enhance: Reload cert if 401 response from LAPI #4269
Conversation
|
@LaurenceJJones: There are no 'kind' label on this PR. You need a 'kind' label to generate the release automatically.
DetailsI am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository. |
|
@LaurenceJJones: There are no area labels on this PR. You can add as many areas as you see fit.
DetailsI am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository. |
| CaCertPool *x509.CertPool | ||
| lapiClient *ApiClient | ||
|
|
||
| // CertPath and KeyPath store the paths to the client certificate and key files. |
There was a problem hiding this comment.
@mmetc will kill me for more global vars, but atm they are held globally and scope of PR is a quick fix rather than a re implementation.
LaurenceJJones
added
kind/enhancement
| Cert = &cert | ||
|
|
||
| // Update the transport's TLS config if possible | ||
| if httpTransport, ok := transport.(*http.Transport); ok && httpTransport.TLSClientConfig != nil { |
There was a problem hiding this comment.
Might want to breakdown into happy path EG: !ok and == nil and return context errors as it may silently pass here even though we read the cert into memory
There was a problem hiding this comment.
44 + httpTransport, ok := transport.(*http.Transport)
45 + if !ok {
46 + return fmt.Errorf("cannot reload certificate: transport is %T, expected *http.Transport", transport)
47 + }
48 +
49 + if httpTransport.TLSClientConfig == nil {
50 + return errors.New("cannot reload certificate: transport has no TLS config")
51 + }
52 +
53 cert, err := tls.LoadX509KeyPair(CertPath, KeyPath)
54 if err != nil {
55 return fmt.Errorf("failed to reload certificate: %w", err)
56 }
57
58 Cert = &cert
59 + httpTransport.TLSClientConfig.Certificates = []tls.Certificate{cert}
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #4269 +/- ##
=======================================
Coverage 63.08% 63.08%
=======================================
Files 472 472
Lines 33426 33443 +17
=======================================
+ Hits 21088 21099 +11
- Misses 10220 10228 +8
+ Partials 2118 2116 -2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
1 participant
fixes: #2810
Quick fix for now till a better solution could be achieved, if the response code from LAPI is 401 and we have certs configured simply re-read them even if they have expired and havent been updated on disk, the retry method will continue to backoff and fail if ultimately if the setup is errored.