Skip to content

Commit 565691c

Browse files
smarterclaytonsmarterclayton
authored
Merge pull request #11413 from liggitt/x509-validation
Test x509 intermediates correctly
2 parents c4c6233 + 14ca2f5 commit 565691c

24 files changed

+381
-39
lines changed

‎Godeps/_workspace/src/k8s.io/kubernetes/plugin/pkg/auth/authenticator/request/x509/testdata/client-expired.pem

+11
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Godeps/_workspace/src/k8s.io/kubernetes/plugin/pkg/auth/authenticator/request/x509/testdata/client-valid.pem

+11
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Godeps/_workspace/src/k8s.io/kubernetes/plugin/pkg/auth/authenticator/request/x509/testdata/client.config.json

+24
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Godeps/_workspace/src/k8s.io/kubernetes/plugin/pkg/auth/authenticator/request/x509/testdata/client.csr.json

+3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Godeps/_workspace/src/k8s.io/kubernetes/plugin/pkg/auth/authenticator/request/x509/testdata/generate.sh

+24
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Godeps/_workspace/src/k8s.io/kubernetes/plugin/pkg/auth/authenticator/request/x509/testdata/intermediate.config.json

+18
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Godeps/_workspace/src/k8s.io/kubernetes/plugin/pkg/auth/authenticator/request/x509/testdata/intermediate.csr.json

+6
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Godeps/_workspace/src/k8s.io/kubernetes/plugin/pkg/auth/authenticator/request/x509/testdata/intermediate.pem

+11
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Godeps/_workspace/src/k8s.io/kubernetes/plugin/pkg/auth/authenticator/request/x509/testdata/root.csr.json

+6
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Godeps/_workspace/src/k8s.io/kubernetes/plugin/pkg/auth/authenticator/request/x509/testdata/root.pem

+11
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Godeps/_workspace/src/k8s.io/kubernetes/plugin/pkg/auth/authenticator/request/x509/x509.go

+19-13
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Godeps/_workspace/src/k8s.io/kubernetes/plugin/pkg/auth/authenticator/request/x509/x509_test.go

+36
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/auth/authenticator/request/x509request/testdata/client-expired.pem

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIBpTCCAUugAwIBAgIUPV4LAC5KK8YWY1FegyTuhkGUr3EwCgYIKoZIzj0EAwIw
3+
GjEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlLUNBMB4XDTkwMTIzMTIzNTkwMFoXDTkw
4+
MTIzMTIzNTkwMFowFDESMBAGA1UEAxMJTXkgQ2xpZW50MFkwEwYHKoZIzj0CAQYI
5+
KoZIzj0DAQcDQgAEyYUnseNUN87rfHgekrfZu5sj4wlt5LYr3JYZZkfSbsb+BW3/
6+
RzX02ifjp+8w7mI4qUGg6y6J7oXHGFT3uj9kj6N1MHMwDgYDVR0PAQH/BAQDAgWg
7+
MBMGA1UdJQQMMAoGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFKsX
8+
EnXwDg8j2LIEM1QzmFrE6537MB8GA1UdIwQYMBaAFF+p0JcY31pz+mjNZnjv0Gum
9+
92vZMAoGCCqGSM49BAMCA0gAMEUCIG4FBcb57oqOCoaFiJ+Yx6S0zkaash7bTv3V
10+
CIy9JvFdAiEAy8bf2S9EkvZyURZ6ycgEMnekll57Ebze6rjlPx8+B1Y=
11+
-----END CERTIFICATE-----

‎pkg/auth/authenticator/request/x509request/testdata/client-valid.pem

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIBqDCCAU2gAwIBAgIUfbqeieihh/oERbfvRm38XvS/xHAwCgYIKoZIzj0EAwIw
3+
GjEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlLUNBMCAXDTE2MTAxMTA1MDYwMFoYDzIx
4+
MTYwOTE3MDUwNjAwWjAUMRIwEAYDVQQDEwlNeSBDbGllbnQwWTATBgcqhkjOPQIB
5+
BggqhkjOPQMBBwNCAARv6N4R/sjMR65iMFGNLN1GC/vd7WhDW6J4X/iAjkRLLnNb
6+
KbRG/AtOUZ+7upJ3BWIRKYbOabbQGQe2BbKFiap4o3UwczAOBgNVHQ8BAf8EBAMC
7+
BaAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU
8+
K/pZOWpNcYai6eHFpmJEeFpeQlEwHwYDVR0jBBgwFoAUX6nQlxjfWnP6aM1meO/Q
9+
a6b3a9kwCgYIKoZIzj0EAwIDSQAwRgIhAIWTKw/sjJITqeuNzJDAKU4xo1zL+xJ5
10+
MnVCuBwfwDXCAiEAw/1TA+CjPq9JC5ek1ifR0FybTURjeQqYkKpve1dveps=
11+
-----END CERTIFICATE-----

‎pkg/auth/authenticator/request/x509request/testdata/client.config.json

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"signing": {
3+
"profiles": {
4+
"valid": {
5+
"expiry": "876000h",
6+
"usages": [
7+
"signing",
8+
"key encipherment",
9+
"client auth"
10+
]
11+
},
12+
"expired": {
13+
"expiry": "1h",
14+
"not_before": "1990-12-31T23:59:00Z",
15+
"not_after": "1990-12-31T23:59:00Z",
16+
"usages": [
17+
"signing",
18+
"key encipherment",
19+
"client auth"
20+
]
21+
}
22+
}
23+
}
24+
}

‎pkg/auth/authenticator/request/x509request/testdata/client.csr.json

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{
2+
"CN": "My Client"
3+
}

‎pkg/auth/authenticator/request/x509request/testdata/generate.sh

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/usr/bin/env bash
2+
3+
cfssl gencert -initca root.csr.json | cfssljson -bare root
4+
5+
cfssl gencert -initca intermediate.csr.json | cfssljson -bare intermediate
6+
cfssl sign -ca root.pem -ca-key root-key.pem -config intermediate.config.json intermediate.csr | cfssljson -bare intermediate
7+
8+
cfssl gencert -ca intermediate.pem -ca-key intermediate-key.pem -config client.config.json --profile=valid client.csr.json | cfssljson -bare client-valid
9+
cfssl gencert -ca intermediate.pem -ca-key intermediate-key.pem -config client.config.json --profile=expired client.csr.json | cfssljson -bare client-expired
10+

‎pkg/auth/authenticator/request/x509request/testdata/intermediate.config.json

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"signing": {
3+
"default": {
4+
"usages": [
5+
"digital signature",
6+
"cert sign",
7+
"crl sign",
8+
"signing",
9+
"key encipherment",
10+
"client auth"
11+
],
12+
"expiry": "876000h",
13+
"ca_constraint": {
14+
"is_ca": true
15+
}
16+
}
17+
}
18+
}

‎pkg/auth/authenticator/request/x509request/testdata/intermediate.csr.json

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"CN": "Intermediate-CA",
3+
"ca": {
4+
"expiry": "876000h"
5+
}
6+
}

‎pkg/auth/authenticator/request/x509request/testdata/intermediate.pem

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIBqDCCAU6gAwIBAgIUfqZtjoFgczZ+oQZbEC/BDSS2J6wwCgYIKoZIzj0EAwIw
3+
EjEQMA4GA1UEAxMHUm9vdC1DQTAgFw0xNjEwMTEwNTA2MDBaGA8yMTE2MDkxNzA1
4+
MDYwMFowGjEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlLUNBMFkwEwYHKoZIzj0CAQYI
5+
KoZIzj0DAQcDQgAEyWHEMMCctJg8Xa5YWLqaCPbk3MjB+uvXac42JM9pj4k9jedD
6+
kpUJRkWIPzgJI8Zk/3cSzluUTixP6JBSDKtwwaN4MHYwDgYDVR0PAQH/BAQDAgGm
7+
MBMGA1UdJQQMMAoGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE
8+
FF+p0JcY31pz+mjNZnjv0Gum92vZMB8GA1UdIwQYMBaAFB7P6+i4/pfNjqZgJv/b
9+
dgA7Fe4tMAoGCCqGSM49BAMCA0gAMEUCIQCTT1YWQZaAqfQ2oBxzOkJE2BqLFxhz
10+
3smQlrZ5gCHddwIgcvT7puhYOzAgcvMn9+SZ1JOyZ7edODjshCVCRnuHK2c=
11+
-----END CERTIFICATE-----

‎pkg/auth/authenticator/request/x509request/testdata/root.csr.json

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"CN": "Root-CA",
3+
"ca": {
4+
"expiry": "876000h"
5+
}
6+
}

‎pkg/auth/authenticator/request/x509request/testdata/root.pem

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIBizCCATGgAwIBAgIUH4plk9qwD61FVXgiOTngFU5FeSkwCgYIKoZIzj0EAwIw
3+
EjEQMA4GA1UEAxMHUm9vdC1DQTAgFw0xNjEwMTEwNTA2MDBaGA8yMTE2MDkxNzA1
4+
MDYwMFowEjEQMA4GA1UEAxMHUm9vdC1DQTBZMBMGByqGSM49AgEGCCqGSM49AwEH
5+
A0IABI2CsrAnMGT8P2VGU2MLo5pv86Z74kcV9hgkLJUkSaeNyc1s89w7X5V2wvwu
6+
iWEJRGm5RoZJausmyZLZEoKEVXejYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB
7+
Af8EBTADAQH/MB0GA1UdDgQWBBQez+vouP6XzY6mYCb/23YAOxXuLTAfBgNVHSME
8+
GDAWgBQez+vouP6XzY6mYCb/23YAOxXuLTAKBggqhkjOPQQDAgNIADBFAiBGclts
9+
vJRM+QMVoV/1L9b+hvhgLIp/OupUFsSOReefIwIhALY06hBklyh8eFwuBtyX2VcE
10+
8xlVn4/5idUvc3Xv2h9s
11+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)