Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(auth): try talk to plaintext S2A if creds unavailable for mTLS-S2A #10941

Merged
merged 3 commits into from
Oct 8, 2024
Merged

fix(auth): try talk to plaintext S2A if creds unavailable for mTLS-S2A #10941

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d11a1bc
fix(auth): try talk to plaintext S2A if credentials can not be found …
xmenxk Oct 1, 2024
d359b62
Merge branch 'main' into gce-s2a-logic
quartzmo Oct 8, 2024
653f509
Merge branch 'main' into gce-s2a-logic
quartzmo Oct 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions auth/internal/transport/cba.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,11 @@ func GetGRPCTransportCredsAndEndpoint(opts *Options) (credentials.TransportCrede
transportCredsForS2A, err = loadMTLSMDSTransportCreds(mtlsMDSRoot, mtlsMDSKey)
if err != nil {
log.Printf("Loading MTLS MDS credentials failed: %v", err)
return defaultTransportCreds, config.endpoint, nil
if config.s2aAddress != "" {
s2aAddr = config.s2aAddress
} else {
return defaultTransportCreds, config.endpoint, nil
}
}
} else if config.s2aAddress != "" {
s2aAddr = config.s2aAddress
Expand Down Expand Up @@ -177,7 +181,11 @@ func GetHTTPTransportConfig(opts *Options) (cert.Provider, func(context.Context,
transportCredsForS2A, err = loadMTLSMDSTransportCreds(mtlsMDSRoot, mtlsMDSKey)
if err != nil {
log.Printf("Loading MTLS MDS credentials failed: %v", err)
return config.clientCertSource, nil, nil
if config.s2aAddress != "" {
s2aAddr = config.s2aAddress
} else {
return config.clientCertSource, nil, nil
}
}
} else if config.s2aAddress != "" {
s2aAddr = config.s2aAddress
Expand Down
33 changes: 33 additions & 0 deletions auth/internal/transport/cba_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,20 @@ var (
return string(configStr), nil
}

validConfigRespDualS2A = func() (string, error) {
validConfig := mtlsConfig{
S2A: &s2aAddresses{
PlaintextAddress: testS2AAddr,
MTLSAddress: testMTLSS2AAddr,
},
}
configStr, err := json.Marshal(validConfig)
if err != nil {
return "", err
}
return string(configStr), nil
}

errorConfigResp = func() (string, error) {
return "", fmt.Errorf("error getting config")
}
Expand Down Expand Up @@ -346,6 +360,15 @@ func TestGetGRPCTransportConfigAndEndpoint_S2A(t *testing.T) {
validConfigRespMTLSS2A,
testRegularEndpoint,
},
{
"no client cert, dual S2A addresses, no MTLS MDS cert",
&Options{
DefaultMTLSEndpoint: testMTLSEndpoint,
DefaultEndpointTemplate: testEndpointTemplate,
},
validConfigRespDualS2A,
testMTLSEndpoint,
},
}
defer setupTest(t)()
for _, tc := range testCases {
Expand Down Expand Up @@ -445,6 +468,16 @@ func TestGetHTTPTransportConfig_S2A(t *testing.T) {
want: testRegularEndpoint,
isDialFnNil: true,
},
{
name: "no client cert, dual S2A addresses, no MTLS MDS cert",
opts: &Options{
DefaultMTLSEndpoint: testMTLSEndpoint,
DefaultEndpointTemplate: testEndpointTemplate,
},
s2ARespFn: validConfigRespDualS2A,
want: testMTLSEndpoint,
isDialFnNil: false,
},
}
defer setupTest(t)()
for _, tc := range testCases {
Expand Down
Loading