.Certificate) *Service {
// Validate checks the given names with the name constraints defined in the // Validate checks the given names with the name constraints defined in the
// service. // service.
func (s *Service) Validate(dnsNames []string, ipAddresses []net.IP, emailAddresses []string, uris []*url.URL) error { func (s *Engine) Validate(dnsNames []string, ipAddresses []net.IP, emailAddresses []string, uris []*url.URL) error {
if !s.hasNameConstraints { if !s.hasNameConstraints {
return nil return nil
} }

8
authority/internal/constraints/constraints_test.go
View file

@ -47,12 +47,12 @@ func TestNew(t *testing.T) {
tests := []struct { tests := []struct {
name string name string
args args args args
want *Service want *Engine
}{ }{
{"ok", args{[]*x509.Certificate{ca1.Intermediate, ca1.Root}}, &Service{ {"ok", args{[]*x509.Certificate{ca1.Intermediate, ca1.Root}}, &Engine{
hasNameConstraints: false, hasNameConstraints: false,
}}, }},
{"ok with constraints", args{[]*x509.Certificate{ca2.Intermediate, ca2.Root}}, &Service{ {"ok with constraints", args{[]*x509.Certificate{ca2.Intermediate, ca2.Root}}, &Engine{
hasNameConstraints: true, hasNameConstraints: true,
permittedDNSDomains: []string{"internal.example.org"}, permittedDNSDomains: []string{"internal.example.org"},
excludedDNSDomains: []string{"internal.example.com"}, excludedDNSDomains: []string{"internal.example.com"},
@ -205,7 +205,7 @@ func Test_service_Validate(t *testing.T) {
} }
for _, tt := range tests { for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) { t.Run(tt.name, func(t *testing.T) {
s := &Service{ s := &Engine{
hasNameConstraints: tt.fields.hasNameConstraints, hasNameConstraints: tt.fields.hasNameConstraints,
permittedDNSDomains: tt.fields.permittedDNSDomains, permittedDNSDomains: tt.fields.permittedDNSDomains,
excludedDNSDomains: tt.fields.excludedDNSDomains, excludedDNSDomains: tt.fields.excludedDNSDomains,