Skip to content

Commit

Permalink
Merge pull request #532 from Venafi/proxy-fix-and-retry
Browse files Browse the repository at this point in the history 
Proxy client fix for VCert Playbook and more
  • Loading branch information
@luispresuelVenafi
luispresuelVenafi authored Sep 25, 2024
2 parents 7703439 + 874ca2d commit 9077668
Show file tree
Hide file tree
Showing 6 changed files with 79 additions and 83 deletions.
2 changes: 1 addition & 1 deletion go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ require (
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
go.uber.org/atomic v1.7.0 // indirect
go.uber.org/multierr v1.6.0 // indirect
golang.org/x/net v0.25.0
golang.org/x/net v0.25.0 // indirect
golang.org/x/sys v0.20.0 // indirect
golang.org/x/term v0.20.0 // indirect
golang.org/x/text v0.15.0 // indirect
Expand Down
20 changes: 0 additions & 20 deletions go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,14 +18,8 @@ github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym
github.com/Khan/genqlient v0.7.0 h1:GZ1meyRnzcDTK48EjqB8t3bcfYvHArCUUvgOwpz1D4w=
github.com/Khan/genqlient v0.7.0/go.mod h1:HNyy3wZvuYwmW3Y7mkoQLZsa/R5n5yIRajS1kPBvSFM=
github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
github.com/agnivade/levenshtein v1.1.1 h1:QY8M92nrzkmr798gCo3kmMyqXFzdQVpxLlGPRBij0P8=
github.com/agnivade/levenshtein v1.1.1/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVbJomOvKkmgYbo=
github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
github.com/alexflint/go-arg v1.4.2 h1:lDWZAXxpAnZUq4qwb86p/3rIJJ2Li81EoMbTMujhVa0=
github.com/alexflint/go-arg v1.4.2/go.mod h1:9iRbDxne7LcR/GSvEr7ma++GLpdIU1zrghf2y2768kM=
github.com/alexflint/go-scalar v1.0.0 h1:NGupf1XV/Xb04wXskDFzS0KWOLH632W/EO4fAFi+A70=
github.com/alexflint/go-scalar v1.0.0/go.mod h1:GpHzbCOZXEKMEcygYQ5n/aa4Aq84zbxjy3MxYW0gjYw=
github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
Expand Down Expand Up @@ -242,8 +236,6 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
Expand All @@ -264,8 +256,6 @@ golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU
golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
golang.org/x/mod v0.15.0 h1:SernR4v+D55NyBH2QiEQrlBAnj1ECL6AGrA5+dPaMY8=
golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
Expand All @@ -280,8 +270,6 @@ golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn
golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
Expand All @@ -308,19 +296,13 @@ golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7w
golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/term v0.18.0 h1:FcHjZXDMxI8mM3nwhX9HlKop4C0YQvCVCdwYl2wOtE8=
golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
golang.org/x/term v0.20.0 h1:VnkxpohqXaOBYJtBmEppKUG6mXpi+4O6purfc2+sMhw=
golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk=
golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
Expand All @@ -342,8 +324,6 @@ golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtn
golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20191112195655-aa38f8e97acc/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.18.0 h1:k8NLag8AGHnn+PHbl7g43CtqZAwG60vZkLqgyZgIHgQ=
golang.org/x/tools v0.18.0/go.mod h1:GL7B4CwcLLeo59yx/9UWWuNOW1n3VZ4f5axWfML7Lcg=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
Expand Down
26 changes: 20 additions & 6 deletions pkg/playbook/app/vcertutil/vcertutil.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ import (
"crypto/x509/pkix"
"errors"
"fmt"
"net"
"net/http"
"strings"
"time"
Expand Down Expand Up @@ -86,6 +87,18 @@ func EnrollCertificate(config domain.Config, request domain.PlaybookRequest) (*c
}

func buildClient(config domain.Config, zone string, timeout int) (endpoint.Connector, error) {
var netTransport = &http.Transport{
Proxy: http.ProxyFromEnvironment,
DialContext: (&net.Dialer{
Timeout: time.Duration(timeout) * time.Second,
KeepAlive: time.Duration(timeout) * time.Second,
}).DialContext,
MaxIdleConns: 100,
IdleConnTimeout: 90 * time.Second,
TLSHandshakeTimeout: 10 * time.Second,
ExpectContinueTimeout: 1 * time.Second,
}

vcertConfig := &vcert.Config{
ConnectorType: config.Connection.GetConnectorType(),
BaseUrl: config.Connection.URL,
Expand All @@ -95,7 +108,8 @@ func buildClient(config domain.Config, zone string, timeout int) (endpoint.Conne
}

vcertConfig.Client = &http.Client{
Timeout: time.Duration(DefaultTimeout) * time.Second,
Timeout: time.Duration(DefaultTimeout) * time.Second,
Transport: netTransport,
}
if timeout > 0 {
vcertConfig.Client.Timeout = time.Duration(timeout) * time.Second
Expand All @@ -108,12 +122,12 @@ func buildClient(config domain.Config, zone string, timeout int) (endpoint.Conne
if !connectionTrustBundle.AppendCertsFromPEM([]byte(vcertConfig.ConnectionTrust)) {
return nil, fmt.Errorf("%w: failed to parse PEM trust bundle", verror.UserDataError)
}
vcertConfig.Client.Transport = &http.Transport{
TLSClientConfig: &tls.Config{
RootCAs: connectionTrustBundle,
MinVersion: tls.VersionTLS12,
},
netTransport.TLSClientConfig = &tls.Config{
RootCAs: connectionTrustBundle,
MinVersion: tls.VersionTLS12,
}

vcertConfig.Client.Transport = netTransport
}

// build Authentication object
Expand Down
3 changes: 2 additions & 1 deletion pkg/venafi/cloud/cloud.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -302,8 +302,9 @@ func (c *Connector) getHTTPClient() *http.Client {
tlsConfig = tlsConfig.Clone()
}
tlsConfig.RootCAs = c.trust
netTransport.TLSClientConfig = tlsConfig
}
netTransport.TLSClientConfig = tlsConfig

c.client = &http.Client{
Timeout: time.Second * 30,
Transport: netTransport,
Expand Down
24 changes: 0 additions & 24 deletions pkg/venafi/cloud/cloudUtil.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,30 +11,6 @@ import (
"github.com/Venafi/vcert/v5/pkg/util"
)

func parseCertificateInfo(httpStatusCode int, httpStatus string, body []byte) (*managedCertificate, error) {
switch httpStatusCode {
case http.StatusOK:
var res = &managedCertificate{}
err := json.Unmarshal(body, res)
if err != nil {
return nil, fmt.Errorf("failed to parse search results: %s, body: %s", err, body)
}
return res, nil
default:
if body != nil {
respErrors, err := parseResponseErrors(body)
if err == nil {
respError := fmt.Sprintf("unexpected status code on Venafi Cloud certificate search. Status: %s\n", httpStatus)
for _, e := range respErrors {
respError += fmt.Sprintf("Error Code: %d Error: %s\n", e.Code, e.Message)
}
return nil, errors.New(respError)
}
}
return nil, fmt.Errorf("unexpected status code on Venafi Cloud certificate search. Status: %s", httpStatus)
}
}

func parseDEKInfo(httpStatusCode int, httpStatus string, body []byte) (*EdgeEncryptionKey, error) {
switch httpStatusCode {
case http.StatusOK:
Expand Down
87 changes: 56 additions & 31 deletions pkg/venafi/cloud/connector.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1102,27 +1102,20 @@ func retrieveServiceGeneratedCertData(c *Connector, req *certificate.Request, de

}

func getDekInfo(c *Connector, cerId string) (*EdgeEncryptionKey, error) {
func getDekInfo(c *Connector, certId string) (*EdgeEncryptionKey, error) {
//get certificate details for getting DekHash
url := c.getURL(urlResourceCertificateByID)
url = fmt.Sprintf(url, cerId)

statusCode, status, body, err := c.request("GET", url, nil)
if err != nil {
return nil, err
}

managedCert, err := parseCertificateInfo(statusCode, status, body)
managedCert, err := c.getCertificate(certId)

if err != nil {
return nil, err
}

//get Dek info for getting DEK's key
url = c.getURL(urlDekPublicKey)
url := c.getURL(urlDekPublicKey)
url = fmt.Sprintf(url, managedCert.DekHash)

statusCode, status, body, err = c.request("GET", url, nil)
statusCode, status, body, err := c.request("GET", url, nil)
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -1274,35 +1267,67 @@ type managedCertificate struct {
}

func (c *Connector) getCertificate(certificateId string) (*managedCertificate, error) {
var err error
url := c.getURL(urlResourceCertificateByID)
url = fmt.Sprintf(url, certificateId)
statusCode, _, body, err := c.request("GET", url, nil)
if err != nil {
return nil, err
}

switch statusCode {
case http.StatusOK:
var res = &managedCertificate{}
err = json.Unmarshal(body, res)
// TODO: Remove following retry logic once VC-31590 is fixed
// retry logic involves the loop to constantly, during 1 minute, to retry
// to get certificate each 2 seconds when it is not found in certificate inventory
timeout := time.Duration(60) * time.Second

startTime := time.Now()
for {
statusCode, _, body, err := c.request("GET", url, nil)
if err != nil {
return nil, fmt.Errorf("failed to parse search results: %s, body: %s", err, body)
return nil, err
}
return res, nil
default:
if body != nil {
respErrors, err := parseResponseErrors(body)
if err == nil {
respError := fmt.Sprintf("unexpected status code on Venafi Cloud certificate search. Status: %d\n", statusCode)
for _, e := range respErrors {
respError += fmt.Sprintf("Error Code: %d Error: %s\n", e.Code, e.Message)

switch statusCode {
case http.StatusOK:
var res = &managedCertificate{}
err = json.Unmarshal(body, res)
if err != nil {
return nil, fmt.Errorf("failed to parse search results: %s, body: %s", err, body)
}
return res, nil
default:
if body != nil {
respErrors, err := parseResponseErrors(body)
if err == nil {
err = validateNotFoundTimeout(statusCode, startTime, timeout, certificateId, respErrors)
if err != nil {
return nil, err
}
}
return nil, errors.New(respError)
return nil, err
}
err = validateNotFoundTimeout(statusCode, startTime, timeout, certificateId, []responseError{})
if err != nil {
return nil, err
}
}
time.Sleep(2 * time.Second)
}
}

// validateNotFoundTimeout function that returns nil for not found error if waiting time for timeout is not
// completed. This is while status code is NotFound
func validateNotFoundTimeout(statusCode int, startTime time.Time, timeout time.Duration, certificateId string, respErrors []responseError) error {
respError := fmt.Sprintf("unexpected status code on Venafi Cloud certificate search. Status: %d\n", statusCode)
if statusCode == http.StatusNotFound {
if time.Now().After(startTime.Add(timeout)) {
return endpoint.ErrRetrieveCertificateTimeout{CertificateID: certificateId}
}
} else {
if len(respErrors) > 0 {
for _, e := range respErrors {
respError += fmt.Sprintf("Error Code: %d Error: %s\n", e.Code, e.Message)
}
return errors.New(respError)
}
return nil, fmt.Errorf("unexpected status code on Venafi Cloud certificate search. Status: %d", statusCode)
return errors.New(respError)
}
return nil
}

func (c *Connector) getCertsBatch(page, pageSize int, withExpired bool) ([]certificate.CertificateInfo, error) {
Expand Down

0 comments on commit 9077668

Please sign in to comment.