root
/
keypairs
mirror of https://github.com/therootcompany/keypairs
2
0
Fork 0
Code Issues Releases Wiki Activity

better error for private networking

This commit is contained in:
AJ ONeal 2019-03-22 14:01:19 -06:00
parent 90b05bac5f
commit ada07e4446
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
keyfetch/fetch.go
View File

@ -11,6 +11,7 @@ package keyfetch
import ( import (
"errors" "errors"
"fmt" "fmt"
"log"
"net/http" "net/http"
"net/url" "net/url"
"strconv" "strconv"
@ -25,6 +26,7 @@ import (
var EInvalidJWKURL = errors.New("url does not lead to valid JWKs") var EInvalidJWKURL = errors.New("url does not lead to valid JWKs")
var KeyCache = map[string]CachableKey{} var KeyCache = map[string]CachableKey{}
var KeyCacheMux = sync.Mutex{} var KeyCacheMux = sync.Mutex{}
var ErrInsecureDomain = errors.New("Whitelists should only allow secure domains (i.e. https://). To allow unsecured private networking (i.e. Docker) pass PrivateWhitelist as `true`")
type CachableKey struct { type CachableKey struct {
Key keypairs.PublicKey Key keypairs.PublicKey
@ -286,6 +288,10 @@ func normalizeIssuer(iss string) string {
encounter it is to make testing easier. encounter it is to make testing easier.
*/ */
func IsTrustedIssuer(iss string, whitelist Whitelist, rs ...*http.Request) bool { func IsTrustedIssuer(iss string, whitelist Whitelist, rs ...*http.Request) bool {
if "" == iss {
return false
}
// Normalize the http:// and https:// and parse // Normalize the http:// and https:// and parse
iss = strings.TrimRight(iss, "/") + "/" iss = strings.TrimRight(iss, "/") + "/"
if strings.HasPrefix(iss, "http://") { if strings.HasPrefix(iss, "http://") {
@ -385,10 +391,10 @@ type Whitelist []*url.URL
// NewWhitelist turns an array of URLs (such as https://example.com/) into // NewWhitelist turns an array of URLs (such as https://example.com/) into
// a parsed array of *url.URLs that can be used by the IsTrustedIssuer function // a parsed array of *url.URLs that can be used by the IsTrustedIssuer function
func NewWhitelist(issuers []string, insecures ...bool) (Whitelist, error) { func NewWhitelist(issuers []string, assumePrivate ...bool) (Whitelist, error) {
list := []*url.URL{} list := []*url.URL{}
insecure := false insecure := false
if 0 != len(insecures) && insecures[0] { if 0 != len(assumePrivate) && assumePrivate[0] {
insecure = true insecure = true
} }
@ -396,7 +402,8 @@ func NewWhitelist(issuers []string, insecures ...bool) (Whitelist, error) {
iss := issuers[i] iss := issuers[i]
if strings.HasPrefix(iss, "http://") { if strings.HasPrefix(iss, "http://") {
if !insecure { if !insecure {
return nil, errors.New("Oops! You have an insecure domain in your whitelist: " + iss) log.Println("Oops! You have an insecure domain in your whitelist: ", iss)
return nil, ErrInsecureDomain
} }
} else if strings.HasPrefix(iss, "//") { } else if strings.HasPrefix(iss, "//") {
// TODO // TODO