adminer/zrepl_patched
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add --skip-cert-check flag to zrepl configcheck to prevent checking cert files

Browse Source 
It may be desirable to check that a config is valid without checking for
the existence of certificate files (e.g. when validating a config inside
a sandbox without access to the cert files).

This will be very useful for NixOS so that we can check the config file
at nix-build time (e.g. potentially without proper permissions to read cert
files for a TLS connection).

fixes https://github.com/zrepl/zrepl/issues/467
closes https://github.com/zrepl/zrepl/pull/587
This commit is contained in:
Cole Helbling
2022-03-29 19:39:10 -07:00
committed by Christian Schwarz
parent e4112d888c
commit 1df0f8912a
13 changed files with 46 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
transport/fromconfig/transport_fromconfig.go
+4 -4
View File
@@ -15,7 +15,7 @@ import (
"github.com/zrepl/zrepl/transport/tls"
)
func ListenerFactoryFromConfig(g *config.Global, in config.ServeEnum) (transport.AuthenticatedListenerFactory, error) {
func ListenerFactoryFromConfig(g *config.Global, in config.ServeEnum, parseFlags config.ParseFlags) (transport.AuthenticatedListenerFactory, error) {
var (
l transport.AuthenticatedListenerFactory
@@ -25,7 +25,7 @@ func ListenerFactoryFromConfig(g *config.Global, in config.ServeEnum) (transport
case *config.TCPServe:
l, err = tcp.TCPListenerFactoryFromConfig(g, v)
case *config.TLSServe:
l, err = tls.TLSListenerFactoryFromConfig(g, v)
l, err = tls.TLSListenerFactoryFromConfig(g, v, parseFlags)
case *config.StdinserverServer:
l, err = ssh.MultiStdinserverListenerFactoryFromConfig(g, v)
case *config.LocalServe:
@@ -37,7 +37,7 @@ func ListenerFactoryFromConfig(g *config.Global, in config.ServeEnum) (transport
return l, err
}
func ConnecterFromConfig(g *config.Global, in config.ConnectEnum) (transport.Connecter, error) {
func ConnecterFromConfig(g *config.Global, in config.ConnectEnum, parseFlags config.ParseFlags) (transport.Connecter, error) {
var (
connecter transport.Connecter
err error
@@ -48,7 +48,7 @@ func ConnecterFromConfig(g *config.Global, in config.ConnectEnum) (transport.Con
case *config.TCPConnect:
connecter, err = tcp.TCPConnecterFromConfig(v)
case *config.TLSConnect:
connecter, err = tls.TLSConnecterFromConfig(v)
connecter, err = tls.TLSConnecterFromConfig(v, parseFlags)
case *config.LocalConnect:
connecter, err = local.LocalConnecterFromConfig(v)
default:
transport/tls/connect_tls.go
+2 -2
View File
@@ -18,12 +18,12 @@ type TLSConnecter struct {
tlsConfig *tls.Config
}
func TLSConnecterFromConfig(in *config.TLSConnect) (*TLSConnecter, error) {
func TLSConnecterFromConfig(in *config.TLSConnect, parseFlags config.ParseFlags) (*TLSConnecter, error) {
dialer := net.Dialer{
Timeout: in.DialTimeout,
}
if fakeCertificateLoading {
if parseFlags&config.ParseFlagsNoCertCheck != 0 {
return &TLSConnecter{in.Address, dialer, nil}, nil
}
transport/tls/serve_tls.go
+2 -2
View File
@@ -16,7 +16,7 @@ import (
type TLSListenerFactory struct{}
func TLSListenerFactoryFromConfig(c *config.Global, in *config.TLSServe) (transport.AuthenticatedListenerFactory, error) {
func TLSListenerFactoryFromConfig(c *config.Global, in *config.TLSServe, parseFlags config.ParseFlags) (transport.AuthenticatedListenerFactory, error) {
address := in.Listen
handshakeTimeout := in.HandshakeTimeout
@@ -25,7 +25,7 @@ func TLSListenerFactoryFromConfig(c *config.Global, in *config.TLSServe) (transp
return nil, errors.New("fields 'ca', 'cert' and 'key'must be specified")
}
if fakeCertificateLoading {
if parseFlags&config.ParseFlagsNoCertCheck != 0 {
return func() (transport.AuthenticatedListener, error) { return nil, nil }, nil
}
transport/tls/tls_test_helper.go
-10
View File
@@ -1,10 +0,0 @@
package tls
import "testing"
var fakeCertificateLoading bool
func FakeCertificateLoading(t *testing.T) {
t.Logf("faking certificate loading")
fakeCertificateLoading = true
}