Skip to content

Commit ef110a9

Browse files
hslatmanhslatman
committed
Change pointer booleans to regular boolean configuration
1 parent e9f5a1e commit ef110a9

File tree

6 files changed

+43
-154
lines changed

6 files changed

+43
-154
lines changed

‎authority/admin/api/policy.go

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ import (
55
"net/http"
66

77
"go.step.sm/linkedca"
8-
"google.golang.org/protobuf/types/known/wrapperspb"
98

109
"github.com/smallstep/certificates/acme"
1110
"github.com/smallstep/certificates/api/read"
@@ -97,8 +96,6 @@ func (par *PolicyAdminResponder) CreateAuthorityPolicy(w http.ResponseWriter, r
9796
return
9897
}
9998

100-
applyConditionalDefaults(newPolicy)
101-
10299
newPolicy.Deduplicate()
103100

104101
adm := linkedca.AdminFromContext(ctx)
@@ -234,8 +231,6 @@ func (par *PolicyAdminResponder) CreateProvisionerPolicy(w http.ResponseWriter,
234231
return
235232
}
236233

237-
applyConditionalDefaults(newPolicy)
238-
239234
newPolicy.Deduplicate()
240235

241236
prov.Policy = newPolicy
@@ -454,14 +449,3 @@ func isBadRequest(err error) bool {
454449
isPolicyError := errors.As(err, &pe)
455450
return isPolicyError && (pe.Typ == authority.AdminLockOut || pe.Typ == authority.EvaluationFailure || pe.Typ == authority.ConfigurationFailure)
456451
}
457-
458-
// applyConditionalDefaults applies default settings in case they're not provided
459-
// in the request body.
460-
func applyConditionalDefaults(p *linkedca.Policy) {
461-
if p.GetX509() == nil {
462-
return
463-
}
464-
if p.GetX509().GetVerifySubjectCommonName() == nil {
465-
p.X509.VerifySubjectCommonName = &wrapperspb.BoolValue{Value: true}
466-
}
467-
}

‎authority/admin/api/policy_test.go

Lines changed: 2 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ import (
1212
"testing"
1313

1414
"google.golang.org/protobuf/encoding/protojson"
15-
"google.golang.org/protobuf/types/known/wrapperspb"
1615

1716
"go.step.sm/linkedca"
1817

@@ -310,7 +309,7 @@ func TestPolicyAdminResponder_CreateAuthorityPolicy(t *testing.T) {
310309
Allow: &linkedca.X509Names{
311310
Dns: []string{"*.local"},
312311
},
313-
VerifySubjectCommonName: &wrapperspb.BoolValue{Value: true},
312+
DisableSubjectCommonNameVerification: false,
314313
},
315314
}
316315
body, err := protojson.Marshal(policy)
@@ -1047,7 +1046,7 @@ func TestPolicyAdminResponder_CreateProvisionerPolicy(t *testing.T) {
10471046
Allow: &linkedca.X509Names{
10481047
Dns: []string{"*.local"},
10491048
},
1050-
VerifySubjectCommonName: &wrapperspb.BoolValue{Value: true},
1049+
DisableSubjectCommonNameVerification: false,
10511050
},
10521051
}
10531052
body, err := protojson.Marshal(policy)
@@ -2077,86 +2076,6 @@ func TestPolicyAdminResponder_DeleteACMEAccountPolicy(t *testing.T) {
20772076
}
20782077
}
20792078

2080-
func Test_applyConditionalDefaults(t *testing.T) {
2081-
tests := []struct {
2082-
name string
2083-
policy *linkedca.Policy
2084-
expected *linkedca.Policy
2085-
}{
2086-
{
2087-
name: "no-x509",
2088-
policy: &linkedca.Policy{
2089-
Ssh: &linkedca.SSHPolicy{},
2090-
},
2091-
expected: &linkedca.Policy{
2092-
Ssh: &linkedca.SSHPolicy{},
2093-
},
2094-
},
2095-
{
2096-
name: "with-x509-verify-subject-common-name",
2097-
policy: &linkedca.Policy{
2098-
X509: &linkedca.X509Policy{
2099-
Allow: &linkedca.X509Names{
2100-
Dns: []string{"*.local"},
2101-
},
2102-
VerifySubjectCommonName: &wrapperspb.BoolValue{Value: true},
2103-
},
2104-
},
2105-
expected: &linkedca.Policy{
2106-
X509: &linkedca.X509Policy{
2107-
Allow: &linkedca.X509Names{
2108-
Dns: []string{"*.local"},
2109-
},
2110-
VerifySubjectCommonName: &wrapperspb.BoolValue{Value: true},
2111-
},
2112-
},
2113-
},
2114-
{
2115-
name: "without-x509-verify-subject-common-name",
2116-
policy: &linkedca.Policy{
2117-
X509: &linkedca.X509Policy{
2118-
Allow: &linkedca.X509Names{
2119-
Dns: []string{"*.local"},
2120-
},
2121-
VerifySubjectCommonName: &wrapperspb.BoolValue{Value: false},
2122-
},
2123-
},
2124-
expected: &linkedca.Policy{
2125-
X509: &linkedca.X509Policy{
2126-
Allow: &linkedca.X509Names{
2127-
Dns: []string{"*.local"},
2128-
},
2129-
VerifySubjectCommonName: &wrapperspb.BoolValue{Value: false},
2130-
},
2131-
},
2132-
},
2133-
{
2134-
name: "no-x509-verify-subject-common-name",
2135-
policy: &linkedca.Policy{
2136-
X509: &linkedca.X509Policy{
2137-
Allow: &linkedca.X509Names{
2138-
Dns: []string{"*.local"},
2139-
},
2140-
},
2141-
},
2142-
expected: &linkedca.Policy{
2143-
X509: &linkedca.X509Policy{
2144-
Allow: &linkedca.X509Names{
2145-
Dns: []string{"*.local"},
2146-
},
2147-
VerifySubjectCommonName: &wrapperspb.BoolValue{Value: true},
2148-
},
2149-
},
2150-
},
2151-
}
2152-
for _, tt := range tests {
2153-
t.Run(tt.name, func(t *testing.T) {
2154-
applyConditionalDefaults(tt.policy)
2155-
assert.Equals(t, tt.expected, tt.policy)
2156-
})
2157-
}
2158-
}
2159-
21602079
func Test_isBadRequest(t *testing.T) {
21612080
tests := []struct {
21622081
name string

‎authority/policy.go

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -350,12 +350,9 @@ func policyToCertificates(p *linkedca.Policy) *authPolicy.Options {
350350
opts.X509.DeniedNames.URIDomains = deny.Uris
351351
}
352352
}
353-
if v := x509.GetAllowWildcardLiteral(); v != nil {
354-
opts.X509.AllowWildcardLiteral = &v.Value
355-
}
356-
if v := x509.GetVerifySubjectCommonName(); v != nil {
357-
opts.X509.VerifySubjectCommonName = &v.Value
358-
}
353+
354+
opts.X509.AllowWildcardLiteral = x509.AllowWildcardLiteral
355+
opts.X509.DisableSubjectCommonNameVerification = x509.DisableSubjectCommonNameVerification
359356
}
360357

361358
// fill ssh policy configuration

‎authority/policy/options.go

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,10 @@ type X509PolicyOptions struct {
4444
// AllowWildcardLiteral indicates if literal wildcard names
4545
// such as *.example.com and @example.com are allowed. Defaults
4646
// to false.
47-
AllowWildcardLiteral *bool `json:"allow_wildcard_literal,omitempty"`
48-
// VerifySubjectCommonName indicates if the Subject Common Name
49-
// is verified in addition to the SANs. Defaults to true.
50-
VerifySubjectCommonName *bool `json:"verify_subject_common_name,omitempty"`
47+
AllowWildcardLiteral bool `json:"allow_wildcard_literal,omitempty"`
48+
// DisableSubjectCommonNameVerification indicates if the Subject Common Name
49+
// is verified in addition to the SANs. Defaults to false.
50+
DisableSubjectCommonNameVerification bool `json:"disable_subject_common_name_verification,omitempty"`
5151
}
5252

5353
// X509NameOptions models the X509 name policy configuration.
@@ -83,21 +83,22 @@ func (o *X509PolicyOptions) GetDeniedNameOptions() *X509NameOptions {
8383
return o.DeniedNames
8484
}
8585

86+
// IsWildcardLiteralAllowed returns whether the authority allows
87+
// literal wildcard domains and other names to be signed.
8688
func (o *X509PolicyOptions) IsWildcardLiteralAllowed() bool {
8789
if o == nil {
8890
return true
8991
}
90-
return o.AllowWildcardLiteral != nil && *o.AllowWildcardLiteral
92+
return o.AllowWildcardLiteral
9193
}
9294

95+
// ShouldVerifySubjectCommonName returns whether the authority
96+
// should verify the Subject Common Name in addition to the SANs.
9397
func (o *X509PolicyOptions) ShouldVerifySubjectCommonName() bool {
9498
if o == nil {
9599
return false
96100
}
97-
if o.VerifySubjectCommonName == nil {
98-
return true
99-
}
100-
return *o.VerifySubjectCommonName
101+
return !o.DisableSubjectCommonNameVerification
101102
}
102103

103104
// SSHPolicyOptionsInterface is an interface for providers of

‎authority/policy/options_test.go

Lines changed: 12 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,6 @@ import (
55
)
66

77
func TestX509PolicyOptions_IsWildcardLiteralAllowed(t *testing.T) {
8-
trueValue := true
9-
falseValue := false
108
tests := []struct {
119
name string
1210
options *X509PolicyOptions
@@ -18,23 +16,21 @@ func TestX509PolicyOptions_IsWildcardLiteralAllowed(t *testing.T) {
1816
want: true,
1917
},
2018
{
21-
name: "nil",
22-
options: &X509PolicyOptions{
23-
AllowWildcardLiteral: nil,
24-
},
25-
want: false,
19+
name: "not-set",
20+
options: &X509PolicyOptions{},
21+
want: false,
2622
},
2723
{
2824
name: "set-true",
2925
options: &X509PolicyOptions{
30-
AllowWildcardLiteral: &trueValue,
26+
AllowWildcardLiteral: true,
3127
},
3228
want: true,
3329
},
3430
{
3531
name: "set-false",
3632
options: &X509PolicyOptions{
37-
AllowWildcardLiteral: &falseValue,
33+
AllowWildcardLiteral: false,
3834
},
3935
want: false,
4036
},
@@ -49,8 +45,6 @@ func TestX509PolicyOptions_IsWildcardLiteralAllowed(t *testing.T) {
4945
}
5046

5147
func TestX509PolicyOptions_ShouldVerifySubjectCommonName(t *testing.T) {
52-
trueValue := true
53-
falseValue := false
5448
tests := []struct {
5549
name string
5650
options *X509PolicyOptions
@@ -62,25 +56,23 @@ func TestX509PolicyOptions_ShouldVerifySubjectCommonName(t *testing.T) {
6256
want: false,
6357
},
6458
{
65-
name: "nil",
66-
options: &X509PolicyOptions{
67-
VerifySubjectCommonName: nil,
68-
},
69-
want: true,
59+
name: "not-set",
60+
options: &X509PolicyOptions{},
61+
want: true,
7062
},
7163
{
7264
name: "set-true",
7365
options: &X509PolicyOptions{
74-
VerifySubjectCommonName: &trueValue,
66+
DisableSubjectCommonNameVerification: true,
7567
},
76-
want: true,
68+
want: false,
7769
},
7870
{
7971
name: "set-false",
8072
options: &X509PolicyOptions{
81-
VerifySubjectCommonName: &falseValue,
73+
DisableSubjectCommonNameVerification: false,
8274
},
83-
want: false,
75+
want: true,
8476
},
8577
}
8678
for _, tt := range tests {

0 commit comments

Comments
 (0)